CompTIA Network+ — All Questions

According to the structured troubleshooting methodology, what is the first step when addressing a network problem?

• a.Escalate to the vendor
• b.Identify the problem and gather information✓
• c.Document findings and outcomes
• d.Implement the solution immediately

The methodology begins with identifying the problem by gathering information, questioning users, and determining the scope. Jumping straight to solutions risks fixing the wrong thing. Later steps include establishing a theory, testing it, and documenting.

After establishing a theory of probable cause, what is the next step in the troubleshooting process?

• a.Test the theory to determine the cause✓
• b.Document the solution
• c.Verify full system functionality
• d.Establish a plan of action

Once a theory of probable cause is formed, the next step is to test that theory to confirm or refute it. If confirmed, a plan of action follows; if not, a new theory is formed. This disciplined loop prevents wasted effort.

A user cannot reach any website by name but can ping external IP addresses directly. Which service is most likely misconfigured?

• a.DNS✓
• b.DHCP
• c.NTP
• d.STP

Being able to ping IPs but not resolve names points to a DNS problem, since name resolution is failing while basic IP connectivity works. Checking the client's DNS server settings is the logical next step. This isolates the layer where the fault lies.

A client receives an address in the 169.254.x.x range. What does this most likely indicate?

• a.A correctly assigned public IP
• b.Failure to reach a DHCP server✓
• c.Successful DNS resolution
• d.A static IP misconfiguration

A 169.254.x.x APIPA address indicates the client could not obtain an address from a DHCP server and self-assigned a link-local address. This points to a DHCP or connectivity problem. Such a host can only communicate on the local link.

Which command-line tool traces the path packets take to a destination, revealing each hop along the way?

• a.ping
• b.traceroute✓
• c.nslookup
• d.arp

Traceroute (or tracert on Windows) maps each router hop between source and destination, helping locate where connectivity breaks or slows. It works by incrementing the TTL to elicit responses from intermediate routers. It complements ping for path analysis.

Two devices on the same subnet cannot communicate, and one shows a duplicate IP address error. What is the likely cause?

• a.An IP address conflict✓
• b.An expired SSL certificate
• c.A DNS misconfiguration
• d.A routing loop

A duplicate IP address error indicates two devices have been assigned the same IP, causing an address conflict that disrupts communication. Resolving it means reassigning one device, often via DHCP reservation or corrected static settings. ARP entries may need clearing afterward.

A fiber link shows very high signal loss and intermittent connectivity. Which physical issue is a likely cause?

• a.A DHCP scope exhaustion
• b.A missing default gateway
• c.An incorrect VLAN assignment
• d.A dirty or damaged fiber connector✓

Dirty, scratched, or damaged fiber connectors cause high signal attenuation and intermittent link problems. Cleaning connectors and inspecting for damage is a standard first check. Optical power meters help quantify the loss.

Users on one switch experience slow performance, and the interface shows a rising count of CRC errors. What does this most likely indicate?

• a.A cabling or physical layer fault✓
• b.A misconfigured default route
• c.A DNS resolution delay
• d.An exhausted DHCP scope

Rising CRC errors point to a physical layer problem such as a damaged cable, bad connector, or electromagnetic interference corrupting frames. Replacing the cable and checking for interference sources is warranted. CRC errors indicate frames arriving corrupted.

Which tool would a technician use to verify that a newly terminated Ethernet cable has correct pinouts and no opens or shorts?

• a.Cable tester✓
• b.Spectrum analyzer
• c.Loopback plug
• d.Tone generator

A cable tester checks continuity, correct pin mapping, and faults such as opens, shorts, or miswires on a terminated cable. It confirms the termination follows the intended standard. A tone generator, by contrast, helps trace and locate cables.

A wireless client experiences a weak signal and frequent disconnects far from the access point. Which term describes this coverage limitation?

• a.Channel overlap
• b.Broadcast storm
• c.Low signal-to-noise ratio / attenuation✓
• d.Jitter

A weak signal at distance reflects attenuation and a low signal-to-noise ratio, degrading throughput and causing disconnects. Solutions include repositioning the AP, adding access points, or adjusting antennas. A site survey helps map coverage gaps.

Which command displays a host's current IP configuration, including address, subnet mask, and default gateway, on Windows?

• a.ipconfig✓
• b.ping
• c.route add
• d.telnet

The ipconfig command on Windows displays the host's IP address, subnet mask, and default gateway, with /all showing DNS and DHCP details. The equivalent on Linux is ifconfig or ip addr. It is a first step in verifying local configuration.

A network experiences a sudden broadcast storm after a technician added a second cable between two switches. What is the most likely cause?

• a.A DNS misconfiguration
• b.An expired DHCP lease
• c.A switching loop from a redundant link without STP✓
• d.An incorrect subnet mask

Adding a redundant link between switches without a working Spanning Tree Protocol creates a Layer 2 loop, producing a broadcast storm. Enabling or verifying STP resolves it. Broadcast storms rapidly saturate switch bandwidth and CPU.

Which utility resolves a hostname to its IP address and can query specific DNS record types?

• a.ipconfig
• b.netstat
• c.nslookup✓
• d.ping

The nslookup utility queries DNS servers to resolve hostnames and can request specific record types such as MX or CNAME. It is invaluable for diagnosing name-resolution issues. The dig command offers similar functionality on Unix-like systems.

A user reports they can access internal resources but not the internet. Other users are unaffected. What should the technician check first on that host?

• a.The host's default gateway and DNS settings✓
• b.The core router's routing table
• c.The ISP's SLA compliance
• d.The entire building's fiber uplink

Because only one user is affected, the problem is likely local to that host, so checking its default gateway and DNS settings comes first. A missing or wrong gateway would block internet access while local resources on the same subnet remain reachable. Isolating scope narrows the fault quickly.

Which command tests basic reachability to a remote host by sending ICMP echo requests?

• a.arp
• b.nbtstat
• c.ping✓
• d.tracert

The ping command sends ICMP echo requests and measures replies to test basic reachability and round-trip time. Successful replies confirm Layer 3 connectivity. Lack of replies may indicate a down host, filtering, or a routing problem.

An access switch port connected to a PC keeps going into an err-disabled state. Which security feature most likely triggered this?

• a.Quality of Service
• b.Link aggregation
• c.Spanning tree root guard
• d.Port security violation✓

A port security violation can place a port into err-disabled state when it detects more MAC addresses than allowed. Reviewing the configured maximum and violation mode reveals the cause. Clearing the condition and correcting the setup restores the port.

Intermittent connectivity affects devices only during business hours, correlating with heavy equipment operation nearby. Which cabling issue is the likely culprit?

• a.Incorrect DNS server
• b.Electromagnetic interference (EMI) on copper cabling✓
• c.A duplicate default gateway
• d.Exhausted DHCP scope

Interference from nearby heavy equipment induces EMI on unshielded copper cabling, causing errors and intermittent connectivity that tracks with equipment use. Rerouting cable away from the source or using shielded cable or fiber resolves it. The time-based correlation is a strong clue.

A pair of switch ports negotiated a duplex mismatch. Which symptom is most characteristic of this condition?

• a.Late collisions and slow throughput✓
• b.Complete loss of link
• c.APIPA addressing
• d.DNS resolution failures

A duplex mismatch, where one side is full and the other half duplex, typically causes late collisions, frame errors, and poor throughput rather than a total link failure. Setting both ends to the same duplex, or both to autonegotiate, resolves it. Late collisions on a full-duplex link are a telltale sign.

After confirming a fix resolves the reported issue, which troubleshooting step should be performed next?

• a.Reboot every device on the network
• b.Escalate the issue to management
• c.Verify full system functionality and implement preventive measures✓
• d.Immediately close the ticket without testing

After implementing a fix, the technician should verify full system functionality and, if applicable, apply preventive measures to keep the issue from recurring. This confirms the solution truly worked end to end. Documentation follows as the final step.

A technician suspects a specific cable among many in a bundle. Which tool pair helps locate and identify that individual cable?

• a.Cable tester and loopback plug
• b.Multimeter and OTDR
• c.Protocol analyzer and syslog
• d.Tone generator and inductive probe✓

A tone generator places a signal on a wire, and the inductive probe detects that tone to locate and identify the specific cable within a bundle. This is standard practice for tracing cables in patch panels or ceilings. It complements continuity testing.

A server's throughput is far below the link's rated speed, and interface counters show many output drops during peak traffic. What is the likely cause?

• a.A DNS misconfiguration
• b.A duplicate IP address
• c.An incorrect default gateway
• d.Congestion causing the interface queue to overflow✓

Output drops during peak traffic indicate the interface queue is overflowing due to congestion, so packets are discarded when buffers fill. QoS, increased capacity, or traffic shaping can relieve it. The correlation with peak load confirms congestion rather than a config error.

Which command shows active TCP/UDP connections and listening ports on a local host?

• a.arp
• b.ping
• c.tracert
• d.netstat✓

The netstat command lists active connections, listening ports, and associated states on the local host. It helps confirm whether a service is listening and which remote endpoints are connected. It is useful for diagnosing application and port issues.

The final step of the troubleshooting methodology is to document the findings, actions, and outcomes. Why is this step important?

• a.It builds a knowledge base that speeds resolution of future similar issues✓
• b.It automatically prevents all future outages
• c.It eliminates the need for change management
• d.It replaces the need for network monitoring

Documenting findings, actions, and outcomes creates a knowledge base that helps resolve similar future problems faster and informs others. It also supports auditing and accountability. Skipping documentation loses valuable troubleshooting insight.

A newly connected device gets no link light and no connectivity, while other ports on the same switch work. What should the technician verify first?

• a.The corporate DNS zone file
• b.The ISP's routing table
• c.The patch cable and physical port connection✓
• d.The organization's SLA terms

With a dead port while neighbors work, the fault is almost certainly local, so the technician should first verify the patch cable and physical connection, swapping the cable and trying another port. A missing link light points to a Layer 1 problem rather than addressing or routing. Confirming physical connectivity comes before higher-layer checks.

A help desk ticket reports 'the network is down.' Before doing anything else in the structured troubleshooting method, what should the technician do first?

• a.Implement a fix immediately
• b.Document the outcome
• c.Identify the problem and gather information✓
• d.Escalate the ticket to the equipment vendor's support line

The first step is to identify the problem by gathering information, questioning users, and determining the scope. Acting before understanding risks fixing the wrong thing. Later steps establish and test a theory, then implement and verify.

A technician has tested and confirmed the probable cause of an outage. According to the methodology, what is the next step?

• a.Establish a plan of action✓
• b.Document the findings and close the ticket
• c.Re-form a new theory from scratch
• d.Verify full system functionality across every device

Once a theory is confirmed, the next step is to establish a plan of action to resolve the problem and identify potential effects. This precedes implementing the solution. Planning reduces the chance the fix causes new issues.

A technician's tested theory turns out to be wrong; the suspected cause is not the real one. What does the methodology say to do next?

• a.Establish a new theory or escalate✓
• b.Implement the disproven fix anyway
• c.Verify full functionality of the entire network before continuing
• d.Document the solution and close out

If testing does not confirm the theory, the technician either establishes a new theory or escalates. Repeatedly forcing a disproven theory wastes time. This disciplined loop keeps troubleshooting evidence-based.

While identifying a problem, a technician asks the user what changed recently and tries to reproduce the failure. These actions belong to which phase of the methodology?

• a.Documenting findings and outcomes
• b.Verifying full system functionality
• c.Establishing a plan of action to resolve the issue
• d.Identifying the problem✓

Questioning users, identifying recent changes, and duplicating the problem are all part of the first phase: identifying the problem. This information shapes the theory that follows. Skipping it leads to guesswork.

After forming a theory that a bad cable is the cause, a technician swaps in a known-good cable to see if the symptom disappears. Which methodology step is this?

• a.Documenting the outcome
• b.Establishing a plan of action for the change
• c.Testing the theory✓
• d.Identifying the problem and its scope

Swapping in a known-good component to see whether the symptom clears is testing the theory to determine the cause. If it confirms the theory, a plan of action follows. If not, a new theory is needed.

A technician has applied a fix and confirmed the reported issue is resolved. Which step comes next before documenting?

• a.Escalate the resolved issue to management for review
• b.Reboot every device on the network as a precaution
• c.Immediately close the ticket without further testing
• d.Verify full functionality and apply preventive measures✓

After implementing the fix, the technician verifies full system functionality and, where applicable, implements preventive measures. This confirms the solution truly worked end to end. Documentation is the final step that follows.

The very last step of the structured troubleshooting methodology is what?

• a.Establish a theory of probable cause
• b.Verify full functionality of the affected systems
• c.Document findings, actions, and outcomes✓
• d.Test the theory to determine the cause

The final step is to document findings, actions, and outcomes, building a knowledge base for future issues and supporting accountability. It captures lessons others can reuse. Skipping it loses valuable insight.

Facing a complex fault, a technician methodically checks from the physical layer upward, confirming each OSI layer before moving to the next. Which troubleshooting approach is this?

• a.Randomly rebooting devices until it works
• b.Immediately replacing all hardware in the affected path
• c.A bottom-up OSI approach✓
• d.Guessing based on the last similar ticket

Working layer by layer up the OSI model (a bottom-up approach) systematically isolates the fault to a specific layer. Top-down and divide-and-conquer are alternative structured approaches. Choosing one prevents random, unfocused checking.

A cable tester on a newly run link shows no continuity on one conductor, indicating the wire is broken somewhere along the run. Which fault is this?

• a.A duplex mismatch negotiated between the two switch ports
• b.Crosstalk between adjacent pairs
• c.A short between two conductors
• d.An open✓

An open is a broken conductor with no continuity end to end, so a signal cannot pass on that wire. A short instead connects two conductors that should be separate. Re-terminating or replacing the cable resolves an open.

A long copper run near other cabling shows signal from one pair bleeding into an adjacent pair, corrupting data at higher speeds. Which impairment is this?

• a.An open circuit
• b.Crosstalk✓
• c.Attenuation over distance
• d.Electromagnetic interference from a nearby motor on the cable path

Crosstalk is the coupling of a signal from one pair into an adjacent pair, degrading data especially at higher frequencies. Proper twist rates and untwisting as little as possible at terminations reduce it. Testers report near-end and far-end crosstalk.

A technician connects two switches with a cable but gets no link, and finds the transmit and receive pairs are not properly crossed for that connection. Which issue is this?

• a.DHCP scope exhaustion
• b.A TX/RX reversal✓
• c.An incorrect default gateway configured on the host
• d.A duplex mismatch

A transmit/receive (TX/RX) reversal means the send and receive pairs are not correctly aligned for the devices, so no link forms. Auto-MDIX often fixes this automatically, but its absence or a miswired cable exposes it. Correcting the pinout or using the right cable type resolves it.

A copper Ethernet run of about 130 meters shows a weak, error-prone signal, while shorter runs are fine. Which cabling limitation explains this?

• a.Crosstalk between pairs
• b.A short circuit in the connector
• c.Attenuation from exceeding the distance limit✓
• d.An IP address conflict between two hosts on the segment

Attenuation is the loss of signal strength over distance, and exceeding the 100-meter copper limit degrades the signal and causes errors. Shorter runs stay within spec and work fine. Fiber or an intermediate switch is needed for longer distances.

A link works intermittently, and inspection reveals a poorly crimped RJ45 plug with loose conductors. Which fault category is this?

• a.A bad connector✓
• b.An oversubscribed uplink dropping packets during peak load
• c.A DNS misconfiguration
• d.A routing loop

A bad connector or failing termination causes intermittent connectivity as loose or misaligned conductors make unreliable contact. Re-terminating with a proper crimp restores a solid connection. Physical inspection and a cable tester confirm it.

A cable passes a basic continuity test but suffers high error rates at gigabit speeds, and testing reveals wires from different pairs were combined. Which wiring fault is this?

• a.Excessive attenuation caused by exceeding the maximum run length
• b.An open circuit
• c.Split pairs✓
• d.A short circuit

Split pairs occur when wires from two different pairs are used together, passing continuity but destroying the twist protection and causing crosstalk at speed. A wire-map test that checks pairing, not just continuity, detects it. Re-terminating to the correct standard fixes it.

A fiber transceiver will not establish a link, and a technician finds the small pluggable optic has a bent pin and a dirty connector end. Which is the most appropriate first action?

• a.Reconfigure the DHCP scope
• b.Clean and reseat or replace the transceiver✓
• c.Change the VLAN assignment on the port
• d.Increase the interface MTU to allow larger frames

Inspecting and cleaning the connector and reseating or replacing a damaged transceiver addresses physical optic faults like bent pins or contamination. Dirty or damaged optics are a common cause of no-link on fiber. Optical inspection tools confirm the condition.

On a fiber patch, no link forms until the technician swaps the two strands at one end. What was the original problem?

• a.The fiber was too short for the optic
• b.The DHCP server had run out of addresses to lease
• c.The switch port was in the wrong VLAN
• d.The fiber transmit and receive strands were reversed✓

On duplex fiber, the transmit strand of one device must reach the receive of the other; if the strands are reversed, no link forms until they are swapped. This TX/RX crossover requirement is easy to overlook. Swapping the strands at one connector resolves it.

A technician plugs a multimode patch cable into a transceiver designed for single-mode fiber and gets high loss or no link. What is the root cause?

• a.An APIPA address assigned to the host
• b.A spanning-tree loop between two switches
• c.A duplex mismatch between the switch ports
• d.A single-mode/multimode fiber mismatch✓

A fiber type mismatch, such as multimode cable with a single-mode optic (or vice versa), causes high loss or link failure. The core sizes and light sources are incompatible. Matching the cable, connector, and optic types resolves it.

An IP camera on a PoE switch loses power under load even though the switch supports PoE, and the switch reports its power budget is fully consumed. What is the likely cause?

• a.The PoE power budget is exhausted✓
• b.An incorrect subnet mask on the switch
• c.A DNS misconfiguration on the camera
• d.A spanning-tree blocking state on the camera's uplink port

Exceeding the switch's total PoE power budget starves later devices of power, causing them to drop even though PoE is supported. Adding a higher-wattage supply, a PoE injector, or fewer powered devices resolves it. Checking the per-port and total budget confirms it.

Copper cabling routed alongside fluorescent lighting and motors shows errors that worsen when the equipment runs. Which remedy directly addresses the cause?

• a.Use shielded cabling or reroute away from the interference✓
• b.Shorten the DHCP lease time
• c.Change the host's DNS server
• d.Increase the switch's MAC address table size

Interference induced on unshielded copper is best addressed with shielded cabling (or rerouting away from the source, or using fiber). Shielding drains the induced noise to ground. The correlation with nearby equipment operation points to EMI.

A user's jack is dead, but testing shows the patch panel port is cross-connected to the wrong switch port than the labeling claims. Which documentation-related fault is this?

• a.A patch panel cross-connect/mapping error✓
• b.Electromagnetic interference on the horizontal cable run
• c.A duplex mismatch
• d.An expired DHCP lease

A patch panel mapping error connects a jack to a different switch port than documented, so the intended configuration never reaches the user. Correcting the cross-connect or updating records resolves it. Accurate labeling prevents this class of mistake.

In a 2.4 GHz deployment, three nearby access points on channels 4, 7, and 9 suffer poor performance from overlapping signals. Which channel plan resolves this?

• a.Set all APs to channel 6
• b.Use channels 1, 6, and 11✓
• c.Raise every AP to maximum transmit power
• d.Bond the channels together into one wide 40 MHz channel

In 2.4 GHz, only channels 1, 6, and 11 are non-overlapping, so assigning adjacent APs to those channels eliminates the overlap. Channels like 4, 7, and 9 partially overlap and interfere. Proper channel reuse is essential in dense deployments.

Wi-Fi in a break room drops out whenever the microwave oven runs, and the interference is not from another access point. Which cause is most likely?

• a.Non-Wi-Fi RF interference✓
• b.An incorrect default gateway on the clients
• c.A DHCP scope that is exhausted
• d.Co-channel interference from another access point on the same channel

Non-Wi-Fi interference from devices like microwave ovens, cordless phones, and Bluetooth radios disrupts the 2.4 GHz band. Its correlation with the microwave running is a strong clue. A spectrum analyzer identifies such non-802.11 sources.

Users in a far corner of the warehouse get very weak Wi-Fi or none at all, while the rest of the floor is fine. Which fix best addresses this coverage gap?

• a.Replace the wired uplink with a higher-category copper cable
• b.Change the SSID name broadcast by the AP
• c.Add an access point to cover the dead zone✓
• d.Shorten the DHCP lease timer

A dead zone from insufficient coverage is resolved by adding an access point (or repositioning/adjusting antennas) to extend signal into the gap. Simply raising power on a distant AP often worsens interference elsewhere. A site survey confirms placement.

A laptop stays connected to a distant access point with a weak signal even after the user walks near a closer AP, hurting performance. What is this behavior called?

• a.A DNS resolution failure
• b.A duplex mismatch between the AP and its wired switch port
• c.A sticky client roaming problem✓
• d.An IP address conflict on the subnet

A sticky client clings to its original AP despite a stronger nearby one, degrading throughput as signal weakens. Tuning roaming thresholds or enabling 802.11k/v/r assistance encourages timely handoff. The client, not the network, decides when to roam.

Several users cannot join the secured Wi-Fi and are repeatedly prompted for the network key, though the signal is strong. Which cause is most likely?

• a.A spanning-tree loop between the AP and the switch
• b.A missing default gateway on the AP
• c.Weak signal at the client location
• d.An incorrect pre-shared key✓

Repeated authentication prompts with a strong signal typically indicate an incorrect pre-shared key (wrong passphrase). Correcting the entered key restores access. Signal strength being fine rules out coverage as the cause.

Older devices cannot connect after an AP is reconfigured, and the AP is set to require a security mode the clients do not support. Which issue is this?

• a.Attenuation from distance to the AP
• b.A security mode mismatch✓
• c.An exhausted DHCP scope
• d.A duplex mismatch on the AP's wired uplink port

A wireless security mode mismatch (for example, requiring WPA3-only while a client supports only WPA2) prevents association. A transitional/mixed mode or matching settings restores compatibility. Verifying supported modes on both ends resolves it.