Question bank
CompTIA Network+
41 CompTIA Network+ questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Network Implementation
8 questions in this domain
- Question 1Single Choice
What is the primary characteristic of static routing compared to dynamic routing protocols?
- AAutomatic adaptation to network topology changes
- BManual configuration by the network administratorCorrect answer
- CContinuous updates using routing protocols
- DHigh scalability in large networks
Why this is the answer
Static routing requires manual entry of routes by the network administrator, offering high predictability and security but lacks scalability and automatic adaptation.
- Question 2Multiple Select
Which of the following are benefits of implementing Virtual Local Area Networks (VLANs) on a network switch? (Select TWO)
- ASegmentation of broadcast domainsCorrect answer
- BEnhanced security through traffic isolationCorrect answer
- CAutomatic loop prevention without STP
- DIncreased physical cabling requirements
Why this is the answer
VLANs allow logical segmentation of broadcast domains and isolate traffic, improving security and reducing unnecessary broadcast traffic.
- Question 3Interactive
Based on the provided IP configuration snippet, what is the network address for the host PC-A?
- A192.168.1.0/24Correct answer
- B192.168.0.0/16
- C192.0.0.0/8
- D192.168.1.10/32
Why this is the answer
The IP address is 192.168.1.10 with a subnet mask of 255.255.255.0 (which is /24). The network address is therefore 192.168.1.0.
- Question 4Single Choice
What is the primary function of Software-Defined Wide Area Network (SD-WAN) technology?
- AReplacing physical transport lines entirely with virtual links
- BCentralized orchestration and dynamic path selection across multiple linksCorrect answer
- CRestricting traffic to a single dedicated MPLS circuit
- DOperating strictly at the physical layer of the OSI model
Why this is the answer
SD-WAN abstracts and orchestrates underlying physical transports (like MPLS, broadband, 5G), allowing dynamic, policy-based routing and application-aware traffic steering.
- Question 5Multiple Select
Which of the following are characteristic applications or properties of single-mode fiber (SMF) optic cabling? (Select TWO)
- AUsed for long-haul and metropolitan area network (MAN) deploymentsCorrect answer
- BTypically utilizes LEDs as the light source
- CSupports higher bandwidth over longer distances using lasersCorrect answer
- DCore size of 50 or 62 micrometers
Why this is the answer
Single-mode fiber has a small core (typically 9 microns), uses lasers for light transmission, and is designed for high-bandwidth, long-distance applications.
- Question 6Interactive
According to the provided STP port state descriptions, which state allows the port to populate the MAC address table but not yet forward user data?
- ABlocking
- BListening
- CLearningCorrect answer
- DForwarding
Why this is the answer
In the Learning state, the switch populates its MAC address table with the source addresses of received frames, but it does not yet forward traffic to avoid loops.
- Question 7Single Choice
Which port number is standard for Secure Shell (SSH) traffic used for secure remote command-line management?
- A23
- B22Correct answer
- C80
- D443
Why this is the answer
SSH (Secure Shell) operates on TCP port 22, providing encrypted command-line access, unlike Telnet which uses port 23 in plaintext.
- Question 8Multiple Select
Which of the following are characteristics of OSPF (Open Shortest Path First) routing? (Select TWO)
- AUses Dijkstra's algorithm to calculate the shortest pathCorrect answer
- BUses hop count as its only metric
- CBuilds a complete topology map of the networkCorrect answer
- DSends entire routing tables to neighbors periodically
Why this is the answer
OSPF is a link-state protocol that builds a complete topology map of the network and uses Dijkstra's algorithm to calculate the shortest path to each destination.
Network Operations
8 questions in this domain
- Question 9Single Choice
A junior network technician notices a critical security vulnerability on a core distribution switch and wants to apply the vendor firmware patch immediately during peak business hours to prevent potential exploitation. What is the correct professional action according to standard organizational procedures?
- ASubmit a formal change request, assess the risks, and schedule the patch deployment during the next approved maintenance window or seek emergency CAB approval.Correct answer
- BApply the patch immediately to the production switch to prevent exploitation, documenting the change only after service is restored.
- CBypass the standard change management process because security vulnerabilities require immediate remediation regardless of operational impact.
- DDefer the patch deployment indefinitely until the vendor releases a less disruptive update that does not require a reboot.
Why this is the answer
The correct professional action is to submit a formal change request to assess risks and schedule the patch during an approved maintenance window, or seek emergency Change Advisory Board (CAB) approval. Bypassing change management protocols, even for urgent security patches, violates standard governance and can cause severe operational disruptions.
- Question 10Multiple Select
Which of the following documents are considered essential components of comprehensive network documentation according to CompTIA best practices? (Select 3)
- APhysical network diagrams detailing cabling, rack layouts, and hardware ports.Correct answer
- BLogical network diagrams illustrating VLANs, subnets, and routing protocols.Correct answer
- CStandard Operating Procedures (SOPs) defining routine maintenance and change workflows.Correct answer
- DThe company's quarterly financial auditing reports and balance sheets.
Why this is the answer
Comprehensive network documentation must include physical layouts (such as rack elevations and cabling paths), logical structures (including VLANs and IP subnet allocations), and operational workflows like Standard Operating Procedures (SOPs) to ensure consistency and quick recovery. Financial auditing reports and corporate marketing materials do not assist network technicians in troubleshooting, capacity planning, or maintaining infrastructure baselines.
- Question 11Interactive
Based on the provided CLI output for interface FastEthernet0/1, which metric indicates a physical layer issue, such as cabling interference or a faulty transceiver?
- AThe high count of CRC errors and FCS failures.Correct answer
- BThe total count of input and output packets.
- CThe description field linking to the core switch.
- DThe low number of output discards.
Why this is the answer
A high count of CRC (Cyclic Redundancy Check) errors and Frame Check Sequence (FCS) failures on a network interface typically points directly to physical layer issues. Common causes include cabling interference, faulty transceivers, dirty fiber optics, or electrical noise on the copper line. Standard input/output packet counts and low discard values do not indicate physical corruption.
- Question 12Single Choice
In disaster recovery planning, which metric determines the maximum acceptable amount of data loss, measured in time units since the outage began?
- ARecovery Point Objective (RPO)Correct answer
- BRecovery Time Objective (RTO)
- CBusiness Impact Analysis (BIA) threshold
- DService Level Agreement (SLA) compliance target
Why this is the answer
The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss after a disruptive event, measured as the age of the data that must be restored. In contrast, the Recovery Time Objective (RTO) specifies the target duration for restoring services. Understanding RPO is critical for scheduling backup frequencies to ensure data loss is kept within business-tolerable limits.
- Question 13Multiple Select
Which of the following statements regarding disaster recovery site types are correct? (Select 3)
- ACold sites provide basic physical facilities and utilities but require the organization to install and configure all network hardware and software on-site.Correct answer
- BWarm sites contain pre-configured hardware and network connections but rely on periodic manual data backups, resulting in potential data loss.Correct answer
- CHot sites offer fully operational infrastructure with real-time data replication, allowing near-instantaneous failover with minimal data loss.Correct answer
- DWarm sites provide real-time data replication and active-active network configurations, making them functionally identical to hot sites.
Why this is the answer
Disaster recovery sites are categorized by their readiness and data replication levels. Cold sites provide basic facilities but require hardware installation, warm sites have pre-configured hardware but rely on periodic backups, and hot sites offer real-time replication for instantaneous cutover. Warm sites do not provide real-time replication, distinguishing them from hot sites.
- Question 14Interactive
Based on the interactive syslog excerpt, what is the operational status of the GigabitEthernet0/0 interface's line protocol?
- AThe line protocol changed state to down.Correct answer
- BThe interface changed state to administratively down.
- CThe system configuration was saved by the console user.
- DThe interface link went up and protocol stayed up permanently.
Why this is the answer
The syslog message `%LINEPROTO-5-UPDOWN` indicates that the line protocol (Layer 3 logical connection) on interface GigabitEthernet0/0 changed state to 'down'. This is distinct from the physical interface state (`%LINK-3-UPDOWN`), which went 'up', meaning the physical cable is connected but the logical routing or keepalives failed.
- Question 15Single Choice
An enterprise network engineer needs to identify the top bandwidth consumers ('top talkers') over a WAN link for capacity planning over a 30-day period. Which tool is best suited for this task?
- ANetFlowCorrect answer
- BPacket analyzer (e.g., Wireshark)
- CActive port scanner (e.g., Nmap)
- DSNMPv1 community string polling
Why this is the answer
NetFlow is a telemetry protocol designed for long-term traffic analysis, capacity planning, and identifying top talkers by collecting flow metadata without inspecting individual packet payloads. Packet analyzers like Wireshark perform deep packet inspection, which is resource-intensive and unsuitable for continuous 30-day historical bandwidth trending on high-speed links.
- Question 16Multiple Select
Which three of the following elements are typically included in effective Standard Operating Procedures (SOPs) for network operations? (Select 3)
- AStep-by-step instructions for routine configurations, such as VLAN creation and trunking setup.Correct answer
- BClear escalation paths and emergency contact numbers for incident response.Correct answer
- CDefined safety and change control guardrails, including approval thresholds and rollback procedures.Correct answer
- DA list of personal social media accounts of the network engineering staff.
Why this is the answer
Effective Standard Operating Procedures (SOPs) must provide clear, step-by-step technical instructions, define escalation paths for emergencies, and outline strict change control guardrails to ensure safety and compliance. Personal social media lists are completely unrelated to operational network safety and consistency.
Network Security
6 questions in this domain
- Question 17Single Choice
What is the primary objective of the Principle of Least Privilege in network security management?
- AThe maximum access required for future expansion
- BThe absolute minimum access necessary to perform specific tasksCorrect answer
- CFull administrative access to all local subsystems
- DAccess levels that match the highest privilege group in the directory
Why this is the answer
The Principle of Least Privilege restricts access to the minimal permissions needed for job functions, reducing the attack surface and limiting damage from compromised credentials.
- Question 18Multiple Select
Which of the following components are part of the Authentication, Authorization, and Accounting (AAA) framework? (Select two)
- AVerifying the identity of a user or device (Authentication)Correct answer
- BEnforcing traffic shaping policies on the uplink port
- CDetermining what resources and actions an authenticated entity is permitted to access (Authorization)Correct answer
- DAutomatically assigning dynamic IP addresses via DHCP
Why this is the answer
The AAA framework consists of Authentication (verifying identity), Authorization (defining permitted actions/resources), and Accounting (tracking resource usage and logins).
- Question 19Interactive
Based on the provided access control list (ACL) configuration, which traffic is explicitly denied?
- AHTTP (Port 80)
- BHTTPS (Port 443)
- CTelnet (Port 23)Correct answer
- DDNS (Port 53)
Why this is the answer
The ACL contains a rule to deny TCP traffic on port 23, which corresponds to the Telnet service, while permitting ports 80 and 443.
- Question 20Single Choice
What is the primary purpose of an access control vestibule, commonly referred to as a mantrap, in physical security?
- ATo monitor environmental conditions like temperature and humidity
- BTo prevent unauthorized individuals from following authorized personnel into a secure areaCorrect answer
- CTo provide continuous video surveillance of server racks
- DTo automatically update operating system patch levels on access control terminals
Why this is the answer
A mantrap is a double-door entryway that isolates a user between two interlocking doors, preventing tailgating and ensuring identity verification before granting access to the secure area.
- Question 21Multiple Select
Which of the following are considered physical security controls designed to protect network equipment in a data center? (Select two)
- ALocking physical enclosures on equipment racks to prevent hardware theftCorrect answer
- BDeploying stateful firewalls to filter network traffic between VLANs
- CImplementing environmental monitoring sensors for temperature and humidityCorrect answer
- DConfiguring dynamic ARP inspection on access switches
Why this is the answer
Physical security involves securing equipment racks with locks to prevent theft and using environmental sensors to monitor temperature and humidity, preventing hardware damage or thermal throttling.
- Question 22Interactive
In the provided 802.1X architecture representation, which component acts as the network access port that forwards traffic only after authentication?
- AThe client laptop (Supplicant)
- BThe network switch port (Authenticator)Correct answer
- CThe central database server
- DThe DNS resolver
Why this is the answer
In 802.1X, the authenticator is typically the physical switch port or wireless access point that enforces network access control before allowing traffic to pass to the RADIUS server.
Network Troubleshooting
10 questions in this domain
- Question 23Single Choice
According to the CompTIA Network+ troubleshooting methodology, what is the very first step in the systematic process when a network outage is reported?
- AEstablish a theory of probable cause.
- BIdentify the problem.Correct answer
- CTest the theory to determine cause.
- DDocument findings, actions, and outcomes.
Why this is the answer
The first step in the CompTIA methodology is to identify the problem by gathering symptoms, questioning users, and isolating the scope of the failure before creating theories.
- Question 24Multiple Select
Which of the following activities are part of the 'Identify the problem' step in the CompTIA troubleshooting methodology? (Choose all that apply)
- AQuestioning users to gather symptom details.Correct answer
- BDetermining if recent changes were made to the network.Correct answer
- CReplacing suspected faulty network hardware immediately.
- DTesting the theory using a loopback plug.
Why this is the answer
Identifying the problem involves gathering information, questioning users, identifying symptoms, and determining if any recent changes were made to duplicate the issue and isolate its scope.
- Question 25Interactive
Based on the provided command-line output, what is the most likely reason the client device is experiencing a lack of network connectivity?
- AThe DNS server is misconfigured.
- BThe DHCP server is unreachable or down, causing APIPA assignment.Correct answer
- CThe default gateway is blocking traffic.
- DThe subnet mask is incorrect.
Why this is the answer
An IP address in the 169.254.0.0/16 range with no default gateway or DHCP server listed indicates Automatic Private IP Addressing (APIPA) was used because the DHCP server was unreachable.
- Question 26Single Choice
What type of physical layer issue occurs when unshielded twisted-pair cabling runs parallel to high-voltage electrical lines?
- AAttenuation
- BElectromagnetic Interference (EMI)Correct answer
- CCrosstalk
- DDuplex mismatch
Why this is the answer
Electromagnetic Interference (EMI) occurs when external magnetic fields, such as those from high-voltage power lines, induce unwanted voltage in nearby unshielded copper cables, corrupting data frames.
- Question 27Multiple Select
Which of the following tools are specifically designed to diagnose physical cabling issues such as breaks, split pairs, and continuity? (Choose two)
- ACable testerCorrect answer
- BTime Domain Reflectometer (TDR)Correct answer
- CProtocol analyzer
- DDHCP snooping configuration tool
Why this is the answer
A basic cable tester verifies pinout and continuity, while a Time Domain Reflectometer (TDR) measures cable length and pinpoints physical breaks or impedance mismatches on copper lines.
- Question 28Interactive
Based on the switch port statistics shown in the interactive output, what configuration issue is most likely occurring on this link?
- AA split pair wiring fault
- BA duplex mismatchCorrect answer
- CA broadcast storm
- DAn IP address conflict
Why this is the answer
High counts of CRC errors and late collisions on an Ethernet interface typically indicate a duplex mismatch, where one port operates in full-duplex while the connected device operates in half-duplex.
- Question 29Single Choice
What is the consequence of a 'split pair' error in twisted-pair Ethernet cabling termination?
- AComplete link down immediately
- BMassive crosstalk and electromagnetic interference due to destroyed pair balanceCorrect answer
- CAutomatic speed negotiation to 10 Mbps
- DDHCP scope exhaustion
Why this is the answer
Split pairs break the physical balance of the twisted pairs, which ruins the cable's ability to cancel out crosstalk, resulting in massive electromagnetic interference and data corruption.
- Question 30Multiple Select
What are the primary symptoms of a broadcast storm in a switched Ethernet network? (Choose two)
- AExtremely high CPU utilization on switchesCorrect answer
- BConstant high link utilization and packet dropsCorrect answer
- CSuccessful ARP resolution
- DNormal unicast throughput
Why this is the answer
A broadcast storm floods the network with constant broadcast frames, saturating bandwidth, causing severe packet loss, and heavily loading switch CPUs as they process the endless loop.
- Question 31Interactive
Based on the interactive command output, what is the status of the DNS resolution process for the queried host?
- AThe DNS server is unreachable or blocking port 53 traffic.Correct answer
- BThe default gateway is misconfigured.
- CThe client has an APIPA address.
- DThe DHCP scope is exhausted.
Why this is the answer
The 'DNS request timed out' message indicates that the client sent queries to the DNS server but did not receive a response, meaning the server is down, unreachable, or blocked by a firewall.
- Question 32Single Choice
At what percentage of the lease time does a standard DHCP client first attempt to renew its IP address lease?
- A50%Correct answer
- B87.5%
- C100%
- D25%
Why this is the answer
Standard DHCP clients attempt to renew their lease at 50% of the total lease duration (T1 timer). If the renewal fails, they attempt to rebind to any available server at 87.5% (T2).
Networking Concepts
9 questions in this domain
- Question 33Single Choice
Which transport-layer protocol is used by the Simple File Transfer Protocol (TFTP) for network booting and lightweight file transfers?
- ATCP
- BUDPCorrect answer
- CICMP
- DARP
Why this is the answer
TFTP uses UDP port 69 for lightweight, connectionless file transfers, commonly used in network device booting environments.
- Question 34Multiple Select
Which of the following transport protocols and port numbers are associated with the Domain Name System (DNS)? (Choose two)
- AUDP port 53Correct answer
- BTCP port 53Correct answer
- CTCP port 22
- DUDP port 69
Why this is the answer
DNS primarily uses UDP port 53 for standard queries but falls back to TCP port 53 for zone transfers and large responses.
- Question 35Interactive
Based on the provided command-line filter, which remote access protocol is being captured on the network interface?
- ASSHCorrect answer
- BTelnet
- CHTTP
- DSMTP
Why this is the answer
The tcpdump command filters traffic on port 22, which is the default port used by SSH for secure remote access.
- Question 36Single Choice
At which layer of the OSI model does a standard network switch operate when forwarding frames based on MAC addresses?
- APhysical Layer (Layer 1)
- BData Link Layer (Layer 2)Correct answer
- CNetwork Layer (Layer 3)
- DTransport Layer (Layer 4)
Why this is the answer
Standard switches operate at the Data Link Layer (Layer 2) of the OSI model, forwarding frames using MAC addresses.
- Question 37Multiple Select
Which of the following are primary responsibilities of the Transport Layer (Layer 4) of the OSI model? (Choose two)
- ALogical addressing and routing
- BSegmentation and reassembly of dataCorrect answer
- CPhysical signal transmission
- DFlow control and error recoveryCorrect answer
Why this is the answer
The Transport Layer handles end-to-end communication, including segmentation, flow control, and error recovery to ensure reliable data delivery.
- Question 38Interactive
Based on the OSI encapsulation mapping provided in the code block, what is the Protocol Data Unit (PDU) at the Network Layer?
- AFrame
- BSegment
- CPacketCorrect answer
- DBits
Why this is the answer
The Network Layer (Layer 3) of the OSI model encapsulates data into packets containing source and destination logical addresses.
- Question 39Single Choice
Which network service is used to automatically assign IP addresses and other network configuration parameters to devices on a local network?
- ADNS
- BDHCPCorrect answer
- CSNMP
- DNTP
Why this is the answer
The Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses, subnet masks, and other parameters to network clients.
- Question 40Multiple Select
Which of the following are considered Application Layer protocols in the OSI model? (Choose two)
- AIP
- BTCP
- CHTTPCorrect answer
- DDNSCorrect answer
Why this is the answer
HTTP and DNS are Application Layer (Layer 7) protocols that define message formats and rely on transport protocols like TCP or UDP for delivery.
- Question 41Interactive
Based on the standard DHCP exchange process shown in the code block, what is the correct chronological order of messages during IP lease acquisition?
- ADiscover, Offer, Request, AcknowledgeCorrect answer
- BRequest, Discover, Acknowledge, Offer
- COffer, Acknowledge, Discover, Request
- DDiscover, Acknowledge, Request, Offer
Why this is the answer
The DHCP lease process follows the DORA sequence: Discover (client), Offer (server), Request (client), and Acknowledge (server) to successfully configure the IP address.
Frequently asked questions
Everything about the CompTIA Network+ question bank and how to use it.