N10-009 - Network Troubleshooting (24% of the exam) - Section 5.3

Use the appropriate software tool or command to solve networking issues, including ping, traceroute, nslookup, ipconfig, and protocol analysers.

Select and interpret the right command-line and software tool for a symptom: ping and traceroute/tracert for reachability and path, nslookup/dig for name resolution, ipconfig/ifconfig and arp for local configuration, and netstat for active connections. Use a protocol analyser (packet capture) and a port scanner when a deeper inspection of traffic or exposed services is required.

ping and traceroutenslookup/digipconfig/ifconfigProtocol analyser (packet capture)

Practice question for this objective

Free sampleNetwork Troubleshootingmedium

A technician suspects an unauthorised service is listening for inbound connections on a Windows host and wants a single command that lists all active TCP connections together with the local ports in a listening state and the process identifier owning each one. Which command produces this?

Aarp -a
Bipconfig /all
Cnetstat -ano Correct
Droute print

netstat -ano lists active connections and listening ports with the process identifier that owns each socket. netstat reports the host's socket table. The -a switch adds listening as well as established sockets, -n keeps output numeric and fast, and -o appends the PID so the technician can trace an unexpected listening port back to the process behind it, then match that PID in Task Manager.

Why A is wrong: arp -a returns the IP-to-MAC cache for the local segment and reveals nothing about which ports are open or which process is bound to them.

Why B is wrong: ipconfig /all details the interface configuration such as address, mask, gateway, and DHCP, but it does not enumerate sockets, listening ports, or owning processes.

Why C is correct: netstat -ano lists all connections and listening ports (-a), shows addresses numerically without name resolution (-n), and includes the owning process identifier (-o), matching the requirement exactly.

Why D is wrong: route print shows the routing table used to forward packets toward destinations; it lists no connection state and no per-process port ownership.

See more N10-009 practice questions, answers explained.

Exam traps in Network Troubleshooting

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

Ping the site's public IP address, and if it replies, conclude that DNS must be misconfigured.
Why it is wrong: A successful ping to an address tests reachability but says nothing about whether the name resolves, so it cannot on its own confirm that DNS is the problem.
ping sent to the destination address, because it reports the overall packet loss to the endpoint.
Why it is wrong: ping measures loss only to the final endpoint and cannot attribute that loss to any particular intermediate hop, so it will not isolate which device is at fault.
The destination server received the echo requests but its host firewall was configured to silently discard the echo replies.
Why it is wrong: A silently dropped reply produces "Request timed out", not an unreachable message; the wording here shows the gateway itself answered, so the requests never reached the destination.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.