CompTIA Network+ — All Questions

Which OSI layer provides reliable, connection-oriented delivery with segmentation, sequencing, and flow control?

• a.Layer 4 (Transport)✓
• b.Layer 5 (Session)
• c.Layer 3 (Network)
• d.Layer 6 (Presentation)

The Transport layer (Layer 4) handles end-to-end delivery, breaking data into segments, sequencing them, and managing flow control and, in TCP, retransmission. The Network layer routes packets but does not guarantee delivery. TCP is the classic Layer 4 protocol that provides these reliability features.

At which OSI layer are data formatting, character encoding, compression, and encryption or decryption handled?

• a.Layer 7 (Application)
• b.Layer 2 (Data Link control)
• c.Layer 4 (Transport)
• d.Layer 6 (Presentation)✓

The Presentation layer (Layer 6) translates data between the application and the network, handling formatting, character encoding, compression, and encryption. It ensures data from the sender is readable by the receiver. TLS encryption is often associated with this layer's functions.

Which OSI layer establishes, maintains, and terminates dialogues between two communicating hosts?

• a.Layer 4 (Transport)
• b.Layer 5 (Session)✓
• c.Layer 7 (Application)
• d.Layer 6 (Presentation)

The Session layer (Layer 5) sets up, manages, and tears down the sessions or dialogues between applications on different hosts. It can also handle checkpointing and reestablishing dropped connections. It sits above Transport and below Presentation in the stack.

Which OSI layer defines voltage levels, pin assignments, and the encoding of bits into electrical, optical, or radio signals?

• a.Layer 4 (Transport)
• b.Layer 3 (Network)
• c.Layer 2 (Data Link)
• d.Layer 1 (Physical)✓

The Physical layer (Layer 1) defines the physical and electrical characteristics of the medium, including voltage, pinouts, cabling, and how bits become signals. Hubs, cables, and connectors operate here. It is concerned only with transmitting raw bits, not their meaning.

The Data Link layer encapsulates packets into which protocol data unit before placing them on the local medium?

• a.Packet
• b.Frame✓
• c.Datagram
• d.Segment

At the Data Link layer (Layer 2), packets from the Network layer are encapsulated into frames that include source and destination MAC addresses and error-checking. Segments belong to the Transport layer and packets to the Network layer. Framing prepares data for delivery across the local link.

Protocols such as HTTP, SMTP, and FTP that provide services directly to user applications operate at which OSI layer?

• a.Layer 5 (Session)
• b.Layer 6 (Presentation)
• c.Layer 7 (Application)✓
• d.Layer 4 (Transport)

The Application layer (Layer 7) is where protocols that interface directly with user-facing applications, such as HTTP, SMTP, and FTP, operate. It provides network services to applications rather than to end users directly. It is the top layer of the OSI model.

As data moves down the OSI stack from a sending host, in what order is it encapsulated?

• a.Bits, frames, packets, segments, data
• b.Packets, segments, frames, data, bits
• c.Data, segments, packets, frames, bits✓
• d.Frames, packets, segments, data, bits

Encapsulation proceeds top down: application data becomes segments at Transport, packets at Network, frames at Data Link, and finally bits at the Physical layer. Each layer adds its own header (and the Data Link layer a trailer). The receiving host reverses this order during de-encapsulation.

At the Network layer, a segment received from the Transport layer is encapsulated into which protocol data unit?

• a.Segment
• b.Packet✓
• c.Bit
• d.Frame

The Network layer (Layer 3) adds logical addressing to form a packet from the Transport layer's segment. Frames are formed at Layer 2 and bits exist at Layer 1. Routers forward packets based on the destination IP in the Layer 3 header.

In a full-mesh topology of 6 nodes, how many direct point-to-point links are required?

• a.15✓
• b.30
• c.6
• d.12

A full mesh connects every node to every other node, requiring n(n-1)/2 links. For 6 nodes that is 6 times 5 divided by 2, which equals 15. Full mesh offers maximum redundancy but grows expensive quickly as nodes increase.

Which topology connects multiple remote sites back to a single central hub site, minimizing links but creating a single point of failure at the center?

• a.Bus
• b.Ring
• c.Full mesh
• d.Hub-and-spoke✓

In a hub-and-spoke topology, each remote spoke site connects only to a central hub, reducing the number of links compared with a mesh. The trade-off is that the hub becomes a single point of failure and a potential bottleneck. It is common in WAN designs for cost efficiency.

Which data center fabric design connects every leaf switch to every spine switch to provide predictable, low-latency east-west traffic?

• a.Token ring
• b.Three-tier collapsed core
• c.Bus backbone
• d.Spine-and-leaf✓

A spine-and-leaf fabric links each leaf (access) switch to every spine switch, so any server is at most two hops from any other. This yields consistent latency and high bandwidth for east-west traffic in modern data centers. It scales better than traditional three-tier designs for server-to-server flows.

In the classic three-tier hierarchical campus model, which layer aggregates access switches and enforces routing and policy between them?

• a.Distribution layer✓
• b.Physical layer
• c.Core layer
• d.Access layer

The distribution (aggregation) layer sits between access and core, aggregating access-layer uplinks and applying routing, filtering, and policy. The access layer connects end devices, and the core provides high-speed backbone transport. Separating these roles improves scalability and manageability.

Which network type spans a city or metropolitan area, larger than a LAN but smaller than a WAN?

• a.SAN
• b.PAN
• c.MAN✓
• d.WLAN

A Metropolitan Area Network (MAN) covers a city or metro region, bridging the gap between a local LAN and a wide-area WAN. It often interconnects multiple campuses within the same city. Service providers frequently deliver MAN services over fiber.

Which specialized network provides block-level access to consolidated storage, appearing to servers as locally attached disks?

• a.Campus area network (CAN)
• b.Personal area network (PAN)
• c.Wireless LAN (WLAN)
• d.Storage area network (SAN)✓

A Storage Area Network (SAN) delivers block-level storage over a dedicated high-speed network so servers treat remote volumes as if locally attached. Technologies include Fiber Channel and iSCSI. This differs from file-level NAS, which presents shares over the LAN.

A wireless connection between a smartphone and nearby earbuds over Bluetooth is an example of which network type?

• a.Storage area network (SAN)
• b.Personal area network (PAN)✓
• c.Metro area network (MAN)
• d.Wide area network (WAN)

A Personal Area Network (PAN) interconnects devices within a person's immediate range, typically a few meters, often over Bluetooth. Pairing a phone with earbuds or a smartwatch is a common example. PANs are the smallest scope among network types.

Which technology uses centralized, software-based policy to steer traffic across multiple transport links such as MPLS, broadband, and LTE between sites?

• a.VLSM
• b.STP
• c.PoE
• d.SD-WAN✓

Software-Defined WAN (SD-WAN) abstracts the underlying transports and uses centralized policy to route application traffic over the best available link. It can combine MPLS, broadband, and cellular for resilience and cost savings. It improves agility compared with traditional static WAN routing.

Which copper cabling category is required to reliably support 10GBASE-T over the full 100-meter distance?

• a.Cat 3
• b.Cat 6a✓
• c.Cat 5e
• d.Cat 5

Category 6a cabling supports 10GBASE-T at the full 100-meter distance with improved alien crosstalk performance. Cat 6 can carry 10 Gbps but only to about 55 meters. Cat 5e tops out at 1 Gbps for typical runs.

Which small-form-factor fiber connector uses a 1.25 mm ferrule and a latching clip, and is common on SFP transceivers?

• a.LC✓
• b.BNC
• c.F-type
• d.ST

The LC (Lucent Connector) uses a compact 1.25 mm ferrule and a push-pull latch, making it ideal for high-density SFP and SFP+ ports. ST and SC are larger 2.5 mm connectors. BNC and F-type are coaxial, not fiber, connectors.

Which transceiver form factor supports a single 10 Gbps link and is widely used in switch uplinks?

• a.RJ45
• b.SFP+✓
• c.GBIC
• d.QSFP28 (100 Gbps quad channel)

SFP+ is an enhanced small form-factor pluggable transceiver rated for 10 Gbps on a single lane. GBIC is an older, larger 1 Gbps module. QSFP variants bundle four lanes for 40 or 100 Gbps, so they are not single-link 10 Gbps modules.

Which fiber type uses a larger core, typically 50 or 62.5 microns, with LED or VCSEL light sources for shorter, cost-effective runs?

• a.Multimode fiber✓
• b.Single-mode fiber
• c.Twinaxial cable
• d.Coaxial cable

Multimode fiber has a larger core that allows multiple light paths, working well for shorter distances with inexpensive LED or VCSEL sources. Single-mode fiber has a tiny core and laser sources for very long distances. Multimode is common inside data centers and buildings.

Which cable rating is required when cabling runs through air-handling spaces because it produces less toxic smoke when burned?

• a.Riser (CMR)
• b.Shielded (STP)
• c.Direct-burial
• d.Plenum (CMP)✓

Plenum-rated cable (CMP) has a fire-resistant jacket that emits less toxic smoke, so it is required in plenum air spaces above ceilings or under raised floors. Riser cable is for vertical shafts between floors but not plenum spaces. Local fire codes mandate plenum cable in these areas.

Which connector is threaded onto coaxial cable to deliver cable-internet or CATV service to a modem?

• a.LC
• b.RJ11
• c.SC
• d.F-type✓

The F-type connector screws onto coaxial cable and is standard for cable television and cable-modem internet service. LC and SC are fiber connectors, while RJ11 is for telephone lines. Coax with F-connectors is common on the last mile of cable networks.

Which short-reach copper assembly with attached transceivers, known as a DAC, is commonly used for top-of-rack switch-to-server links?

• a.Coaxial RG-6
• b.Twinaxial cable✓
• c.Single-mode fiber
• d.Cat 5e patch cord

A Direct Attach Copper (DAC) cable uses twinaxial copper with transceivers permanently attached to each end, providing a low-cost, low-power option for short 10 to 100 Gbps links inside a rack. It is cheaper than optics for these short distances. It is popular for top-of-rack connectivity.

Which fiber connector bundles 12 or more fibers into one housing and is often used to break out 40G or 100G into multiple lanes?

• a.ST
• b.MPO/MTP✓
• c.SC simplex
• d.LC duplex

The MPO/MTP connector groups many fibers (commonly 12 or 24) into a single rectangular housing, enabling high-density parallel optics for 40G and 100G. It can be broken out into multiple duplex LC links. It is widely used in data-center fiber trunking.

A traditional analog telephone line typically terminates in which small connector with fewer conductors than an Ethernet jack?

• a.LC
• b.RJ45
• c.BNC
• d.RJ11✓

The RJ11 connector, with its two to four conductors, is used for analog telephone and some DSL connections. RJ45 is the eight-conductor connector used for Ethernet. The two look similar but RJ11 is noticeably narrower.

How many usable host addresses does a /26 subnet provide?

• a.126
• b.30
• c.64
• d.62✓

A /26 leaves 6 host bits, giving 2 to the 6th power, or 64 total addresses, minus the network and broadcast addresses, for 62 usable hosts. Always subtract two reserved addresses from the total. A /26 is a common size for medium departmental subnets.

The subnet mask 255.255.255.240 corresponds to which CIDR prefix length?

• a./27
• b./29
• c./28✓
• d./26

The last octet 240 is 11110000 in binary, which is four network bits added to the 24 in the first three octets, totaling 28. So 255.255.255.240 equals /28. Each /28 subnet provides 14 usable hosts.

Host 10.1.5.130 with a /25 mask belongs to which subnet network address?

• a.10.1.5.128✓
• b.10.1.5.0
• c.10.1.5.64
• d.10.1.5.96

A /25 splits the last octet into blocks of 128, producing subnets .0 and .128. The host .130 falls in the second block, so its network address is 10.1.5.128. The broadcast for that subnet would be 10.1.5.255.

A /30 subnet, commonly used for point-to-point router links, provides how many usable host addresses?

• a.6
• b.1
• c.4
• d.2✓

A /30 leaves 2 host bits, giving 4 total addresses minus the network and broadcast, for 2 usable hosts. That is exactly enough for the two ends of a point-to-point link. This efficiency is why /30 is traditional for router interconnections.

How many /27 subnets can be created from a single /24 network?

• a.16
• b.4
• c.32
• d.8✓

Moving from /24 to /27 borrows 3 host bits, and 2 to the 3rd power equals 8 subnets. Each /27 provides 30 usable hosts. The formula 2 to the number of borrowed bits gives the subnet count.

What is the broadcast address of the network 172.16.4.0/22?

• a.172.16.255.255
• b.172.16.7.255✓
• c.172.16.4.255
• d.172.16.4.63

A /22 mask is 255.255.252.0, giving a block size of 4 in the third octet, so 172.16.4.0 spans 172.16.4.0 through 172.16.7.255. The broadcast address is therefore 172.16.7.255. The last usable host is 172.16.7.254.

An IPv6 address is composed of how many bits?

• a.256
• b.128✓
• c.64
• d.32

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits. This vastly expands the address space compared with IPv4's 32 bits. The larger space removes the practical scarcity that drove IPv4 NAT adoption.

Which IPv6 prefix is reserved for unique local addresses, the rough equivalent of IPv4 RFC 1918 private space?

• a.FF00::/8
• b.FC00::/7✓
• c.2000::/3
• d.FE80::/10

Unique local addresses use the FC00::/7 range (in practice FD00::/8) and are routable within an organization but not on the public internet. FE80::/10 is link-local, FF00::/8 is multicast, and 2000::/3 is global unicast. ULAs provide private-style addressing for IPv6.

Which IPv6 address is the loopback used to test the local protocol stack?

• a.FF02::1
• b.FE80::1
• c.::
• d.::1✓

The IPv6 loopback address is ::1, the equivalent of 127.0.0.1 in IPv4, used to test the local TCP/IP stack. The all-zeros :: is the unspecified address. FF02::1 is the all-nodes multicast address on the local link.

Which IPv6 mechanism lets a host automatically generate its own global address from a router-advertised prefix without a DHCP server?

• a.APIPA
• b.SLAAC✓
• c.NAT66
• d.DHCPv6 stateful

Stateless Address Autoconfiguration (SLAAC) lets a host build its own address by combining the prefix from a Router Advertisement with a locally generated interface identifier. No DHCP server is required. APIPA is an IPv4 concept, and stateful DHCPv6 does track assignments centrally.

Which process forms the 64-bit IPv6 interface identifier from a 48-bit MAC address by inserting FFFE and flipping a bit?

• a.Stateful DHCPv6
• b.Anycast assignment
• c.EUI-64✓
• d.SLAAC prefix delegation

EUI-64 expands a 48-bit MAC into a 64-bit interface identifier by inserting FFFE in the middle and flipping the seventh bit of the first byte. SLAAC often uses EUI-64 to build the host portion of an address. Privacy extensions can replace it with randomized identifiers.

Which address range does a Windows host self-assign when it cannot reach a DHCP server?

• a.172.16.0.0/12
• b.192.168.0.0/16
• c.169.254.0.0/16✓
• d.10.0.0.0/8

APIPA self-assigns an address from 169.254.0.0/16 when no DHCP server responds, allowing local-link communication only. The other ranges are RFC 1918 private blocks that are normally assigned deliberately. Seeing a 169.254 address is a strong sign of a DHCP problem.

Which transition approach runs IPv4 and IPv6 simultaneously on the same interfaces so hosts can use either protocol?

• a.6to4 only
• b.Dual stack✓
• c.Tunneling
• d.NAT64

Dual stack configures both IPv4 and IPv6 on the same interfaces so a host can communicate over whichever protocol a destination supports. It is the most straightforward migration method. Tunneling and NAT64 address cases where only one protocol is available end to end.

Under legacy classful addressing, what is the default subnet mask for a Class B network?

• a.255.255.0.0✓
• b.255.255.255.0
• c.255.255.255.128
• d.255.0.0.0

Class B networks span 128.0.0.0 through 191.255.255.255 and use a default mask of 255.255.0.0, or /16. Class A defaults to 255.0.0.0 and Class C to 255.255.255.0. Modern networks use CIDR rather than rigid classful boundaries.

Which IPv4 address range is reserved for multicast group traffic?

• a.10.0.0.0/8
• b.127.0.0.0/8
• c.224.0.0.0/4✓
• d.169.254.0.0/16

The 224.0.0.0/4 range (224.0.0.0 through 239.255.255.255), historically Class D, is reserved for multicast. Multicast delivers a single stream to many subscribed receivers efficiently. The other ranges are loopback, APIPA, and private unicast respectively.

Which TCP port does FTP use for its control connection carrying commands and responses?

• a.21✓
• b.22
• c.69
• d.20

FTP uses TCP port 21 for the control channel that carries commands and server responses, while port 20 handles active-mode data transfer. Port 22 is SSH and port 69 is TFTP. Separating control and data is a defining trait of FTP.

Which well-known TCP port is used by SMTP to relay email between mail servers?

• a.993
• b.110
• c.143
• d.25✓

SMTP uses TCP port 25 to transfer email between servers. Ports 110 and 143 are POP3 and IMAP for retrieval, and 993 is secure IMAP. Submission from clients often uses port 587 with authentication.

Which TCP port does IMAP use by default to retrieve and synchronize email from a server?

• a.25
• b.110
• c.389
• d.143✓

IMAP uses TCP port 143 and, unlike POP3, keeps messages on the server and synchronizes folder state across devices. POP3 on port 110 typically downloads and deletes mail. Secure IMAP over TLS uses port 993.

On which UDP port does an SNMP agent listen for polling requests from a management station?

• a.514
• b.161✓
• c.123
• d.162

SNMP agents listen on UDP port 161 for get and set requests, while traps are sent to the manager on UDP 162. Port 514 is syslog and 123 is NTP. Knowing this pair is key to allowing monitoring through firewalls.

Which TCP port is used by Microsoft's Remote Desktop Protocol for graphical remote sessions?

• a.5900
• b.22
• c.23
• d.3389✓

RDP uses TCP port 3389 to provide graphical remote access to Windows systems. Port 5900 is VNC, port 22 is SSH, and 23 is Telnet. Exposing 3389 directly to the internet is a common security risk.

Which TCP or UDP port does LDAP use for unencrypted directory queries?

• a.636
• b.445
• c.389✓
• d.88

LDAP uses port 389 for standard, unencrypted directory lookups. The secure variant LDAPS uses port 636. Port 88 is Kerberos and 445 is SMB, both common in the same directory environments.

Which TCP port does modern SMB use for Windows file and printer sharing over TCP/IP?

• a.139
• b.137
• c.3389
• d.445✓

Modern SMB (CIFS) runs directly over TCP port 445 for file and printer sharing. Legacy NetBIOS used ports 137 through 139. Port 445 is frequently targeted by worms, so it should be filtered at the perimeter.

Which UDP port do network devices commonly use to send syslog messages to a logging server?

• a.514✓
• b.123
• c.161
• d.69

Syslog traditionally uses UDP port 514 to forward event messages to a central log server. SNMP uses 161, NTP uses 123, and TFTP uses 69. Reliable variants can carry syslog over TCP, sometimes with TLS.

Which TCP port does the insecure, clear-text Telnet remote-terminal protocol use?

• a.23✓
• b.25
• c.22
• d.21

Telnet uses TCP port 23 and transmits everything, including credentials, in clear text. SSH on port 22 is the secure replacement. Telnet should be disabled on production devices for security reasons.

Which UDP port does TFTP use, often for network device firmware and configuration transfers?

• a.161
• b.69✓
• c.20
• d.21

TFTP uses UDP port 69 and is a lightweight, unauthenticated file-transfer protocol often used to load firmware or configs onto network devices. It lacks the reliability and security of FTP. Its simplicity makes it convenient on the LAN but unsafe across untrusted links.