CompTIA Network+ — All Questions

Management wants to know, on average, how long it takes staff to repair a failed device and restore service once work begins. Which metric captures this?

• a.RPO
• b.The recovery time objective set in the DR plan
• c.MTTR✓
• d.MTBF

Mean Time To Repair (MTTR) is the average time to restore a failed component to service, reflecting maintainability and process efficiency. Lowering MTTR shrinks outage duration. It complements MTBF, which measures how often failures occur.

A vendor advertises how long, on average, a device operates before it fails, helping predict reliability and replacement planning. Which metric is this?

• a.RTO
• b.MTTR
• c.The recovery point objective for acceptable data loss
• d.MTBF✓

Mean Time Between Failures (MTBF) estimates the average operating time between failures of a repairable device, indicating reliability. Higher MTBF suggests longer expected service life. It informs redundancy and spare-parts planning.

A budget-limited backup facility provides floor space, power, and cooling but no installed equipment or current data; hardware must be brought in after a disaster. Which site type is this?

• a.An active-active cloud region
• b.A cold site✓
• c.A warm site with servers preinstalled and data partially synchronized
• d.A hot site

A cold site provides only the physical space, power, and cooling; equipment and data must be delivered and configured after a disaster, so recovery is slow but cheap. A hot site is fully ready and costly. A warm site sits between the two.

A backup job copies only the data that changed since the previous backup of any type, minimizing each night's backup size but requiring the full chain to restore. Which backup type is this?

• a.A differential backup that copies everything changed since the last full backup
• b.An incremental backup✓
• c.A full backup
• d.A snapshot of the live volume

An incremental backup copies only data changed since the last backup of any kind, making each job small and fast. Restoration requires the last full backup plus every incremental in order. This trades quick backups for a longer restore chain.

A team gathers stakeholders in a room to walk through the disaster recovery plan step by step and discuss responses, without touching production systems. Which exercise is this?

• a.A tabletop exercise✓
• b.A live failover cutover of production traffic
• c.A full restore of every backup to new hardware
• d.A penetration test against the perimeter

A tabletop exercise is a discussion-based walkthrough of the DR or incident plan that validates roles and steps without disrupting production. It surfaces gaps cheaply before a real event. More disruptive tests, like full failover, come later.

Beyond restoring IT systems, an organization documents how the whole business will keep operating essential functions during a major disruption. Which plan covers this broader scope?

• a.A disaster recovery plan focused only on IT systems
• b.A change management record
• c.A business continuity plan✓
• d.An acceptable use policy

A business continuity plan (BCP) addresses keeping essential business functions running during a disruption, of which IT disaster recovery is one part. It covers people, facilities, and processes, not just technology. DR plans nest inside the broader BCP.

A best-practice backup strategy calls for three copies of data on two different media types with one copy kept offsite. What is this guideline commonly called?

• a.The default gateway of last resort
• b.The single-copy nightly backup approach
• c.Continuous active-active replication between two data centers
• d.The 3-2-1 backup rule✓

The 3-2-1 rule keeps three copies of data on two media types with one copy offsite, protecting against device, site, and media failures. The offsite copy guards against local disasters. Many teams add an offline copy to resist ransomware.

When a primary system fails, operations automatically shifts to a standby system so service continues. What is this transition called?

• a.Load balancing
• b.Failover✓
• c.Failback to the original primary once it is repaired
• d.A backup restore from tape

Failover is the automatic (or manual) switch of operations from a failed primary to a standby system to preserve service. Returning to the primary once repaired is called failback. Well-tested failover minimizes downtime during incidents.

A storage system keeps a continuously updated copy of data on a second array so that a copy is always current if the primary array fails. Which technique is this?

• a.An archived copy stored offline for compliance
• b.A weekly full tape backup
• c.Replication✓
• d.A point-in-time snapshot taken once per day

Replication maintains a continuously updated copy of data on another system or site, keeping a near-current copy available for recovery. Synchronous replication keeps copies identical; asynchronous lags slightly to reduce latency. It underpins low-RPO recovery.

Users on a satellite WAN link report that interactive applications feel sluggish even though the link is not congested and no packets are lost. Which metric best explains this?

• a.Excessive jitter between packets
• b.Low bandwidth
• c.Insufficient throughput on the local LAN segment
• d.High latency✓

Latency is the time a packet takes to travel end to end, and high latency (as on satellite links) makes interactive apps feel sluggish even without loss or congestion. It is distinct from bandwidth, which is capacity. Propagation distance is a major latency contributor.

A VoIP call breaks up and words drop out, and monitoring shows some packets never arrive at the far end. Which metric describes this?

• a.Bandwidth
• b.The signal-to-noise ratio measured on the wireless link
• c.Jitter
• d.Packet loss✓

Packet loss is the percentage of packets that never reach the destination, and even small amounts badly degrade real-time voice. Causes include congestion, errors, and faulty links. QoS and capacity fixes reduce it.

VoIP audio is uneven because packets arrive with inconsistent spacing, so an engineer configures a mechanism to hold and release them at a steady rate. What is this mechanism?

• a.An access control list that filters unwanted traffic
• b.A jitter buffer✓
• c.A spanning-tree recalculation
• d.A larger DHCP scope

A jitter buffer temporarily holds arriving packets and releases them at a steady interval, smoothing out variation in delay. Too small a buffer fails to absorb jitter; too large adds latency. It is a standard mitigation for real-time media.

A voice platform reports a numeric score from 1 to 5 that summarizes perceived call quality for stakeholders. Which metric is this?

• a.RTT
• b.The link utilization percentage during the busy hour
• c.DSCP
• d.MOS✓

Mean Opinion Score (MOS) rates perceived voice quality on a 1-to-5 scale, condensing latency, jitter, and loss into one figure. Scores above about 4 are considered good. It gives non-technical stakeholders an intuitive quality measure.

A technician pings a server and reads the time reported for an echo request to be sent and its reply received. Which metric is this measuring?

• a.The number of hops between the source and destination
• b.Round-trip time✓
• c.Total available bandwidth
• d.One-way delay in a single direction only

Round-trip time (RTT) is the time for a packet to reach a destination and its reply to return, which ping reports directly. It reflects two-way latency along the path. Rising RTT often signals congestion or a longer route.

For acceptable interactive voice, engineers target keeping delay in a single direction under roughly a specific threshold. What is the commonly cited one-way delay budget for VoIP?

• a.About 5 ms
• b.About 2 seconds
• c.About 500 ms, which is the point at which callers stop noticing delay
• d.About 150 ms✓

A common design target keeps one-way delay under about 150 ms for good interactive voice quality. Beyond that, callers begin talking over each other. Jitter and loss budgets accompany this latency target.

To ensure voice packets receive top priority through the network, an engineer marks them with a specific Layer 3 code point that routers honor. Which marking is standard for voice?

• a.The 802.1Q VLAN tag value
• b.DSCP default (0)
• c.A best-effort class with no special priority applied at all
• d.DSCP EF (46)✓

Expedited Forwarding (EF, DSCP 46) is the standard DiffServ marking for voice, giving it low-latency, priority handling. Routers map EF to a priority queue. Consistent marking end to end is what makes QoS effective.

On a trunk, an engineer wants switches to prioritize frames at Layer 2 using a 3-bit priority field in the VLAN tag. Which mechanism provides this?

• a.A spanning-tree priority value
• b.DSCP marking at Layer 3
• c.The differentiated services field carried in the IP header
• d.802.1p CoS✓

The 802.1p Class of Service (CoS) uses a 3-bit priority field in the 802.1Q tag for Layer 2 prioritization. It is the Layer 2 counterpart to Layer 3 DSCP marking. Switches map CoS values to egress queues.

During congestion, a policy should buffer and delay excess traffic to smooth bursts rather than immediately discarding it. Which QoS technique does this?

• a.Spanning-tree blocking
• b.Port mirroring
• c.Traffic shaping✓
• d.Traffic policing that drops packets exceeding the rate

Traffic shaping buffers and delays excess traffic to smooth bursts to a target rate, whereas policing simply drops or remarks traffic above the rate. Shaping adds latency but avoids drops. The choice depends on whether smoothing or hard limiting is desired.

An engineer wants to measure the actual achievable transfer rate between two endpoints by pushing test traffic across the link. Which type of tool provides this?

• a.A physical cable continuity tester that checks pin mapping
• b.A bandwidth speed test tool✓
• c.A DNS lookup utility
• d.An ARP cache viewer

A throughput/bandwidth test tool (such as iperf) generates traffic between endpoints to measure achievable transfer rates. It reveals real performance versus the link's rated speed. Results depend on latency, loss, and TCP tuning.

A monitoring system reports that a WAN link averaged 85 percent of its capacity during business hours. Which metric is being reported?

• a.Link utilization✓
• b.Latency
• c.The mean time between failures of the WAN router
• d.Jitter

Link utilization expresses used capacity as a percentage of the link's total, here 85 percent, and sustained high values warn of congestion risk. It is derived from interface byte counters over time. Trending it guides capacity upgrades.

A server room's equipment keeps overheating, and staff must guarantee stable temperature and airflow year-round. Which facility system addresses this?

• a.HVAC✓
• b.A UPS
• c.A power distribution unit feeding the racks
• d.A fire suppression system

HVAC (heating, ventilation, and air conditioning) maintains stable temperature and airflow so equipment stays within safe operating ranges. Hot- and cold-aisle layouts improve its efficiency. Inadequate cooling causes thermal shutdowns and shortened hardware life.

A data center needs to extinguish fires without soaking and destroying electronic equipment with water. Which protection approach fits?

• a.An HVAC economizer that brings in outside air
• b.A UPS
• c.Standard water sprinklers over the racks
• d.Clean-agent fire suppression✓

A clean-agent (gaseous) fire suppression system extinguishes fires without water, protecting electronics from damage. Water-based sprinklers would ruin equipment. Such systems are standard in equipment rooms and data centers.

Technicians handling circuit boards in a dry equipment room keep damaging components with static discharge. Controlling which environmental factor most reduces this risk?

• a.Humidity✓
• b.Air pressure
• c.Ambient light level
• d.The temperature set point of the cooling system

Maintaining adequate humidity reduces static buildup and the electrostatic discharge (ESD) that damages components. Air that is too dry raises ESD risk, while too humid promotes condensation. ESD wrist straps and mats add further protection.

An engineer must ensure that if utility power fails, several racks receive conditioned, distributed power from a single managed unit that also reports per-outlet load. Which device is this?

• a.A managed PDU✓
• b.A single power strip
• c.A network interface card teamed for redundancy
• d.A KVM switch

A managed PDU (power distribution unit) distributes and monitors power to multiple devices in a rack, often reporting per-outlet load and enabling remote switching. Fed by a UPS or generator, it supports resilient power design. Monitoring helps avoid overloading circuits.

Operations wants an automatic alert if a wiring closet exceeds a safe temperature threshold so staff can intervene before a shutdown. Which control provides this?

• a.A smoke detector
• b.A humidity-only sensor
• c.A power distribution unit that reports outlet current
• d.A temperature monitor with alert thresholds✓

A temperature monitor with an alerting threshold notifies staff when a closet exceeds safe limits, allowing intervention before thermal shutdown. It integrates with the NMS or environmental system. Early alerts prevent heat-related outages and hardware damage.

An organization wants to enforce minimum length, complexity, and periodic change of user credentials across all systems. Which document defines these rules?

• a.A network topology diagram
• b.A memorandum of understanding
• c.An acceptable use policy governing general resource use
• d.A password policy✓

A password policy defines requirements such as length, complexity, history, and rotation for credentials. It standardizes account security across systems. Enforcement is typically automated through directory settings.

When an employee leaves, IT must reliably disable accounts, reclaim equipment, and revoke access on their last day. Which documented process ensures this happens consistently?

• a.A password complexity requirement in the account policy
• b.An offboarding process✓
• c.A disaster recovery tabletop exercise
• d.A change advisory board review

An offboarding process defines the steps to disable accounts, revoke access, and recover assets when someone leaves, closing security gaps. It mirrors the onboarding process that grants access. Consistent execution prevents lingering access by former staff.

A company lets staff use personal phones and laptops for work and needs rules covering security requirements and acceptable use of those devices. Which policy governs this?

• a.A BYOD policy✓
• b.A quality-of-service policy
• c.A service level agreement with an external provider
• d.A rack elevation diagram

A BYOD (bring your own device) policy sets the security and usage rules for employee-owned devices accessing company resources. It typically requires controls like passcodes, encryption, and remote wipe. It balances flexibility against data protection.

An organization must define how staff may connect from outside the office, including required VPN use and authentication for remote sessions. Which policy covers this?

• a.A memorandum of understanding between two organizations
• b.A remote access policy✓
• c.A rack diagram
• d.A wiring standard

A remote access policy defines the approved methods, security requirements, and authentication for connecting from outside the network, such as mandatory VPN and multifactor authentication. It reduces risk from remote connections. It complements broader acceptable use rules.

Before a risky configuration change reaches production, a group formally reviews and approves it, weighing risk and scheduling. What is this body called?

• a.A penetration testing crew
• b.A change advisory board✓
• c.An incident response team
• d.A disaster recovery site coordinator

A change advisory board (CAB) reviews, prioritizes, and approves proposed changes, weighing risk, impact, and timing. Its sign-off is part of formal change management. This governance reduces the chance of unplanned outages from unvetted changes.

When a security breach is detected, staff follow a predefined set of stages to detect, contain, eradicate, and recover from the event. Which document guides these stages?

• a.A rack elevation diagram
• b.An incident response plan✓
• c.An acceptable use policy
• d.A service level agreement with the cloud provider

An incident response plan defines the phases (such as preparation, detection, containment, eradication, recovery, and lessons learned) for handling security events. It assigns roles and communication paths. Practicing it improves real-world response speed.

A contractor and client sign a document that spells out exactly the deliverables, tasks, timeline, and price for a specific network project. Which document is this?

• a.A statement of work (SOW)✓
• b.A non-disclosure agreement protecting shared information
• c.A memorandum of understanding
• d.An acceptable use policy

A statement of work (SOW) details the specific deliverables, tasks, timeline, and cost for a defined project. It sits under a broader master agreement and prevents scope disputes. Clear SOWs align expectations between client and vendor.

Two organizations sign a non-binding document expressing their intent to cooperate and outlining broad roles before any formal contract. Which document is this?

• a.A service level agreement
• b.A statement of work
• c.A memorandum of understanding✓
• d.A master service agreement setting overall contract terms

A memorandum of understanding (MOU) expresses a mutual, generally non-binding intent to cooperate and outlines broad responsibilities. It precedes more formal, binding contracts. It signals commitment while details are still negotiated.

A company and a vendor sign one overarching contract that sets the general legal and commercial terms governing all future projects between them. Which document is this?

• a.A master service agreement✓
• b.A memorandum of understanding
• c.A statement of work
• d.A non-disclosure agreement covering confidential data only

A master service agreement (MSA) establishes the overarching terms that govern all future engagements between two parties, so each new project needs only a short statement of work. It streamlines repeated work. Individual SOWs reference the MSA for legal terms.

A vendor announces a date after which a switch model will receive no further updates, patches, or support. Which term describes this milestone?

• a.A recovery point objective
• b.End of life / end of support✓
• c.A service level agreement renewal date
• d.A maintenance window

End of life / end of support (EOL/EOS) marks when a product no longer receives updates, patches, or vendor support, making continued use a security and reliability risk. Tracking these dates drives replacement planning. Running EOL gear can also break compliance.

An operations team schedules disruptive upgrades for 2 a.m. Sunday when usage is lowest to limit impact on users. What is this pre-approved timeframe called?

• a.A change freeze
• b.A recovery time objective
• c.An acceptable use policy signed at onboarding
• d.A maintenance window✓

A maintenance window is a pre-approved, scheduled period, usually during low-usage hours, for performing disruptive changes with minimal user impact. It is coordinated through change management. Communicating it in advance sets user expectations.

A team wants every device configuration stored in version control so changes are tracked and any prior known-good version can be restored. Which practice provides this?

• a.Disabling remote management to prevent changes
• b.Configuration management with version control✓
• c.Manually retyping commands on each device
• d.Relying on each device's factory defaults

Configuration management with version control tracks every change to device configs and lets teams roll back to a known-good version. It reveals who changed what and when, and detects drift from the baseline. Automation tools often enforce it at scale.

Before sharing sensitive network diagrams with a consultant, the company requires them to sign an agreement not to disclose the information. Which document is this?

• a.A non-disclosure agreement✓
• b.A memorandum of understanding outlining cooperative intent
• c.A service level agreement
• d.A statement of work

A non-disclosure agreement (NDA) legally binds a party to keep shared confidential information private. It protects sensitive designs and data disclosed during an engagement. Signing it precedes sharing proprietary details.

A provider's contract promises 99.9 percent uptime and specifies credits to the customer if that level is not met. Which document defines these commitments and penalties?

• a.A service level agreement✓
• b.A memorandum of understanding between the parties
• c.A statement of work
• d.A non-disclosure agreement

A service level agreement (SLA) defines measurable commitments such as uptime and response time, plus remedies like credits when they are missed. It sets accountability between provider and customer. SLA terms guide escalation and prioritization.

When provisioning a new switch, technicians must apply a standard set of steps to disable defaults, set strong credentials, and enable logging before it goes live. Which process ensures this?

• a.A disaster recovery tabletop test
• b.A predictive wireless site survey
• c.A change advisory board approval for the purchase
• d.A device hardening baseline✓

A device hardening (secure onboarding) baseline is the standard set of steps applied to new gear, disabling insecure defaults, setting strong credentials, and enabling logging before deployment. It ensures every device starts from a consistent secure state. Automation keeps it repeatable.

A help desk ticket reports 'the network is down.' Before doing anything else in the structured troubleshooting method, what should the technician do first?

• a.Implement a fix immediately
• b.Document the outcome
• c.Identify the problem and gather information✓
• d.Escalate the ticket to the equipment vendor's support line

The first step is to identify the problem by gathering information, questioning users, and determining the scope. Acting before understanding risks fixing the wrong thing. Later steps establish and test a theory, then implement and verify.

A technician has tested and confirmed the probable cause of an outage. According to the methodology, what is the next step?

• a.Establish a plan of action✓
• b.Document the findings and close the ticket
• c.Re-form a new theory from scratch
• d.Verify full system functionality across every device

Once a theory is confirmed, the next step is to establish a plan of action to resolve the problem and identify potential effects. This precedes implementing the solution. Planning reduces the chance the fix causes new issues.

A technician's tested theory turns out to be wrong; the suspected cause is not the real one. What does the methodology say to do next?

• a.Establish a new theory or escalate✓
• b.Implement the disproven fix anyway
• c.Verify full functionality of the entire network before continuing
• d.Document the solution and close out

If testing does not confirm the theory, the technician either establishes a new theory or escalates. Repeatedly forcing a disproven theory wastes time. This disciplined loop keeps troubleshooting evidence-based.

While identifying a problem, a technician asks the user what changed recently and tries to reproduce the failure. These actions belong to which phase of the methodology?

• a.Documenting findings and outcomes
• b.Verifying full system functionality
• c.Establishing a plan of action to resolve the issue
• d.Identifying the problem✓

Questioning users, identifying recent changes, and duplicating the problem are all part of the first phase: identifying the problem. This information shapes the theory that follows. Skipping it leads to guesswork.

After forming a theory that a bad cable is the cause, a technician swaps in a known-good cable to see if the symptom disappears. Which methodology step is this?

• a.Documenting the outcome
• b.Establishing a plan of action for the change
• c.Testing the theory✓
• d.Identifying the problem and its scope

Swapping in a known-good component to see whether the symptom clears is testing the theory to determine the cause. If it confirms the theory, a plan of action follows. If not, a new theory is needed.

A technician has applied a fix and confirmed the reported issue is resolved. Which step comes next before documenting?

• a.Escalate the resolved issue to management for review
• b.Reboot every device on the network as a precaution
• c.Immediately close the ticket without further testing
• d.Verify full functionality and apply preventive measures✓

After implementing the fix, the technician verifies full system functionality and, where applicable, implements preventive measures. This confirms the solution truly worked end to end. Documentation is the final step that follows.

The very last step of the structured troubleshooting methodology is what?

• a.Establish a theory of probable cause
• b.Verify full functionality of the affected systems
• c.Document findings, actions, and outcomes✓
• d.Test the theory to determine the cause

The final step is to document findings, actions, and outcomes, building a knowledge base for future issues and supporting accountability. It captures lessons others can reuse. Skipping it loses valuable insight.

Facing a complex fault, a technician methodically checks from the physical layer upward, confirming each OSI layer before moving to the next. Which troubleshooting approach is this?

• a.Randomly rebooting devices until it works
• b.Immediately replacing all hardware in the affected path
• c.A bottom-up OSI approach✓
• d.Guessing based on the last similar ticket

Working layer by layer up the OSI model (a bottom-up approach) systematically isolates the fault to a specific layer. Top-down and divide-and-conquer are alternative structured approaches. Choosing one prevents random, unfocused checking.

A cable tester on a newly run link shows no continuity on one conductor, indicating the wire is broken somewhere along the run. Which fault is this?

• a.A duplex mismatch negotiated between the two switch ports
• b.Crosstalk between adjacent pairs
• c.A short between two conductors
• d.An open✓

An open is a broken conductor with no continuity end to end, so a signal cannot pass on that wire. A short instead connects two conductors that should be separate. Re-terminating or replacing the cable resolves an open.

A long copper run near other cabling shows signal from one pair bleeding into an adjacent pair, corrupting data at higher speeds. Which impairment is this?

• a.An open circuit
• b.Crosstalk✓
• c.Attenuation over distance
• d.Electromagnetic interference from a nearby motor on the cable path

Crosstalk is the coupling of a signal from one pair into an adjacent pair, degrading data especially at higher frequencies. Proper twist rates and untwisting as little as possible at terminations reduce it. Testers report near-end and far-end crosstalk.