A security analyst is correlating events across firewall, switch, and authentication server logs during an incident review. Direct clock checks show that the devices differ by several seconds. Which protocol should synchronize those device clocks, and what transport and well-known server port does it use?

NTP (Network Time Protocol) over UDP, with client requests sent to the well-known server port 123.

Syslog on UDP 514 because the syslog collector is responsible for normalizing timestamps across every source device that sends log messages into the system.

SNMP traps on UDP 162 because each trap carries a precise timestamp that lets the SIEM resequence log events across firewall, switch, and authentication sources properly.

DNS reverse lookup on UDP 53 because resolving each source IP to a hostname is what reorders log entries chronologically inside the central log aggregation system.

A data center operator is planning 40 Gbps uplinks between top of rack switches and the spine layer over a 100 meter run. Which combination of transceiver, connector, and fiber is the appropriate selection?

40GBASE-SR4 QSFP+ transceivers with MPO-12 multifiber connectors over OM3.

A 1000BASE-SX SFP transceiver with LC connectors over OM2 multimode fiber.

A 1000BASE-SX GBIC transceiver with SC connectors over OM3 multimode fiber.

A 10GBASE-SR SFP+ transceiver with LC connectors over OM1 multimode fiber.

An organization with 40 access points across three floors wants centralized management, consistent client experience as users walk between floors, and a single pane of glass for firmware and policy. Which design pattern fits these requirements?

A wireless LAN controller (WLC) plus 40 lightweight access points, with the controller managing radio config and policy.

Forty fully standalone APs, each configured by hand from its own web interface and not aware of any other AP nearby.

A pair of consumer mesh nodes from a home networking vendor placed in the lobby and the second floor break room.

A captive portal appliance at the edge of the network with each AP independently sending traffic to that portal for inspection.

A junior tech is pulling a fiber backbone run between the MDF and an IDF and asks how tightly the cable can be looped at the rack entry. Which guideline correctly describes the minimum bend radius rule for the installation?

Follow the cable manufacturer's limit; typical fiber cable may specify about 20 times its outer diameter under pull load and about 10 times at rest.

Bend the fiber as tightly as needed to fit the rack entry; modern fibers tolerate small loops without measurable signal loss in the run.

Bend the fiber to whatever curvature matches the copper bend rules for the same run, since both media share identical mechanical loss characteristics.

Coil any excess slack into tight 2-inch loops behind the rack to keep the run tidy, regardless of the manufacturer's published bend specifications.

A report is slow, and the team needs request timing across the browser, web service, application service, and database. Which monitoring discipline BEST supplies that tier-by-tier view?

Application Performance Monitoring (APM), because APM instruments the app to break down request time by tier (browser, web server, app server, database) and shows where the seconds go.

Increased SNMP polling rate on every switch in the path so the team can see sub-second utilization spikes that the longer poll cycle is missing right now and correlate the spikes.

Full hour-long packet capture at the user's workstation and the report server, then manual analysis of every TCP handshake to look for retransmissions and out-of-order segments in flight.

Configure every router in the path to forward all syslog messages of severity 6 and 7 to a central server so the team can read the full firmware log stream during the next slow report run.

An organization wants intranet.example.com to resolve to a private IP address for clients using its internal DNS service and to a public IP address for clients using public DNS. Which DNS pattern BEST fits this requirement?

Split-brain (split-horizon) DNS, which returns the private address in the internal view and the public address in the external view for the same hostname.

Round-robin DNS, which returns multiple address records for a hostname and varies their order for basic load distribution, without creating separate internal and public views.

Dynamic DNS, which lets authorized clients or DHCP services add or update DNS records when addresses change but does not create separate views by itself.

DNSSEC, which provides origin authentication and data-integrity protection for DNS data but does not choose between internal and external addresses.

A network administrator asks why the security team evaluates confidentiality, integrity, and availability instead of relying on a single firewall. Which response BEST explains the CIA triad's role on a network?

Confidentiality limits disclosure, Integrity protects against unauthorized change, and Availability supports reliable authorized access.

CIA is a vendor certification program that defines which firewall brands are allowed to sit at the perimeter of a small business network.

CIA stands for Cybersecurity Industry Association and is mostly a regulatory term used by auditors when inspecting paperwork inside a SOC 2 audit window.

CIA is a Layer 3 routing protocol that prioritizes encrypted traffic so confidential packets always reach their destination before any unencrypted packet.

A security audit finds that an edge router is exchanging OSPF updates without neighbor authentication. Which hardening change addresses this finding directly?

Configure a cryptographic OSPF authentication method supported by the deployed OSPF version and platform, with matching authentication settings on neighboring routers.

Use Control Plane Policing (CoPP) to rate-limit excessive OSPF traffic sent to the route processor.

Apply Unicast Reverse Path Forwarding (uRPF) on suitable edge interfaces to drop packets that fail reverse-path source validation.

Disable IP source routing so packet senders cannot specify a forwarding path in the IP header.

A balanced-copper channel from switch to endpoint measures 112 meters including patch cords. It was designed for standards-compliant 1000BASE-T service. What cabling issue must be corrected?

The cable is exceeding the 100 m twisted pair maximum, so signal attenuation rises and the run must be shortened or repeated.

The cable is fine because the 100 m limit is a guideline only and modern Cat6A reliably reaches 150 m on gigabit links.

The cable is shorted, which would show on a basic wire-map test as two conductors lighting up together at termination.

The cable has wrong Cat rating, and upgrading the keystone jacks from Cat5e to Cat6 will resolve the throughput issue on this run.

A user reports their email works again after a recent ticket. The technician closes the ticket immediately without testing other related services. Which step of the methodology did the technician skip or shortcut?

Verify full system functionality, since adjacent services were not tested before the ticket closed.

Identify the problem step, since the technician did not gather information at the start of the work cycle.

Establish a theory of probable cause, since the technician never formed a working hypothesis.

Implement the solution, since the technician deployed the change without writing down the steps first.

Home
CompTIA Network+
Network+ practice test

Free practice test

Free CompTIA Network+ (N10-009) practice test

RTJ is an IT certification platform that starts with CompTIA A+, Network+ and Security+.

This free CompTIA Network+ (N10-009) practice test, also called a Network plus practice test, has 10 questions that cover all 5 Network+ domains. Pick an answer to see whether it is right and why. No account, no timer.

Try the sample questions

Nothing here is saved or sent. Choose an answer to see whether it is right and why.

0 of 10 answered

Question 1 of 10 · Networking Concepts
A security analyst is correlating events across firewall, switch, and authentication server logs during an incident review. Direct clock checks show that the devices differ by several seconds. Which protocol should synchronize those device clocks, and what transport and well-known server port does it use?
A. Syslog on UDP 514 because the syslog collector is responsible for normalizing timestamps across every source device that sends log messages into the system.B. SNMP traps on UDP 162 because each trap carries a precise timestamp that lets the SIEM resequence log events across firewall, switch, and authentication sources properly.C. NTP (Network Time Protocol) over UDP, with client requests sent to the well-known server port 123.D. DNS reverse lookup on UDP 53 because resolving each source IP to a hostname is what reorders log entries chronologically inside the central log aggregation system.
Answer and explanation
Right answer: C. NTP (Network Time Protocol) over UDP, with client requests sent to the well-known server port 123.
NTP synchronizes system clocks and carries NTP packets in UDP datagrams. Clients send requests to the server's well-known UDP port 123; current guidance recommends randomized ephemeral client source ports when the operating mode permits. Synchronized clocks make timestamps from different systems more comparable, but they do not by themselves guarantee perfect event ordering because logging precision, time-zone handling, transport delay, and collector behavior still matter. Syslog transports events, SNMP monitors devices, and DNS resolves names; none synchronizes source clocks.
Objective NP-1.4: Ports and Protocols
Question 2 of 10 · Networking Concepts
A data center operator is planning 40 Gbps uplinks between top of rack switches and the spine layer over a 100 meter run. Which combination of transceiver, connector, and fiber is the appropriate selection?
A. A 1000BASE-SX SFP transceiver with LC connectors over OM2 multimode fiber.B. 40GBASE-SR4 QSFP+ transceivers with MPO-12 multifiber connectors over OM3.C. A 1000BASE-SX GBIC transceiver with SC connectors over OM3 multimode fiber.D. A 10GBASE-SR SFP+ transceiver with LC connectors over OM1 multimode fiber.
Answer and explanation
Right answer: B. 40GBASE-SR4 QSFP+ transceivers with MPO-12 multifiber connectors over OM3.
The 1000BASE-SX SFP and GBIC choices are 1GbE, while the 10GBASE-SR SFP+ choice is 10GbE. The keyed 40GBASE-SR4 QSFP+ uses parallel lanes through an MPO-12 connection; Cisco rates it to 100 meters over OM3.
Objective NP-1.5: Transmission Media
Question 3 of 10 · Network Implementation
An organization with 40 access points across three floors wants centralized management, consistent client experience as users walk between floors, and a single pane of glass for firmware and policy. Which design pattern fits these requirements?
A. Forty fully standalone APs, each configured by hand from its own web interface and not aware of any other AP nearby.B. A pair of consumer mesh nodes from a home networking vendor placed in the lobby and the second floor break room.C. A wireless LAN controller (WLC) plus 40 lightweight access points, with the controller managing radio config and policy.D. A captive portal appliance at the edge of the network with each AP independently sending traffic to that portal for inspection.
Answer and explanation
Right answer: C. A wireless LAN controller (WLC) plus 40 lightweight access points, with the controller managing radio config and policy.
A WLC with managed APs matches the explicit centralized configuration, firmware, and policy requirements. A controller can also provide neighbor information and other roaming assistance, but the client normally decides when and where to roam, so smooth roaming is not guaranteed by a controller alone. Cloud-managed APs offer another centralized model. The choice between local controller, cloud management, standalone APs, wired backhaul, and mesh depends on requirements rather than a fixed AP-count threshold.
Objective NP-2.3: Wireless Devices
Question 4 of 10 · Network Implementation
A junior tech is pulling a fiber backbone run between the MDF and an IDF and asks how tightly the cable can be looped at the rack entry. Which guideline correctly describes the minimum bend radius rule for the installation?
A. Bend the fiber as tightly as needed to fit the rack entry; modern fibers tolerate small loops without measurable signal loss in the run.B. Follow the cable manufacturer's limit; typical fiber cable may specify about 20 times its outer diameter under pull load and about 10 times at rest.C. Bend the fiber to whatever curvature matches the copper bend rules for the same run, since both media share identical mechanical loss characteristics.D. Coil any excess slack into tight 2-inch loops behind the rack to keep the run tidy, regardless of the manufacturer's published bend specifications.
Answer and explanation
Right answer: B. Follow the cable manufacturer's limit; typical fiber cable may specify about 20 times its outer diameter under pull load and about 10 times at rest.
Fiber bend limits depend on cable construction and whether the cable is under pulling load or resting after installation. A typical product may require roughly 20 times the outer diameter during installation and allow roughly 10 times at rest, but the manufacturer's published value controls. Tighter bends can add macrobend loss or cause mechanical damage. Bend-insensitive fiber also has a specified limit. Use proper pathway and slack management, preserve the required radius through rack entry and service loops, and verify the installed link rather than applying a copper rule to fiber.
Objective NP-2.4: Physical Installations
Question 5 of 10 · Network Operations
A report is slow, and the team needs request timing across the browser, web service, application service, and database. Which monitoring discipline BEST supplies that tier-by-tier view?
A. Application Performance Monitoring (APM), because APM instruments the app to break down request time by tier (browser, web server, app server, database) and shows where the seconds go.B. Increased SNMP polling rate on every switch in the path so the team can see sub-second utilization spikes that the longer poll cycle is missing right now and correlate the spikes.C. Full hour-long packet capture at the user's workstation and the report server, then manual analysis of every TCP handshake to look for retransmissions and out-of-order segments in flight.D. Configure every router in the path to forward all syslog messages of severity 6 and 7 to a central server so the team can read the full firmware log stream during the next slow report run.
Answer and explanation
Right answer: A. Application Performance Monitoring (APM), because APM instruments the app to break down request time by tier (browser, web server, app server, database) and shows where the seconds go.
Application Performance Monitoring can instrument request paths and report timing across browser, service, application, database, and external-call tiers. SNMP and flow data describe devices, interfaces, and traffic summaries, while packet capture observes packets at selected points. The requested tier-by-tier timing makes APM the direct fit without asserting that the network is already proven healthy.
Objective NP-3.2: Network Monitoring
Question 6 of 10 · Network Operations
An organization wants intranet.example.com to resolve to a private IP address for clients using its internal DNS service and to a public IP address for clients using public DNS. Which DNS pattern BEST fits this requirement?
A. Round-robin DNS, which returns multiple address records for a hostname and varies their order for basic load distribution, without creating separate internal and public views.B. Split-brain (split-horizon) DNS, which returns the private address in the internal view and the public address in the external view for the same hostname.C. Dynamic DNS, which lets authorized clients or DHCP services add or update DNS records when addresses change but does not create separate views by itself.D. DNSSEC, which provides origin authentication and data-integrity protection for DNS data but does not choose between internal and external addresses.
Answer and explanation
Right answer: B. Split-brain (split-horizon) DNS, which returns the private address in the internal view and the public address in the external view for the same hostname.
Split-brain DNS, also called split-horizon DNS, provides different answers for the same name based on the query context. Here, the internal view returns the private address and the external view returns the public address. Round-robin DNS varies the order of multiple records, dynamic DNS updates records, and DNSSEC authenticates DNS data; none of those mechanisms by itself creates separate internal and external views. Administrators must manage the views deliberately and keep internal-only records out of the public view.
Objective NP-3.4: IP Services
Question 7 of 10 · Network Security
A network administrator asks why the security team evaluates confidentiality, integrity, and availability instead of relying on a single firewall. Which response BEST explains the CIA triad's role on a network?
A. CIA is a vendor certification program that defines which firewall brands are allowed to sit at the perimeter of a small business network.B. Confidentiality limits disclosure, Integrity protects against unauthorized change, and Availability supports reliable authorized access.C. CIA stands for Cybersecurity Industry Association and is mostly a regulatory term used by auditors when inspecting paperwork inside a SOC 2 audit window.D. CIA is a Layer 3 routing protocol that prioritizes encrypted traffic so confidential packets always reach their destination before any unencrypted packet.
Answer and explanation
Right answer: B. Confidentiality limits disclosure, Integrity protects against unauthorized change, and Availability supports reliable authorized access.
The CIA triad organizes three security goals. Confidentiality limits data disclosure to authorized parties. Integrity protects data and systems from unauthorized change. Availability keeps authorized access reliable when needed. Controls can support one or more goals, so the triad helps explain what a proposed control protects without implying that one firewall covers every goal.
Objective NP-4.1: Network Security Concepts
Question 8 of 10 · Network Security
A security audit finds that an edge router is exchanging OSPF updates without neighbor authentication. Which hardening change addresses this finding directly?
A. Use Control Plane Policing (CoPP) to rate-limit excessive OSPF traffic sent to the route processor.B. Apply Unicast Reverse Path Forwarding (uRPF) on suitable edge interfaces to drop packets that fail reverse-path source validation.C. Configure a cryptographic OSPF authentication method supported by the deployed OSPF version and platform, with matching authentication settings on neighboring routers.D. Disable IP source routing so packet senders cannot specify a forwarding path in the IP header.
Answer and explanation
Right answer: C. Configure a cryptographic OSPF authentication method supported by the deployed OSPF version and platform, with matching authentication settings on neighboring routers.
Cryptographic OSPF authentication directly addresses the finding by allowing neighboring routers to validate authentication data on OSPF exchanges. The available mechanism and algorithms depend on the OSPF version and platform, so configure a mutually supported method and matching settings on every neighbor on the segment. CoPP rate-limits traffic sent to the control plane, uRPF validates source reachability, and disabling IP source routing blocks source-selected forwarding paths; none of those controls authenticates OSPF exchanges.
Objective NP-4.3: Network Security Features
Question 9 of 10 · Network Troubleshooting
A balanced-copper channel from switch to endpoint measures 112 meters including patch cords. It was designed for standards-compliant 1000BASE-T service. What cabling issue must be corrected?
A. The cable is exceeding the 100 m twisted pair maximum, so signal attenuation rises and the run must be shortened or repeated.B. The cable is fine because the 100 m limit is a guideline only and modern Cat6A reliably reaches 150 m on gigabit links.C. The cable is shorted, which would show on a basic wire-map test as two conductors lighting up together at termination.D. The cable has wrong Cat rating, and upgrading the keystone jacks from Cat5e to Cat6 will resolve the throughput issue on this run.
Answer and explanation
Right answer: A. The cable is exceeding the 100 m twisted pair maximum, so signal attenuation rises and the run must be shortened or repeated.
A 112-meter balanced-copper channel exceeds the common 100-meter channel limit. It is outside the cabling specification even if a link sometimes comes up. Shorten the channel, redesign with an intermediate active device in an appropriate location, or use a supported fiber link; do not predict a guaranteed fallback rate.
Objective NP-5.2: Physical Issues
Question 10 of 10 · Network Troubleshooting
A user reports their email works again after a recent ticket. The technician closes the ticket immediately without testing other related services. Which step of the methodology did the technician skip or shortcut?
A. Identify the problem step, since the technician did not gather information at the start of the work cycle.B. Verify full system functionality, since adjacent services were not tested before the ticket closed.C. Establish a theory of probable cause, since the technician never formed a working hypothesis.D. Implement the solution, since the technician deployed the change without writing down the steps first.
Answer and explanation
Right answer: B. Verify full system functionality, since adjacent services were not tested before the ticket closed.
CompTIA's troubleshooting methodology requires verifying full system functionality and implementing preventive measures when applicable. Here, the technician accepted the report that email worked but did not test the affected workflow or other related functionality before closing the ticket, so B is the skipped step. The closing behavior does not show that problem identification, theory formation, or solution implementation was skipped.
Objective NP-5.1: Troubleshooting

What does the CompTIA Network+ exam cover?

Network+ (N10-009) covers 5 domains, and this sample draws questions from each:

Domain NP-1.0: Networking Concepts (2 questions)
Domain NP-2.0: Network Implementation (2 questions)
Domain NP-3.0: Network Operations (2 questions)
Domain NP-4.0: Network Security (2 questions)
Domain NP-5.0: Network Troubleshooting (2 questions)

CompTIA decides what is on the exam. Read the official N10-009 objectives on CompTIA's Network+ page, then use RTJ's objective-by-objective guides and practice to work through them.

How does the full practice exam work?

RTJ's full-length practice exam runs 90 questions in 90 minutes, with performance-based questions mixed in and a per-domain breakdown when you finish. A free account includes one full-length practice exam per certification track, and paid plans remove that cap. The format is RTJ's own interface, not CompTIA's or Pearson VUE's.

Where do these questions come from?

They are RTJ's own questions, written to the published Network+ N10-009 objectives. RTJ drafts questions with AI assistance, and the AI policy explains how. If you find a mistake, report it on the corrections page. The sample is a fixed pick, so the same 10 questions show every time you visit.

Questions

Is this the real CompTIA Network+ exam?+

No. It is a short practice sample written by RTJ to the published N10-009 objectives. It is not CompTIA's exam, it does not use CompTIA's questions, and its result says nothing about how you would score on exam day.

Is the practice test really free?+

Yes. The 10 questions on this page need no account and nothing is saved or sent. A free account adds one full-length timed practice exam per certification track.

Does a high score on this sample mean I will pass?+

No. 10 questions cannot measure readiness for a full certification exam. RTJ's own Mastery Index is an internal, uncalibrated study signal built from many questions, and it is not a pass prediction either.

Where are the official CompTIA Network+ objectives?+

CompTIA publishes the N10-009 exam objectives on its own site, which is the source to follow for what the exam covers. RTJ's study guides and questions are written against those objectives and carry the objective number.

Keep going

CompTIA Network+ on RTJThe objective map, study guides, labs and the practice exam for Network+.
The full-length practice exam90 questions in 90 minutes, with performance-based questions and a per-domain breakdown.
How the Mastery Index worksAn uncalibrated study signal, shown with its evidence quality. Not a pass predictor.
Hands-on labsDo the procedure step by step in a simulated tool. Free labs need no account.

Revy's Tech Journey is an independent study platform and is not endorsed by or affiliated with CompTIA. CompTIA names identify the public exam objectives each RTJ track covers.

Start free, no credit card.

A free account keeps your progress and adds one full-length timed practice exam per certification track.

Create a free account See what is included