How to pass CompTIA Network+ (N10-009)

How this exam thinks

What each domain tests and how to study it

The N10-009 blueprint is split across 5 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.

1. Networking Concepts

   23% of exam

   What you must be able to do. Place every protocol, device, and address at the right layer and in the right range: read the OSI model fluently, recall well-known ports with their transport, and subnet in CIDR without wasting hosts.

   In one sentenceThe broad conceptual foundation the rest of the exam assumes: the OSI model, ports and protocols, cloud connectivity, and IPv4 and IPv6 addressing with subnetting and CIDR.

   Recall check: answer these from memory first

   • Name the seven OSI layers in order and give the device or protocol that lives at each.
   • State the transport and port for SSH, DNS, HTTP, HTTPS, and RDP without hesitating.
   • For a subnet that must provide exactly six usable hosts, give the prefix length and explain the host-count arithmetic.
   • Distinguish an RFC 1918 private address from an APIPA address by their ranges and how a host acquires each.

   What it tests. The conceptual bedrock of networking: the seven OSI layers and what device, protocol, and data unit belong at each, the common appliances (routers, switches, firewalls, load balancers, IDS/IPS, proxies), well-known ports and their transport protocols, cloud service and deployment models with their connectivity options, and IPv4 and IPv6 addressing including subnetting, CIDR, private RFC 1918 ranges, and APIPA.

   How to study it. Get the OSI model exact first, because everything else hangs off it: know the device and protocol at each layer and which layer a described action happens on. Drill the well-known ports as port-plus-transport pairs, not bare numbers, so you never confuse DNS on UDP 53 with a TCP service. Above all, practise subnetting until CIDR-to-host-count is instant: given a required number of usable hosts, name the prefix that fits with the least waste, and read RFC 1918 versus APIPA on sight.

   Easy to confuse

   • Which OSI layer a described action happens on. Tie the layer to the addressing and data unit in the scenario: a switch forwarding by MAC address is Layer 2 (frames), a router forwarding by IP and decrementing TTL is Layer 3 (packets), and port-based delivery is Layer 4 (segments). The exam plants an off-by-one-layer distractor, so match the action to its addressing before you answer.
   • TCP versus UDP, and a port transposed onto the wrong service. TCP is connection-oriented with handshake and retransmission for correctness; UDP is connectionless and lightweight for speed. The trap pairs the right port number with the wrong transport or swaps two ports (HTTP 80 with HTTPS 443), so verify both the number and the transport as one unit.
   • RFC 1918 private addressing versus APIPA. RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are deliberately assigned private space that NAT translates for internet access; APIPA (169.254.0.0/16) is self-assigned when a host wanted a DHCP lease and got none. An APIPA address is therefore a symptom of DHCP failure, not a designed addressing choice.
   • A prefix that fits the host count versus one that wastes or falls short. Usable hosts equal two to the power of the host bits, minus two for the network and broadcast addresses. Six usable hosts needs three host bits (a /29, giving eight addresses less two), so pick the smallest block that still covers the requirement rather than the next size up that wastes addresses.

   Worked example from the N10-009 bank

   lock_openFree sampleNetworking Conceptshard

   A network designer needs each subnet to provide exactly six usable host addresses, with no addresses wasted beyond the network and broadcast addresses. Which IPv4 prefix length meets this requirement?

   • A/29check_circle Correct
   • B/27
   • C/28
   • D/30

   Usable hosts per subnet equal two raised to the host-bit count minus two, so a /29 with three host bits yields exactly six usable addresses. The usable-host count is two raised to the power of thirty-two minus the prefix, minus two for the all-zeros network address and the all-ones broadcast address. A /29 has three host bits, giving eight total and six usable.

   Why A is correct: A /29 leaves three host bits, so two to the third power is eight addresses, and subtracting the network and broadcast addresses leaves exactly six usable hosts.

   Why B is wrong: A /27 leaves five host bits, giving 32 addresses and 30 usable hosts; tempting if you stop at the host-bit field, but it is far larger than six.

   Why C is wrong: A /28 leaves four host bits, giving 16 addresses and 14 usable hosts; tempting if you miscount by a single host bit, but it doubles the size needed.

   Why D is wrong: A /30 leaves two host bits, giving four addresses and two usable hosts, the point-to-point size; tempting but it supplies only two hosts, not six.

2. Network Implementation

   20% of exam

   What you must be able to do. Build the network: segment with VLANs and trunks, choose the right routing technology by its category and administrative distance, install wireless on the correct band and security, and configure DHCP, DNS, and NAT.

   In one sentenceTurning the concepts into a working network: switching and VLANs, static and dynamic routing, 802.11 wireless standards and security, and the core services of DHCP, DNS, and NAT.

   Recall check: answer these from memory first

   • Explain what lets two hosts on different VLANs communicate while the VLANs stay separate.
   • Classify OSPF, EIGRP, and BGP by protocol category and order them by administrative distance.
   • Say which band each of 802.11ac and Wi-Fi 6E uses, and why moving a client to 5 GHz can raise its throughput.
   • Describe how PAT lets two internal hosts share one public address for simultaneous HTTPS sessions.

   What it tests. Configuring and deploying the network: VLANs, 802.1Q trunking, spanning tree, and port security on switches; static versus dynamic routing with OSPF, EIGRP, and BGP, plus administrative distance, metrics, and QoS; wireless standards (Wi-Fi 5, 6, and 6E), the 2.4, 5, and 6 GHz bands, channel planning, and WPA2 versus WPA3; and the placement of physical and virtual devices alongside DHCP scopes, DNS record types, and NAT/PAT.

   How to study it. Learn routing by category before detail: static routes are manual, and among dynamic protocols OSPF and IS-IS are link-state, EIGRP is Cisco's advanced distance-vector, and BGP is the path-vector protocol between autonomous systems. Attach administrative distance to that map so you can say which source a router trusts when two protocols offer the same route. For wireless, bind each 802.11 standard to its band (802.11ac is 5 GHz only, Wi-Fi 6E adds 6 GHz) and know that WPA3 replaced the WPA2 handshake with SAE. Practise the DHCP, DNS, and NAT services as configuration tasks, since performance-based items live here.

   Easy to confuse

   • Routing-protocol category and administrative distance. Category and trust are separate axes. OSPF is link-state, EIGRP is advanced distance-vector, BGP is path-vector, and administrative distance ranks how far a router trusts each source (a directly connected route beats static, which beats EIGRP, which beats OSPF, which beats external BGP for internal routes). The trap mislabels the category or claims the wrong protocol wins a tie.
   • WPA2 versus WPA3. WPA2-Personal uses a pre-shared key with the four-way handshake, which is exposed to offline dictionary attack; WPA3-Personal replaces it with Simultaneous Authentication of Equals (SAE) for forward secrecy and protection against offline cracking. If the requirement is resistance to offline password guessing, WPA3 is the answer, not a longer WPA2 passphrase.
   • 802.11 standard versus the band and channel width it uses. The standard dictates the band: 802.11ac (Wi-Fi 5) runs only on 5 GHz, Wi-Fi 6E extends into 6 GHz, and 2.4 GHz is practically limited to 20 MHz channels while 5 and 6 GHz support bonded 40, 80, and 160 MHz channels. A client stuck at legacy rates on 2.4 GHz needs the correct band, not a wider 2.4 GHz channel or a driver change.
   • Inter-VLAN routing versus a trunk link. A trunk (802.1Q) carries many VLANs' tagged frames over one link between switches; it does not by itself move traffic between VLANs. Hosts in different VLANs need a Layer 3 device (a router or Layer 3 switch doing inter-VLAN routing) to forward between the subnets, so a working trunk with no routing still leaves the VLANs unable to reach each other.

   Worked example from the N10-009 bank

   lock_openFree sampleNetwork Implementationmedium

   On a single access switch, PC-A sits in VLAN 10 (subnet 10.1.10.0/24) and PC-B sits in VLAN 20 (subnet 10.1.20.0/24). Both link lights are up and each PC reaches other hosts inside its own VLAN, but PC-A cannot ping PC-B. What is required to let the two PCs communicate while keeping the VLANs separate?

   • AEnable an 802.1Q trunk between the two switchports so the VLAN tags carry the traffic across.
   • BAdd a Layer 3 device such as a router or multilayer switch to route between the VLAN 10 and VLAN 20 subnets.check_circle Correct
   • CEnable Spanning Tree Protocol for VLAN 10 and VLAN 20 to open a forwarding path between them.
   • DConfigure port security on both switchports to permit each PC's MAC address.

   Hosts in different VLANs occupy different subnets and broadcast domains, so a Layer 3 device is required to route traffic between them. VLANs are separate Layer 2 broadcast domains mapped to different IP subnets, so traffic between them must be routed by a Layer 3 device; a router subinterface or a multilayer switch SVI supplies that inter-VLAN gateway.

   Why A is wrong: Trunking sounds like it connects VLANs, but an 802.1Q trunk multiplexes several VLANs onto one switch-to-switch link; it does not route packets from one VLAN subnet into another.

   Why B is correct: Each VLAN is a separate broadcast domain on its own IP subnet, so traffic between them must cross a Layer 3 boundary provided by a router subinterface or a multilayer switch SVI.

   Why C is wrong: STP is tempting because it manages forwarding paths, but it only prevents Layer 2 loops within a broadcast domain and never routes traffic between two different VLAN subnets.

   Why D is wrong: Port security is tempting when a host cannot pass traffic, but it only limits which MAC addresses a port accepts and does nothing to forward traffic between two separate VLAN subnets.

3. Network Operations

   19% of exam

   What you must be able to do. Keep the network healthy and documented: monitor with the right tool against a baseline, apply change management and standard procedures, and design high availability and disaster recovery to meet RPO and RTO.

   In one sentenceRunning the network day to day: monitoring and baselines, the organisational documents and policies that govern change, and high-availability and disaster-recovery design.

   Recall check: answer these from memory first

   • Say which monitoring tool you reach for to graph a single interface counter, and what identifies that counter.
   • State what a configuration baseline is for and why change management depends on it.
   • Define RPO and RTO in one line each and give the difference in plain terms.
   • Match hot, warm, and cold recovery sites to the recovery time each supports.

   What it tests. Operating a network reliably: monitoring with SNMP, flow data (NetFlow/sFlow), syslog, and SIEM, and reading utilisation, latency, jitter, and packet loss against a baseline; the organisational documents and policies (physical and logical diagrams, IPAM, change management, standard operating procedures); and high-availability and disaster-recovery design including first-hop redundancy, NIC teaming, active/active versus active/passive, hot/warm/cold sites, backups, and the RPO and RTO recovery metrics.

   How to study it. Anchor monitoring to purpose: SNMP polls counters and sends traps, flow data shows who talked to whom and how much, and syslog carries event messages, so match the tool to the question being asked. Learn the availability building blocks by what single point of failure each removes (NIC teaming survives a cable or switch failure, FHRP survives a gateway failure). For disaster recovery, keep RPO and RTO straight as the two metrics that scope a recovery: how much data you can lose versus how long you can be down, and which site type each recovery time implies.

   Easy to confuse

   • RPO versus RTO. RPO (recovery point objective) is how much data loss is tolerable, measured backwards from the failure to the last good backup; RTO (recovery time objective) is how long the service may be down before it must be restored. One sets backup frequency, the other sets recovery speed and site type, so a question about acceptable data loss is RPO and one about acceptable downtime is RTO.
   • SNMP polling versus a trap, and the OID that names a counter. Polling is the manager pulling values on a schedule; a trap is the agent pushing an unsolicited alert when an event fires. Either way, a specific object identifier (OID) in the device MIB names the single value you want, so the answer to 'which counter' is the OID, not the community string or engine ID.
   • NIC teaming versus Spanning Tree Protocol. NIC teaming groups a server's interfaces into one logical link for redundancy and throughput, protecting against a cable, port, or switch failure; STP prevents Layer 2 loops by blocking redundant switch paths. Both touch redundancy, but teaming adds resilience to a host while STP removes loops from a switched topology.

   Worked example from the N10-009 bank

   lock_openFree sampleNetwork Operationsmedium

   A network administrator must poll performance counters from routers across a shared provider link and requires that both the login credentials and the payload of every SNMP message be encrypted in transit. Which SNMP configuration meets this requirement?

   • ASNMPv2c using a non-default, read-only community string.
   • BSNMPv3 operating in authPriv mode with SHA authentication and AES privacy.check_circle Correct
   • CSNMPv1 with a read-write community restricted by an access list.
   • DSNMPv3 operating in authNoPriv mode with SHA authentication only.

   SNMPv3 in authPriv mode both authenticates the user and encrypts the payload, whereas SNMPv1 and SNMPv2c rely on cleartext community strings with no encryption. SNMPv3's User-based Security Model defines three security levels, and authPriv adds a privacy protocol such as AES on top of authentication, so both the credentials and the payload are encrypted. SNMPv1 and SNMPv2c community strings traverse the network in cleartext.

   Why A is wrong: A non-default community string is safer than the default 'public', but SNMPv2c carries the community string and the message payload in cleartext, so nothing is encrypted in transit.

   Why B is correct: authPriv authenticates the user and applies a privacy protocol such as AES to the payload, so both the credentials and the data are protected in transit as required.

   Why C is wrong: An access list limits which hosts may connect, yet SNMPv1 offers no encryption at all and sends the community string and data as cleartext, failing the requirement.

   Why D is wrong: SNMPv3 can encrypt, but authNoPriv authenticates the user without applying privacy, so the payload travels unencrypted and only half the requirement is met.

4. Network Security

   14% of exam

   What you must be able to do. Reason about security by principle and category: map a finding to the right element of the CIA triad, name an attack by how it works and the layer it targets, and choose the control that actually addresses the threat.

   In one sentenceSecuring the network: the CIA triad, zero trust and defence in depth, the common attacks and their impact, and the controls (ACLs, segmentation, NAC, VPNs) that harden it.

   Recall check: answer these from memory first

   • Map a cleartext-credentials-on-the-wire finding to the element of the CIA triad it most directly breaks.
   • Explain the implicit deny at the end of an ACL and the outage it causes when only two permits are configured.
   • Distinguish authentication, authorisation, and accounting in the AAA model.
   • Give the defensive control that best addresses a rogue device plugging into an access port.

   What it tests. Foundational network security: the CIA triad, defence in depth, least privilege, zero trust, and the AAA and multifactor authentication concepts; the common attacks (DoS/DDoS, on-path, ARP and DNS poisoning, MAC flooding, VLAN hopping, rogue access points, social engineering) with their impact and target layer; and the defensive controls (access control lists, network segmentation and screened subnets, port security with 802.1X NAC, IPsec and SSL/TLS VPNs, and device hardening).

   How to study it. Learn security as principle plus category, not a list of tools. For the CIA triad, practise mapping a finding to the element it breaks: cleartext credentials on the wire is a confidentiality loss, tampering is integrity, an outage is availability. Sort each attack by mechanism and the layer it targets so you can pair it with the right defence (segmentation and 802.1X against rogue devices, ACLs to filter traffic, dynamic ARP inspection against ARP poisoning). Remember that an ACL ends in an implicit deny, a fact the exam tests directly.

   Easy to confuse

   • Which element of the CIA triad a finding compromises. Confidentiality is about unauthorised disclosure, integrity about unauthorised change, availability about access when needed. Credentials readable in a packet capture is a confidentiality loss because an unauthorised party can read secret data in transit, even though it could later enable a change; answer on the most direct loss, not a downstream consequence.
   • 802.1X authentication versus MAC Authentication Bypass. 802.1X requires a supplicant on the device to authenticate over EAPOL before the port opens; MAB is the fallback that authenticates a device by its hardware address when it has no supplicant, used for printers and IoT. A guest VLAN that opens the port to anything on timeout is the insecure trap, not the controlled MAB answer.
   • An on-path (man-in-the-middle) attack versus ARP poisoning that enables it. On-path names the outcome, an attacker positioned to read or alter traffic between two parties; ARP poisoning is one Layer 2 technique that achieves that position by mapping the attacker's MAC to a legitimate IP. The exam wants the mechanism named where it asks how the position was gained, and the outcome named where it asks about impact.

   Worked example from the N10-009 bank

   lock_openFree sampleNetwork Securitymedium

   A technician captures traffic on a switch mirror port and finds that user login credentials for an internal web application are travelling in readable cleartext over HTTP, so anyone with packet-capture access can read them. Which element of the CIA triad is most directly compromised by this finding?

   • AIntegrity, because an attacker who reads the credentials could later modify the account, so the trustworthiness of the stored data is the main loss.
   • BAvailability, because exposing the login could lead to the account being locked out and the legitimate user then denied access to the application.
   • CConfidentiality, because the credentials can be read by an unauthorised party who captures the packets, defeating the aim of keeping data secret in transit.check_circle Correct
   • DNon-repudiation, because cleartext credentials would make it impossible to prove who carried out a given action later on.

   Reading data such as credentials in cleartext on the network breaks confidentiality, the assurance that information is disclosed only to authorised parties. Confidentiality is the assurance that data is accessible to authorised parties; credentials sent in cleartext can be read by anyone capturing the traffic, which is a direct confidentiality breach rather than alteration or loss of access.

   Why A is wrong: Integrity concerns unauthorised alteration of data; capturing readable credentials exposes them but does not change any stored value, so this is not the principle harmed here.

   Why B is wrong: Availability is about authorised users reaching a service; the web application stays reachable and no disruption has occurred, so availability is not what the cleartext exposure breaks.

   Why C is correct: Confidentiality is the assurance that data is disclosed to authorised parties alone; cleartext credentials on the wire can be read by anyone capturing packets, which is precisely this loss.

   Why D is wrong: Non-repudiation is the inability to deny an action and is not one of the three CIA-triad pillars, so it cannot be the triad element compromised by packet exposure.

5. Network Troubleshooting

   24% of exam

   What you must be able to do. Diagnose faults by method, not hunch: follow the seven-step methodology in order, read physical-layer symptoms like a duplex mismatch, and pick the right command or tool for the symptom in front of you.

   In one sentenceThe most heavily weighted domain: the seven-step troubleshooting methodology, cable and physical-layer faults, the command-line and software tools, and general wired and wireless problems.

   Recall check: answer these from memory first

   • List the seven troubleshooting steps in order and say what you do immediately after establishing a theory.
   • Give the classic symptoms of a duplex mismatch and how they differ from a hard speed mismatch.
   • Choose the command for a name-resolution failure versus a path or reachability problem.
   • Explain why a client with a 169.254 address points to a DHCP problem rather than a cabling fault.

   What it tests. Diagnosing and resolving faults: the CompTIA seven-step troubleshooting methodology in order; cable and physical-layer issues (attenuation, crosstalk, EMI, pinout, open/short, duplex and speed mismatch) with the right diagnostic tool; the software tools and commands (ping, traceroute, nslookup, ipconfig, arp, netstat, and protocol analysers); and general service failures across DHCP, DNS, addressing, routing, and wireless interference and coverage.

   How to study it. This domain carries the most weight, so give it the most time and make the seven steps automatic in order: identify, theorise, test the theory, plan, implement, verify, document. Rehearse the what-comes-next questions until you never skip ahead, especially the trap of implementing or documenting before verifying. Learn duplex mismatch as a signature (up link but poor throughput, late collisions and CRC errors on the full-duplex side; a hard speed mismatch drops the link entirely). Match each command to the symptom it diagnoses so you reach for nslookup on a name-resolution fault and traceroute on a path problem.

   Easy to confuse

   • The order of the seven troubleshooting steps. The sequence is fixed: identify the problem, establish a theory, test the theory, establish a plan of action, implement the solution, verify full functionality, then document. Just after forming a theory you test it; you do not implement a fix or document findings yet. The trap answer is always a later step offered too early.
   • Duplex mismatch versus a hard speed mismatch. A duplex mismatch leaves the link up but slow, with late collisions and CRC errors on the full-duplex end and framing errors on the half-duplex end. A speed mismatch (one end forced to 1000 and the other to 100) brings the link down entirely with no light, because neither end will adapt. Slow-but-up points to duplex; dead-link points to speed.
   • ping and traceroute versus nslookup for the symptom. ping tests reachability to an address and traceroute maps the hops and where a path breaks, while nslookup and dig test name resolution against DNS. If a host resolves a name to the wrong or no address, the fault is DNS and nslookup is the tool; if the address is known but unreachable, ping and traceroute localise the break.

   Worked example from the N10-009 bank

   lock_openFree sampleNetwork Troubleshootingeasy

   A technician troubleshooting a slow 100 Mbps server link has just formed the idea that a duplex mismatch between the switch port and the server NIC is the likely cause. Following the CompTIA seven-step troubleshooting methodology, what should the technician do next?

   • ATest the theory by checking the interface counters and duplex settings on both ends to confirm the mismatch.check_circle Correct
   • BImplement the solution by hard-coding both interfaces to the same speed and duplex.
   • CDocument the findings and the corrective action taken in the ticketing system.
   • DEstablish a plan of action and identify the potential effects of changing the duplex settings.

   After establishing a theory of probable cause, the next methodology step is to test that theory before planning or implementing any fix. The CompTIA method sequences theory work as establish, then test, then plan, then implement, so a freshly formed theory must be tested to confirm the cause before any change is made.

   Why A is correct: After a theory of probable cause is established, the methodology's next step is to test that theory to determine whether it is actually the cause.

   Why B is wrong: This is the eventual corrective action and feels efficient, but implementing a change comes only after the theory has been tested and a plan of action has been established.

   Why C is wrong: Documentation is a real methodology step, but it is the final one performed after the fix is verified, not the step that follows forming a theory.

   Why D is wrong: Planning is a genuine step, but it belongs after the theory is confirmed by testing, so building a plan now skips the required test step.

A study plan that works

1. Map the blueprint and book a date

   Day 1

   Read the official exam objectives and the five domains. Note that troubleshooting and networking concepts carry the most weight, and set a provisional exam date now: a fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam.

2. Lock the concepts foundation (Networking Concepts)

   Weeks 1-2

   Get the OSI model, ports and protocols, and addressing solid before anything else, because every later domain assumes them. Drill subnetting daily until CIDR-to-host-count is instant, and memorise the well-known ports as port-plus-transport pairs. Use the recall prompts: cover the answer, respond from memory, then reveal.

3. Build the network (Network Implementation)

   Weeks 2-3

   Work through VLANs and trunking, routing by category and administrative distance, wireless standards and their bands, and the DHCP, DNS, and NAT services. Do the performance-based practice tasks here, since simulations cluster in implementation and troubleshooting.

4. Operate and secure it (Network Operations and Security)

   Weeks 3-4

   Cover monitoring and baselines, change management and documentation, high availability and RPO/RTO, then the security principles, attacks, and controls. These are lower weight and largely conceptual, so a focused pass plus scenario practice is enough to secure the marks.

5. Drill troubleshooting until the method is automatic

   Week 4

   Give the most heavily weighted domain the most time. Rehearse the seven steps in order on what-comes-next questions, learn the physical-layer signatures (duplex mismatch, APIPA meaning DHCP failure), and match each command to its symptom. This is where the exam concentrates its marks.

6. Practise on scenarios with worked explanations

   Week 5

   Move to full practice sets and read the explanation for every question, including the ones you got right. The exam tests the single best answer among plausible options, so understanding why each distractor fails is where the marks are.

7. Sit a timed mock and close weak domains

   Week 6

   Take at least one full timed mock to rehearse pacing and the flag-and-return habit, including the performance-based items. Use your per-domain accuracy to drill the two weakest domains rather than re-reading what you already know, and repeat until every domain clears the pass line with margin.

Know when you're ready

Exam-day tips

• Read the last line of the question first. It tells you what is actually being asked, so you can read the scenario looking for the answer rather than absorbing every detail.
• Choose the single best option, not merely a correct one. Several options are often true; the exam wants the best fit for the stated requirement, such as the exact host count or the band in use.
• On troubleshooting questions, respect the order of the seven steps. The trap is a later step offered too early: after a theory you test it, and you verify before you document.
• Check the port and the transport together. A right port number with the wrong transport (or two ports swapped) is a classic distractor, so read DNS as UDP 53, not just 53.
• For subnetting, work from the required usable hosts to the prefix and pick the smallest block that fits. Usable hosts are two to the host bits minus two for network and broadcast.
• Flag and move on. Do not lose time on one hard item when easier marks are waiting, and budget time for the performance-based tasks, which take longer than multiple-choice questions.
• Match the tool to the symptom: nslookup for name resolution, ping and traceroute for reachability and path, a cable tester and interface counters for physical faults.

Frequently asked questions

Related certifications

Other Networking certifications with a study guide.

• Cisco Certified Network Associate (CCNA 200-301) study guideCisco