20 free CompTIA Network+ practice questions

Correct answer: C · /26, which gives 62 usable host addresses

The VLAN needs 51 usable addresses: 50 cameras plus the gateway. For a conventional multiaccess IPv4 subnet, there are 32 minus the prefix length host bits and 2^(host bits) minus 2 usable addresses, reserving network and broadcast. A /26 gives 62, so it fits. A /27 gives 30 and a /28 gives 14, both too few. A /25 gives 126 but is larger than needed. The special /31 point-to-point and /32 host-route cases do not apply to this camera VLAN.

Look for this next time: Count the hosts plus the gateway, then pick the first prefix whose 2^(host bits) − 2 covers them.

Correct answer: A · TCP 636, the default port for LDAP over SSL

LDAP over SSL uses its own default port, TCP 636, so a rule that allows only TCP 389, the plain LDAP port, drops the new connections. Allowing TCP 636 for the same source and destination fixes it. TCP 443 is the default HTTPS port for web traffic, not directory binds. TCP 3389 is the Remote Desktop Protocol port, used for remote sessions. TCP 1433 is the default Microsoft SQL Server port. None of them carries LDAPS by default.

Look for this next time: LDAP uses 389 and LDAPS uses 636, so a move to LDAPS needs a firewall rule for 636.

Correct answer: A · 2001:db8::ff00:42:8329

RFC 5952 says to drop leading zeros in each 16-bit group, so 0db8 becomes db8 and 0042 becomes 42, and to use '::' for the longest run of zero groups, here the three groups after db8. That gives 2001:db8::ff00:42:8329. The form with 0:0 lists only seven groups and no '::', so one group is missing. The form with two '::' is invalid, because '::' can appear only once, and it also cuts ff00 to ff, which changes the value. Writing 4200 removes the wrong zeros: only leading zeros can go.

Look for this next time: Drop leading zeros in each group, then replace the longest run of zero groups with a single '::'.

Correct answer: D · A NAT gateway in a public subnet, set as the private subnet's default route

In AWS, a public NAT gateway lets private IPv4 instances initiate connections to internet services without accepting unsolicited inbound connections through that gateway. The gateway is placed in a public subnet with a route to an internet gateway, and the private subnet routes outbound internet traffic to the NAT gateway. Public IPs violate the stated private-address requirement; actual inbound reachability would also depend on security rules and routing. Direct Connect alone provides a private path to the data center, not the specified internet egress design. An inbound HTTPS rule neither supplies that egress path nor satisfies the no-unsolicited-inbound requirement.

Look for this next time: For this AWS IPv4 design, private instances use a public NAT gateway for outbound internet access; the gateway does not accept unsolicited inbound connections to them.

Correct answer: B · The OSPF /22 route, because the longest matching prefix is chosen first

A router forwards on the most specific route that matches. 172.16.8.0/22 covers 172.16.8.0 through 172.16.11.255, so it matches 172.16.10.25 on 22 bits, while the /16 matches on 16 and the default on none. Administrative distance only breaks ties between sources offering the same prefix; it does not override a longer match, as RFC 1812 and Cisco's documentation both state. The default route is used only when nothing more specific matches, and a route does not need to list a single host to match it. Two different prefixes are not load-balanced.

Look for this next time: Longest prefix match comes first, and administrative distance only chooses between routes to the same prefix.

Correct answer: C · As an access port in data VLAN 10, with VLAN 20 as its voice VLAN

A voice VLAN lets one access port carry the phone's traffic in a separate voice VLAN while the PC behind the phone stays in the port's access, or data, VLAN. Here that means access VLAN 10 with voice VLAN 20. A trunk breaks the access-port standard, and with VLAN 20 as native, the PC's untagged frames would land in the phone VLAN. Putting the port in VLAN 20 alone mixes the PC with the phones. An access port has one access VLAN, so it cannot list two.

Look for this next time: A voice VLAN is set on an access port: the phone uses the voice VLAN, and the PC behind it stays in the data VLAN.

Correct answer: D · Lightweight access points that a wireless LAN controller manages centrally

In the controller model, a wireless LAN controller manages a group of lightweight access points, so configuration, firmware, and RF settings are handled in one place and pushed to every access point. CAPWAP is a standard protocol for that controller-to-access-point management. Autonomous access points each keep their own configuration, which is the per-device login work the team wants to avoid, even when the SSIDs match. A captive portal controls guest sign-in, not access point management. Ad hoc mode connects clients directly to each other and manages no access points at all.

Look for this next time: Many access points managed from one place means lightweight access points with a wireless LAN controller.

Correct answer: D · A first hop redundancy protocol, with its virtual IP set as the hosts' gateway

A first hop redundancy protocol, such as the standard VRRP, lets the two routers share a virtual IP address. Hosts use that virtual IP as their only gateway, and the protocol elects which router answers for it, so if that router fails, the other takes over with no host change. Splitting gateways through DHCP leaves half the hosts stranded when their router fails. PAT translates addresses toward another network and gives no gateway failover. A second gateway entry on every host is a host change and breaks the single-address requirement.

Look for this next time: An FHRP gives hosts one virtual gateway IP that survives the loss of either router.

Correct answer: B · SNMPv3 with both authentication and privacy (encryption) enabled

SNMPv3's user-based security model provides data origin authentication and integrity, and, when privacy is enabled, confidentiality of the management data. Turning on both authentication and privacy meets both parts of the rule. A longer community string is harder to guess, but it is still a shared string, not the per-user authentication and encryption that SNMPv3's security model adds. Traps only change the direction of the messages, from the device to the manager on UDP 162. Sending syslog to a SIEM replaces the monitoring data instead of securing the polling the audit flagged.

Look for this next time: Use SNMPv3 with authentication and privacy when each poll must be tied to a user and encrypted.

Correct answer: A · A DHCP relay (IP helper) on VLAN 40's gateway interface, pointing to 10.1.5.10

A DHCP client starts by broadcasting on its own subnet, and routers do not forward that broadcast to other subnets, so VLAN 40's requests never reach the server. A relay agent on the VLAN 40 gateway interface, often called an IP helper, passes DHCP messages between the clients and the server, and the server picks the 10.40.0.0/24 scope from the relay's address. An exclusion range and a shorter lease change how a scope hands out addresses, but no requests are arriving. SLAAC is an IPv6 method, so it cannot give these clients IPv4 addresses.

Look for this next time: When a DHCP server sits on another subnet, the client VLAN's gateway needs a DHCP relay pointing to it.

Correct answer: C · A hot site, a fully operational facility with hardware and software in place

NIST defines a hot site as a fully operational offsite facility equipped with hardware and software for use when systems are disrupted. Keeping current data there is what makes a one-hour restart realistic. A cold site has the electrical and physical basics but no computer equipment in place, so equipment must be brought in and set up first. A warm site is only partly equipped, so systems and data still need work before use. A tabletop exercise is a discussion-based test of the plan, not a place to run systems.

Look for this next time: The shorter the restart window, the hotter the site: a hot site is already running when the disaster happens.

Correct answer: B · Split tunnel, so only corporate-bound traffic uses the VPN

Split tunneling sends organization-specific traffic through the VPN tunnel and other traffic through the user's own default gateway. That is the policy, and it takes streaming and browsing off the HQ link. A full tunnel is the current setup, in which everything goes through HQ. A clientless VPN changes how users reach web applications, through a browser portal, but does not decide which traffic uses the tunnel. A site-to-site VPN joins whole networks through their gateways and is not a per-user remote-access setting.

Look for this next time: Split tunnel sends only corporate traffic through the VPN; full tunnel sends everything.

Correct answer: D · A rogue DHCP server answering requests on that VLAN

A consumer router connected by its LAN side usually runs its own DHCP server, and a client generally takes the first offer it receives. That explains why only some users get 192.168.0.x addresses and a 192.168.0.1 gateway that leads nowhere useful, while others still get 10.10.x.x leases from the real server. DNS poisoning changes name answers, not the address and gateway a client is given. MAC flooding attacks the switch's MAC table and hands out no addresses. An evil twin imitates a wireless network, but these users are wired.

Look for this next time: Wrong addresses and a wrong gateway on part of a VLAN point to a rogue DHCP server, often an unauthorized router.

Correct answer: C · In a screened subnet that admits web traffic and blocks new connections to the LAN

A screened subnet (DMZ) separates public-facing services from the internal LAN. For this company's stated policy, firewall rules admit the required web traffic and deny new connections from the DMZ into the LAN. This limits the available lateral path if the server is compromised; a DMZ is not a guarantee against every compromise. Port-forwarding to a server on the internal LAN places that server inside the trusted network. The guest VLAN is intended for visitors, not this public-service design. A honeypot is a decoy and cannot replace the required segmentation.

Look for this next time: Place the public service in a screened subnet and enforce the required inter-zone rules; in this scenario, deny new connections from that subnet into the LAN.

Correct answer: A · TACACS+, which handles each AAA function on its own

TACACS+ runs over TCP port 49 and keeps authentication, authorization, and accounting as separate functions, so a device can ask the server to authorize each command and send an accounting record for it. That fits per-command device administration. RADIUS also centralizes logins and hides the user's password, but it does not separate the three functions the same way, so it is not the usual choice for command-by-command authorization. LDAP is a protocol for reaching a directory of accounts, not a per-command authorization service. SAML passes sign-in assertions to web applications, not to switch command lines.

Look for this next time: For per-command authorization and logging on network devices, think TACACS+; it separates the three AAA functions.

Correct answer: B · Establish a plan of action for the fix and identify its potential effects

In the methodology, testing the theory comes before establishing a plan of action to resolve the problem and identifying its potential effects. On a production switch that serves a whole floor, the plan should say which ports change, when, and how to back out if something else breaks. Moving the ports right away skips that step. Documenting findings comes last, after the fix is in place and full functionality is verified, so closing the ticket now is early. Questioning users belongs to identifying the problem, which is already done.

Look for this next time: After a theory is confirmed, plan the fix and its effects before you implement it.

Correct answer: B · Remove the extra device, then re-enable the port as the security policy allows

Error-disabled means the switch itself shut the port after detecting a problem, and a port security violation is a common cause: the secure MAC limit was reached and frames arrived from another source MAC, here the second device behind the small switch. Fix the cause first, or the port will shut again, then re-enable it, for example by disabling and enabling the interface, as policy allows. A failed cable does not create a security violation. Nothing in the scenario points to power: the port shut down when a second device appeared on a port limited to one MAC address. A port an admin shuts by hand shows as administratively down, not err-disabled.

Look for this next time: Err-disabled is the switch's own shutdown, so remove the cause before you re-enable the port.

Correct answer: C · The /26 mask puts the gateway outside the PC's subnet

255.255.255.192 is a /26 mask, which splits the last octet into blocks of 64. 192.168.10.70 falls in the block from 192.168.10.64, the network address, to 192.168.10.127, the broadcast, so the PC treats only .64 through .127 as local. The gateway at 192.168.10.1 sits in another block, so the PC cannot use it and reaches only hosts in its own block. The other PCs use a /24 that covers .0 through .255, so the fix is the same mask here. A gateway need not be the last address, a DNS fault would not block traffic sent to IP addresses, and a duplicate address would not explain why exactly the hosts outside .64 through .127 fail.

Look for this next time: Work out the PC's network and broadcast from its mask; if the gateway falls outside that range, the mask or the gateway is wrong.

Correct answer: A · Jitter: give voice traffic priority with QoS on the link

Jitter is variation in delay from one packet to the next, and real-time voice suffers when packets arrive unevenly even if none are lost. Replies that swing from 5 to 120 ms around a 40 ms average show high variation with no loss. With the link at only 35% on average, short bursts of other traffic queuing ahead of voice are a likely cause, and QoS that prioritizes voice addresses that. The test showed no loss, so a cable fault that drops packets does not fit. The link has spare capacity on average, so a bigger circuit is not the first fix. DNS affects finding the server by name, not audio during a call.

Look for this next time: Choppy voice with no loss but wide swings in delay points to jitter, and QoS for voice is the usual fix.

Correct answer: D · show mac-address-table, to see the port where each MAC was learned

A switch learns the source MAC address of frames arriving on each port and keeps those entries in its MAC address table, so show mac-address-table lists each MAC with the port, and VLAN, where it was learned. show arp maps IP addresses to MAC addresses, which the technician already has, and it does not name the physical port. show vlan lists VLANs and their member ports, not which device sits on each one. show route shows the routing table, which works with IP networks, not MAC addresses. Exact command spelling varies by vendor.

Look for this next time: To find the port behind a MAC address, read the switch's MAC address table.