25 Free CompTIA Network+ Practice Questions
Get All 25 Free Practice Questions
Enter your email below to unlock the complete question set with detailed explanations.
Preparing for the CompTIA Network+ (N10-009) certification? Test your knowledge with these practice questions covering subnetting, network security, troubleshooting, wireless technologies, and more. These questions are written in the same style you’ll encounter on exam day.
We’re offering the first 5 questions free — enter your email below to unlock all 25 and get exclusive study tips from Total Seminars.
Free Preview — Questions 1–5
Question 1: Which layer of the OSI model is primarily responsible for routing packets between different networks?
- A) Layer 1 (Physical)
- B) Layer 2 (Data Link)
- C) Layer 3 (Network)
- D) Layer 4 (Transport)
Click to reveal answer
Answer: C) Layer 3 (Network) — The Network layer is responsible for logical addressing (IP addresses) and routing packets across different networks using devices like routers.
Question 2: Which technology is used to segment a single physical switch into multiple broadcast domains?
- A) Hubs
- B) VLANs
- C) Repeaters
- D) Bridges
Click to reveal answer
Answer: B) VLANs — Virtual LANs allow a managed switch to logically separate ports into distinct broadcast domains without requiring separate physical hardware.
Question 3: What does the Address Resolution Protocol (ARP) resolve?
- A) MAC addresses to IP addresses
- B) IP addresses to MAC addresses
- C) Hostnames to IP addresses
- D) IP addresses to hostnames
Click to reveal answer
Answer: B) IP addresses to MAC addresses — ARP maps a known Layer 3 IP address to a Layer 2 MAC address so frames can be delivered on the local network segment.
Question 4: You need to create at least 4 subnets from a single /24 network. What is the minimum subnet mask you should use?
- A) /25
- B) /26
- C) /27
- D) /28
Click to reveal answer
Answer: B) /26 — Borrowing 2 bits from the host portion of a /24 creates exactly 4 subnets (2^2 = 4), each with 62 usable host addresses.
Question 5: Which transport-layer protocol provides reliable, connection-oriented delivery of data?
- A) UDP
- B) ICMP
- C) TCP
- D) ARP
Click to reveal answer
Answer: C) TCP — The Transmission Control Protocol uses a three-way handshake, sequencing, and acknowledgments to guarantee reliable, ordered delivery of data.
Want all 25 questions?
Enter your email above to unlock Questions 6-25 with full explanations.
Already signed up? Check your email for the unlock link.
Questions 6–25
Question 6: You are designing a network that requires at least 500 usable host addresses per subnet. Which CIDR prefix length provides the minimum number of addresses to meet this requirement?
- A) /24
- B) /23
- C) /22
- D) /25
Click to reveal answer
Answer: B) /23 — A /23 network provides 510 usable host addresses (2^9 – 2 = 510), which is the smallest prefix that meets the 500-host requirement.
Question 7: Which of the following is a private IPv4 address range as defined by RFC 1918?
- A) 8.8.8.0/24
- B) 10.0.0.0/8
- C) 172.32.0.0/16
- D) 192.169.0.0/16
Click to reveal answer
Answer: B) 10.0.0.0/8 — The three RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The other options fall outside these defined private ranges.
Question 8: Which minimum cable category supports 10 Gbps Ethernet (10GBASE-T) over a full 100-meter copper run?
- A) Cat5e
- B) Cat6
- C) Cat6a
- D) Cat5
Click to reveal answer
Answer: C) Cat6a — Cat6a (augmented) supports 10GBASE-T up to 100 meters. Standard Cat6 can handle 10 Gbps but only up to approximately 55 meters.
Question 9: Which type of switch port configuration allows multiple VLANs to traverse a single physical link between switches?
- A) Access port
- B) Trunk port
- C) Mirror port
- D) Uplink port
Click to reveal answer
Answer: B) Trunk port — A trunk port uses 802.1Q tagging to carry traffic from multiple VLANs over a single link, typically between switches or between a switch and a router.
Question 10: What is the purpose of a DHCP relay agent on a network?
- A) To assign static IP addresses to servers
- B) To forward DHCP requests across different subnets
- C) To cache DNS records for faster lookups
- D) To encrypt DHCP traffic between client and server
Click to reveal answer
Answer: B) To forward DHCP requests across different subnets — Since DHCP discovery messages are broadcasts that don’t cross routers, a relay agent forwards these requests to a DHCP server on another subnet.
Question 11: Which wireless security standard provides the strongest protection for an enterprise environment?
- A) WEP
- B) WPA-Personal
- C) WPA2-Personal
- D) WPA3-Enterprise
Click to reveal answer
Answer: D) WPA3-Enterprise — WPA3-Enterprise offers the highest level of wireless security with 192-bit encryption, individualized data encryption, and RADIUS-based authentication for each user.
Question 12: A technician needs to verify that each pin in an Ethernet cable is terminated to the correct position on both ends. Which tool should be used?
- A) Cable tester
- B) Tone generator
- C) Multimeter
- D) OTDR
Click to reveal answer
Answer: A) Cable tester — A cable tester (continuity tester) checks each pin-to-pin connection to confirm correct wiring order, detect opens, shorts, and crossed pairs in copper cabling.
Question 13: Which routing protocol uses a composite metric based on bandwidth and delay by default?
- A) RIP
- B) OSPF
- C) EIGRP
- D) BGP
Click to reveal answer
Answer: C) EIGRP — Enhanced Interior Gateway Routing Protocol calculates its composite metric using bandwidth and delay by default, though it can also factor in reliability, load, and MTU.
Question 14: An attacker positions themselves between two communicating hosts to secretly intercept and potentially alter traffic. What type of attack is this?
- A) Denial of Service (DoS)
- B) Man-in-the-middle (MITM)
- C) Brute force
- D) Social engineering
Click to reveal answer
Answer: B) Man-in-the-middle (MITM) — In a MITM attack, the attacker secretly relays and possibly alters communication between two parties who believe they are communicating directly with each other.
Question 15: Which security device monitors network traffic for suspicious activity and generates alerts, but does NOT take automatic action to block threats?
- A) IPS
- B) IDS
- C) Firewall
- D) Proxy server
Click to reveal answer
Answer: B) IDS — An Intrusion Detection System passively monitors traffic and alerts administrators to potential threats. Unlike an IPS, it does not actively block or prevent malicious traffic.
Question 16: A remote employee needs to securely access the corporate network over the public internet. Which technology should be implemented?
- A) Telnet
- B) VPN
- C) RDP alone
- D) FTP
Click to reveal answer
Answer: B) VPN — A Virtual Private Network creates an encrypted tunnel over the public internet, allowing remote users to securely access internal corporate resources as if they were on the local network.
Question 17: A security administrator wants to block all unencrypted web traffic on the network. Which firewall rule should be implemented?
- A) Block port 443
- B) Block port 22
- C) Block port 80
- D) Block port 53
Click to reveal answer
Answer: C) Block port 80 — Port 80 is used for unencrypted HTTP traffic. Blocking it forces users to use HTTPS on port 443, which encrypts web traffic with TLS.
Question 18: An attacker sends falsified ARP messages on a local network to link their MAC address with the IP address of a legitimate host. What is this attack called?
- A) DNS poisoning
- B) ARP spoofing/poisoning
- C) MAC flooding
- D) DHCP starvation
Click to reveal answer
Answer: B) ARP spoofing/poisoning — ARP spoofing corrupts the ARP cache of other devices on the network, redirecting traffic intended for a legitimate host to the attacker’s machine instead.
Question 19: Which IEEE standard defines port-based network access control that authenticates devices before granting them access to the network?
- A) 802.11ac
- B) 802.3
- C) 802.1X
- D) 802.1Q
Click to reveal answer
Answer: C) 802.1X — IEEE 802.1X provides port-based Network Access Control using a supplicant, authenticator, and authentication server (RADIUS) to verify credentials before allowing network access.
Question 20: A user can successfully ping 8.8.8.8 but cannot access any websites by name. What is the most likely cause?
- A) The default gateway is misconfigured
- B) There is a DNS configuration issue
- C) The NIC is disabled
- D) The Ethernet cable is unplugged
Click to reveal answer
Answer: B) There is a DNS configuration issue — Since pinging by IP address works, basic connectivity is fine. The inability to reach sites by name indicates that DNS resolution is failing, likely due to a missing or incorrect DNS server setting.
Question 21: Which command on a managed switch displays the MAC address table, showing which MAC addresses are associated with which ports?
- A) show ip route
- B) show mac address-table
- C) show arp
- D) show vlan
Click to reveal answer
Answer: B) show mac address-table — This command displays the switch’s MAC address table, listing learned MAC addresses and the corresponding switch ports, which is essential for troubleshooting Layer 2 connectivity.
Question 22: A technician has installed a new copper Ethernet cable run measured at 115 meters. The link is not coming up. What is the most likely cause?
- A) The wrong cable category was used
- B) The cable exceeds the 100-meter maximum distance for copper Ethernet
- C) There is a duplex mismatch on the port
- D) The PoE power budget has been exceeded
Click to reveal answer
Answer: B) The cable exceeds the 100-meter maximum distance for copper Ethernet — The maximum supported distance for standard copper Ethernet cabling (Cat5e through Cat6a) is 100 meters. At 115 meters, signal attenuation is too great for a reliable link.
Question 23: Which protocol prevents Layer 2 switching loops by placing redundant ports into a blocking state?
- A) VRRP
- B) Spanning Tree Protocol (STP)
- C) LACP
- D) SNMP
Click to reveal answer
Answer: B) Spanning Tree Protocol (STP) — STP (IEEE 802.1D) prevents broadcast storms and switching loops by detecting redundant paths and placing extra ports in a blocking state until they are needed for failover.
Question 24: A network administrator needs to capture and analyze packets traversing the network to diagnose a connectivity issue. Which tool is best suited for this task?
- A) Nmap
- B) Wireshark
- C) Nessus
- D) Netstat
Click to reveal answer
Answer: B) Wireshark — Wireshark is a free, open-source packet analyzer that captures network traffic in real time and provides detailed protocol-level inspection for troubleshooting and analysis.
Question 25: A user reports that a specific application is running slowly, but a network speed test shows normal throughput. What should the technician investigate first?
- A) Check application-layer performance and server response times
- B) Replace the user’s network interface card
- C) Upgrade the ISP plan to a higher speed tier
- D) Change the DNS server to a faster provider
Click to reveal answer
Answer: A) Check application-layer performance and server response times — Since the speed test confirms the network is performing normally, the issue is likely above the network layer. Checking the application server’s load, latency, and response times is the logical next step.
Ready for More Practice?
These 25 questions are just the beginning. Total Seminars TotalTester gives you hundreds of exam-realistic Network+ practice questions with detailed explanations, performance tracking, and customizable quizzes — everything you need to pass on your first attempt.