CompTIA • N10-009
CompTIA Network+ validates the skills needed to establish, maintain, and troubleshoot essential networks. It covers networking concepts, implementation, operations, security, and troubleshooting for junior network administrators.
Questions
699
Duration
90 minutes
Passing Score
720/900
Difficulty
AssociateLast Updated
Mar 2026
CompTIA Network+ (N10-009) validates the skills required to establish, maintain, and troubleshoot essential enterprise and small office/home office (SOHO) networks. The certification covers networking concepts including the OSI model and protocols, network implementation such as routing and switching, network operations including documentation and monitoring, network security with encryption and access controls, and troubleshooting methodologies. The N10-009 exam, launched June 20, 2024, includes a maximum of 90 questions (a mix of multiple-choice and performance-based questions) delivered over 90 minutes. This vendor-neutral certification prepares professionals to support networks across multiple platforms and is recognized by the U.S. Department of Defense (DoD 8140) and accredited by ANSI.
Network+ is designed for IT professionals pursuing roles as junior network administrators, network support technicians, network operations specialists, technical support specialists, and system administrators. The certification targets candidates with basic IT knowledge who are advancing into network-focused positions and those seeking to validate their hands-on networking experience. It serves as an ideal intermediate stepping stone for IT professionals who have completed CompTIA A+ and are looking to specialize in networking infrastructure and operations.
CompTIA recommends a minimum of 9 to 12 months of hands-on experience in a junior network administrator or network support technician role. While not strictly required, holding CompTIA A+ certification beforehand is strongly recommended as it provides foundational IT knowledge. Candidates should have practical experience with network configuration, basic troubleshooting, and familiarity with networking concepts including TCP/IP, DHCP, DNS, and network topologies. Hands-on experience with networking tools, switches, routers, and wireless access points is beneficial for success, particularly for the performance-based questions that simulate real-world network administration tasks.
The N10-009 exam contains a maximum of 90 scored questions delivered over 90 minutes. The exam combines multiple-choice questions (including single and multiple-response formats) with performance-based questions (PBQs) that require candidates to solve networking problems in a simulated IT environment. The exam uses a scaled scoring system with a range of 100-900, and a passing score is 720. The exam is administered through CompTIA's testing partners both online and at testing centers, with results available immediately upon completion. The test was launched on June 20, 2024, with an estimated retirement date around 2027.
CompTIA Network+ certification significantly enhances career prospects in networking and IT operations. Professionals holding Network+ certification typically earn approximately 20% more than non-certified peers, with entry-level salaries ranging from $50,000 to $65,000, compared to around $40,000 for non-certified individuals. Career paths include technical support specialist, network operations specialist, system administrator, and junior network administrator positions. The certification is recognized by the U.S. Department of Defense (DoD 8140) and accredited by ANSI, making it valuable for government and enterprise roles. As professionals gain experience with Network+, advancement opportunities include senior network administrator, systems engineer, and network architect positions, with system administrators earning median salaries around $90,000 and systems engineers averaging $130,000 annually. Unlike vendor-specific certifications, Network+ prepares professionals to support multi-vendor network environments, making it universally applicable across diverse IT infrastructures and organizations.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 699 questions.
1. A Northwind Traders administrator needs to implement a highly accurate time synchronization solution for financial trading systems that require sub-microsecond accuracy for regulatory audit trails and transaction ordering. Standard NTP has been tested and provides only millisecond accuracy, which is insufficient. Which time synchronization protocol should replace NTP for these systems? (Select one!)
Explanation
PTP (Precision Time Protocol), standardized as IEEE 1588-2019, is specifically designed for environments requiring sub-microsecond time synchronization accuracy. Unlike NTP which operates in software and achieves millisecond accuracy, PTP uses hardware timestamping at the network interface level and operates over UDP ports 319 and 320. It is widely used in financial services, telecommunications, and industrial control systems where precise event ordering and regulatory compliance require nanosecond-to-microsecond accuracy. NTS (Network Time Security, RFC 8915) adds TLS 1.3-based cryptographic authentication to NTP but does not improve NTP's inherent millisecond accuracy — it addresses security, not precision. SNTP is a simplified, lower-accuracy subset of NTP, not a more accurate alternative. Stratum 1 NTP servers provide accurate time sources but the NTP protocol itself is still limited to millisecond accuracy in software implementations.
2. A network administrator at Fabrikam is troubleshooting connectivity to a remote server. A traceroute shows asterisks (*) for hops 4, 5, and 6, but successful responses from hop 7 and the destination. What is the most likely cause of this behavior? (Select one!)
Explanation
Traceroute works by sending packets with incrementing TTL values and listening for ICMP Time Exceeded messages. When routers are configured to not generate ICMP Time Exceeded messages (often for security hardening), they appear as asterisks in the output. Since subsequent hops and the destination respond successfully, the routers are clearly forwarding packets correctly. If the routers were offline or if there was a link failure, the destination would not be reachable. A routing loop would prevent packets from reaching the destination.
3. Adatum Enterprises is deploying STP security on their access switches. PortFast is enabled on all access ports to speed up client connections. The security team wants to ensure that if a rogue switch is plugged into any PortFast-enabled access port, it cannot disrupt the spanning tree topology or take over the root bridge role. Which STP guard feature should be enabled on access ports? (Select one!)
Explanation
BPDU Guard should be enabled on all PortFast-enabled access ports. When a BPDU is received on a BPDU Guard-protected port (indicating a switch has been connected), the port immediately transitions to err-disabled state, preventing the unauthorized switch from participating in STP and potentially causing topology changes or taking over as root bridge. Root Guard is used on designated ports to prevent connected switches from claiming root bridge status but allows the port to remain active in a listening/blocking state. Loop Guard prevents loops caused by unidirectional link failures on non-designated ports. BPDU Filter can be dangerous as it completely hides the port from STP, potentially creating loops. BPDU Guard provides the strongest access port protection.
4. A network engineer at Northwind Traders is reviewing DNS security options. The security team needs a solution that provides integrity and authenticity verification for DNS responses to prevent cache poisoning attacks. A separate requirement mandates encrypting DNS queries in transit to prevent eavesdropping by ISPs. Which combination of technologies should the engineer recommend? (Select two!)
Multiple correct answersExplanation
DNSSEC digitally signs DNS zone records using public key cryptography, allowing resolvers to verify that DNS responses have not been tampered with and originate from the legitimate authoritative source. Critically, DNSSEC does NOT encrypt queries — it only provides integrity and authenticity. DNS over HTTPS (DoH) encrypts DNS queries and responses between the client and resolver over HTTPS on port 443, preventing ISP eavesdropping and man-in-the-middle interception. These two technologies are complementary: DNSSEC secures the data itself while DoH secures the transport channel. DNS over TLS (DoT, port 853) also encrypts queries but does not replace DNSSEC because it provides no record signing or integrity verification. DNSSEC does not encrypt traffic; confusing it with encryption is a common misconception.
5. A technician at Contoso is using the tcpdump command on a Linux server to capture traffic on the eth1 interface and save the output to a file named capture.pcap for later analysis in Wireshark. Which command syntax correctly accomplishes this task? (Select one!)
Explanation
The correct tcpdump syntax uses -i to specify the interface (eth1), -n to suppress DNS name resolution for faster capture and to display raw IP addresses, and -w to write the raw packet data to a file (capture.pcap) in libpcap format that Wireshark can read. The -n flag is considered best practice during capture to avoid DNS lookups that could slow the capture process. The option -listen is not a valid tcpdump flag; tcpdump uses standard UNIX-style single-character flags preceded by a hyphen. The option -save is not valid; the correct flag for writing to a file is -w. The option -c in tcpdump specifies a packet count limit (number of packets to capture before stopping), not an interface specification.
One-time access to this exam