CompTIA Network+ — All Questions

Which layer of the OSI model is responsible for logical addressing and determining the best path for packets across an internetwork?

• a.Layer 1 (Physical)
• b.Layer 4 (Transport)
• c.Layer 3 (Network)✓
• d.Layer 2 (Data Link)

Layer 3, the Network layer, handles logical addressing such as IP and makes routing decisions to move packets between networks. The Data Link layer uses physical MAC addresses for local delivery, while the Transport layer manages end-to-end segmentation. Routers operate primarily at Layer 3.

A network administrator needs to identify the protocol data unit (PDU) used at the Transport layer of the OSI model. Which term applies?

• a.Packet
• b.Bit
• c.Frame
• d.Segment✓

At the Transport layer the PDU is called a segment (or datagram for UDP). Packets exist at the Network layer, frames at the Data Link layer, and bits at the Physical layer. Knowing PDU names per layer helps when interpreting protocol behavior.

Which protocol and port number are used by HTTPS for secure web traffic by default?

• a.TCP 443✓
• b.UDP 53
• c.TCP 80
• d.TCP 22

HTTPS uses TCP port 443 and secures web traffic with TLS. Port 80 is plain HTTP, port 53 is DNS, and port 22 is SSH. Memorizing well-known ports is essential for firewall and troubleshooting work.

What is the default port used by the Domain Name System (DNS) for standard name resolution queries?

• a.TCP 110
• b.UDP 53✓
• c.TCP 25
• d.UDP 67

DNS uses UDP port 53 for most standard queries because they are small and benefit from low overhead. TCP 53 is used for zone transfers and larger responses. Ports 25, 110, and 67 belong to SMTP, POP3, and DHCP respectively.

An engineer must choose an address class for a private network that supports up to 500 hosts on a single subnet. Which private range is most appropriate to draw from?

• a.10.0.0.0/8✓
• b.224.0.0.0/4
• c.127.0.0.0/8
• d.169.254.0.0/16

The 10.0.0.0/8 range is an RFC 1918 private block that easily provides subnets large enough for 500 hosts. 169.254.0.0/16 is APIPA link-local, 224.0.0.0/4 is multicast, and 127.0.0.0/8 is loopback. Private ranges avoid public IP consumption.

How many usable host addresses are available in a subnet with a /29 prefix?

• a.4
• b.8
• c.2
• d.6✓

A /29 leaves 3 host bits, giving 2^3 = 8 total addresses, minus the network and broadcast addresses, for 6 usable hosts. Subnetting math requires subtracting two reserved addresses from the total. /29 subnets are common for small point-to-point or device segments.

Which IPv6 address type begins with the prefix FE80::/10 and is used only for communication on the local link?

• a.Link-local✓
• b.Global unicast
• c.Anycast
• d.Multicast

Link-local IPv6 addresses use the FE80::/10 prefix and are auto-configured on every interface for local-link communication. Global unicast addresses are routable on the internet, while multicast uses FF00::/8. Link-local addresses are never routed beyond the local segment.

A star topology relies on which central device to interconnect all end nodes?

• a.A central switch or hub✓
• b.A ring of daisy-chained cables
• c.A repeater between each pair of nodes
• d.A shared coaxial bus

In a star topology every node connects to a central switch or hub, which forwards traffic between them. A failure of one cable affects only that node, improving fault isolation. Bus and ring topologies use shared media that create single points of failure.

Which cabling standard defines the maximum supported distance of 100 meters for a twisted-pair Ethernet run?

• a.1000BASE-LX
• b.10GBASE-ER
• c.1000BASE-T✓
• d.100BASE-FX

1000BASE-T runs over twisted-pair copper and is limited to 100 meters per segment. The other options are fiber standards that support much longer distances. The 100-meter copper limit includes patch cords and horizontal cabling.

What is the primary purpose of a VLAN in a switched network?

• a.To convert Layer 2 frames into Layer 3 packets
• b.To provide power to connected devices
• c.To increase the speed of individual switch ports
• d.To logically segment a physical switch into separate broadcast domains✓

A VLAN logically segments a switch so that ports belong to separate broadcast domains without needing additional physical switches. This improves security and reduces broadcast traffic. Routing between VLANs still requires a Layer 3 device.

Which protocol resolves an IPv4 address to a MAC address on a local Ethernet segment?

• a.ARP✓
• b.ICMP
• c.DNS
• d.NTP

ARP (Address Resolution Protocol) maps a known IPv4 address to the MAC address needed for Layer 2 delivery. DNS resolves names to IPs, ICMP handles diagnostics, and NTP synchronizes time. ARP operates only within a local broadcast domain.

A company wants clients to obtain IP configuration automatically. Which protocol assigns addresses, subnet masks, gateways, and DNS servers dynamically?

• a.LDAP
• b.DHCP✓
• c.SNMP
• d.DNS

DHCP dynamically leases IP addresses along with subnet mask, default gateway, and DNS server information to clients. This eliminates manual configuration and reduces addressing errors. DHCP uses UDP ports 67 and 68 for server and client communication.

In the TCP three-way handshake, which sequence of flags correctly establishes a connection?

• a.ACK, SYN-ACK, SYN
• b.SYN, SYN-ACK, ACK✓
• c.PSH, URG, ACK
• d.FIN, ACK, RST

The TCP three-way handshake proceeds as SYN, then SYN-ACK, then ACK to establish a reliable session. FIN and RST relate to closing or resetting connections. Understanding the handshake helps diagnose connection setup failures.

Which cloud service model provides virtual machines, storage, and networking that customers manage themselves?

• a.PaaS
• b.IaaS✓
• c.DaaS
• d.SaaS

Infrastructure as a Service (IaaS) delivers fundamental compute, storage, and network resources that the customer configures and manages. SaaS delivers finished applications, and PaaS provides a development platform. IaaS offers the most customer control among cloud models.

What distinguishes UDP from TCP at the Transport layer?

• a.UDP guarantees ordered delivery through sequencing
• b.UDP always encrypts application data
• c.UDP performs a three-way handshake before sending data
• d.UDP is connectionless and does not guarantee delivery✓

UDP is connectionless, has low overhead, and does not guarantee delivery, ordering, or retransmission. This makes it ideal for latency-sensitive traffic such as VoIP and streaming. TCP, by contrast, is connection-oriented and reliable.

A /24 network needs to be divided into four equal subnets. Which new prefix length should be used?

• a./27
• b./28
• c./26✓
• d./25

Borrowing two host bits from a /24 creates four subnets, resulting in a /26 prefix. Each /26 subnet provides 62 usable hosts. The formula 2^n subnets requires n borrowed bits, so 2^2 equals four subnets.

Which network device forwards frames based on MAC address tables and operates primarily at Layer 2?

• a.Firewall
• b.Router
• c.Switch✓
• d.Load balancer

A switch builds a MAC address table and forwards frames only to the port associated with the destination MAC, operating at Layer 2. Routers work at Layer 3 using IP addresses. Switching reduces collisions by creating dedicated collision domains per port.

Which IEEE standard defines VLAN tagging on Ethernet trunk links?

• a.802.1Q✓
• b.802.11ac
• c.802.1X
• d.802.3af

IEEE 802.1Q defines the frame tagging method used to carry multiple VLANs across a trunk link. 802.3af covers PoE, 802.11ac is Wi-Fi, and 802.1X is port-based access control. The 802.1Q tag adds a 4-byte field to the Ethernet frame.

What is the purpose of a default gateway on a host's IP configuration?

• a.To resolve domain names into IP addresses
• b.To encrypt outbound traffic automatically
• c.To assign IP addresses to other hosts
• d.To forward traffic destined for remote networks✓

The default gateway is the router interface a host uses to reach destinations outside its local subnet. Without it, a host can only communicate on its own network. Traffic for remote networks is sent to the gateway for further routing.

Which frequency band and standard pairing offers wider channels and higher throughput but shorter range?

• a.2.4 GHz with 802.11g
• b.2.4 GHz with 802.11b
• c.900 MHz with 802.11ah
• d.5 GHz with 802.11ac✓

802.11ac operates in the 5 GHz band, offering wider channels and higher throughput at the cost of shorter range and less obstacle penetration. The 2.4 GHz band travels farther but is more congested and slower. Band selection balances speed against coverage.

Which protocol uses TCP port 22 to provide encrypted remote command-line access?

• a.SSH✓
• b.FTP
• c.RDP
• d.Telnet

SSH uses TCP port 22 to provide an encrypted remote shell, replacing insecure protocols like Telnet. Telnet on port 23 sends data in clear text. SSH is the standard for secure device management.

In a client-server architecture, what best describes the role of the server?

• a.It exclusively resolves MAC addresses to IPs
• b.It provides resources or services in response to client requests✓
• c.It only forwards broadcast traffic between subnets
• d.It generates spanning-tree topology changes

A server centrally provides resources or services such as files, web pages, or databases in response to client requests. Clients initiate requests and consume those services. This model contrasts with peer-to-peer where nodes act as both.

Which address is reserved as the IPv4 loopback used to test the local TCP/IP stack?

• a.10.0.0.1
• b.127.0.0.1✓
• c.255.255.255.255
• d.192.168.0.1

127.0.0.1 is the loopback address that lets a host test its own TCP/IP stack without touching the physical network. The entire 127.0.0.0/8 block is reserved for loopback. Pinging it confirms the local protocol stack is functioning.

Which OSI layer provides reliable, connection-oriented delivery with segmentation, sequencing, and flow control?

• a.Layer 4 (Transport)✓
• b.Layer 5 (Session)
• c.Layer 3 (Network)
• d.Layer 6 (Presentation)

The Transport layer (Layer 4) handles end-to-end delivery, breaking data into segments, sequencing them, and managing flow control and, in TCP, retransmission. The Network layer routes packets but does not guarantee delivery. TCP is the classic Layer 4 protocol that provides these reliability features.

At which OSI layer are data formatting, character encoding, compression, and encryption or decryption handled?

• a.Layer 7 (Application)
• b.Layer 2 (Data Link control)
• c.Layer 4 (Transport)
• d.Layer 6 (Presentation)✓

The Presentation layer (Layer 6) translates data between the application and the network, handling formatting, character encoding, compression, and encryption. It ensures data from the sender is readable by the receiver. TLS encryption is often associated with this layer's functions.

Which OSI layer establishes, maintains, and terminates dialogues between two communicating hosts?

• a.Layer 4 (Transport)
• b.Layer 5 (Session)✓
• c.Layer 7 (Application)
• d.Layer 6 (Presentation)

The Session layer (Layer 5) sets up, manages, and tears down the sessions or dialogues between applications on different hosts. It can also handle checkpointing and reestablishing dropped connections. It sits above Transport and below Presentation in the stack.

Which OSI layer defines voltage levels, pin assignments, and the encoding of bits into electrical, optical, or radio signals?

• a.Layer 4 (Transport)
• b.Layer 3 (Network)
• c.Layer 2 (Data Link)
• d.Layer 1 (Physical)✓

The Physical layer (Layer 1) defines the physical and electrical characteristics of the medium, including voltage, pinouts, cabling, and how bits become signals. Hubs, cables, and connectors operate here. It is concerned only with transmitting raw bits, not their meaning.

The Data Link layer encapsulates packets into which protocol data unit before placing them on the local medium?

• a.Packet
• b.Frame✓
• c.Datagram
• d.Segment

At the Data Link layer (Layer 2), packets from the Network layer are encapsulated into frames that include source and destination MAC addresses and error-checking. Segments belong to the Transport layer and packets to the Network layer. Framing prepares data for delivery across the local link.

Protocols such as HTTP, SMTP, and FTP that provide services directly to user applications operate at which OSI layer?

• a.Layer 5 (Session)
• b.Layer 6 (Presentation)
• c.Layer 7 (Application)✓
• d.Layer 4 (Transport)

The Application layer (Layer 7) is where protocols that interface directly with user-facing applications, such as HTTP, SMTP, and FTP, operate. It provides network services to applications rather than to end users directly. It is the top layer of the OSI model.

As data moves down the OSI stack from a sending host, in what order is it encapsulated?

• a.Bits, frames, packets, segments, data
• b.Packets, segments, frames, data, bits
• c.Data, segments, packets, frames, bits✓
• d.Frames, packets, segments, data, bits

Encapsulation proceeds top down: application data becomes segments at Transport, packets at Network, frames at Data Link, and finally bits at the Physical layer. Each layer adds its own header (and the Data Link layer a trailer). The receiving host reverses this order during de-encapsulation.

At the Network layer, a segment received from the Transport layer is encapsulated into which protocol data unit?

• a.Segment
• b.Packet✓
• c.Bit
• d.Frame

The Network layer (Layer 3) adds logical addressing to form a packet from the Transport layer's segment. Frames are formed at Layer 2 and bits exist at Layer 1. Routers forward packets based on the destination IP in the Layer 3 header.

In a full-mesh topology of 6 nodes, how many direct point-to-point links are required?

• a.15✓
• b.30
• c.6
• d.12

A full mesh connects every node to every other node, requiring n(n-1)/2 links. For 6 nodes that is 6 times 5 divided by 2, which equals 15. Full mesh offers maximum redundancy but grows expensive quickly as nodes increase.

Which topology connects multiple remote sites back to a single central hub site, minimizing links but creating a single point of failure at the center?

• a.Bus
• b.Ring
• c.Full mesh
• d.Hub-and-spoke✓

In a hub-and-spoke topology, each remote spoke site connects only to a central hub, reducing the number of links compared with a mesh. The trade-off is that the hub becomes a single point of failure and a potential bottleneck. It is common in WAN designs for cost efficiency.

Which data center fabric design connects every leaf switch to every spine switch to provide predictable, low-latency east-west traffic?

• a.Token ring
• b.Three-tier collapsed core
• c.Bus backbone
• d.Spine-and-leaf✓

A spine-and-leaf fabric links each leaf (access) switch to every spine switch, so any server is at most two hops from any other. This yields consistent latency and high bandwidth for east-west traffic in modern data centers. It scales better than traditional three-tier designs for server-to-server flows.

In the classic three-tier hierarchical campus model, which layer aggregates access switches and enforces routing and policy between them?

• a.Distribution layer✓
• b.Physical layer
• c.Core layer
• d.Access layer

The distribution (aggregation) layer sits between access and core, aggregating access-layer uplinks and applying routing, filtering, and policy. The access layer connects end devices, and the core provides high-speed backbone transport. Separating these roles improves scalability and manageability.

Which network type spans a city or metropolitan area, larger than a LAN but smaller than a WAN?

• a.SAN
• b.PAN
• c.MAN✓
• d.WLAN

A Metropolitan Area Network (MAN) covers a city or metro region, bridging the gap between a local LAN and a wide-area WAN. It often interconnects multiple campuses within the same city. Service providers frequently deliver MAN services over fiber.

Which specialized network provides block-level access to consolidated storage, appearing to servers as locally attached disks?

• a.Campus area network (CAN)
• b.Personal area network (PAN)
• c.Wireless LAN (WLAN)
• d.Storage area network (SAN)✓

A Storage Area Network (SAN) delivers block-level storage over a dedicated high-speed network so servers treat remote volumes as if locally attached. Technologies include Fiber Channel and iSCSI. This differs from file-level NAS, which presents shares over the LAN.

A wireless connection between a smartphone and nearby earbuds over Bluetooth is an example of which network type?

• a.Storage area network (SAN)
• b.Personal area network (PAN)✓
• c.Metro area network (MAN)
• d.Wide area network (WAN)

A Personal Area Network (PAN) interconnects devices within a person's immediate range, typically a few meters, often over Bluetooth. Pairing a phone with earbuds or a smartwatch is a common example. PANs are the smallest scope among network types.

Which technology uses centralized, software-based policy to steer traffic across multiple transport links such as MPLS, broadband, and LTE between sites?

• a.VLSM
• b.STP
• c.PoE
• d.SD-WAN✓

Software-Defined WAN (SD-WAN) abstracts the underlying transports and uses centralized policy to route application traffic over the best available link. It can combine MPLS, broadband, and cellular for resilience and cost savings. It improves agility compared with traditional static WAN routing.

Which copper cabling category is required to reliably support 10GBASE-T over the full 100-meter distance?

• a.Cat 3
• b.Cat 6a✓
• c.Cat 5e
• d.Cat 5

Category 6a cabling supports 10GBASE-T at the full 100-meter distance with improved alien crosstalk performance. Cat 6 can carry 10 Gbps but only to about 55 meters. Cat 5e tops out at 1 Gbps for typical runs.

Which small-form-factor fiber connector uses a 1.25 mm ferrule and a latching clip, and is common on SFP transceivers?

• a.LC✓
• b.BNC
• c.F-type
• d.ST

The LC (Lucent Connector) uses a compact 1.25 mm ferrule and a push-pull latch, making it ideal for high-density SFP and SFP+ ports. ST and SC are larger 2.5 mm connectors. BNC and F-type are coaxial, not fiber, connectors.

Which transceiver form factor supports a single 10 Gbps link and is widely used in switch uplinks?

• a.RJ45
• b.SFP+✓
• c.GBIC
• d.QSFP28 (100 Gbps quad channel)

SFP+ is an enhanced small form-factor pluggable transceiver rated for 10 Gbps on a single lane. GBIC is an older, larger 1 Gbps module. QSFP variants bundle four lanes for 40 or 100 Gbps, so they are not single-link 10 Gbps modules.

Which fiber type uses a larger core, typically 50 or 62.5 microns, with LED or VCSEL light sources for shorter, cost-effective runs?

• a.Multimode fiber✓
• b.Single-mode fiber
• c.Twinaxial cable
• d.Coaxial cable

Multimode fiber has a larger core that allows multiple light paths, working well for shorter distances with inexpensive LED or VCSEL sources. Single-mode fiber has a tiny core and laser sources for very long distances. Multimode is common inside data centers and buildings.

Which cable rating is required when cabling runs through air-handling spaces because it produces less toxic smoke when burned?

• a.Riser (CMR)
• b.Shielded (STP)
• c.Direct-burial
• d.Plenum (CMP)✓

Plenum-rated cable (CMP) has a fire-resistant jacket that emits less toxic smoke, so it is required in plenum air spaces above ceilings or under raised floors. Riser cable is for vertical shafts between floors but not plenum spaces. Local fire codes mandate plenum cable in these areas.

Which connector is threaded onto coaxial cable to deliver cable-internet or CATV service to a modem?

• a.LC
• b.RJ11
• c.SC
• d.F-type✓

The F-type connector screws onto coaxial cable and is standard for cable television and cable-modem internet service. LC and SC are fiber connectors, while RJ11 is for telephone lines. Coax with F-connectors is common on the last mile of cable networks.

Which short-reach copper assembly with attached transceivers, known as a DAC, is commonly used for top-of-rack switch-to-server links?

• a.Coaxial RG-6
• b.Twinaxial cable✓
• c.Single-mode fiber
• d.Cat 5e patch cord

A Direct Attach Copper (DAC) cable uses twinaxial copper with transceivers permanently attached to each end, providing a low-cost, low-power option for short 10 to 100 Gbps links inside a rack. It is cheaper than optics for these short distances. It is popular for top-of-rack connectivity.

Which fiber connector bundles 12 or more fibers into one housing and is often used to break out 40G or 100G into multiple lanes?

• a.ST
• b.MPO/MTP✓
• c.SC simplex
• d.LC duplex

The MPO/MTP connector groups many fibers (commonly 12 or 24) into a single rectangular housing, enabling high-density parallel optics for 40G and 100G. It can be broken out into multiple duplex LC links. It is widely used in data-center fiber trunking.

A traditional analog telephone line typically terminates in which small connector with fewer conductors than an Ethernet jack?

• a.LC
• b.RJ45
• c.BNC
• d.RJ11✓

The RJ11 connector, with its two to four conductors, is used for analog telephone and some DSL connections. RJ45 is the eight-conductor connector used for Ethernet. The two look similar but RJ11 is noticeably narrower.

How many usable host addresses does a /26 subnet provide?

• a.126
• b.30
• c.64
• d.62✓

A /26 leaves 6 host bits, giving 2 to the 6th power, or 64 total addresses, minus the network and broadcast addresses, for 62 usable hosts. Always subtract two reserved addresses from the total. A /26 is a common size for medium departmental subnets.

The subnet mask 255.255.255.240 corresponds to which CIDR prefix length?

• a./27
• b./29
• c./28✓
• d./26

The last octet 240 is 11110000 in binary, which is four network bits added to the 24 in the first three octets, totaling 28. So 255.255.255.240 equals /28. Each /28 subnet provides 14 usable hosts.

Host 10.1.5.130 with a /25 mask belongs to which subnet network address?

• a.10.1.5.128✓
• b.10.1.5.0
• c.10.1.5.64
• d.10.1.5.96

A /25 splits the last octet into blocks of 128, producing subnets .0 and .128. The host .130 falls in the second block, so its network address is 10.1.5.128. The broadcast for that subnet would be 10.1.5.255.

A /30 subnet, commonly used for point-to-point router links, provides how many usable host addresses?

• a.6
• b.1
• c.4
• d.2✓

A /30 leaves 2 host bits, giving 4 total addresses minus the network and broadcast, for 2 usable hosts. That is exactly enough for the two ends of a point-to-point link. This efficiency is why /30 is traditional for router interconnections.

How many /27 subnets can be created from a single /24 network?

• a.16
• b.4
• c.32
• d.8✓

Moving from /24 to /27 borrows 3 host bits, and 2 to the 3rd power equals 8 subnets. Each /27 provides 30 usable hosts. The formula 2 to the number of borrowed bits gives the subnet count.

What is the broadcast address of the network 172.16.4.0/22?

• a.172.16.255.255
• b.172.16.7.255✓
• c.172.16.4.255
• d.172.16.4.63

A /22 mask is 255.255.252.0, giving a block size of 4 in the third octet, so 172.16.4.0 spans 172.16.4.0 through 172.16.7.255. The broadcast address is therefore 172.16.7.255. The last usable host is 172.16.7.254.

An IPv6 address is composed of how many bits?

• a.256
• b.128✓
• c.64
• d.32

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits. This vastly expands the address space compared with IPv4's 32 bits. The larger space removes the practical scarcity that drove IPv4 NAT adoption.

Which IPv6 prefix is reserved for unique local addresses, the rough equivalent of IPv4 RFC 1918 private space?

• a.FF00::/8
• b.FC00::/7✓
• c.2000::/3
• d.FE80::/10

Unique local addresses use the FC00::/7 range (in practice FD00::/8) and are routable within an organization but not on the public internet. FE80::/10 is link-local, FF00::/8 is multicast, and 2000::/3 is global unicast. ULAs provide private-style addressing for IPv6.

Which IPv6 address is the loopback used to test the local protocol stack?

• a.FF02::1
• b.FE80::1
• c.::
• d.::1✓

The IPv6 loopback address is ::1, the equivalent of 127.0.0.1 in IPv4, used to test the local TCP/IP stack. The all-zeros :: is the unspecified address. FF02::1 is the all-nodes multicast address on the local link.

Which IPv6 mechanism lets a host automatically generate its own global address from a router-advertised prefix without a DHCP server?

• a.APIPA
• b.SLAAC✓
• c.NAT66
• d.DHCPv6 stateful

Stateless Address Autoconfiguration (SLAAC) lets a host build its own address by combining the prefix from a Router Advertisement with a locally generated interface identifier. No DHCP server is required. APIPA is an IPv4 concept, and stateful DHCPv6 does track assignments centrally.

Which process forms the 64-bit IPv6 interface identifier from a 48-bit MAC address by inserting FFFE and flipping a bit?

• a.Stateful DHCPv6
• b.Anycast assignment
• c.EUI-64✓
• d.SLAAC prefix delegation

EUI-64 expands a 48-bit MAC into a 64-bit interface identifier by inserting FFFE in the middle and flipping the seventh bit of the first byte. SLAAC often uses EUI-64 to build the host portion of an address. Privacy extensions can replace it with randomized identifiers.

Which address range does a Windows host self-assign when it cannot reach a DHCP server?

• a.172.16.0.0/12
• b.192.168.0.0/16
• c.169.254.0.0/16✓
• d.10.0.0.0/8

APIPA self-assigns an address from 169.254.0.0/16 when no DHCP server responds, allowing local-link communication only. The other ranges are RFC 1918 private blocks that are normally assigned deliberately. Seeing a 169.254 address is a strong sign of a DHCP problem.

Which transition approach runs IPv4 and IPv6 simultaneously on the same interfaces so hosts can use either protocol?

• a.6to4 only
• b.Dual stack✓
• c.Tunneling
• d.NAT64

Dual stack configures both IPv4 and IPv6 on the same interfaces so a host can communicate over whichever protocol a destination supports. It is the most straightforward migration method. Tunneling and NAT64 address cases where only one protocol is available end to end.

Under legacy classful addressing, what is the default subnet mask for a Class B network?

• a.255.255.0.0✓
• b.255.255.255.0
• c.255.255.255.128
• d.255.0.0.0

Class B networks span 128.0.0.0 through 191.255.255.255 and use a default mask of 255.255.0.0, or /16. Class A defaults to 255.0.0.0 and Class C to 255.255.255.0. Modern networks use CIDR rather than rigid classful boundaries.

Which IPv4 address range is reserved for multicast group traffic?

• a.10.0.0.0/8
• b.127.0.0.0/8
• c.224.0.0.0/4✓
• d.169.254.0.0/16

The 224.0.0.0/4 range (224.0.0.0 through 239.255.255.255), historically Class D, is reserved for multicast. Multicast delivers a single stream to many subscribed receivers efficiently. The other ranges are loopback, APIPA, and private unicast respectively.

Which TCP port does FTP use for its control connection carrying commands and responses?

• a.21✓
• b.22
• c.69
• d.20

FTP uses TCP port 21 for the control channel that carries commands and server responses, while port 20 handles active-mode data transfer. Port 22 is SSH and port 69 is TFTP. Separating control and data is a defining trait of FTP.

Which well-known TCP port is used by SMTP to relay email between mail servers?

• a.993
• b.110
• c.143
• d.25✓

SMTP uses TCP port 25 to transfer email between servers. Ports 110 and 143 are POP3 and IMAP for retrieval, and 993 is secure IMAP. Submission from clients often uses port 587 with authentication.

Which TCP port does IMAP use by default to retrieve and synchronize email from a server?

• a.25
• b.110
• c.389
• d.143✓

IMAP uses TCP port 143 and, unlike POP3, keeps messages on the server and synchronizes folder state across devices. POP3 on port 110 typically downloads and deletes mail. Secure IMAP over TLS uses port 993.

On which UDP port does an SNMP agent listen for polling requests from a management station?

• a.514
• b.161✓
• c.123
• d.162

SNMP agents listen on UDP port 161 for get and set requests, while traps are sent to the manager on UDP 162. Port 514 is syslog and 123 is NTP. Knowing this pair is key to allowing monitoring through firewalls.

Which TCP port is used by Microsoft's Remote Desktop Protocol for graphical remote sessions?

• a.5900
• b.22
• c.23
• d.3389✓

RDP uses TCP port 3389 to provide graphical remote access to Windows systems. Port 5900 is VNC, port 22 is SSH, and 23 is Telnet. Exposing 3389 directly to the internet is a common security risk.

Which TCP or UDP port does LDAP use for unencrypted directory queries?

• a.636
• b.445
• c.389✓
• d.88

LDAP uses port 389 for standard, unencrypted directory lookups. The secure variant LDAPS uses port 636. Port 88 is Kerberos and 445 is SMB, both common in the same directory environments.

Which TCP port does modern SMB use for Windows file and printer sharing over TCP/IP?

• a.139
• b.137
• c.3389
• d.445✓

Modern SMB (CIFS) runs directly over TCP port 445 for file and printer sharing. Legacy NetBIOS used ports 137 through 139. Port 445 is frequently targeted by worms, so it should be filtered at the perimeter.

Which UDP port do network devices commonly use to send syslog messages to a logging server?

• a.514✓
• b.123
• c.161
• d.69

Syslog traditionally uses UDP port 514 to forward event messages to a central log server. SNMP uses 161, NTP uses 123, and TFTP uses 69. Reliable variants can carry syslog over TCP, sometimes with TLS.

Which TCP port does the insecure, clear-text Telnet remote-terminal protocol use?

• a.23✓
• b.25
• c.22
• d.21

Telnet uses TCP port 23 and transmits everything, including credentials, in clear text. SSH on port 22 is the secure replacement. Telnet should be disabled on production devices for security reasons.

Which UDP port does TFTP use, often for network device firmware and configuration transfers?

• a.161
• b.69✓
• c.20
• d.21

TFTP uses UDP port 69 and is a lightweight, unauthenticated file-transfer protocol often used to load firmware or configs onto network devices. It lacks the reliability and security of FTP. Its simplicity makes it convenient on the LAN but unsafe across untrusted links.

Which TCP port carries LDAP directory traffic secured with SSL or TLS as LDAPS?

• a.989
• b.636✓
• c.389
• d.443

LDAPS encrypts directory traffic and uses TCP port 636. Standard LDAP on 389 is unencrypted. Port 443 is HTTPS and 989 is FTPS data, so neither applies to secure directory queries.

Which port is used by unencrypted SIP for setting up and tearing down VoIP calls?

• a.5060✓
• b.5061
• c.1720
• d.554

SIP signaling for VoIP call setup and teardown uses port 5060 without encryption, while 5061 is used for SIP over TLS. Port 1720 is H.323 and 554 is RTSP for streaming. SIP handles signaling while RTP carries the actual media.

Which TCP port does POP3 use to download email, typically removing it from the server?

• a.143
• b.110✓
• c.465
• d.25

POP3 uses TCP port 110 and generally downloads messages to a single device, removing them from the server. IMAP on 143 keeps mail synchronized on the server. Secure POP3 over TLS uses port 995.

Which port does Kerberos use for authentication in Windows Active Directory environments?

• a.636
• b.88✓
• c.445
• d.389

Kerberos authentication uses port 88 to issue and validate tickets in Active Directory. LDAP uses 389, LDAPS 636, and SMB 445 in the same environments. Kerberos provides single sign-on through its ticket-granting mechanism.

Which TCP port carries unencrypted HTTP web traffic by default?

• a.21
• b.80✓
• c.8080
• d.443

HTTP uses TCP port 80 for unencrypted web traffic. Port 443 carries HTTPS with TLS encryption, and 8080 is a common alternate proxy or web port. Modern sites redirect port 80 to 443 for security.

Which default TCP port does Microsoft SQL Server listen on for database client connections?

• a.3306
• b.1521
• c.1433✓
• d.5432

Microsoft SQL Server listens on TCP port 1433 by default. MySQL uses 3306, Oracle 1521, and PostgreSQL 5432. Database ports should be restricted to application servers rather than exposed broadly.

Which sequence correctly lists the four DHCP messages a client and server exchange to obtain a lease?

• a.Offer, Discover, Acknowledge, Request
• b.Discover, Request, Offer, Acknowledge
• c.Discover, Offer, Request, Acknowledge✓
• d.Request, Offer, Discover, Acknowledge

The DHCP process follows the DORA sequence: the client broadcasts a Discover, the server sends an Offer, the client sends a Request for the offered address, and the server confirms with an Acknowledge. Remembering DORA keeps the order straight. Only after the ACK does the client use the leased address.

Which DNS record type maps a hostname to an IPv4 address?

• a.CNAME
• b.MX
• c.AAAA
• d.A✓

The A record maps a hostname to a 32-bit IPv4 address. The AAAA record does the same for IPv6, MX points to mail servers, and CNAME creates an alias. A records are the most common forward-lookup entries.

Which DNS record type resolves a hostname to an IPv6 address?

• a.PTR (reverse pointer)
• b.TXT
• c.A
• d.AAAA✓

The AAAA (quad-A) record maps a hostname to a 128-bit IPv6 address. The A record handles IPv4, PTR handles reverse lookups, and TXT holds arbitrary text. Dual-stack hosts commonly have both A and AAAA records.

Which DNS record identifies the mail server responsible for accepting email for a domain?

• a.CNAME
• b.MX✓
• c.SRV
• d.NS

The MX (Mail Exchange) record specifies the mail servers that accept email for a domain, along with a priority value. Lower priority numbers are preferred. SRV records locate other services, while NS records delegate the zone.

Which DNS record creates an alias that points one hostname to another canonical name?

• a.CNAME✓
• b.PTR
• c.SOA
• d.A

A CNAME (Canonical Name) record aliases one hostname to another, so www can point to a canonical host that itself has an A record. It avoids duplicating address records. A CNAME should not coexist with other record types for the same name.

Which DNS record maps an IP address back to a hostname for reverse lookups?

• a.TXT
• b.A
• c.PTR✓
• d.MX

The PTR (pointer) record provides reverse DNS, mapping an IP address to a hostname within the in-addr.arpa or ip6.arpa zones. Mail servers often check PTR records to help verify sender legitimacy. It is the inverse of an A or AAAA record.

Which DNS record type holds free-form text and is used for SPF, DKIM, and domain-verification data?

• a.SRV
• b.CNAME
• c.TXT✓
• d.NS

The TXT record stores arbitrary text and is widely used for email authentication such as SPF and DKIM, plus domain ownership verification. It carries policy data rather than addressing. Its flexibility makes it central to modern email security.

In a DNS record, what does the TTL value control?

• a.How long a resolver may cache the record✓
• b.The priority of a mail server
• c.The UDP port the query is sent to
• d.The maximum size of the DNS response packet

The DNS TTL tells resolvers how many seconds they may cache a record before querying again for a fresh copy. Lower TTLs speed propagation of changes but increase query load. Administrators lower TTLs before planned changes to reduce stale answers.

Which term describes a DNS resolver that takes full responsibility for querying other servers and returning a final answer to the client?

• a.Root hint server
• b.Authoritative-only server
• c.Iterative forwarder
• d.Recursive resolver✓

A recursive resolver accepts a client's query and does the work of contacting root, TLD, and authoritative servers until it has the final answer. The client makes one request and gets one answer. Authoritative servers, by contrast, only answer for the zones they host.

In NTP, what does the stratum number indicate?

• a.The distance in hops from a reference clock✓
• b.The encryption strength of the time source
• c.The UDP port used for synchronization
• d.The number of clients a server can serve

The NTP stratum indicates how many steps a time source is from an authoritative reference clock, with stratum 0 being the reference itself and stratum 1 directly attached. Higher stratum numbers are further away and slightly less accurate. Clients typically sync to low-stratum servers.

Which DHCP feature guarantees that a specific device always receives the same IP address based on its MAC address?

• a.Exclusion range
• b.Lease time
• c.Scope option
• d.Reservation✓

A DHCP reservation ties a specific MAC address to a fixed IP so the device always gets the same address while still using DHCP. Exclusions merely remove addresses from the pool, and scope options set parameters like DNS. Reservations suit printers and servers that need consistent addressing.

On which UDP port does NTP exchange time-synchronization messages?

• a.53
• b.67
• c.514
• d.123✓

NTP uses UDP port 123 to synchronize clocks between devices and time sources. Port 53 is DNS, 67 is DHCP, and 514 is syslog. Accurate time from NTP underpins logging, certificates, and authentication.

Which UDP port pair does DHCP use for server and client communication?

• a.80 and 8080
• b.53 and 54
• c.67 and 68✓
• d.137 and 138

DHCP servers listen on UDP port 67 and clients receive on UDP port 68. These ports are essential to allow through firewalls or configure in DHCP relays. Knowing them helps diagnose why clients fail to obtain addresses.

Which DNS record identifies the authoritative name servers for a zone?

• a.MX
• b.PTR
• c.NS✓
• d.A

NS (Name Server) records list the authoritative name servers for a zone and are used to delegate subdomains. MX points to mail servers, PTR handles reverse lookups, and A maps names to IPv4 addresses. Correct NS records are essential for delegation to work.

A company uses a web-based email and CRM suite that the provider fully manages, with no OS or application maintenance by the customer. Which cloud model is this?

• a.PaaS
• b.DaaS
• c.IaaS
• d.SaaS✓

Software as a Service (SaaS) delivers complete, provider-managed applications accessed over the web, with the customer managing only data and users. IaaS and PaaS require the customer to manage more of the stack. Email and CRM suites are classic SaaS examples.

Which cloud service model gives developers a managed platform of runtime, OS, and middleware to deploy their own applications without managing servers?

• a.On-premises
• b.PaaS✓
• c.IaaS
• d.SaaS

Platform as a Service (PaaS) provides a managed environment, including the operating system, runtime, and middleware, so developers deploy code without maintaining the underlying infrastructure. IaaS gives raw compute the customer must manage, and SaaS gives finished apps. PaaS accelerates development.

An organization keeps sensitive workloads in its private data center but bursts to a public provider during peak demand. Which cloud deployment model is this?

• a.Private cloud
• b.Public cloud
• c.Community cloud
• d.Hybrid cloud✓

A hybrid cloud combines private infrastructure with public cloud resources, allowing sensitive workloads to stay private while bursting to public capacity when needed. This balances control with scalability. Cloud bursting is a common hybrid use case.

Which cloud characteristic allows resources to automatically expand and contract in response to changing demand?

• a.Elasticity✓
• b.Multitenancy
• c.Metered billing
• d.Broad network access

Elasticity lets cloud resources scale up during spikes and scale down when demand falls, often automatically. This ensures performance during peaks while avoiding paying for idle capacity. It is a defining advantage of cloud over fixed on-premises hardware.

Which cloud construct provides a logically isolated, customer-defined virtual network with its own subnets and routing inside a public provider?

• a.Network function virtualization (NFV)
• b.Availability zone
• c.Virtual private cloud (VPC)✓
• d.Content delivery network (CDN)

A Virtual Private Cloud (VPC) is a logically isolated section of a public cloud where a customer defines subnets, route tables, and gateways. It gives control similar to an on-premises network within the provider. CDNs cache content, and availability zones describe physical data-center groupings.