CompTIA Network+ — All Questions

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Trunking
• b.Port mirroring (SPAN)✓
• c.Link aggregation
• d.Port security

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Disable all monitoring during the change
• b.Obtain approval and prepare a rollback plan✓
• c.Skip documentation to save time
• d.Immediately push the change during peak hours

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Warm site
• b.Cold site
• c.Mirror archive
• d.Hot site✓

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Get
• b.Trap✓
• c.Walk
• d.Poll

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Latency
• b.Throughput✓
• c.Frequency
• d.Bandwidth

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Bill of materials
• b.Wiring schematic
• c.Acceptable Use Policy✓
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.Proxy ARP
• b.DNS forwarding
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RTO
• d.RPO✓

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Disabling all remote management
• b.Relying only on factory defaults
• c.Configuration management and automation tools✓
• d.Manually typing commands on each device

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.LDAP
• b.SNMP
• c.NTP✓
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which access control method assigns permissions to users based on their job function within an organization?

• a.Discretionary access control
• b.Rule-based access control
• c.Role-based access control✓
• d.Mandatory access control

Role-based access control (RBAC) grants permissions according to a user's role or job function, simplifying administration at scale. Users inherit access by being placed into roles rather than being assigned rights individually. This supports least-privilege principles.

A firewall rule set should end with which type of rule to enforce a secure default posture?

• a.An implicit or explicit deny-all✓
• b.A permit-all to any destination
• c.A rule allowing all ICMP
• d.A rule opening all high ports

A secure firewall enforces a default-deny posture, so any traffic not explicitly permitted is blocked by an implicit or explicit deny-all rule. This follows the principle of least privilege for network access. Permit-all rules undermine the firewall's purpose.

Which attack floods a switch's MAC address table to force it to broadcast frames out all ports?

• a.MAC flooding✓
• b.DNS poisoning
• c.ARP spoofing
• d.Smurf attack

MAC flooding overwhelms a switch's MAC address table, causing it to fail open and flood frames out all ports so an attacker can capture traffic. Port security limiting MAC addresses per port mitigates this. It exploits the finite size of the CAM table.

Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a corporate network?

• a.VLAN
• b.VPN✓
• c.DMZ
• d.NAT

A VPN establishes an encrypted tunnel across untrusted networks, allowing remote users to securely access internal resources. IPsec and SSL/TLS are common VPN technologies. The encryption protects confidentiality and integrity in transit.

Which network segment is designed to host public-facing servers while isolating them from the internal LAN?

• a.Loopback interface
• b.Native VLAN
• c.Broadcast domain
• d.Screened subnet (DMZ)✓

A screened subnet, commonly called a DMZ, hosts public-facing services like web and mail servers in an isolated zone between the internet and the internal network. If a DMZ host is compromised, the internal LAN remains protected. Firewalls control traffic in and out of the DMZ.

Which authentication framework provides port-based network access control, often used with RADIUS for wired and wireless clients?

• a.802.3af
• b.802.1X✓
• c.802.1Q
• d.802.11ac

IEEE 802.1X provides port-based network access control, requiring clients to authenticate, often against a RADIUS server, before gaining network access. It is widely used for both wired ports and wireless networks. This prevents unauthorized devices from connecting.

An attacker sends forged ARP replies to associate their MAC with the default gateway's IP. What is this attack called?

• a.SYN flooding
• b.Session hijacking via cookies
• c.ARP poisoning✓
• d.Port scanning

ARP poisoning sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, enabling on-path interception. Dynamic ARP Inspection and static ARP entries mitigate it. It is a classic on-path (man-in-the-middle) technique.

Which principle dictates that users and processes should receive only the minimum access necessary to perform their tasks?

• a.Zero trust
• b.Separation of duties
• c.Least privilege✓
• d.Defense in depth

The principle of least privilege grants only the minimum access required, limiting the damage from compromised accounts or mistakes. It is a foundational security control. Regular access reviews help maintain it over time.

Which device inspects traffic and can actively block malicious activity inline, rather than only alerting on it?

• a.IDS
• b.IPS✓
• c.Proxy cache
• d.Syslog server

An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time. An IDS, by contrast, only detects and alerts without stopping the traffic. Inline placement is what enables prevention.

Which switch feature limits the number of MAC addresses learned on a port and can shut the port down if violated?

• a.Dynamic ARP inspection
• b.DHCP snooping
• c.BPDU guard
• d.Port security✓

Port security restricts how many MAC addresses a switch port learns and can take actions like shutting the port down on a violation. This mitigates MAC flooding and unauthorized device connections. Violation modes include protect, restrict, and shutdown.

Which authentication factor category does a hardware token or smartphone authenticator app represent?

• a.Something you have✓
• b.Something you know
• c.Something you are
• d.Somewhere you are

A hardware token or authenticator app is a 'something you have' factor, since it is a physical or possessed item. Passwords are 'something you know' and biometrics are 'something you are.' Combining factor categories creates multifactor authentication.

Which feature validates DHCP messages and blocks rogue DHCP servers on untrusted switch ports?

• a.Port mirroring
• b.MAC filtering
• c.DHCP snooping✓
• d.Link aggregation

DHCP snooping designates trusted and untrusted ports, dropping DHCP server responses on untrusted ports to block rogue DHCP servers. It also builds a binding table used by Dynamic ARP Inspection. This protects clients from receiving malicious configuration.

Which social engineering attack uses fraudulent emails that appear legitimate to trick users into revealing credentials?

• a.Dumpster diving
• b.Tailgating
• c.Phishing✓
• d.Shoulder surfing

Phishing uses deceptive emails impersonating trusted entities to lure users into disclosing credentials or clicking malicious links. Targeted variants include spear phishing and whaling. User awareness training is a primary defense.

Which security model assumes no implicit trust and verifies every request regardless of network location?

• a.Flat network model
• b.Zero trust✓
• c.Perimeter security
• d.Open access model

Zero trust assumes no user or device is inherently trusted, requiring continuous verification of every access request regardless of location. It shifts security away from a trusted internal perimeter. Microsegmentation and strong identity verification support the model.

According to the structured troubleshooting methodology, what is the first step when addressing a network problem?

• a.Escalate to the vendor
• b.Identify the problem and gather information✓
• c.Document findings and outcomes
• d.Implement the solution immediately

The methodology begins with identifying the problem by gathering information, questioning users, and determining the scope. Jumping straight to solutions risks fixing the wrong thing. Later steps include establishing a theory, testing it, and documenting.

After establishing a theory of probable cause, what is the next step in the troubleshooting process?

• a.Test the theory to determine the cause✓
• b.Document the solution
• c.Verify full system functionality
• d.Establish a plan of action

Once a theory of probable cause is formed, the next step is to test that theory to confirm or refute it. If confirmed, a plan of action follows; if not, a new theory is formed. This disciplined loop prevents wasted effort.

A user cannot reach any website by name but can ping external IP addresses directly. Which service is most likely misconfigured?

• a.DNS✓
• b.DHCP
• c.NTP
• d.STP

Being able to ping IPs but not resolve names points to a DNS problem, since name resolution is failing while basic IP connectivity works. Checking the client's DNS server settings is the logical next step. This isolates the layer where the fault lies.

A client receives an address in the 169.254.x.x range. What does this most likely indicate?

• a.A correctly assigned public IP
• b.Failure to reach a DHCP server✓
• c.Successful DNS resolution
• d.A static IP misconfiguration

A 169.254.x.x APIPA address indicates the client could not obtain an address from a DHCP server and self-assigned a link-local address. This points to a DHCP or connectivity problem. Such a host can only communicate on the local link.

Which command-line tool traces the path packets take to a destination, revealing each hop along the way?

• a.ping
• b.traceroute✓
• c.nslookup
• d.arp

Traceroute (or tracert on Windows) maps each router hop between source and destination, helping locate where connectivity breaks or slows. It works by incrementing the TTL to elicit responses from intermediate routers. It complements ping for path analysis.

Two devices on the same subnet cannot communicate, and one shows a duplicate IP address error. What is the likely cause?

• a.An IP address conflict✓
• b.An expired SSL certificate
• c.A DNS misconfiguration
• d.A routing loop

A duplicate IP address error indicates two devices have been assigned the same IP, causing an address conflict that disrupts communication. Resolving it means reassigning one device, often via DHCP reservation or corrected static settings. ARP entries may need clearing afterward.

A fiber link shows very high signal loss and intermittent connectivity. Which physical issue is a likely cause?

• a.A DHCP scope exhaustion
• b.A missing default gateway
• c.An incorrect VLAN assignment
• d.A dirty or damaged fiber connector✓

Dirty, scratched, or damaged fiber connectors cause high signal attenuation and intermittent link problems. Cleaning connectors and inspecting for damage is a standard first check. Optical power meters help quantify the loss.

Users on one switch experience slow performance, and the interface shows a rising count of CRC errors. What does this most likely indicate?

• a.A cabling or physical layer fault✓
• b.A misconfigured default route
• c.A DNS resolution delay
• d.An exhausted DHCP scope

Rising CRC errors point to a physical layer problem such as a damaged cable, bad connector, or electromagnetic interference corrupting frames. Replacing the cable and checking for interference sources is warranted. CRC errors indicate frames arriving corrupted.

Which tool would a technician use to verify that a newly terminated Ethernet cable has correct pinouts and no opens or shorts?

• a.Cable tester✓
• b.Spectrum analyzer
• c.Loopback plug
• d.Tone generator

A cable tester checks continuity, correct pin mapping, and faults such as opens, shorts, or miswires on a terminated cable. It confirms the termination follows the intended standard. A tone generator, by contrast, helps trace and locate cables.

A wireless client experiences a weak signal and frequent disconnects far from the access point. Which term describes this coverage limitation?

• a.Channel overlap
• b.Broadcast storm
• c.Low signal-to-noise ratio / attenuation✓
• d.Jitter

A weak signal at distance reflects attenuation and a low signal-to-noise ratio, degrading throughput and causing disconnects. Solutions include repositioning the AP, adding access points, or adjusting antennas. A site survey helps map coverage gaps.

Which command displays a host's current IP configuration, including address, subnet mask, and default gateway, on Windows?

• a.ipconfig✓
• b.ping
• c.route add
• d.telnet

The ipconfig command on Windows displays the host's IP address, subnet mask, and default gateway, with /all showing DNS and DHCP details. The equivalent on Linux is ifconfig or ip addr. It is a first step in verifying local configuration.

A network experiences a sudden broadcast storm after a technician added a second cable between two switches. What is the most likely cause?

• a.A DNS misconfiguration
• b.An expired DHCP lease
• c.A switching loop from a redundant link without STP✓
• d.An incorrect subnet mask

Adding a redundant link between switches without a working Spanning Tree Protocol creates a Layer 2 loop, producing a broadcast storm. Enabling or verifying STP resolves it. Broadcast storms rapidly saturate switch bandwidth and CPU.

Which utility resolves a hostname to its IP address and can query specific DNS record types?

• a.ipconfig
• b.netstat
• c.nslookup✓
• d.ping

The nslookup utility queries DNS servers to resolve hostnames and can request specific record types such as MX or CNAME. It is invaluable for diagnosing name-resolution issues. The dig command offers similar functionality on Unix-like systems.

A user reports they can access internal resources but not the internet. Other users are unaffected. What should the technician check first on that host?

• a.The host's default gateway and DNS settings✓
• b.The core router's routing table
• c.The ISP's SLA compliance
• d.The entire building's fiber uplink

Because only one user is affected, the problem is likely local to that host, so checking its default gateway and DNS settings comes first. A missing or wrong gateway would block internet access while local resources on the same subnet remain reachable. Isolating scope narrows the fault quickly.

Which command tests basic reachability to a remote host by sending ICMP echo requests?

• a.arp
• b.nbtstat
• c.ping✓
• d.tracert

The ping command sends ICMP echo requests and measures replies to test basic reachability and round-trip time. Successful replies confirm Layer 3 connectivity. Lack of replies may indicate a down host, filtering, or a routing problem.

An access switch port connected to a PC keeps going into an err-disabled state. Which security feature most likely triggered this?

• a.Quality of Service
• b.Link aggregation
• c.Spanning tree root guard
• d.Port security violation✓

A port security violation can place a port into err-disabled state when it detects more MAC addresses than allowed. Reviewing the configured maximum and violation mode reveals the cause. Clearing the condition and correcting the setup restores the port.

Intermittent connectivity affects devices only during business hours, correlating with heavy equipment operation nearby. Which cabling issue is the likely culprit?

• a.Incorrect DNS server
• b.Electromagnetic interference (EMI) on copper cabling✓
• c.A duplicate default gateway
• d.Exhausted DHCP scope

Interference from nearby heavy equipment induces EMI on unshielded copper cabling, causing errors and intermittent connectivity that tracks with equipment use. Rerouting cable away from the source or using shielded cable or fiber resolves it. The time-based correlation is a strong clue.

A pair of switch ports negotiated a duplex mismatch. Which symptom is most characteristic of this condition?

• a.Late collisions and slow throughput✓
• b.Complete loss of link
• c.APIPA addressing
• d.DNS resolution failures

A duplex mismatch, where one side is full and the other half duplex, typically causes late collisions, frame errors, and poor throughput rather than a total link failure. Setting both ends to the same duplex, or both to autonegotiate, resolves it. Late collisions on a full-duplex link are a telltale sign.

After confirming a fix resolves the reported issue, which troubleshooting step should be performed next?

• a.Reboot every device on the network
• b.Escalate the issue to management
• c.Verify full system functionality and implement preventive measures✓
• d.Immediately close the ticket without testing

After implementing a fix, the technician should verify full system functionality and, if applicable, apply preventive measures to keep the issue from recurring. This confirms the solution truly worked end to end. Documentation follows as the final step.

A technician suspects a specific cable among many in a bundle. Which tool pair helps locate and identify that individual cable?

• a.Cable tester and loopback plug
• b.Multimeter and OTDR
• c.Protocol analyzer and syslog
• d.Tone generator and inductive probe✓

A tone generator places a signal on a wire, and the inductive probe detects that tone to locate and identify the specific cable within a bundle. This is standard practice for tracing cables in patch panels or ceilings. It complements continuity testing.

A server's throughput is far below the link's rated speed, and interface counters show many output drops during peak traffic. What is the likely cause?

• a.A DNS misconfiguration
• b.A duplicate IP address
• c.An incorrect default gateway
• d.Congestion causing the interface queue to overflow✓

Output drops during peak traffic indicate the interface queue is overflowing due to congestion, so packets are discarded when buffers fill. QoS, increased capacity, or traffic shaping can relieve it. The correlation with peak load confirms congestion rather than a config error.

Which command shows active TCP/UDP connections and listening ports on a local host?

• a.arp
• b.ping
• c.tracert
• d.netstat✓

The netstat command lists active connections, listening ports, and associated states on the local host. It helps confirm whether a service is listening and which remote endpoints are connected. It is useful for diagnosing application and port issues.

The final step of the troubleshooting methodology is to document the findings, actions, and outcomes. Why is this step important?

• a.It builds a knowledge base that speeds resolution of future similar issues✓
• b.It automatically prevents all future outages
• c.It eliminates the need for change management
• d.It replaces the need for network monitoring

Documenting findings, actions, and outcomes creates a knowledge base that helps resolve similar future problems faster and informs others. It also supports auditing and accountability. Skipping documentation loses valuable troubleshooting insight.

Which Layer 3 switch feature provides a virtual interface used to route traffic for a VLAN without a separate router?

• a.A loopback plug
• b.A switched virtual interface (SVI)✓
• c.A native VLAN
• d.A trunk port

A switched virtual interface (SVI) is a virtual Layer 3 interface on a multilayer switch that routes traffic for an associated VLAN. This enables inter-VLAN routing entirely within the switch, avoiding router-on-a-stick. Each routed VLAN typically has its own SVI acting as the default gateway.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A direct/private cloud interconnect✓
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A site-to-site VPN over the internet

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.

A newly connected device gets no link light and no connectivity, while other ports on the same switch work. What should the technician verify first?

• a.The corporate DNS zone file
• b.The ISP's routing table
• c.The patch cable and physical port connection✓
• d.The organization's SLA terms

With a dead port while neighbors work, the fault is almost certainly local, so the technician should first verify the patch cable and physical connection, swapping the cable and trying another port. A missing link light points to a Layer 1 problem rather than addressing or routing. Confirming physical connectivity comes before higher-layer checks.