• 105 questions

CompTIA Network+ Practice Test

Questions for exam N10-009, each answer checked against a public text, most often an RFC or a NIST publication.

A SIP phone registers without TLS. Which port does IANA list for plain SIP?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 90 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 90 questions, 90 minutes.

More options

Unofficial practice questions, not affiliated with CompTIA. Bank checked October 6, 2026.

Next step Another IT certification? Pick it

All 105 questions

Networking concepts 25

  • A customer deploys its own applications on a provider's cloud but does not manage the servers, operating systems or storage underneath. Which NIST service model is this? NIST SP 800-145, section 2
  • A SIP phone registers without TLS. Which port does IANA list for plain SIP? IANA Service Name and Transport Protocol Port Number Registry, entries sip and sips
  • How long is the VXLAN Network Identifier (VNI) that separates one overlay segment from another? RFC 7348, section 4
  • How many addresses does a /26 IPv4 prefix contain? RFC 4632, section 3.1
  • In a leaf and spine data center network, which stage of the Clos topology is the spine? RFC 7938, section 3.2.1
  • In the OSI reference model, which layer is layer 4? ITU-T Rec. X.200 (ISO/IEC 7498-1), clause 6.1.2
  • IPv6 has no broadcast addresses. What takes over their function? RFC 4291, section 2
  • Under RFC 1122, what is true of an address of the form 127.x.x.x? RFC 1122, section 3.2.1.3
  • What happens to an IPv6 packet addressed to an anycast address? RFC 4291, section 2
  • Which block is one of the three private address ranges set aside by RFC 1918? RFC 1918, section 3
Show all 105 questions (95 more)

Networking concepts, continued

  • Which cloud deployment model joins two or more distinct cloud infrastructures that stay separate entities but allow data and application portability? NIST SP 800-145, section 2
  • Which OSI layer detects, and possibly corrects, errors that occur in the Physical Layer? ITU-T Rec. X.200 (ISO/IEC 7498-1), clause 7.6.2.2
  • Which OSI layer gives the layer above it independence from routing and relay considerations? ITU-T Rec. X.200 (ISO/IEC 7498-1), clause 7.5.2.1
  • Which OSI layer organizes and synchronizes the dialogue between the two ends of a conversation? ITU-T Rec. X.200 (ISO/IEC 7498-1), clause 7.3.2.1
  • Which OSI layer provides a common representation of the data that two applications exchange? ITU-T Rec. X.200 (ISO/IEC 7498-1), clause 7.2.2.2
  • Which pair of ports does IANA register for SNMP and for SNMP traps? IANA Service Name and Transport Protocol Port Number Registry, entries snmp and snmptrap
  • Which port does RFC 6409 reserve for mail clients to submit outgoing messages? RFC 6409, section 3.1
  • Which port does the IANA registry assign to SSH? IANA Service Name and Transport Protocol Port Number Registry, entry ssh
  • Which port is registered for LDAP over TLS (ldaps)? IANA Service Name and Transport Protocol Port Number Registry, entry ldaps
  • Which prefix identifies an IPv6 link-local unicast address? RFC 4291, section 2.4
  • Which range does RFC 6335 call the Dynamic Ports, also known as private or ephemeral ports? RFC 6335, section 6
  • Which sequence of segments is the TCP three-way handshake? RFC 9293, section 3.5
  • Which service is registered at UDP port 69? IANA Service Name and Transport Protocol Port Number Registry, entry tftp
  • Which statement about UDP is true? RFC 768, Introduction
  • Which subnet mask is the dotted-decimal form of a /20 prefix? RFC 4632, section 6.1

Network implementation 20

  • A router holds routes for 10.0.0.0/8, 10.1.0.0/16 and 10.1.2.0/24. Which one forwards a packet addressed to 10.1.2.9? RFC 1812, section 2.2.5.2
  • The Bridge MIB lists the spanning tree port states in order. Which state comes between listening and forwarding? RFC 4188, dot1dStpPortState
  • Every link that carries IPv6 must support an MTU of at least how many octets? RFC 8200, section 5
  • How does a BGP speaker reach its peer? RFC 4271, section 3
  • In IEEE 802.1X port-based access control, what is the entity called that requires a connecting device to authenticate before it gets network access? RFC 3580, section 1.1
  • In RIP version 2, which metric value marks a destination as unreachable? RFC 2453, section 3.4.1
  • RFC 7348 gives a VLAN limit that is too small for large multi-tenant data centers, one reason VXLAN exists. What is that limit? RFC 7348, section 1
  • What does stateful NAT64 make possible? RFC 6146, Abstract
  • What does the Virtual Router Redundancy Protocol (VRRP) give the hosts on a LAN? RFC 5798, Abstract
  • What is OSPF Area 0? RFC 2328, section 3.1
  • What is the largest IP datagram that one standard Ethernet frame can carry? RFC 894, Frame Format
  • What kind of routing protocol is OSPF, and where is it designed to run? RFC 2328, Abstract
  • Which algorithm does EIGRP use to compute loop-free routes? RFC 7868, section 1
  • Which equipment does NIST SP 800-53 name to keep systems running long enough for an orderly shutdown or a switch to long-term alternate power? NIST SP 800-53 Rev. 5, control PE-11
  • Which IPv6 transition mechanism runs complete IPv4 and IPv6 implementations side by side on the same host or router? RFC 4213, Abstract
  • Which protocol lets an Access Controller manage a collection of wireless access points (Wireless Termination Points)? RFC 5415, Abstract
  • Which technique lets many private hosts share one public address by translating TCP and UDP port numbers as well as addresses? RFC 3022, Abstract
  • Which two environmental levels head the list that NIST SP 800-53 control PE-14 tells an organization to maintain and monitor where its equipment sits? NIST SP 800-53 Rev. 5, control PE-14
  • Which VRRP priority does the router that owns the virtual router's IP address use? RFC 5798, section 5.2.4
  • Which WLAN data protection protocol is built on AES and required by NIST for federal IEEE 802.11 networks? NIST SP 800-97, Executive Summary

Network operations 21

  • A core switch model has reached end of support and no longer gets fixes. What does NIST SP 800-53 control SA-22 call for? NIST SP 800-53 Rev. 5, control SA-22
  • A firewall is set to log at syslog severity 7. Which level of message is that? RFC 5424, section 6.2.1
  • A remote worker's VPN client sends company traffic through the tunnel and everything else out through the home router. What is this arrangement called? NIST glossary, "split tunneling" (SP 800-113)
  • An intrusion detection sensor must see all the traffic that passes through a switch. Which switch feature does NIST SP 800-94 describe for this? NIST SP 800-94, section 4.2.2
  • In IPFIX flow monitoring, what is a flow? RFC 7011, section 2
  • In syslog, which numerical severity means "Emergency: system is unusable"? RFC 5424, section 6.2.1
  • In what order are the four DHCP messages exchanged when a client first leases an address? RFC 2131, section 3.1
  • In which disaster recovery test do staff meet in a classroom setting and talk through their roles and responses to a scenario? NIST glossary, "tabletop exercise" (SP 800-84)
  • Management decides the billing system's components may spend at most four hours in the recovery phase before the mission is harmed. Which metric did they set? NIST glossary, "recovery time objective" (SP 800-34 Rev. 1)
  • Two VPN gateways form a high-availability pair. One services all connections while the other waits in standby and listens for heartbeats. What is this mode called? NIST SP 800-113, section 3.3.2
  • Under configuration change control, when is a proposed change to a production device tested and approved? NIST SP 800-128, section 2.2.3
  • What do the DNS Security Extensions (DNSSEC) add to DNS? RFC 4033, Abstract and section 1
  • What lets clients on a network segment with no DHCP server lease addresses from a server on another segment? RFC 2131, section 1
  • Which alternate site has the electrical and physical components of a computer facility but no computer equipment in place? NIST glossary, "cold site" (SP 800-34 Rev. 1)
  • Which alternate site is a fully operational offsite facility, already equipped with hardware and software? NIST glossary, "hot site" (SP 800-34 Rev. 1)
  • Which DNS resource record stores a single IPv6 address for a host name? RFC 3596, section 2.1
  • Which document is formally reviewed and agreed on at a point in time, can be changed only through change control, and is the basis for future builds? NIST glossary, "baseline configuration" (SP 800-128)
  • Which NTP stratum is assigned to a primary server, the top level of the time hierarchy? RFC 5905, section 3
  • Which recovery metric is "the point in time to which data must be recovered after an outage"? NIST glossary, "recovery point objective" (SP 800-34 Rev. 1)
  • Which security services does the SNMPv3 User-based Security Model add to SNMP messages? RFC 3414, section 1.3
  • With IPv6 stateless address autoconfiguration (SLAAC), how does a host form its address? RFC 4862, section 1

Network security 15

  • A decoy server is built to look attractive to intruders so that their activity can be observed. What is it called? RFC 4949, definition of "honey pot"
  • A router runs firmware with a known flaw that an attacker could use to take control. In NIST terms, what is the flaw? NIST glossary, "vulnerability" (FIPS 200)
  • An attacker positions a device between a user and a server to intercept and alter the data passing between them. Which attack is this? NIST glossary, "man-in-the-middle attack" (SP 1800-21B)
  • An attacker sets up an access point that imitates a public hotspot and broadcasts a stronger signal so that users connect to it. Which attack is this? CISA, Securing Wireless Networks, "Evil Twin Attacks"
  • An IPsec security association runs between two security gateways to join two offices. Which mode does it use? RFC 4301, section 4.1
  • In a public key infrastructure, which entity issues and revokes public key certificates? NIST glossary, "certification authority" (FIPS 201-3)
  • Thousands of compromised hosts flood a web server until customers cannot reach it. Which attack is this? NIST glossary, "distributed denial of service" (NISTIR 7711)
  • Where does a demilitarized zone (DMZ) sit in a network? NIST glossary, "demilitarized zone" (CNSSI 4009)
  • Which data is the PCI Data Security Standard designed to protect? PCI Security Standards Council, PCI DSS overview
  • Which feature admits a device to the network based on the user's credentials and the results of health checks on the device? NIST glossary, "network access control" (SP 800-41 Rev. 1)
  • Which IPsec protocol provides confidentiality (encryption) for the data it carries? RFC 4303, Abstract
  • Which part of the CIA triad is "ensuring timely and reliable access to and use of information"? NIST glossary, "availability" (FIPS 200)
  • Which port is officially assigned to RADIUS authentication? RFC 2865, Implementation Note
  • Which sign-in uses multi-factor authentication? NIST glossary, "multi-factor authentication" (CNSSI 4009)
  • Which statement about TACACS+ is correct? RFC 8907, sections 1 and 3.4

Network troubleshooting 24

  • A "runt" or undersize Ethernet packet is one shorter than how many octets? RFC 2819, etherStatsUndersizePkts
  • A DHCP client receives an address, checks it with ARP and finds another host already using it. Which message does it send to the server? RFC 2131, section 3.1
  • A freshly rebuilt PC rejects every HTTPS certificate as "not yet valid". What should you check first? RFC 5280, section 4.1.2.5
  • A PC set to obtain its address automatically shows 169.254.18.7 and reaches nothing beyond its own segment. What is the most likely cause? RFC 3927, section 1
  • A ping returns ICMP Destination Unreachable with the code "Communication Administratively Prohibited". What stopped the packet? RFC 1812, section 5.2.7.1
  • A ping with the Don't Fragment bit set fails with "fragmentation needed and DF set". What does that tell you? RFC 1191, section 2
  • A router interface is listed as administratively down. What does that mean? RFC 2863, ifAdminStatus and ifOperStatus
  • A router returns ICMP Destination Unreachable, code 0 (Network Unreachable), for internet destinations only. What is most likely missing from its routing table? RFC 1812, section 5.2.7.1
  • A server answers ping by IP address, but its host name fails to resolve. Which tool queries a name server directly to investigate? RFC 2151, section 3.1
  • A server's A record was changed an hour ago, yet some users still reach the old address. What explains it? RFC 1035, section 3.2.1
  • A switch port's late collision counter keeps rising. What does RFC 3635 tell you about how that port is operating? RFC 3635, dot3StatsLateCollisions
  • A TCP SYN sent to a server is answered at once with a reset (RST). What does that show? RFC 9293, section 3.5.2
  • A workstation reaches every host on its own subnet but nothing on other networks. Which setting should you check first? RFC 1122, sections 3.3.1 and 3.3.1.1
  • An oversized IPv6 packet reaches a router whose next link has a smaller MTU. Why does the router not fragment it? RFC 8200, section 4.5
  • How does traceroute find each router along a path? RFC 2151, section 3.4
  • In CompTIA's published troubleshooting methodology for Network+, what comes directly after you establish a theory? CompTIA, Network+ (V9) exam objectives summary, Network troubleshooting
  • In the same methodology, what is the last step, done after functionality has been verified? CompTIA, Network+ (V9) exam objectives summary, Network troubleshooting
  • Logons that use Kerberos begin to fail on a server whose clock has drifted 20 minutes from the domain's time. Why? RFC 4120, section 3.2.3
  • On an IPv6-only segment, which protocol does the job that ARP does for IPv4, resolving a neighbor's link-layer address? RFC 4861, section 3.1
  • Routers on a congested path should forward voice ahead of bulk transfers. Which IP header field marks a packet for that per-hop treatment? RFC 2474, section 3
  • Voice calls sound choppy although average delay is low. Which measurement describes the variation in packet delay? RFC 3393, section 1.1
  • What does an FCS (CRC) error on an Ethernet interface count? RFC 3635, dot3StatsFCSErrors
  • Which ICMP messages does the ping tool rely on? RFC 2151, section 3.2, and RFC 792
  • Without VLAN tagging or jumbo frames, an Ethernet packet is counted as oversize (a "giant") when it is longer than how many octets? RFC 2819, etherStatsOversizePkts

How this list was compiled: Own questions, written to the five domains and weights of CompTIA's Network+ exam N10-009 (version 9) as CompTIA publishes them at https://www.comptia.org/en-us/certifications/network/ (read 2026-10-06). Facts were read on 2026-10-06 in public texts: IETF RFCs on rfc-editor.org, the IANA Service Name and Transport Protocol Port Number Registry, ITU-T Recommendation X.200 (the OSI reference model), NIST Special Publications and the NIST glossary at csrc.nist.gov, CISA's page Securing Wireless Networks and the PCI Security Standards Council's PCI DSS page. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a CompTIA exam, a released or sample question, or another practice product.

How it works

This unofficial CompTIA Network+ practice test holds 105 of our own questions on the five domains of the current N10-009 objectives. It is not affiliated with CompTIA, and no question comes from the real exam.

Read the full guide

What the Network Plus exam asks

CompTIA's page for exam N10-009 (version 9), read on October 6, 2026, weights five domains: networking concepts 23%, network implementation 20%, network operations 19%, network security 14% and network troubleshooting 24%.

What this bank leaves out

Every question is multiple choice, so the exam's performance-based tasks are not here. Neither are cabling facts that sit only in paid standards, such as connector types and cable distances.

  • Syslog severities run from 0 (Emergency) to 7 (Debug), so the lowest number is the most urgent (RFC 5424).
  • A 169.254.x.x address means the host configured itself. Look for the DHCP server first (RFC 3927).
  • Dynamic ports run from 49152 to 65535; registered ports stop at 49151 (RFC 6335).

Questions and answers

Is this a Network+ N10-007 practice test?

It follows N10-009, the only Network+ exam on CompTIA's page today, launched June 20, 2024. CompTIA's page offers neither N10-007 nor N10-006, so someone booking now studies the N10-009 objectives.

Can I get the CompTIA Network+ practice test as a PDF?

Yes. After a round, Print makes a question sheet of as many questions as you add, with an optional answer key that names each source. Choose Save as PDF in the print window.

How many questions are on the Network+ exam?

CompTIA gives a maximum of 90, multiple-choice and performance-based, in 90 minutes. Exam mode here draws 90 multiple-choice questions on the same clock and reports your percent right by domain.

What is the passing score for Network+ N10-009?

720 on a scale of 100 to 900, by CompTIA's page. A scaled score is not a percent, so no score on this page tells you whether you would pass.

More tests

Show 7 more

Browse Safety and Trades