CompTIA Network+ — All Questions

During a busy all-hands meeting, a single access point serving hundreds of attendees becomes sluggish for everyone, though signal is strong. What is the likely cause?

• a.An incorrect subnet mask on the AP
• b.A dirty fiber connector on the AP's uplink
• c.Too many clients on one access point (overcapacity)✓
• d.A weak signal at every client

AP overcapacity occurs when too many clients share one radio, so airtime contention degrades performance despite good signal. Adding APs or enabling band steering spreads the load. High client counts, not weak signal, are the tell.

A client sees a strong 5 GHz signal near the access point but loses it much sooner than 2.4 GHz as they walk away. Which characteristic explains this?

• a.The client's DHCP lease expired
• b.5 GHz has shorter range than 2.4 GHz✓
• c.The switch port feeding the AP had a duplex mismatch
• d.A default gateway was missing on the client

The 5 GHz band offers higher throughput and less congestion but has shorter range and weaker obstacle penetration than 2.4 GHz. So coverage falls off faster with distance and walls. Band selection trades speed against reach.

To cover a long, narrow corridor from one end, an engineer needs to focus the AP's signal down the hallway rather than spread it in all directions. Which change helps?

• a.Disable SSID broadcast on the AP
• b.Assign the AP a static route to the corridor subnet
• c.Use a shorter DHCP lease
• d.Use a directional antenna✓

A directional antenna focuses RF energy in a specific direction, ideal for long corridors or point-to-point links, versus an omnidirectional antenna that radiates evenly. Matching antenna type and placement to the space improves coverage. Antenna choice is part of RF design.

Wi-Fi is strong in an office but drops sharply behind a room with thick concrete and metal walls. Which factor best explains the loss?

• a.An IP address conflict
• b.A DNS server outage
• c.Signal attenuation from building materials✓
• d.Co-channel interference from a distant access point on channel 11

Dense building materials like concrete and metal cause RF attenuation and reflection, sharply reducing signal behind them. Repositioning or adding an AP on the far side restores coverage. Materials are a key input to any site survey.

Guests connect to the open Wi-Fi and get an IP address, but the sign-in web page that should grant internet access never appears. Which component is likely failing?

• a.The captive portal is not loading✓
• b.The switch uplink is running at half duplex
• c.The antenna is directional instead of omnidirectional
• d.The client is too close to the access point

A captive portal is the web page that authenticates or accepts terms before granting internet access; if it fails to load, users associate but cannot browse. DNS redirection or portal server issues commonly cause this. Verifying the portal and its DNS handling resolves it.

An access point using a 5 GHz channel occasionally goes quiet and moves channels after detecting radar, briefly disrupting clients. Which mechanism causes this?

• a.A sticky client refusing to roam
• b.Crosstalk on the copper cable feeding the access point
• c.An exhausted DHCP scope on the guest VLAN
• d.Dynamic Frequency Selection (DFS) radar avoidance✓

Dynamic Frequency Selection (DFS) requires APs on certain 5 GHz channels to vacate when radar is detected, causing brief channel changes and disruption. Choosing non-DFS channels avoids it where radar is present. It is a regulatory requirement, not a fault.

A technician wants to quickly confirm whether a remote server is reachable at the IP layer and see the round-trip time. Which command is the simplest choice?

• a.ping✓
• b.netstat
• c.nslookup
• d.traceroute, which maps every router hop along the path

Ping sends ICMP echo requests and reports replies and round-trip time, confirming basic Layer 3 reachability. Success shows the path and host are responding. No reply may mean a down host, filtering, or a routing problem.

Users report a site is slow to reach, and a technician wants to see at which router hop along the path latency spikes. Which tool shows per-hop delay?

• a.arp
• b.traceroute✓
• c.ipconfig
• d.netstat, which lists active connections and listening ports

Traceroute (tracert on Windows) lists each router hop and the delay to it, revealing where latency spikes or the path breaks. It increments the TTL to elicit responses from intermediate routers. It complements ping for locating path problems.

A technician suspects a specific DNS record is wrong and wants to query the DNS server directly for that record type. Which tool is appropriate?

• a.ipconfig, which displays the local interface addressing
• b.nslookup✓
• c.ping
• d.netstat

nslookup (or dig) queries DNS servers directly and can request specific record types such as MX, A, or CNAME. It isolates name-resolution problems from other issues. Comparing results across resolvers reveals inconsistencies.

A Windows client is stuck with a bad DHCP lease, and a technician wants to force it to drop the current address and request a fresh one. Which commands accomplish this?

• a.nslookup and arp
• b.ping and traceroute
• c.ipconfig /release and /renew✓
• d.netstat combined with the route print command

Running ipconfig /release then ipconfig /renew forces the client to give up its lease and request a new one from the DHCP server. This resolves stale or incorrect leases. It is a quick fix for many client addressing problems.

A technician wants to see which TCP ports a server is currently listening on and what connections are established. Which command shows this?

• a.ping
• b.netstat✓
• c.tracert
• d.nslookup, which resolves hostnames to addresses

netstat lists active connections, listening ports, and their states on the local host. It confirms whether a service is listening and which endpoints are connected. It is a first check when an application will not accept connections.

A host cannot reach a device on its own subnet, and a technician wants to view the cached IP-to-MAC mappings the host has learned. Which command displays this table?

• a.ping -t
• b.arp -a✓
• c.ipconfig /all
• d.netstat -r, which prints the local routing table

The arp -a command displays the ARP cache, mapping recently contacted IP addresses to their MAC addresses. A wrong or missing entry can explain local delivery failures. Clearing a stale entry can restore connectivity.

A technician wants a single tool that both traces the path to a destination and, over time, measures packet loss at each hop. Which utility combines these?

• a.arp
• b.pathping/mtr✓
• c.ipconfig
• d.nslookup, used to query DNS record types

Pathping (Windows) and mtr (Unix) combine traceroute with continuous statistics, reporting per-hop latency and packet loss over time. This pinpoints the hop where loss originates. It is more diagnostic than a single traceroute pass.

A technician suspects a host is missing a route and wants to view the local routing table to confirm the default gateway and any static routes. Which command shows this?

• a.nslookup for the destination hostname
• b.route print✓
• c.ping -t
• d.arp -a

The route print command (or ip route on Linux) displays the host's local routing table, including the default gateway and any static routes. A missing or wrong default route explains failures reaching remote networks. It is key when local traffic works but remote does not.

To analyze the exact contents of packets during a subtle protocol failure, a technician needs to capture and decode frames on the wire. Which tool fits?

• a.ipconfig
• b.arp, which only shows the local address cache
• c.ping
• d.Wireshark/tcpdump✓

A protocol analyzer like Wireshark or tcpdump captures and decodes packets, exposing headers and payloads for deep analysis. It reveals malformed exchanges that summaries hide. A SPAN/mirror port often feeds it the traffic.

An engineer wants to measure the actual throughput achievable between two hosts by generating test traffic in a controlled way. Which tool is designed for this?

• a.arp -a
• b.tracert to the far-end host's address
• c.nslookup
• d.iperf✓

iperf generates controlled TCP or UDP traffic between a client and server to measure achievable throughput, jitter, and loss. It isolates network capacity from application behavior. Results guide capacity and QoS decisions.

A security technician wants to discover which hosts are alive on a subnet and which TCP ports they have open. Which tool provides this scan?

• a.ipconfig
• b.ping -t
• c.nmap✓
• d.netstat run on each individual host

nmap scans a range of hosts to discover live systems and their open ports and services. It is a standard reconnaissance and audit tool. Results reveal exposure and help verify firewall rules.

After a DNS record was corrected, a Windows client still resolves the old address because of local caching. Which command clears the client's DNS cache?

• a.netstat -a to list all connections and ports
• b.arp -d
• c.ipconfig /flushdns✓
• d.route add

ipconfig /flushdns clears the Windows DNS resolver cache so the client queries fresh records instead of stale cached ones. It resolves cases where a record changed but the client still returns the old value. Restarting the resolver service does the same.

Traffic to a cloud service routes over a very long path across several continents, adding significant delay even though no link is congested. Which factor is responsible?

• a.Path length / propagation delay✓
• b.Insufficient link bandwidth
• c.Packet loss from bad cabling
• d.A duplex mismatch between two switches in the path

Propagation and path length add latency independent of congestion; a longer route simply takes more time end to end. Choosing a closer endpoint or better-peered path reduces it. High RTT with low utilization points here rather than to congestion.

During peak hours a WAN link is saturated and applications slow down, and monitoring shows the interface at 100 percent with rising output drops. What is the cause?

• a.A DNS misconfiguration
• b.A missing default gateway on the affected hosts
• c.Bandwidth saturation (congestion)✓
• d.An IP address conflict

Bandwidth saturation occurs when demand exceeds link capacity, filling queues and dropping packets during peaks. Adding capacity, shaping, or QoS relieves it. The correlation with peak load and full utilization confirms congestion.

A link shows intermittent packet loss and rising interface error counters, and replacing a marginal cable clears both. Which was the underlying cause?

• a.A DNS server outage
• b.Physical-layer errors from a faulty cable✓
• c.An access control list blocking the traffic at the router
• d.An exhausted DHCP scope

Physical errors from a marginal cable or connector corrupt frames, showing up as CRC/input errors and causing intermittent loss. Replacing the faulty cable removes the errors. Error counters are the diagnostic that points to Layer 1.

A saturated link makes interactive traffic laggy because oversized buffers hold packets far too long before forwarding them. What is this phenomenon called?

• a.Co-channel interference on the wireless segment
• b.Attenuation
• c.Bufferbloat✓
• d.A routing loop

Bufferbloat is excessive latency caused by overly large buffers that queue packets instead of dropping them promptly, hurting interactive traffic. Active queue management (such as CoDel) mitigates it. It appears as high latency under load without heavy loss.

Traffic reaches a server fine but return traffic takes a different path, and a stateful firewall drops the flow because it never saw the outbound side. Which condition is this?

• a.An exhausted DHCP address pool on the subnet
• b.Asymmetric routing✓
• c.A duplex mismatch
• d.A DNS misconfiguration

Asymmetric routing sends forward and return traffic over different paths, which can break stateful devices that must see both directions of a flow. Aligning the paths or making the device state-aware of both resolves it. It often appears after redundancy or route changes.

A VPN tunnel drops large packets while small ones pass, and the problem clears when the interface's maximum frame size is lowered. Which issue caused it?

• a.A spanning-tree loop between the tunnel endpoints
• b.A DNS resolution failure
• c.An MTU mismatch✓
• d.A duplicate IP address on the tunnel

An MTU mismatch or fragmentation problem drops or mishandles packets larger than a link allows, especially where encapsulation shrinks the usable size. Lowering the MTU or enabling proper path MTU discovery resolves it. Small packets passing while large ones fail is the classic symptom.

Two switch ports show late collisions and poor throughput because one end is set to full duplex and the other to half. What is the recommended fix?

• a.Set both ends to autonegotiate or matching duplex✓
• b.Assign the ports to different VLANs
• c.Replace the switch with a router
• d.Increase the interface MTU to reduce collisions on the link

Setting both ends to autonegotiate (or both to the same fixed duplex) resolves a duplex mismatch that causes late collisions and slow throughput. Mismatched fixed settings are a common misconfiguration. Matching the configuration on both ends is essential.

After a redundant switch link was added without loop prevention, switch CPUs spike to 100 percent and the whole segment slows to a crawl. Which problem does this indicate?

• a.An expired DHCP lease on the clients
• b.A DNS misconfiguration
• c.An access control list dropping legitimate traffic at the edge
• d.A broadcast storm from a switching loop✓

A broadcast storm from a Layer 2 loop floods frames endlessly, spiking switch CPU and saturating the segment. Enabling or verifying spanning tree stops it. The sudden onset after adding a redundant link is the giveaway.

Web pages take several seconds to begin loading, but once resolved they download quickly, and the assigned DNS server is geographically distant. Which fix most directly helps?

• a.Enable jumbo frames on the client's network adapter
• b.Increase the link bandwidth
• c.Configure a faster, closer DNS resolver✓
• d.Replace the copper cabling with fiber

Slow initial page loads with fast downloads point to slow DNS resolution; using a closer or faster resolver cuts the lookup delay. The quick transfer once resolved rules out bandwidth. Testing with nslookup timing confirms the cause.

A traceroute shows the same set of routers repeating and packets eventually dying with TTL-exceeded messages, and users cannot reach the destination. Which problem is this?

• a.A duplex mismatch
• b.A routing loop✓
• c.Electromagnetic interference on the copper uplink
• d.A DHCP scope exhaustion

A routing loop sends packets circling between routers until the TTL expires, producing TTL-exceeded messages and unreachable destinations. Correcting the conflicting routes breaks the loop. The repeating hops in traceroute are the telltale sign.

After a QoS change, backup traffic monopolizes the link and voice suffers because the policy failed to reserve capacity for voice. Which is the underlying issue?

• a.A QoS misconfiguration✓
• b.A dirty fiber connector on the WAN uplink
• c.A DNS outage
• d.A duplicate IP address

A QoS misconfiguration that fails to classify or reserve priority for voice lets bulk traffic starve it during congestion. Correcting the classification and queuing restores voice quality. The change coinciding with the problem points to the policy.

An old segment built around a hub shows many collisions and poor performance as more devices are added. Which characteristic of the hub explains this?

• a.The hub blocks redundant links using spanning tree
• b.The hub is one shared, half-duplex collision domain✓
• c.The hub exhausts the DHCP scope
• d.The hub routes between VLANs at Layer 3

A hub creates a single shared collision domain running half duplex, so collisions rise as devices and traffic increase. Replacing it with a switch gives each port its own collision domain and full duplex. This is why hubs are obsolete for modern LANs.

A high-latency, high-bandwidth WAN link achieves far less throughput than its capacity for a single TCP transfer, and the small TCP window cannot keep the long pipe full. Which fix helps?

• a.Disable QoS on the link
• b.Lower the interface MTU
• c.Enable TCP window scaling✓
• d.Shorten the DHCP lease duration for the clients

On a long fat network, a small TCP window limits throughput because the sender cannot keep enough data in flight for the high latency. Enabling window scaling (larger windows) lets a single flow fill the pipe. This explains low single-stream throughput despite ample bandwidth.

VoIP calls sound choppy with syllables clipped, and monitoring shows packets arriving at uneven intervals though few are lost. Which mitigation best addresses the cause?

• a.Replace the DNS server with a local one
• b.Assign the phones static IP addresses
• c.Add a jitter buffer and prioritize voice with QoS✓
• d.Increase the DHCP scope size on the voice VLAN

Choppy audio from uneven packet arrival is caused by jitter, and a properly sized jitter buffer plus QoS prioritization smooths it. The low loss rules out congestion drops as the main issue. Marking and queuing voice traffic reduces the jitter itself.

After terminating a cable, a technician needs to confirm each pin connects to the correct pin at the far end with no miswires. Which tool verifies the wire map?

• a.A cable tester✓
• b.A loopback plug
• c.A tone generator paired with an inductive probe
• d.A spectrum analyzer

A cable tester with a wire-map function confirms pin-to-pin correctness and flags opens, shorts, reversed, or split pairs. It validates that the termination follows the intended standard. It is the standard check after terminating a run.

A technician needs to find which wall jack corresponds to an unlabeled cable end in a crowded telecom closet. Which tool pair helps locate it?

• a.A protocol analyzer capturing frames on the link
• b.A multimeter
• c.An OTDR
• d.A tone generator and inductive probe✓

A tone generator places an audible signal on a wire, and an inductive probe detects that tone to trace and identify the specific cable or jack. It is standard for locating cables in bundles or panels. It complements, rather than replaces, continuity testing.

To test whether a switch port or NIC is functioning by looping its transmit back to its receive, which simple tool does a technician use?

• a.An optical time-domain reflectometer for fiber
• b.A loopback plug✓
• c.A tone generator
• d.A cable certifier

A loopback plug (or adapter) connects a port's transmit to its receive so the interface can test itself without another device. It confirms the port electrically works. It is a quick way to isolate a suspected bad port.

A long fiber run has a break somewhere, and the team needs to know the distance to the fault without digging up the whole path. Which instrument provides this?

• a.A tone generator with an inductive probe
• b.An OTDR✓
• c.A cable tester
• d.A loopback plug

An OTDR (optical time-domain reflectometer) sends light pulses and measures reflections to locate breaks, bends, and their distance along a fiber. It maps loss events across the run. This pinpoints where to dig or repair.

A technician needs to measure the actual optical signal strength arriving at a receiver to confirm it is within the transceiver's specified range. Which tool measures this?

• a.An optical power meter✓
• b.A multimeter
• c.A tone generator used to trace copper pairs
• d.A punchdown tool

An optical power meter (light meter) measures received optical power in dBm to verify a fiber link is within the transceiver's budget. Readings that are too low indicate excess loss. It quantifies problems a visual check cannot.

To check continuity and measure voltage on a copper conductor or a PoE circuit, which general-purpose electrical tool does a technician use?

• a.A multimeter✓
• b.An OTDR
• c.A Wi-Fi analyzer
• d.A protocol analyzer that decodes captured packets

A multimeter measures continuity, voltage, and resistance, useful for checking copper conductors and PoE voltage. It is a general electrical diagnostic, not a network-specific tester. It helps confirm power delivery and basic wire integrity.

A technician must seat individual conductors into an insulation-displacement block on a patch panel, cutting and securing each wire. Which tool is required?

• a.An optical time-domain reflectometer
• b.A crimper
• c.A loopback plug
• d.A punchdown tool✓

A punchdown tool seats conductors into insulation-displacement contacts on 66- or 110-blocks and patch panels, trimming the excess in one motion. It ensures solid, standardized terminations. Using it correctly avoids intermittent connections.

To attach an RJ45 plug onto a freshly stripped patch cable, securing the pins and strain relief, which tool does a technician use?

• a.A tone generator
• b.A crimper✓
• c.A cable certifier that validates performance to a standard
• d.A punchdown tool

A crimper attaches RJ45 (or RJ11) connectors to a cable, seating the pins onto the conductors and locking the strain relief. Proper crimping prevents loose, intermittent contacts. It pairs with a stripper and a tester for reliable field terminations.

A contractor must prove a finished cabling run meets the full performance requirements of a category standard for the customer's records. Which tool produces this compliance report?

• a.A basic continuity cable tester
• b.A loopback plug
• c.A tone generator with a probe
• d.A cable certifier✓

A cable certifier tests a run against a category's full performance parameters (such as insertion loss, NEXT, and return loss) and produces a pass/fail compliance report. A basic tester only checks wiring continuity and mapping. Certification is required for many warranties.

An engineer wants to see which Wi-Fi channels nearby access points occupy and their signal strengths to plan channel assignments. Which tool provides this view?

• a.A punchdown tool
• b.A Wi-Fi analyzer✓
• c.A multimeter measuring the AP's supply voltage
• d.An OTDR

A Wi-Fi analyzer scans the bands to show nearby SSIDs, their channels, and signal strengths, guiding channel planning to avoid overlap. It reveals congestion from other 802.11 networks. It is a first step in wireless troubleshooting and design.

Wi-Fi in an area suffers interference that a Wi-Fi analyzer cannot explain, suggesting a non-802.11 source. Which instrument identifies such RF energy?

• a.A spectrum analyzer✓
• b.A loopback plug
• c.A tone generator and inductive probe
• d.A cable certifier

A spectrum analyzer visualizes all RF energy in a band, revealing non-Wi-Fi sources like microwaves, cordless phones, or jammers that a Wi-Fi analyzer misses. It shows interference the 802.11 view cannot. This pinpoints physical-layer RF problems.

A field team must permanently join two fiber strands with minimal loss for a long-haul splice. Which specialized tool set performs this?

• a.A punchdown tool
• b.A crimper and stripper
• c.A fusion splicer and cleaver✓
• d.A tone generator paired with an inductive probe

A fusion splicer (with a cleaver) permanently joins fiber strands by aligning and melting the cores together, producing a very low-loss splice. A cleaver first prepares clean, square end faces. This is the standard method for durable, high-quality fiber joins.

To decode a suspicious traffic exchange down to individual protocol fields during an investigation, which tool does an analyst rely on?

• a.A protocol analyzer✓
• b.An optical power meter reading the receive level
• c.An OTDR
• d.A punchdown tool

A protocol analyzer captures and decodes traffic field by field, exposing the exact protocol behavior during an investigation. It reveals malformed or malicious exchanges that summaries hide. It is central to deep network and security analysis.

A technician needs a quick way to confirm a short fiber patch has continuity and to see roughly where a break is by looking for escaping red light. Which simple tool helps?

• a.A multimeter
• b.A tone generator used on copper pairs
• c.A crimper
• d.A visual fault locator✓

A visual fault locator injects visible red laser light into a fiber, making breaks, sharp bends, or bad connectors glow where light escapes. It is a fast, low-cost check for continuity and gross faults. It complements the precise distance data of an OTDR.

A team wants a dedicated hardware appliance that generates and measures traffic to certify a circuit's throughput and latency during turn-up. Which tool fits?

• a.A loopback plug
• b.A punchdown tool
• c.A tone generator and inductive probe
• d.A throughput/traffic tester✓

A dedicated throughput/traffic tester generates and measures traffic to certify a circuit's throughput, latency, and loss during turn-up. It provides repeatable, standards-based results a laptop utility may not. Providers often require it to validate an SLA.

To access a switch's command line locally when the network is down, a technician connects a laptop to the device's serial management port. Which cable is required?

• a.A fiber patch cable
• b.A crossover cable
• c.A tone generator with an inductive probe
• d.A console (rollover) cable✓

A console (rollover) cable connects a computer to a device's serial console port for out-of-band CLI access, even when the network is unreachable. It is essential for initial setup and recovery. USB-to-serial adapters often bridge to modern laptops.

A fiber uplink will not come up, and the transceiver, though it fits, is a different vendor code than the switch expects and is rejected. What is the likely cause?

• a.A duplex mismatch on the link
• b.An incompatible/uncoded transceiver✓
• c.A spanning-tree loop between the two switches
• d.An exhausted DHCP scope

Some switches reject transceivers whose vendor coding is not recognized or compatible, so the link never comes up despite a physical fit. Using a supported or properly coded optic resolves it. Checking compatibility lists prevents this surprise.

A technician must trim cable jacket and cut conductors cleanly while terminating copper. Which hand tools are appropriate?

• a.An OTDR
• b.A cable stripper and snips✓
• c.A spectrum analyzer
• d.A protocol analyzer decoding the captured frames

A cable stripper and cutting snips cleanly remove jacket and trim conductors during termination without nicking the wire. Clean preparation is essential for reliable crimps and punchdowns. They are basic parts of a cabling toolkit.