CompTIA Network+ practice questions and exam guide

Which port pair is correctly mapped to its secure email protocol?

1. IMAPS — TCP 995
2. POP3S — TCP 465
3. SMTPS — TCP 587
4. IMAPS — TCP 993

Answer: D — IMAPS — TCP 993

IMAPS uses TCP 993. POP3S uses 995 (not IMAPS). SMTPS implicit TLS uses 465; 587 is the submission port with STARTTLS. Off-by-one between 993/995/465/587 is a classic Network+ trap.

The PDU at the Transport layer for TCP is called a:

1. Frame
2. Datagram
3. Packet
4. Segment

Answer: D — Segment

TCP PDU = segment. UDP PDU = datagram. Network layer PDU = packet. Data link PDU = frame. Confusing segment/datagram between TCP/UDP is a frequent question.

Which protocol uses UDP and not TCP?

1. HTTP
2. FTP control channel
3. TFTP
4. SMTP

Answer: C — TFTP

TFTP uses UDP 69. HTTP, FTP control (21), and SMTP (25) all use TCP. TFTP's UDP simplicity is why it is used for PXE boot and config transfers — and a common UDP-vs-TCP test point.

Instances in a private cloud subnet must download vendor patches from the internet, but nothing on the internet may initiate a session to them. Which configuration MOST appropriately meets both requirements?

1. Route the subnet's default path to a NAT gateway in a public subnet
2. Attach an internet gateway route directly to the private subnet
3. Assign each instance a public address and restrict it with a security group
4. Peer the VPC with the vendor's network over a transit connection

Answer: A — Route the subnet's default path to a NAT gateway in a public subnet

A) Correct — a NAT gateway lets outbound sessions leave and return while providing no inbound reachability, which is exactly the asymmetry requested. B) An internet gateway route plus public addressing makes the instances directly addressable, which the requirement forbids. C) Public addresses with a restrictive security group is half right: it can block inbound traffic, but it still exposes routable addresses and depends entirely on rule correctness. D) Peering solves private reachability to one partner network, not general patch downloads from vendor sites.

An organization is adding IPv6 while a number of internal applications still speak only IPv4. Which transition approach carries the LEAST risk of breaking those applications?

1. Translate all IPv6 traffic to IPv4 at a gateway and disable IPv6 on hosts
2. Run dual-stack so hosts hold both IPv4 and IPv6 addresses concurrently
3. Cut over to IPv6-only and rely on link-local addressing internally
4. Tunnel IPv4 inside IPv6 across the campus core switches

Answer: B — Run dual-stack so hosts hold both IPv4 and IPv6 addresses concurrently

B) Correct — dual-stack keeps the existing IPv4 path intact while IPv6 is introduced, so legacy applications continue to work unchanged during migration. A) Translation gateways are a fallback where dual-stack is impossible and add a stateful choke point and application breakage. C) IPv6-only immediately strands the IPv4-only applications, and link-local addresses do not route between subnets. D) Tunnelling IPv4 over an IPv6 core is a later-stage technique that presumes the core is already IPv6-only.

Which address is a valid IPv6 link-local address?

1. 2001:db8::1
2. fc00::1
3. fe80::1
4. ::1

Answer: C — fe80::1

Link-local is fe80::/10. 2001:db8::/32 is documentation/global. fc00::/7 is Unique Local (ULA). ::1 is loopback. Confusing fe80 with fc00 or 2001:db8 is a frequent IPv6 trap.

IPv6 clients on a segment form addresses automatically from the router's prefix but receive no DNS server information. Which explanation is MOST likely?

1. The prefix advertised by the router is longer than /64 and blocks options
2. SLAAC is supplying the prefix while no DHCPv6 or RDNSS option provides resolvers
3. Duplicate address detection is failing and suppressing all router advertisements
4. The clients require an IPv4 default gateway before IPv6 options are accepted

Answer: B — SLAAC is supplying the prefix while no DHCPv6 or RDNSS option provides resolvers

B) Correct — SLAAC builds an address from the advertised prefix, but resolver information must come from a DHCPv6 server or an RDNSS option in the router advertisement; without either, addressing works and name resolution does not. A) A prefix longer than /64 breaks SLAAC address formation entirely, which is not the observed symptom. C) If router advertisements were suppressed, clients would not obtain a prefix at all. D) IPv6 option delivery is independent of whether an IPv4 gateway exists.

Which DNS record correctly maps a hostname to an IPv6 address?

1. A
2. CNAME
3. PTR
4. AAAA

Answer: D — AAAA

AAAA (quad-A) maps hostname to IPv6. A maps to IPv4. CNAME aliases one name to another. PTR is reverse mapping (IP to name). Adjacent-record-type confusion (A vs AAAA vs CNAME) is the textbook Network+ trap.

An engineer needs to bond two switch uplinks for higher throughput and redundancy. Which standard should they configure?

1. 802.1Q — VLAN tagging on trunk links between two switches
2. 802.1X — port-based network access control with a RADIUS server
3. 802.3ad (LACP) — link aggregation of multiple physical ports
4. 802.1D — spanning tree loop prevention across bridged links

Answer: C — 802.3ad (LACP) — link aggregation of multiple physical ports

802.3ad / LACP provides link aggregation. 802.1Q is VLAN tagging. 802.1X is NAC/port-based authentication. 802.1D is STP. Adjacent-standard confusion is a frequent trap.

Two switches are joined by four gigabit links that must act as one logical path with redundancy and no spanning tree blocking. Which configuration achieves this?

1. Configure a link aggregation group negotiated with LACP
2. Configure each link as an access port in the same VLAN
3. Set three links administratively down as standby capacity
4. Enable spanning tree PortFast on all four interfaces

Answer: A — Configure a link aggregation group negotiated with LACP

A) Correct — LACP bundles the links into one logical interface, so spanning tree sees a single port and all four members carry traffic with automatic failover. B) Four parallel access ports create a loop that spanning tree will block down to one active link. C) Manual standby wastes three quarters of the capacity and requires human intervention on failure. D) PortFast skips listening and learning on edge ports and would make a switch-to-switch loop worse, not better.

An engineer wants client devices on VLANs 10 and 20 to communicate. What is REQUIRED?

1. A trunk carrying both VLANs between the two access switches
2. Moving both access ports into the default VLAN 1 untagged
3. Disabling spanning tree on the interconnecting switch ports
4. Router-on-a-stick subinterfaces or an SVI on a Layer 3 switch

Answer: D — Router-on-a-stick subinterfaces or an SVI on a Layer 3 switch

Inter-VLAN routing requires Layer 3: router-on-a-stick subinterfaces or SVIs on an L3 switch. Trunks alone do not route. Disabling STP is unrelated. VLAN 1 collapse breaks segmentation.

Which routing protocol is the BEST choice for inter-domain routing on the public Internet?

1. OSPF
2. EIGRP
3. RIPv2
4. BGP

Answer: D — BGP

BGP is the Internet's exterior gateway protocol — path-vector, policy-driven. OSPF/EIGRP/RIP are interior gateway protocols. Mixing IGP/EGP roles is a popular routing trap.

A lecture hall with several hundred small-packet clients performs poorly despite modern access points. Which wireless capability MOST directly improves efficiency for many simultaneous low-throughput clients?

1. Orthogonal frequency-division multiple access subdividing a channel
2. Increasing channel width to the widest option the radio supports
3. Reducing the beacon interval so that clients discover the network faster
4. Disabling lower data rates so distant clients associate elsewhere

Answer: A — Orthogonal frequency-division multiple access subdividing a channel

A) Correct — OFDMA splits a channel into resource units so several small transmissions share one time slot, which is the key efficiency gain in high-density, small-frame environments. B) Wider channels help a single fast client but reduce the number of usable channels and worsen contention in dense rooms. C) Beacon interval affects discovery and power saving, not per-frame efficiency under load. D) Disabling low rates trims airtime waste modestly but does not address hundreds of concurrent small transmissions.

Cat 6a vs. Cat 5e cable supports a max speed of:

1. Cat 5e carries 10 Gbps to 100 m, while Cat 6a is limited to 1 Gbps
2. Both cable grades are capped at 100 Mbps regardless of run length
3. Cat 5e carries 1 Gbps to 100 m, while Cat 6a carries 10 Gbps to 100 m
4. Cat 6a reaches fiber-class speeds only when used with optical transceivers

Answer: C — Cat 5e carries 1 Gbps to 100 m, while Cat 6a carries 10 Gbps to 100 m

C is right: Cat 5e supports 1 Gbps to 100 m, and Cat 6a supports 10 Gbps to the full 100 m thanks to tighter alien-crosstalk control (plain Cat 6 reaches 10 Gbps only on shorter runs). A simply swaps the two grades. B describes older Cat 5-era limits. D confuses copper with optical media, which needs fiber, not twisted pair.

Which fiber type is best for a 40 km inter-building backbone run?

1. OM3 multimode
2. OM4 multimode
3. OS2 single-mode
4. OM1 multimode

Answer: C — OS2 single-mode

OS2 single-mode supports tens of kilometers. OM3/OM4 multimode reaches a few hundred meters at high speeds. OM1 is older multimode for short runs. SMF vs MMF distance trap is a Network+ classic.

Management asks which internal hosts and applications consumed the most WAN bandwidth overnight. Which data source answers this MOST directly?

1. SNMP interface counters polled from the WAN router
2. Syslog messages generated by the WAN router
3. Flow data exported by the WAN router
4. A full packet capture taken at the core switch

Answer: C — Flow data exported by the WAN router

C) Correct — flow records summarize conversations by source, destination, port and byte count, which is precisely a top-talkers question. A) Interface counters give total throughput on the link but cannot attribute it to hosts. B) Syslog records events and state changes, not per-conversation volume. D) A capture could theoretically answer it but was not running overnight, and storing a night of full packets is impractical.

An engineer should follow which order for change management on a production change?

1. Implement the change first and document it afterward if time allows
2. Request, review, approve, schedule, implement, validate, close
3. Implement and approve at the same time to shorten the window
4. Document only after a user reports a problem with the change

Answer: B — Request, review, approve, schedule, implement, validate, close

Standard change-management workflow ensures peer review, approval, and rollback plans before implementation. Skipping approvals or back-filling documentation is the classic operations failure pattern.

After a floor rewire, technicians cannot determine which patch-panel port terminates at which wall jack, so every move takes a tone-out. Which operational practice would MOST directly have prevented this?

1. A consistent labeling scheme with a port map documenting both ends of every run
2. Nightly automated configuration backups of every access switch on the floor
3. An updated rack elevation showing where each patch panel is mounted in the closet
4. A weekly automated network discovery scan across all access VLANs

Answer: A — A consistent labeling scheme with a port map documenting both ends of every run

A) Correct — cable and port labeling documented at both terminations is the control that makes any run traceable without testing. B) Config backups protect switch settings; they say nothing about copper terminations. C) A rack elevation locates the panel but not the jack each port serves. D) Discovery finds live devices and addresses, not the passive cabling map.

Which is the difference between a stateful and stateless firewall?

1. There is no functional difference between the two firewall designs at all
2. Stateful firewalls are the older and simpler of the two designs
3. Stateless firewalls track connections and permit return traffic
4. Stateful tracks session state; stateless filters each packet alone
5. Both behave the same as a signature-based intrusion detection system

Answer: D — Stateful tracks session state; stateless filters each packet alone

D is right: a stateful firewall keeps a session table, so it recognizes the TCP handshake and automatically permits return traffic for established flows, while a stateless packet filter evaluates each packet in isolation. C simply reverses the two. A denies a real distinction. B has the history backwards, since stateless filtering came first. E confuses filtering with detection.

An architecture review concludes that a device on the internal LAN should get no implicit trust and must be evaluated on every request. Which principle is being applied?

1. Defence in depth, layering independent controls along the path
2. Zero trust, verifying identity and posture per request regardless of location
3. Separation of duties, splitting privileged tasks among staff
4. Implicit deny, blocking traffic that no rule explicitly permits

Answer: B — Zero trust, verifying identity and posture per request regardless of location

B) Correct — zero trust removes location-based trust and applies policy-based authentication and authorization to each access request. A) Defence in depth describes stacking controls generally and does not by itself remove trust based on network position. C) Separation of duties governs how human responsibilities are divided, not per-request device access. D) Implicit deny is a rule-processing default within a firewall or ACL, narrower than the architectural principle described.

Which is the BEST mitigation for password attacks against management interfaces?

1. Permit Telnet access only from the management VLAN subnet
2. Use one shared administrator password across all devices
3. Disable authentication logging to reduce collector volume
4. Use SSH key-based auth with MFA and login rate limiting

Answer: D — Use SSH key-based auth with MFA and login rate limiting

Strong auth (SSH keys + MFA), rate-limiting, and lockout protect management planes. Telnet, no logging, and shared passwords are anti-patterns.

Users on the third floor report they cannot reach any internal server, while users on other floors are unaffected and third-floor users can still print to a local printer. During problem identification, this scoping is MOST useful because it

1. proves the fault is a physical cable break in a single wall jack
2. eliminates DNS as a possible contributor to the reported symptoms
3. narrows probable cause to infrastructure shared by that floor alone
4. confirms the theory that the core routing table has been corrupted

Answer: C — narrows probable cause to infrastructure shared by that floor alone

C) Correct — symptoms bounded by one floor while intra-floor traffic works point at that floor's shared uplink or distribution path, which is a large reduction in search space. A) One jack cannot affect a whole floor, and nothing has been physically tested. B) DNS has not been ruled out; scoping does not by itself eliminate a name resolution factor. D) A corrupted core routing table would affect more than a single floor, and no theory has been tested yet.

A switch port repeatedly transitions up and down. Which is the BEST first diagnostic action?

1. Reload the entire switch during the next maintenance window
2. Check the cable, SFP, and far-end NIC, plus duplex settings
3. Assign the affected user a new address from the same subnet
4. Change the VLAN tag configured on the affected switch port

Answer: B — Check the cable, SFP, and far-end NIC, plus duplex settings

Link flap commonly comes from cabling, SFP, or duplex/speed mismatch. Reload, re-IP, or retagging skip layer-by-layer isolation.

A survey of a small office finds three access points within range of each other on 2.4 GHz channels 1, 3 and 6. Users report erratic performance throughout the space. What should the engineer do?

1. Widen each radio's channel width to 40 MHz to increase available capacity
2. Set all three access points to the same channel so they can coordinate
3. Reassign the radios to channels 1, 6 and 11 to eliminate overlap
4. Reduce transmit power on all three radios until the cells no longer touch

Answer: C — Reassign the radios to channels 1, 6 and 11 to eliminate overlap

C) Correct — in 2.4 GHz only 1, 6 and 11 are non-overlapping, and channel 3 partially overlaps both 1 and 6, causing interference rather than contention. A) Wider channels in 2.4 GHz consume even more of the limited spectrum and worsen overlap. B) Co-channel operation shares airtime politely but cuts each cell's capacity and is not preferable to full separation. D) Cutting power to eliminate all overlap would create coverage holes and does not fix the channel plan.

What is firmware management for network devices?

Schedule firmware updates during maintenance windows. Validate compatibility. Maintain rollback images. Track CVEs and apply security updates promptly.

What does the principle of least privilege require, and how does it apply to network device administration?

Least privilege requires every user, device and service to hold only the permissions needed for its task, and only for as long as needed. On network devices this means role-based accounts rather than shared full-privilege logins, read-only roles for monitoring and audit staff, management access restricted to a dedicated management network or jump host, and prompt removal of rights when a role changes.

What is a MAC address and how is it formatted?

48-bit hardware address, written as 6 hex bytes (e.g., 00:1A:2B:3C:4D:5E). First 24 bits = OUI (vendor); last 24 bits = device-specific.

How does SD-WAN differ from SDN in what each one controls and where it is deployed?

SDN separates the control plane from the data plane and centralises forwarding decisions in a controller, usually inside one campus or data centre fabric. SD-WAN applies that same centralised, policy-driven control to wide area links across geographically distributed sites, steering application traffic over broadband, MPLS or cellular based on policy and current path quality.

What is the role of a SIEM?

Security Information and Event Management — centralizes logs, correlates events, and alerts on security/operational issues. Examples: Splunk, QRadar, Sentinel.

What is the difference between TCPdump filter and Wireshark display filter?

tcpdump uses BPF capture filters (e.g., 'host 1.2.3.4 and port 80'). Wireshark display filters use a different syntax (ip.addr == 1.2.3.4 && tcp.port == 80) post-capture.