The most useful Network+ practice questions are the ones you can take apart afterward. Getting an item right tells you very little. Knowing why each of the other three options is wrong tells you whether you would get the next variation right too.
Below are five original questions written for the N10-009 exam, one from each of its five domains. Each comes with the answer, why every distractor fails, and the habit the item is really testing. The exam format (up to 90 questions in 90 minutes, 720 to pass) is covered in what the Network+ certification is.
Before you read the answers
Pick an answer and write one sentence on why before you read on. A right answer reached for the wrong reason is a miss waiting to happen. Then read the wrong-option notes even when you got it right.
Question 1: Which address belongs to this subnet? (Networking Concepts)
A workstation is configured with the address 172.16.8.45 and the subnet mask 255.255.255.240. Which of the following addresses could be assigned to another host on the same subnet?
A. 172.16.8.32
B. 172.16.8.46
C. 172.16.8.47
D. 172.16.8.50
Answer: B.
The mask 255.255.255.240 is a /28. The interesting octet is the last one, and the block size is 256 minus 240, which is 16. Subnets in that octet start at multiples of 16: .0, .16, .32, .48 and so on. The value 45 falls between 32 and 48, so the host lives in 172.16.8.32/28. That subnet's broadcast is one less than the next boundary, .47, which leaves .33 through .46 as usable hosts. Only .46 is in range.
Why the others fail:
- A (.32) is the network ID of the subnet. It identifies the subnet and cannot be given to a host.
- C (.47) is the broadcast address. It looks like the last host, which is exactly why it is offered.
- D (.50) sits in the next subnet, 172.16.8.48/28. A host there needs a router to reach .45.
The habit: find the boundaries before you look at the options. Once you know the network ID and broadcast, three of the four choices eliminate themselves.
Question 2: Why is the warehouse Wi-Fi slow? (Network Implementation)
A warehouse is covered by three access points in the 2.4 GHz band. AP1 is on channel 1, AP2 on channel 6 and AP3 on channel 11, and all three are set to a 40 MHz channel width. Handheld scanners report poor throughput wherever two cells meet. Which change will most improve performance?
A. Increase the transmit power on all three access points
B. Move all three access points to channel 6 so clients roam more easily
C. Set all three access points to 20 MHz channels and keep channels 1, 6 and 11
D. Keep 40 MHz width and move the access points to channels 1, 4 and 8
Answer: C.
In North America the 2.4 GHz band has three non-overlapping 20 MHz channels: 1, 6 and 11. That plan only works at 20 MHz. A 40 MHz channel in 2.4 GHz eats the space between them, so the three cells overlap each other even though the channel numbers look correct on paper. Dropping to 20 MHz restores three clean channels.
Why the others fail:
- A makes the cells larger and pushes more energy into the neighbors' space. More power means more overlap, not less.
- B creates co-channel interference on purpose. Every AP and client would contend for the same airtime.
- D keeps the width that caused the problem and adds overlapping channel numbers on top. Channels 1, 4 and 8 overlap even at 20 MHz.
The habit: when a configuration looks right but behaves wrong, check the setting nobody mentioned. The stem gave you the width almost in passing.
Question 3: Does the backup schedule meet the RPO? (Network Operations)
An online retailer runs a full backup of its order database every Sunday at midnight and a differential backup every night at 1:00 a.m. Management has just set a recovery point objective (RPO) of one hour for that database. Which statement is correct?
A. The schedule meets the RPO, because a differential restore needs only two backup sets
B. The schedule misses the RPO, because a failure late in the day could lose many hours of orders, so the data must be captured at least hourly
C. The RPO describes how quickly the database must be back online, so the backup schedule does not affect it
D. Replacing the nightly differentials with nightly incrementals would meet the RPO
Answer: B.
RPO is the maximum acceptable data loss, measured in time. It answers "how far back can we afford to rewind?" With one backup a night, a failure at 4:00 p.m. loses everything since 1:00 a.m., which is 15 hours of orders against a one-hour limit. Meeting a one-hour RPO means capturing changes at least every hour, through far more frequent backups or replication.
Why the others fail:
- A is true about differentials and irrelevant here. Fewer restore sets means a faster restore, which is about recovery time, not data loss.
- C describes the recovery time objective (RTO). It is a common swap in scenario questions: RTO is downtime tolerance, RPO is data-loss tolerance.
- D changes the backup type but not the frequency. A nightly incremental still leaves the same gap between backups.
The habit: translate each metric into its plain question before you read the options. "How long can we be down?" is RTO. "How much data can we lose?" is RPO.
Question 4: What is happening on this subnet? (Network Security)
Users on the 192.168.5.0/24 subnet report slow web pages and dropped sessions. A technician runs arp -a on two affected workstations. Both show the default gateway, 192.168.5.1, mapped to the MAC address 00-1a-2b-3c-4d-5e. The same MAC address is also listed for 192.168.5.37, a desktop in the accounts office. nslookup returns the correct addresses for internal and external names, and a protocol analyzer on another switch port sees only traffic addressed to that port. Which attack is the most likely cause?
A. DNS poisoning
B. MAC flooding
C. ARP poisoning
D. VLAN hopping
Answer: C.
ARP maps IP addresses to MAC addresses on the local subnet, and it trusts whatever replies it receives. In ARP poisoning an attacker sends forged replies claiming the gateway's IP address for its own MAC. Victims cache it and send outbound traffic to the attacker first, putting the attacker on-path. Two different IP addresses, one of them the gateway, resolving to the same MAC is the signature the stem hands you.
Why the others fail:
-
A would show up as names resolving to the wrong IP addresses. The stem tells you
nslookupreturns correct answers, which rules it out. - B fills the switch's MAC address table until the switch floods frames out every port. The analyzer seeing only its own traffic rules that out.
- D is about frames crossing into a VLAN they should not reach. Nothing here involves a second VLAN.
The habit: read every clue in the stem as an elimination. The nslookup and analyzer results are there to remove distractors. Tie each attack to its layer too: ARP poisoning is Layer 2 and local, DNS poisoning is Layer 7 and can span subnets.
Question 5: A troubleshooting scenario in prose (Network Troubleshooting)
This item is an illustration, in prose, of the multi-step reasoning a performance-based task can ask for. It is written as a normal multiple-choice question and does not claim to reproduce the real PBQ format.
A company has opened a fourth floor and created VLAN 40 for it, using 10.10.40.0/24 with the switch virtual interface (SVI) at 10.10.40.1. The other floors use VLANs 10 to 30 and work normally. Every new workstation on the fourth floor shows this:
IPv4 Address: 169.254.112.9
Subnet Mask: 255.255.0.0
Default Gateway:
The technician gathers more information:
- The DHCP server at 10.10.1.20 has a scope for 10.10.40.0/24 with 200 free addresses.
- The server's log shows no DHCP requests from the new subnet at all.
- A laptop given a static address of 10.10.40.50 with gateway 10.10.40.1 can ping 10.10.1.20 and browse the internet.
What is the most likely cause?
A. The DHCP scope for 10.10.40.0/24 is exhausted
B. The router has no default route to the internet
C. The VLAN 40 SVI has no DHCP relay (IP helper) pointing to 10.10.1.20
D. The new workstations have faulty network adapters
Answer: C.
A 169.254.x.x address is APIPA: the client asked for DHCP, heard nothing, and assigned itself a link-local address. DHCP discovery uses broadcasts, and routers do not forward broadcasts between subnets by default. The server sits on a different subnet, so without a relay agent on the VLAN 40 interface, the requests never leave the floor. That fits the empty server log and the pattern of one new subnet failing while the rest work.
Why the others fail:
- A contradicts the evidence. The scope has 200 free addresses, and the empty log shows the requests never reached the server in the first place.
- B is ruled out by the static laptop, which reaches the internet through the same gateway. Routing works.
- D misreads APIPA. A self-assigned address proves the adapter is working, and a whole floor of new adapters failing at once is far less likely than one missing setting.
The habit: scope the failure before you theorize. "One subnet broken, everything else fine" points at that subnet's edge, not at the server or the clients. After adding the relay, verify that clients pull 10.10.40.x leases before you call it fixed.
What pattern runs through all five?
None is pure recall. Each takes one fact and asks you to apply it to a situation with some noise in it, which matches the objectives themselves: ten of the 25 open with "Given a scenario". Network+ domains explained lists which ones.
The distractors share a pattern too. In most items, at least one wrong option is a true statement attached to the wrong problem. Differentials really do restore in two steps. You need to know which question a fact answers, and that is a large part of how hard the Network+ exam feels.
How should you review a Network+ question you got wrong?
Sort every miss into one of three buckets:
-
Did not know the fact. Go back to the objective and relearn it.
-
Knew the fact, misapplied it. You attached a real concept to the wrong scenario, like swapping RTO and RPO. Write the distinction in one line and retest it in a few days.
-
Misread the stem. You missed a clue such as the channel width. Underline each piece of evidence on your second read.
The second bucket is usually the biggest, and it is the one that more questions alone do not fix. Our Network+ study plan builds this kind of review into each week rather than leaving it to the end.
Where can you find more Network+ practice questions?
Once these five make sense, you need volume, sorted by domain so you can see where misses cluster. The CompTIA Network+ N10-009 Study Guide has 164 original practice questions in five domain banks, each with the correct answer explained and every distractor addressed, alongside one chapter for each of the 25 objectives. Work each bank after its chapters and sort your misses into the three buckets.
FAQ
Are these real Network+ exam questions?
No. All five were written for this post from the N10-009 objectives and our study guide's teaching chapters. They test the same skills the objectives describe, but none of them is a recalled exam item, and you should be wary of any source that claims to offer those.
What are performance-based questions on Network+?
They are tasks that ask you to apply a skill rather than pick from four options. CompTIA does not publish how many appear on a given exam or which objectives they come from, so prepare every scenario objective as if it could become one.
How many practice questions should I do before the Network+ exam?
There is no official number. What matters more is that you review every miss and can explain why each wrong option is wrong. A few hundred questions reviewed properly will teach you more than a thousand answered quickly.
Which Network+ domain should I practice most?
Network Troubleshooting carries the most weight at 24%, followed by Networking Concepts at 23%. Weight your practice toward those two, but do not skip Network Security at 14%: its items often hinge on one detail, as Question 4 shows.
Want more questions worked this way? The CompTIA Network+ N10-009 Study Guide covers all 25 N10-009 objectives, one chapter each, with 164 original practice questions across five domain banks and every answer explained.
Simply Certified is an independent publisher. Network+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by CompTIA.