CompTIA Network+ — All Questions

Which protocol allows network devices to be monitored and managed by collecting metrics such as interface counters and CPU usage?

• a.TFTP
• b.NTP
• c.SNMP✓
• d.SMTP

SNMP (Simple Network Management Protocol) polls and collects metrics like interface statistics and CPU usage from managed devices. SNMPv3 adds authentication and encryption over earlier versions. It is a foundational tool for network monitoring systems.

An organization wants a centralized record of events from all network devices for correlation and alerting. Which system aggregates these logs?

• a.RADIUS server
• b.DHCP server
• c.DNS resolver
• d.Syslog server✓

A syslog server centralizes log messages from many devices, enabling correlation, retention, and alerting. Consistent timestamps from NTP make correlation reliable. SIEM platforms often ingest syslog data for security analysis.

Why is accurate time synchronization across network devices important for operations?

• a.It replaces the need for DNS resolution
• b.It increases available interface bandwidth
• c.It eliminates the need for routing protocols
• d.It ensures log timestamps align for accurate event correlation✓

Accurate time via NTP ensures that log entries from different devices share a consistent timeline, which is critical for correlating events during troubleshooting or security investigations. Without synchronized clocks, reconstructing an incident becomes difficult. NTP typically uses UDP port 123.

Which metric describes the variation in packet delay that can degrade real-time voice and video quality?

• a.Jitter✓
• b.Attenuation
• c.Bandwidth
• d.Throughput

Jitter is the variation in delay between received packets and is especially harmful to real-time applications like VoIP and video. Buffers can absorb small amounts of jitter, but excessive jitter causes choppy audio. QoS policies help minimize it.

An administrator wants to prioritize voice traffic over bulk file transfers on a congested link. Which mechanism should be configured?

• a.Port mirroring
• b.Quality of Service (QoS)✓
• c.Jumbo frames
• d.Spanning tree

Quality of Service (QoS) classifies and prioritizes traffic so latency-sensitive flows like voice receive preferential treatment during congestion. Marking and queuing ensure critical traffic is served first. Without QoS, all traffic competes equally.

Which document records the physical and logical layout of network cabling, ports, and connections for reference during maintenance?

• a.Network topology diagram✓
• b.Incident response plan
• c.Acceptable use policy
• d.Service level agreement

A network topology diagram documents devices, cabling, and connections, serving as a reference during maintenance and troubleshooting. Keeping it current speeds fault isolation. Physical and logical diagrams may be maintained separately.

What is the primary purpose of establishing a performance baseline for a network?

• a.To replace the need for monitoring tools
• b.To permanently cap the maximum throughput of links
• c.To assign static IP addresses to servers
• d.To define normal behavior so anomalies can be detected✓

A baseline captures normal metrics such as utilization, latency, and error rates so that deviations signaling problems can be identified. Comparing current data against the baseline speeds anomaly detection. Baselines should be updated as the network evolves.

Which agreement defines the guaranteed uptime and response times a service provider commits to deliver?

• a.MOU
• b.SLA✓
• c.AUP
• d.NDA

A Service Level Agreement (SLA) specifies measurable commitments such as guaranteed uptime and response times between a provider and customer. Failing to meet an SLA may trigger penalties or credits. SLAs guide operational priorities and escalation.

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Trunking
• b.Port mirroring (SPAN)✓
• c.Link aggregation
• d.Port security

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Disable all monitoring during the change
• b.Obtain approval and prepare a rollback plan✓
• c.Skip documentation to save time
• d.Immediately push the change during peak hours

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Warm site
• b.Cold site
• c.Mirror archive
• d.Hot site✓

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Get
• b.Trap✓
• c.Walk
• d.Poll

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Latency
• b.Throughput✓
• c.Frequency
• d.Bandwidth

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Bill of materials
• b.Wiring schematic
• c.Acceptable Use Policy✓
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.Proxy ARP
• b.DNS forwarding
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RTO
• d.RPO✓

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Disabling all remote management
• b.Relying only on factory defaults
• c.Configuration management and automation tools✓
• d.Manually typing commands on each device

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.LDAP
• b.SNMP
• c.NTP✓
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A direct/private cloud interconnect✓
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A site-to-site VPN over the internet

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.

A monitoring team must poll router statistics across a segment where credentials could be captured, so they need both authentication and encryption for the management traffic. Which SNMP version should they deploy?

• a.SNMPv2c
• b.SNMPv3✓
• c.SNMPv1
• d.the community-string model used by the earlier SNMP versions

SNMPv3 adds authentication and encryption (authPriv), unlike v1 and v2c which rely on clear-text community strings. It is the only version that protects management data in transit. Choose v3 whenever confidentiality or integrity of monitoring matters.

Within SNMP, which component is the hierarchical database that defines the managed objects a device exposes, each identified by a numeric object identifier?

• a.The MIB✓
• b.An unsolicited SNMP trap
• c.The read-only community string configured on the agent
• d.A single OID value

The MIB (Management Information Base) is the structured catalog of managed objects, each addressed by an OID. Agents return MIB values when the manager polls them. Understanding the MIB/OID relationship is key to building useful monitoring.

On a syslog server, an engineer wants to alert only on the most critical device messages. Which numeric severity level represents the highest urgency?

• a.0 (emergency)✓
• b.5 (notice)
• c.the highest number in the range, because a larger value signals more urgency
• d.7 (debugging)

Syslog severities run 0 to 7, where 0 (emergency) is the most severe and 7 (debugging) the least. Lower numbers mean higher urgency, which is counterintuitive at first. Filtering on 0-2 captures messages that usually demand immediate attention.

A capacity-planning report needs a summary of which hosts and applications consume the most bandwidth, grouped by conversation rather than by full packet contents. Which data source best provides this?

• a.Flow data such as NetFlow✓
• b.Basic SNMP interface polling
• c.A packet sniffer capturing every full frame on the link
• d.Syslog messages from the router

Flow technologies like NetFlow, sFlow, and IPFIX summarize traffic into conversation records (source, destination, ports, bytes). This gives top-talker and application visibility without storing full packets. It is lighter than a capture yet richer than raw interface counters.

A team finds some SNMP notifications are lost in transit and wants the manager to acknowledge receipt so the agent can retransmit if needed. Which notification type provides this confirmation?

• a.An SNMP GET request
• b.An SNMP trap
• c.A one-way syslog message delivered over UDP without acknowledgment
• d.An SNMP inform✓

An SNMP inform is an acknowledged notification; the manager confirms receipt so the agent can resend if the message is lost. A trap is fire-and-forget with no acknowledgment. Informs trade extra overhead for reliability.

Security operations wants logs from firewalls, servers, and switches gathered in one place, normalized, and correlated to surface multi-device attack patterns. Which platform is designed for this?

• a.A SIEM✓
• b.A DHCP server
• c.An NTP time source
• d.A TFTP server used for config backups

A SIEM (Security Information and Event Management) aggregates and correlates logs from many sources to detect patterns a single device would miss. It adds alerting, retention, and search on top of raw syslog. Synchronized time via NTP makes its correlation trustworthy.

To decide when interface utilization is abnormal, an operations team compares live metrics against previously recorded normal values. What are they comparing against?

• a.The current routing table
• b.The maximum rated link speed
• c.The switch's original factory-default configuration settings
• d.A performance baseline✓

A performance baseline records normal utilization, latency, and error rates so deviations can trigger alerts. Thresholds are usually set relative to the baseline rather than to a device's rated maximum. Baselines must be refreshed as the network grows.

Which per-port data does a monitoring system read to calculate link utilization, error rates, and discards on a switch?

• a.The ARP cache
• b.The spanning-tree topology table maintained by the switch
• c.Interface counters✓
• d.DNS query logs

Interface counters track bytes, packets, errors, and discards per port, and tools poll them (often via SNMP) to compute utilization. Rising error or discard counters flag physical or congestion problems. They are the foundation of throughput dashboards.

A data-center team wants automated alerts if a wiring closet gets too hot or humid before equipment is damaged. Which monitoring input provides this?

• a.A NetFlow exporter
• b.A syslog facility code
• c.Environmental sensors✓
• d.An SNMP trap threshold set on router CPU load

Environmental sensors report temperature, humidity, water, and airflow, feeding alerts that prevent heat- or moisture-related failures. They are often integrated into the same NMS that tracks network metrics. Early warning here avoids costly hardware damage.

A modern platform needs sub-second, push-based metrics from devices instead of waiting for the next polling interval. Which approach delivers this?

• a.Manual CLI checks by an on-call engineer
• b.SNMP polling on a fixed five-minute interval
• c.Periodic ICMP pings
• d.Streaming telemetry✓

Streaming telemetry has devices continuously push metrics to a collector, giving near-real-time granularity that periodic SNMP polling cannot match. It scales better for large, fast-changing environments. Polling still suits simpler or legacy gear.

An operations lead wants to monitor network devices without installing extra software on each one, relying on protocols already built into the gear. Which monitoring model fits?

• a.Agentless polling✓
• b.Mirroring all ports to a dedicated packet sniffer
• c.Installing a proprietary monitoring agent on every managed device
• d.Exporting device logs by hand each week

Agentless monitoring uses protocols already on the device, such as SNMP, ICMP, or SSH, avoiding software installs. It is quick to deploy across mixed hardware. Agent-based monitoring can offer deeper data but adds installation and upkeep.

To diagnose a subtle application handshake failure, an analyst needs the actual bytes of each packet, not just summary statistics. Which tool output is required?

• a.A NetFlow conversation record
• b.An interface utilization graph
• c.A full packet capture✓
• d.An SNMP walk of the device MIB

A full packet capture (via Wireshark, tcpdump, or a SPAN port) records complete frame contents for deep protocol analysis. Flow and SNMP data only summarize traffic and cannot show payload detail. Captures are powerful but storage-intensive, so they are used selectively.

Auditors ask how long the organization keeps device and security logs before they are purged. Which document defines this?

• a.A log retention policy✓
• b.A memorandum of understanding between two parties
• c.An acceptable use policy
• d.The spanning-tree configuration

A log retention policy specifies how long logs are stored and when they are deleted, balancing investigative and compliance needs against storage cost. It often reflects regulatory requirements. Consistent retention ensures evidence exists when incidents surface late.

In SNMPv2c, which credential lets a manager poll device values but not change the configuration?

• a.A trap receiver address
• b.A read-write credential that also permits pushing configuration changes
• c.An OID
• d.A read-only community string✓

A read-only community string permits GET operations but denies SET, so monitoring cannot alter the device. Because v2c community strings are clear-text, SNMPv3 is preferred where security matters. Read-write strings are far more sensitive and should be tightly controlled.

Management wants an at-a-glance visual view of uptime, utilization, and open alert counts across key links. Which operations artifact provides this?

• a.A one-time ARP table export
• b.A single syslog severity filter
• c.A paper change-request form
• d.A monitoring dashboard✓

A monitoring dashboard visualizes KPIs like uptime, utilization, latency, and open alerts for quick situational awareness. It aggregates data from SNMP, flow, and log sources. Well-designed dashboards speed detection and reporting.

A technician needs to know exactly which patch-panel port and cable run connect a specific wall jack to the switch. Which document shows this?

• a.A logical diagram showing subnets and VLANs
• b.A rack power-load schedule
• c.A physical network diagram✓
• d.An IP address allocation plan

A physical network diagram maps actual cabling, ports, panels, and device locations. A logical diagram instead shows IP subnets, VLANs, and routing relationships. The two are maintained together because each answers different questions.

As subnets multiply, a team wants a single authoritative record of which IP addresses are assigned, reserved, or free. Which tool manages this?

• a.A change advisory board that reviews proposed changes
• b.An IPAM system✓
• c.A syslog server
• d.A rack elevation diagram

IPAM (IP Address Management) tracks address allocation, reservations, and availability, often integrating DNS and DHCP. It prevents conflicts and address exhaustion. Spreadsheets do not scale to large or dynamic networks.

Before installing a new 2U server, an engineer checks a drawing that shows which rack units are occupied and where free space and power exist. What is this document?

• a.A logical topology map of the whole campus
• b.An IP address plan
• c.A rack diagram✓
• d.A cable test report

A rack diagram (rack elevation) depicts the front and rear layout of equipment by rack unit, aiding installation and airflow planning. It shows occupancy, weight, and power distribution. Keeping it current prevents installation surprises.

To speed future troubleshooting, a cabling contractor marks each cable end and patch-panel port with a consistent identifier. Which documentation practice is this?

• a.Publishing a service level agreement
• b.Cable and port labeling✓
• c.Drawing a full mesh topology
• d.Maintaining a spanning-tree convergence diagram

Standardized cable and port labeling lets technicians trace connections quickly and reduces errors during moves and changes. Labels should follow a documented naming convention. Good labeling pays off most during outages.

An organization stores a known-good, standard device configuration that all similar switches should match. What is this reference called?

• a.A memorandum of understanding
• b.A configuration baseline✓
• c.A disaster recovery plan
• d.An after-action incident report

A configuration baseline is the documented standard build that devices should conform to, making drift easy to spot. Comparing a running config against it reveals unauthorized changes. It also speeds provisioning of replacement hardware.

Finance and security both need an authoritative list of every network device, its model, serial number, and warranty status. Which record provides this?

• a.An asset inventory✓
• b.A logical topology diagram
• c.A quality-of-service marking policy
• d.The firewall rule set

An asset inventory catalogs hardware and software with details like model, serial, location, and lifecycle status. It supports warranty, licensing, and end-of-life planning. Accurate inventory underpins both security and budgeting.

After a Wi-Fi deployment, an engineer documents measured signal strength across the floor as a color-coded coverage map. What is this artifact?

• a.A site survey heat map✓
• b.A rack elevation showing every device mounted in the cabinet
• c.An SLA compliance report
• d.A logical VLAN diagram

A wireless site survey heat map visualizes signal strength and coverage, revealing dead zones and overlap. It guides AP placement and channel planning. Surveys are done before deployment (predictive) and after (validation).

In a multi-floor building, cabling from each floor's wiring closet runs back to a central equipment room. What is the per-floor closet called?

• a.The default gateway for the floor
• b.An IDF✓
• c.The native VLAN on the trunk
• d.A separate broadcast domain

An IDF (intermediate distribution frame) is a floor or zone wiring closet that connects back to the MDF (main distribution frame). Documenting IDF/MDF locations and links is essential for structured cabling. This hierarchy keeps runs within distance limits.

After a project is complete, a team updates the diagrams to reflect exactly how the network was actually built, including last-minute field changes. What is this documentation called?

• a.As-built documentation✓
• b.A predictive site survey
• c.A request-for-change ticket
• d.The original pre-construction design proposal

As-built documentation records the real, final state of an installation, including deviations from the original design. It is more accurate than the planning drawings because it captures field changes. Keeping it current prevents surprises during later work.

A regulator requires proof that network controls are periodically checked against policy and standards by an independent review. Which activity satisfies this?

• a.A network audit✓
• b.A firmware upgrade
• c.A change freeze
• d.A predictive wireless coverage survey

A network audit is an independent review that verifies configurations, access, and controls against policy and standards. It produces findings and remediation items. Regular audits demonstrate compliance and surface drift or gaps.

A new technician needs a documented, repeatable set of steps for safely rebooting a core switch during a maintenance window. Which document provides this?

• a.A vendor master service agreement
• b.An acceptable use policy
• c.A standard operating procedure✓
• d.A network topology diagram

A standard operating procedure (SOP) documents the exact, repeatable steps for a routine task, reducing errors and inconsistency. It captures institutional knowledge so any qualified staff member can perform the work. SOPs support both safety and compliance.

An operations team keeps a record of each vendor, the equipment covered, support entitlements, and renewal dates so contracts do not lapse. Which document is this?

• a.A spanning-tree diagram
• b.A vendor support contract record✓
• c.A one-time packet capture from the core switch
• d.A wireless heat map

A vendor support contract record tracks coverage levels, entitlements, and renewal dates so critical support does not lapse unnoticed. It links assets to their applicable service agreements. This avoids scrambling for support during an outage on out-of-contract gear.

Two routers should share a single virtual gateway IP so that if the active router fails, the standby takes over transparently to hosts. Which category of protocol provides this?

• a.The Address Resolution Protocol used for local delivery
• b.A first hop redundancy protocol✓
• c.Spanning Tree Protocol
• d.Network Time Protocol

A first hop redundancy protocol such as VRRP or HSRP presents one virtual gateway IP backed by multiple routers, enabling automatic failover. Hosts keep the same gateway address regardless of which router is active. This removes the gateway as a single point of failure.

A design distributes live traffic across two data centers simultaneously so both handle load and either can absorb the other's share. Which model is this?

• a.Active-active✓
• b.A single node with no redundancy
• c.Cold standby only
• d.Active-passive with an idle standby node held in reserve

An active-active design runs both nodes or sites simultaneously, sharing load and providing redundancy. If one fails, the other absorbs its traffic, though capacity planning must allow for it. Active-passive instead keeps a standby idle until needed.

A load balancer must send each new client connection to the next server in a repeating list, distributing sessions evenly. Which distribution method is this?

• a.Least connections
• b.Weighted response time
• c.Source-IP hashing that pins a client to one server
• d.Round robin✓

Round robin sends each successive request to the next server in rotation, distributing connections evenly without regard to load. Least-connections and weighted methods account for server capacity or current load. The right method depends on how uniform the servers and sessions are.

A server should keep network connectivity even if one of its two network cards or switch uplinks fails. Which server-side technique provides this?

• a.Static ARP entries
• b.Enabling jumbo frames on the interface
• c.Port mirroring
• d.NIC teaming✓

NIC teaming (bonding) groups multiple physical adapters so the server tolerates a NIC, cable, or switch-port failure, and can add throughput. Modes include active-backup and load-balancing. It protects the host's connection independently of the network core.