Free CompTIA Network+ Practice Test 2026 (N10-009)

Question 1Network Operations

Brightline Logistics uses a colocation provider whose remote-hands staff must reseat a failed power supply in a specific firewall. The technician needs to know exactly which cabinet and rack unit the device occupies. Which document should the network team send?

Correct answer: C. A rack diagram showing device positions
A rack diagram shows each device's physical location by cabinet and rack unit, which is what remote hands need to find the right box. A cable map shows where cables terminate, but it does not reliably show where a device is mounted in the rack.

Question 2Networking Concepts

A technician at Harbor Logistics captures traffic on a WAN link. She notices the edge router lowers the TTL value of each packet by one and picks a next hop based on the destination IP address. At which OSI layer is the router making this decision?

Correct answer: B. Layer 3, Network
Routers forward packets using logical IP addresses and decrement TTL, which are Layer 3 functions. Layer 2 devices such as switches forward frames by MAC address and never touch the IP TTL field.

Question 3Network Operations

A hospital is adding Wi-Fi to a new wing and wants to place access points so that every patient room gets strong signal before any hardware is purchased. What should the network team do FIRST?

Correct answer: D. Perform a predictive wireless site survey and review the heat map
A site survey produces a heat map that shows expected signal strength and coverage gaps before money is spent. Installing first and tuning later wastes hardware and labor and may leave dead zones in rooms.

Question 4Networking Concepts

Brightline Credit Union already has a sensor that alerts on suspicious traffic, but analysts often see the alerts hours later. Management now wants malicious sessions stopped automatically as they pass through the network. Which device BEST meets this requirement?

Correct answer: A. An inline intrusion prevention system
An IPS sits inline and can drop or reset malicious traffic in real time. An IDS connected to a SPAN port only sees a copy of the traffic, so it can alert but cannot block the session itself.

Question 5Network Operations

A managed service contract for Corvan Retail guarantees 99.9% availability measured over a 30-day month. What is the maximum downtime allowed in that month without breaching the SLA?

Correct answer: B. 43.2 minutes
A 30-day month has 30 x 24 x 60 = 43,200 minutes, and 0.1% of that is 43,200 x 0.001 = 43.2 minutes. The value 8.76 hours is the yearly allowance at 99.9%, not the monthly one.

Question 6Networking Concepts

Meadow Health runs a patient portal on three identical web servers. The team wants incoming requests spread across the servers and wants a failed server removed from rotation automatically. Which solution should the network engineer deploy?

Correct answer: A. A load balancer using health checks
A load balancer distributes client sessions across a server pool and uses health checks to stop sending traffic to a server that fails. A CDN caches content at edge locations but does not manage a local pool of application servers.

Question 7Network Operations

A vendor announces that a router model used at 40 branch offices will stop receiving firmware and security patches next June. Which life-cycle milestone does this describe, and what should the team plan?

Correct answer: D. End of support, so the team should budget for replacement
When a vendor stops releasing patches, the product has reached end of support (EOS), and running it afterward leaves known flaws unfixed. End of sale only means new units can no longer be ordered, while patches may continue for years.

Question 8Network Operations

At Halvern Insurance, a change request to replace a core switch is rejected by the change advisory board. The reviewer notes that the request explains the steps and the maintenance window but not what happens if the new switch fails. What is missing?

Correct answer: A. A rollback plan
A change request must include a rollback (backout) plan that restores the previous state if the change fails. A risk statement is also useful, but it does not tell engineers how to recover service during the window.

Question 9Networking Concepts

An online retailer sees traffic triple for two weeks every November. Leadership wants cloud compute capacity to grow automatically during the spike and shrink afterward so the company stops paying for idle servers. Which cloud characteristic does this describe?

Correct answer: C. Elasticity
Elasticity is the ability to add and release resources automatically as demand rises and falls. Scalability describes the ability to grow capacity, but it does not by itself imply automatic shrinking when demand drops.

Question 10Network Operations

An auditor finds that several access switches at Pinecrest College have different SNMP, logging and banner settings even though they serve the same role. The team wants a reference to detect and correct this drift. What should it create?

Correct answer: A. A golden configuration for that switch role
A golden (baseline) configuration defines the approved settings for a device role, so each switch can be compared against it and corrected. Exporting each running config only captures the current, inconsistent state without defining what is correct.

Question 11Networking Concepts

A cloud architect at Tallis Media places web servers in a public subnet of a virtual private cloud. The servers must accept inbound HTTPS from the internet and nothing else. Which cloud control should the architect configure FIRST?

Correct answer: D. A network security group allowing TCP 443
A network security group acts as a virtual firewall that filters traffic to cloud instances, so allowing only TCP 443 meets the requirement. An internet gateway route provides reachability but does not restrict which ports are allowed.

Question 12Network Operations

Ridgeway Bank's security policy requires that network monitoring traffic be both authenticated and encrypted. The monitoring server currently polls switches using community strings. What should the team change?

Correct answer: B. Move to SNMPv3 with the authPriv security level
SNMPv3 with authPriv provides both user authentication and encryption of SNMP messages. SNMPv2c still sends community strings in clear text, so a longer string does not meet an encryption requirement.

Question 13Networking Concepts

A help desk application at Corbin Insurance queries Active Directory for user details. The security team requires all directory lookups to be encrypted with TLS using the dedicated secure port. Which port must be allowed on the firewall?

Correct answer: C. TCP 636
LDAPS uses TCP 636 to carry LDAP inside TLS. TCP 389 is standard LDAP, which is unencrypted unless StartTLS is used, so it does not match the dedicated secure port requirement.

Question 14Network Operations

A NOC analyst wants the monitoring system to learn about a link failure the moment it happens, instead of waiting for the next five-minute polling cycle. What should be configured on the switches?

Correct answer: B. SNMP traps sent to the manager on UDP 162
Traps are unsolicited messages that an agent sends to the manager, normally on UDP 162, as soon as an event such as a link-down occurs. GET requests are polls started by the manager, so they only discover the failure at the next poll.

Question 15Networking Concepts

A network administrator points all switches and routers at a new central log server in a different subnet. The server receives no messages, and the firewall between them only permits management traffic on SSH. Which rule should be added to fix the problem?

Correct answer: D. Allow UDP 514 to the log server
Traditional syslog sends messages over UDP 514, so that port must be allowed toward the collector. UDP 161 is used for SNMP polling of agents, not for delivering log messages.

Question 16Network Operations

Users at Ostrander Media complain that the internet link is saturated every afternoon. The manager wants to see which hosts and applications use the most bandwidth over time without storing full packet contents. Which data source is BEST?

Correct answer: B. Flow data such as NetFlow or IPFIX
Flow records summarize conversations by source, destination, ports and byte counts, which identifies top talkers without keeping payloads. SNMP counters show how busy the interface is but cannot say which hosts or applications caused it.

Question 17Network Operations

A security team installs a passive intrusion detection sensor and needs it to receive a copy of all traffic entering and leaving a server VLAN. The sensor must not sit inline. What should the network engineer configure on the switch?

Correct answer: C. Port mirroring with the sensor as the destination
Port mirroring (SPAN) copies traffic from source ports or VLANs to a destination port where a passive sensor can analyze it. A trunk port only carries frames addressed to devices on that link, so the sensor would not see other hosts' traffic.

Question 18Networking Concepts

A financial trading firm needs its servers' clocks synchronized to within a microsecond for regulatory timestamping of trades. Standard NTP is accurate only to milliseconds on its network. Which protocol should the firm deploy?

Correct answer: A. Precision Time Protocol (PTP)
PTP uses hardware timestamping and can reach sub-microsecond accuracy, which suits trading and industrial timing needs. Network Time Security protects NTP from tampering but does not improve NTP's accuracy to the microsecond level.

Question 19Network Operations

The finance director at Tolland Freight says the business can lose no more than 15 minutes of order data after a disaster. Which metric does this statement define?

Correct answer: D. Recovery point objective
The recovery point objective (RPO) is the maximum acceptable data loss measured in time, which drives backup or replication frequency. The recovery time objective (RTO) is how quickly service must be restored, which is a different requirement.

Question 20Networking Concepts

Two branch offices are being joined with an IPsec site-to-site tunnel. Auditors require that the contents of every packet be encrypted, not just authenticated. Which IPsec protocol must be used?

Correct answer: A. Encapsulating Security Payload (ESP)
ESP, IP protocol 50, provides confidentiality through encryption as well as integrity. AH, IP protocol 51, authenticates packets but does not encrypt the payload, so it fails the audit requirement.

Question 21Network Operations

An online payment processor must be able to continue operations at a secondary location within minutes of losing its primary data center. Data is replicated continuously. Which recovery site type fits this requirement?

Correct answer: C. A hot site with live systems and current data
A hot site has running systems and current data, so it can take over within minutes. A warm site has equipment in place but needs data restores and configuration, which usually takes hours or days.

Question 22Networking Concepts

A DNS hosting company announces the same IP address from data centers in Dallas, Frankfurt and Singapore. Each client query is routed to whichever site is closest in routing terms. Which traffic type is being used?

Correct answer: D. Anycast
Anycast assigns one address to multiple locations, and routing delivers each packet to the nearest one. Multicast delivers a single stream to every member of a group rather than to one nearest node.

Question 23Network Operations

A network printer at Fairmont Dental keeps changing addresses, which breaks staff print queues. The administrator wants the printer to always get the same IP but still be managed from the DHCP server. What should be configured?

Correct answer: D. A DHCP reservation tied to the printer's MAC address
A reservation maps the printer's MAC address to a fixed IP, so it always receives the same address while staying under central DHCP management. A static IP on the device works but is no longer managed by the DHCP server, which the requirement rules out.

Question 24Network Operations

Clients on a newly created VLAN at Sutter Labs never receive addresses. The DHCP server is in the data center on a different subnet, and the scope for the new VLAN is configured and active. What is the MOST likely fix?

Correct answer: B. Configure a DHCP relay on the VLAN's router interface
DHCP discovers are broadcasts that routers do not forward, so the VLAN gateway needs a relay (IP helper) that forwards requests to the server. Adding scope options does not help because the requests never reach the server in the first place.

Question 25Networking Concepts

A coworking space wants its new access points to use the 6 GHz band to avoid congestion on 2.4 GHz and 5 GHz. Which wireless standard must the access points support?

Correct answer: C. 802.11ax
802.11ax devices certified as Wi-Fi 6E can operate in the 6 GHz band. 802.11ac (Wi-Fi 5) works only in 5 GHz, so it cannot use the 6 GHz spectrum.

Question 26Network Operations

Kestrel Outdoors moved its email to a cloud provider. Web browsing to the company domain works, but external senders' messages still go to the old on-premises server. Which DNS record must be updated?

Correct answer: D. The MX record for the domain
Sending mail servers look up the MX record to find where to deliver mail for a domain, so it must point to the cloud provider. The A record controls the web address mapping, which is already working correctly.

Question 27Networking Concepts

Ridgeway University must connect two campus buildings that are 10 km apart with a 10 Gbps link. The cable plant must support this distance without repeaters. Which medium is MOST appropriate?

Correct answer: C. Single-mode fiber
Single-mode fiber uses a narrow core and laser light, so it supports 10 Gbps over 10 km and beyond. OM4 multimode reaches only a few hundred meters at 10 Gbps, and copper options are limited to 100 m or less.

Question 28Network Operations

During an incident review, analysts cannot line up events from the firewall, switches and servers because each log shows a slightly different time. What should be implemented to fix this?

Correct answer: B. NTP with all devices using the same time source
Pointing all devices to a common NTP source keeps their clocks synchronized, so log timestamps can be correlated. A syslog collector centralizes logs but does not correct the clock drift on each device.

Question 29Networking Concepts

A data center engineer is cabling a new switch uplink that must run at 40 Gbps over a single transceiver slot. Which transceiver form factor should the engineer order?

Correct answer: C. QSFP+
QSFP+ bundles four 10 Gbps lanes to deliver 40 Gbps in one module. SFP+ is a single-lane 10 Gbps module, so it cannot provide a 40 Gbps uplink by itself.

Question 30Network Operations

Engineers at Marlow Energy need to reach the console of core routers at remote substations even when the production WAN is down. Which solution meets this requirement?

Correct answer: A. An out-of-band console server with a cellular link
Out-of-band management uses a separate path, such as a console server with cellular access, that does not depend on the production network. SSH and VPN access are in-band, so they fail when the WAN they ride on is down.

Question 31Network Security

A software company publishes firmware files with a SHA-256 value next to each download link. Customers compare the value after downloading. Which part of the CIA triad does this practice support?

Correct answer: B. Integrity
Comparing a hash confirms the file was not altered, which is integrity. Confidentiality would require encryption to keep the file secret, and a hash does not hide the content.

Question 32Networking Concepts

Most traffic in Novak Analytics' data center flows between virtual servers rather than out to the internet. The team wants every server to be the same number of hops from any other server with consistent latency. Which architecture BEST fits?

Correct answer: A. Spine and leaf
In a spine and leaf design every leaf connects to every spine, so any two servers are two hops apart with predictable latency for east-west traffic. A three-tier design is optimized for north-south flows and can add uneven hop counts between servers.

Question 33Network Security

A field engineer at Quarry Point Mining lost a laptop that stored saved switch configurations and VPN profiles. Management wants to make sure data on future lost devices cannot be read. Which control BEST addresses this?

Correct answer: C. Full-disk encryption of laptop storage
Full-disk encryption protects data at rest, so a thief cannot read the drive without the key. TLS protects data in transit and does nothing for files already stored on a stolen laptop.

Question 34Networking Concepts

A small private school has one building and a modest budget. The network designer wants fewer devices to manage and plans to merge the core and distribution layers into one pair of switches. Which design is this?

Correct answer: D. Collapsed core
A collapsed core combines the core and distribution layers into a single layer, which suits smaller sites. A full three-tier hierarchy keeps those layers separate and adds cost and complexity the school wants to avoid.

Question 35Network Security

Users at Weller Clinic see a browser warning every time they open the internal network monitoring portal. The portal uses a certificate generated on the server itself. What is the BEST long-term fix?

Correct answer: D. Issue a certificate from the internal CA trusted by clients
Browsers warn because a self-signed certificate is not chained to a trusted authority, and a certificate from the company PKI that clients already trust removes the warning securely. Extending the expiration does not change the trust problem.

Question 36Networking Concepts

An administrator must divide 192.168.40.0/24 into subnets that each support 50 hosts while wasting as few addresses as possible. Which prefix length should be used?

Correct answer: A. /26
A /26 has 2^6 = 64 addresses, and 64 - 2 = 62 usable hosts, which covers 50 with the least waste. A /27 gives only 2^5 - 2 = 30 usable hosts, which is not enough.

Question 37Network Security

A network team wants every command that administrators enter on routers and switches to be authorized and logged individually by a central server. Which AAA protocol is BEST suited?

Correct answer: B. TACACS+
TACACS+ separates authentication, authorization and accounting and supports per-command authorization and logging for device administration. RADIUS combines authentication and authorization and is better suited to network access such as VPN and Wi-Fi.

Question 38Network Security

Darrow Credit Union wants VPN logins to require multifactor authentication. Which combination meets that requirement?

Correct answer: D. A password and a code from a hardware token
MFA needs factors from different categories, and a password (something you know) plus a token code (something you have) qualifies. Two biometrics or two knowledge items are still a single factor type, even when two steps are used.

Question 39Networking Concepts

After a switch closet was rewired, several laptops at Linden Dental show IP addresses beginning with 169.254. They can talk to each other but cannot reach any other subnet. What does this address range MOST likely indicate?

Correct answer: C. The clients could not obtain a DHCP lease
Clients assign themselves an APIPA address in 169.254.0.0/16 when no DHCP server answers. A bad gateway setting would still leave the client with its normal DHCP address, so the 169.254 range points to a DHCP failure.

Question 40Network Security

Help desk staff at Linwood Manufacturing currently use a domain administrator account to reset user passwords. What change BEST follows the principle of least privilege?

Correct answer: B. Grant a role that only allows password resets
Least privilege means giving only the rights a job requires, so a password-reset role is the correct fix. MFA and logging add useful controls but still leave help desk staff with far more access than they need.

Question 41Networking Concepts

A junior engineer is reviewing a list of addresses for an internal lab network. Which address falls within the RFC 1918 private ranges?

Correct answer: C. 172.20.8.10
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, and 172.16.0.0/12 covers 172.16.0.0 through 172.31.255.255. Address 172.32.8.10 sits just outside that block, and 100.64.0.0/10 is shared carrier space, not RFC 1918.

Question 42Network Security

The security team at Cobalt Analytics wants early warning when an intruder starts probing internal systems. They deploy a server with fake file shares that no legitimate user should ever touch, and alert on any connection to it. What is this server?

Correct answer: A. A honeypot
A honeypot is a decoy system with no business purpose, so any access to it is suspicious and signals reconnaissance. A jump box is a hardened host that administrators use on purpose, so access to it is expected.

Question 43Networking Concepts

Vantage Retail wants to push policy changes to hundreds of switches from one central application. The devices would keep forwarding traffic locally while path decisions come from that central point. Which approach is described?

Correct answer: B. Software-defined networking
SDN separates the control plane into a central controller while the switches keep handling the data plane. NFV runs network functions such as firewalls as virtual machines, but it does not by itself centralize control of forwarding decisions.

Question 44Network Security

A scanner reports that a firewall runs firmware with a published flaw that could allow remote code execution. No attack has been seen. In risk terms, what is the unpatched flaw?

Correct answer: A. A vulnerability
A vulnerability is a weakness, such as an unpatched flaw, that could be used against a system. An exploit is the actual code or technique that takes advantage of the flaw, and a threat is the actor or event that might do so.

Question 45Networking Concepts

Ashford Consulting has staff working from homes and hotels worldwide. The company wants WAN optimization and cloud-delivered security services such as secure web gateway and zero trust access combined into one service. Which framework BEST fits this need?

Correct answer: C. Secure access service edge
SASE combines SD-WAN networking with cloud-delivered security functions so remote users get consistent protection anywhere. NAC controls which devices may join a local network but does not provide cloud-delivered security for remote staff.

Question 46Network Security

An e-commerce startup will begin storing and processing customer credit card numbers on its own servers. Which compliance standard must its network design satisfy?

Correct answer: B. PCI DSS
PCI DSS applies to any organization that stores, processes or transmits payment card data and includes network segmentation and encryption requirements. GDPR covers personal data of people in the EU, not card data handling specifically.

Question 47Network Security

A switch at Barrow Library suddenly starts flooding all traffic out every port, and its MAC address table is full of thousands of random entries learned on a single access port. Which control would BEST prevent this?

Correct answer: D. Port security limiting MAC addresses per port
This is MAC flooding, which fills the table so the switch floods frames like a hub, and port security limits how many MACs a port can learn. An ACL works on IP traffic and does not stop a switch from learning fake source MAC addresses.

Question 48Networking Concepts

A mobile carrier runs an IPv6-only core for its subscribers. Customers still need to reach many websites that only have IPv4 addresses. Which transition method allows this?

Correct answer: A. NAT64 working with DNS64
NAT64 translates IPv6 packets into IPv4, and DNS64 creates synthetic IPv6 addresses for IPv4-only names, so IPv6-only clients can reach IPv4 servers. Dual stack would require IPv4 addressing on the client, which the IPv6-only design avoids.

Question 49Network Security

Several users on the second floor at Granger Legal received addresses in 192.168.0.0/24 with a gateway of 192.168.0.1, while the company uses 10.20.0.0/16. Users on other floors are fine. What is the MOST likely cause?

Correct answer: B. A rogue DHCP server connected on that floor
Receiving a valid but foreign address and gateway points to an unauthorized DHCP server, often a consumer router plugged into a wall jack. Scope exhaustion or a missing relay would cause hosts to get APIPA addresses, not a working address from a different network.

Question 50Network Implementation

A router at Pinecrest Manufacturing learns the route 10.50.0.0/16 from both OSPF and internal EIGRP. Both routes have the same prefix length. Which route will be installed in the routing table by default?

Correct answer: D. The EIGRP route, because its administrative distance is lower
When prefix lengths match, the router prefers the source with the lowest administrative distance. Internal EIGRP has an AD of 90 and OSPF has 110, so the EIGRP route wins, and metrics from different protocols are never compared directly.

Question 51Network Security

Staff at a coffee shop chain's head office report that the corporate SSID sometimes shows twice, and after connecting to one of them a fake login page asks for their domain password. What is the MOST likely issue?

Correct answer: D. An evil twin access point
An evil twin broadcasts the same SSID as the real network to lure users and collect credentials. Channel overlap causes poor performance but does not create a second network with a fake login page.

Question 52Network Implementation

A router has these routes: 10.1.0.0/16 via Router A, 10.1.4.0/22 via Router B, and 0.0.0.0/0 via Router C. A packet arrives for 10.1.5.20. Where will the router send it?

Correct answer: A. Router B
Routers choose the longest matching prefix. A /22 covers blocks of 4 in the third octet, so 10.1.4.0/22 spans 10.1.4.0 to 10.1.7.255 and includes 10.1.5.20, which beats the shorter /16 match.

Question 53Network Security

Harlan Outfitters will host a public web server and wants to make sure that if the server is compromised, attackers cannot directly reach the internal network. Where should the server be placed?

Correct answer: C. In a screened subnet between two firewall zones
A screened subnet (DMZ) isolates public-facing servers, and firewall rules limit what they can reach in the trusted zone. Placing the server on the internal VLAN would give an attacker a direct path to internal hosts.

Question 54Network Troubleshooting

A user at Elmwood Insurance reports that a shared drive is slow. Following the CompTIA troubleshooting methodology, what should the technician do FIRST?

Correct answer: A. Identify the problem by gathering information
The first step is to identify the problem by gathering information, questioning users and checking for recent changes. Building a theory before understanding the symptoms leads to guesses and wasted time.

Question 55Network Implementation

Ostrander Bank is connecting to two different internet providers and wants to advertise its own public prefix to both while choosing paths between autonomous systems. Which routing protocol is required?

Correct answer: B. BGP
BGP is the path-vector protocol used to exchange routes between autonomous systems, such as an enterprise and its ISPs. OSPF is an interior gateway protocol designed for routing inside a single organization.

Question 56Network Troubleshooting

A technician replaced a faulty uplink module and the affected department can now reach the internet. According to the troubleshooting methodology, what is the NEXT step?

Correct answer: B. Verify full system functionality and apply preventive measures
After implementing the solution, the technician verifies full system functionality and, if needed, puts preventive measures in place. Documentation comes last, after it is confirmed that everything works.

Question 57Network Implementation

A small clinic has 200 workstations with private addresses and only one public IPv4 address from its ISP. All workstations must be able to browse the internet at the same time. Which technology should be configured on the edge router?

Correct answer: C. Port address translation
PAT maps many private addresses to one public address by tracking unique source port numbers for each session. Static NAT creates a one-to-one mapping, so a single public address could serve only one internal host.

Question 58Network Troubleshooting

A new security camera at the far end of a warehouse loses connection several times a day. The Cat 6 run from the switch to the camera measures 135 meters. What is the MOST likely cause?

Correct answer: B. Attenuation from exceeding the copper distance limit
Twisted-pair Ethernet is limited to 100 meters per segment, and longer runs suffer attenuation that causes errors and drops. A wrong VLAN would stop the camera from working at all, not cause intermittent drops.

Question 59Network Implementation

Users at Fairview Logistics lose all off-subnet access whenever their single default gateway router reboots. The network team adds a second router and wants hosts to keep the same gateway address during a failure. What should the team configure?

Correct answer: D. A first hop redundancy protocol with a virtual IP
An FHRP such as VRRP or HSRP lets two routers share a virtual IP that hosts use as their gateway, so a standby router takes over without client changes. A second DHCP scope would not help clients that already hold a lease pointing to the failed router.

Question 60Network Troubleshooting

A cable certifier fails a newly installed Cat 6 drop for near-end crosstalk. The installer notices that about 5 cm of the pairs were untwisted at the keystone jack. What should be done?

Correct answer: A. Re-terminate the jack keeping the twists to the contacts
Untwisting too much at the termination point reduces the pairs' ability to cancel noise, which causes crosstalk. Changing to T568A only swaps pair positions and does not fix the poor termination.

Question 61Network Troubleshooting

Two switches at Navarro Foods are linked by a new duplex fiber patch cable. Both SFPs are the same model and show light output, but the link stays down. Swapping the two connectors at one end brings the link up. What was the problem?

Correct answer: C. Transposed TX and RX strands
Fiber links need the transmit of one side connected to the receive of the other, and swapping the connectors at one end fixed that. A dirty connector or wrong fiber type would not be cured simply by swapping the two strands.

Question 62Network Implementation

A branch office has one router with a single LAN port and four VLANs on its access switch. The administrator must route between all four VLANs using that one port. Which configuration should be used?

Correct answer: A. One subinterface per VLAN on a trunked port
Router on a stick uses one physical port configured as an 802.1Q trunk, with a subinterface for each VLAN acting as that VLAN's gateway. Static routes alone cannot separate tagged VLAN traffic arriving on a single port.

Question 63Network Troubleshooting

A school adds eight new access points to a 48-port PoE switch that already powers phones and cameras. Five of the new APs power up, but three stay dark, and their ports show power denied. What is the MOST likely cause?

Correct answer: D. The switch has exceeded its PoE power budget
When total draw reaches the switch's PoE budget, it stops supplying power to more ports, and a power-denied status confirms this. A VLAN problem would let the APs power on but fail to join the controller.

Question 64Network Implementation

A student asks what an 802.1Q tag adds to an Ethernet frame on a trunk link. Which statement is accurate?

Correct answer: A. A 4-byte field that includes a 12-bit VLAN ID
802.1Q inserts a 4-byte tag after the source MAC address, and its 12-bit VLAN ID allows 4,094 usable VLANs. It does not add an IP header, because tagging happens at Layer 2.

Question 65Network Troubleshooting

An engineer connects a 10GBASE-SR module in one switch to a 10GBASE-LR module in another over a single-mode fiber run. The link will not come up. What is the issue?

Correct answer: C. The transceivers are mismatched for the link
SR modules use 850 nm multimode optics while LR modules use 1310 nm single-mode optics, so they cannot form a link together. Both ends must use matching transceiver types suited to the fiber installed.

Question 66Network Implementation

Two switches are connected by a trunk. Switch 1 uses VLAN 1 as its native VLAN, and Switch 2 uses VLAN 99. Users report that some untagged traffic appears in the wrong VLAN. What is the BEST fix?

Correct answer: D. Configure the same native VLAN on both trunk ends
Native VLAN traffic crosses a trunk untagged, so a mismatch makes one switch place it in a different VLAN than the other. Changing both ports to access mode would stop the link from carrying multiple VLANs at all.

Question 67Network Troubleshooting

The interface counters on a switch port connected to a CNC machine show CRC errors climbing steadily. The cable runs alongside large motors on the shop floor. What is the MOST likely cause?

Correct answer: D. Electromagnetic interference corrupting frames
CRC errors mean frames arrive corrupted, and running unshielded cable next to motors is a classic source of EMI. An MTU mismatch shows up as giants or drops, not as a steady rise in CRC errors.

Question 68Network Troubleshooting

After enabling jumbo frames on a storage server, the switch port facing that server begins reporting a large number of giants. Other ports are clean. What is the MOST likely cause?

Correct answer: B. The switch port MTU was not raised to match
Giants are frames larger than the port's maximum size, so they appear when the server sends jumbo frames and the switch port still uses a 1500-byte MTU. Auto-negotiation affects speed and duplex, not maximum frame size.

Question 69Network Implementation

Elmwood Realty is deploying IP phones. Each desk has one cable, and the PC plugs into the phone's built-in switch port. Voice must be kept separate from data so QoS can be applied. What should be configured on the switch port?

Correct answer: C. An access VLAN for data and a voice VLAN
A voice VLAN lets the phone tag its traffic into a separate VLAN while the PC uses the untagged access VLAN on the same port. Allowing every VLAN on a full trunk to a desk is unnecessary and exposes the port to more traffic than needed.

Question 70Network Troubleshooting

Minutes after a user connects an unmanaged switch to two wall jacks, the whole floor at Ashby Consulting slows to a crawl. Switch logs show MAC addresses flapping between ports and broadcast traffic near 100%. What is the MOST likely cause?

Correct answer: B. A switching loop
Connecting one switch to two jacks creates a loop, and without spanning tree protection broadcasts circulate endlessly and MACs flap between ports. A rogue DHCP server hands out wrong addresses but does not create a broadcast storm.

Question 71Network Implementation

A technician adds a second cable between two access switches for redundancy. Within seconds, the network slows to a crawl and switch CPU usage spikes from repeated broadcasts. Which protocol should have prevented this?

Correct answer: C. Spanning Tree Protocol
Spanning Tree Protocol detects redundant Layer 2 paths and blocks one so a broadcast storm cannot loop endlessly. LACP bundles links into one logical channel, but only when both ends are configured for it, so it does not stop loops on unconfigured links.

Question 72Network Troubleshooting

An accountant moved to a new desk and can now reach the internet but not the finance file server. Her PC receives an address in the guest subnet. Other finance users are fine. What is the MOST likely cause?

Correct answer: B. The new switch port is assigned to the wrong VLAN
Getting a guest subnet address after a desk move means the new port is in the guest VLAN, which is usually blocked from internal servers. Scope exhaustion would give an APIPA address, not a working guest address.

Question 73Network Implementation

A file server needs more bandwidth to its switch and must stay online if one cable fails. The server and switch each have four free 1 Gbps ports. Which solution BEST meets both needs?

Correct answer: C. Configure LACP to bundle the four ports
LACP (IEEE 802.3ad) combines several physical links into one logical link that adds bandwidth and survives a member failure. Raising the MTU reduces header overhead but does not add redundancy or extra links.

Question 74Network Troubleshooting

During a large training event, new laptops in a conference room show 169.254.x.x addresses, while laptops that connected earlier work normally. What is the MOST likely cause?

Correct answer: A. The DHCP address pool has been exhausted
A 169.254.x.x address is APIPA, which a client assigns itself when no DHCP lease is available, and early arrivals working points to a full pool. A DNS failure would leave clients with valid addresses but broken name resolution.

Question 75Network Implementation

A contractor at Ridgefield Library plans to run new Ethernet cable through the space above a drop ceiling that is also used for building air return. Local fire code applies. Which cable type must be used?

Correct answer: D. Plenum-rated (CMP) cable
Spaces used for air circulation require plenum-rated cable, whose jacket resists flame spread and gives off less toxic smoke. Riser-rated cable is meant for vertical runs between floors and is not rated for air-handling spaces.

Question 76Network Troubleshooting

A workstation can ping other hosts on its own subnet but cannot reach anything on other subnets or the internet. Its IP and mask are correct, and other hosts on the subnet work. What should the technician check NEXT?

Correct answer: A. The default gateway configured on the workstation
Local reachability with no remote reachability points to a missing or incorrect default gateway, which the host needs for off-subnet traffic. DNS problems affect name resolution, but pinging remote IPs would still work.

Question 77Network Troubleshooting

Two users report that their network connection drops every few minutes. The technician sees the switch learning the same IP address from two different MAC addresses, alternating back and forth. What is the MOST likely cause?

Correct answer: C. A duplicate IP address on the network
Two MAC addresses claiming the same IP is the signature of a duplicate IP, which makes both hosts lose connectivity intermittently. A switching loop shows the same MAC on different ports, not different MACs for one IP.

Question 78Network Implementation

A wireless engineer is planning 2.4 GHz channels for a warehouse in the United States. To minimize co-channel and adjacent-channel interference, which set of channels should neighboring access points use?

Correct answer: D. 1, 6 and 11
In the US 2.4 GHz band, channels 1, 6 and 11 are the only three 20 MHz channels that do not overlap. Channels such as 1, 4 and 8 sit close enough together to overlap and interfere.

Question 79Network Troubleshooting

VoIP users at Stratford Realty report choppy, robotic audio. Monitoring shows average latency of 40 ms and no packet loss, but delay between packets varies from 5 ms to 90 ms. Which issue is causing the problem?

Correct answer: D. Jitter
Jitter is variation in packet delay, and real-time voice is very sensitive to it even when average latency is acceptable. Packet loss is ruled out because monitoring reports none.

Question 80Network Implementation

Laptops at Wexford Hotel all support both 2.4 GHz and 5 GHz, yet most of them stay on the crowded 2.4 GHz band. The engineer wants capable clients steered to 5 GHz automatically. Which feature should be enabled?

Correct answer: B. Band steering
Band steering encourages dual-band clients to join the less crowded 5 GHz band. Hiding the SSID does not change which band a client prefers and only makes the network harder for legitimate users to find.

Question 81Network Troubleshooting

Users at a law office complain that pages stall for several seconds, then load normally. A packet capture on the user VLAN shows the same frames circulating repeatedly and broadcast traffic climbing until the switches' CPUs spike. Two closets were recently cross-connected for redundancy. What is the MOST likely cause?

Correct answer: B. A switching loop with spanning tree disabled or blocked
Frames circulating endlessly and a broadcast storm after adding a redundant link point to a Layer 2 loop that spanning tree is not blocking. A duplex mismatch causes late collisions and slow throughput on one link, not a growing broadcast storm across the VLAN.

Question 82Network Implementation

Granite Engineering wants each employee to sign in to Wi-Fi with their own directory credentials. Access must be revoked for one person without changing a shared password for everyone else. Which configuration meets this requirement?

Correct answer: D. WPA3-Enterprise using 802.1X and RADIUS
Enterprise mode authenticates each user through 802.1X to a RADIUS server, so one account can be disabled without affecting others. Personal mode, even with SAE, uses one shared passphrase that would need to change for everyone.

Question 83Network Troubleshooting

A branch office has a 1 Gbps internet circuit, but a file transfer test from the branch to headquarters averages about 380 Mbps. Which term describes the 380 Mbps figure?

Correct answer: C. Throughput
Throughput is the actual amount of data successfully delivered over time, while bandwidth is the link's theoretical capacity of 1 Gbps. Latency and jitter measure delay, not data rate.

Question 84Network Troubleshooting

A technician must find which patch panel port connects to an unlabeled wall jack in a conference room. No devices are plugged into the jack. Which tool is BEST?

Correct answer: B. Toner and probe
A toner injects a signal on the cable at the jack, and the probe detects it at the patch panel to identify the matching port. An OTDR tests fiber, and a protocol analyzer needs live traffic, which an empty jack does not provide.

Question 85Network Implementation

A farm owner wants to link a barn office to the main house 400 meters away with a dedicated wireless bridge. The link must focus signal strength in one direction. Which antenna type is MOST appropriate?

Correct answer: C. Directional Yagi
A directional antenna such as a Yagi concentrates energy in one direction, giving the range a point-to-point bridge needs. An omnidirectional dipole spreads signal in all directions, which wastes power and shortens the useful distance.

Question 86Network Troubleshooting

A 12 km fiber link between two campus buildings fails after nearby construction. The team needs to know approximately how far from the main building the break is. Which tool should it use?

Correct answer: A. An OTDR
An OTDR sends light pulses and measures reflections to show the distance to a break or fault on long fiber runs. A visual fault locator uses visible red light and is only practical for short distances, not a 12 km run.

Question 87Network Implementation

A server room at Clearwater Legal has frequent power flickers that last a few seconds. The company also wants servers to shut down gracefully during a longer outage. Which device BEST meets both needs?

Correct answer: B. An uninterruptible power supply
A UPS supplies battery power instantly during brief flickers and can signal servers to shut down cleanly in a longer outage. A generator takes time to start, so it cannot carry equipment through a sudden drop on its own.

Question 88Network Troubleshooting

Users can reach an internal application by typing its IP address, but typing its hostname fails. Which command will BEST help confirm the cause from a Windows workstation?

Correct answer: A. nslookup
Success by IP and failure by name points to name resolution, and nslookup queries DNS directly to show what the server returns. tracert tests the path, which is already working since the IP is reachable.

Question 89Network Implementation

A new data center row at Bayside Cloud is overheating. The racks are installed so the exhaust of one row blows directly into the intake of the next row. What is the BEST corrective action?

Correct answer: C. Arrange rows into alternating hot and cold aisles
Hot aisle and cold aisle layouts face rack intakes toward a shared cool aisle and exhausts toward a shared hot aisle, so hot air is not recycled. Very low humidity raises the risk of electrostatic discharge and does nothing to fix the airflow problem.

Question 90Network Troubleshooting

A technician knows the MAC address of a misbehaving device and needs to find which switch port it is connected to. Which command should be run on the access switch?

Correct answer: D. show mac address-table
The MAC address table maps learned MAC addresses to switch ports, so it shows exactly where the device connects. The routing table lists IP networks and next hops and contains no port mapping for end devices.