CompTIA certification

Network+ N10-009 labs

Every topic of the CompTIA Network+ exam, in its domains, with the labs that teach it. 23 of its 25 topics have a lab.

Questions: Up to 90
Time: 90 minutes
Pass mark: 720 of 900

1.0 Networking concepts · 23%

4 taught, 3 partly, 1 without a lab

1.1 The OSI reference model Taught

physical · data link · network · transport · session · presentation · application

ARP and MAC addresses: who is behind this IP address?Routing across hops: how a packet finds a server three routers away TCP and UDP: ports, connections and datagrams HTTP up close: requests, answers and connections TLS certificates: chains, trust and what breaks them
1.2 Network appliances, applications and functions Partly taught

router · switch · firewall · IDS/IPS · load balancer · proxy · NAS · SAN · wireless access point · wireless controller · CDN · VPN · QoS · TTL

Routing across hops: how a packet finds a server three routers away ICMP: what the network tells you about your packets Switching: how a switch learns where everyone is Quality of service: a call and a backup on one slow line Load balancing: one address, many servers A stateful firewall: replies come home, nothing new gets in A forward proxy: the office's one way out to the web A reverse proxy and a web application firewall VPN: a private tunnel across a hostile network IDS and IPS: Suricata watching, then blocking
1.3 Cloud concepts and connectivity Taught

NFV · VPC · network security groups and lists · internet and NAT gateways · VPN and direct connect · deployment models · service models · scalability, elasticity and multitenancy

VPN: a private tunnel across a hostile network IPsec: two offices, one untrusted network between them A cloud VPC in miniature
1.4 Common ports, protocols, services and traffic types Partly taught

FTP · SFTP · SSH · Telnet · SMTP · DNS · DHCP · TFTP · HTTP · NTP · SNMP · LDAP · HTTPS · SMB · syslog · SMTPS · LDAPS · SQL Server · RDP · SIP · ICMP · TCP · UDP · GRE · IPsec (AH, ESP, IKE) · unicast · multicast · anycast · broadcast

ARP and MAC addresses: who is behind this IP address?DHCP: how a device gets its address ICMP: what the network tells you about your packets TCP and UDP: ports, connections and datagrams The DNS tree: how a name is found HTTP up close: requests, answers and connections TLS certificates: chains, trust and what breaks them HTTP/1.1, HTTP/2 and HTTP/3 The path of an email NTP: keeping clocks right, and what a wrong one breaks The office LAN's own protocols: files, desktops and calls FTP: two channels, active and passive PTP and NTS: time that is precise, and time that is proven Multicast: one stream, only to those who asked Beyond IPv6 basics: NAT64, DNS64 and anycast SNMP: asking devices how they are Central syslog: every device's log in one place Router config backups: TFTP, SCP and a restore The bastion: one guarded door into a private network GRE tunnels: a private link across a network that will not carry it IPsec: two offices, one untrusted network between them LDAP: one directory for every login
1.5 Transmission media and transceivers No lab yet

802.11 standards · cellular · satellite · 802.3 standards · fiber · copper and coax · transceivers and form factors · connectors
1.6 Topologies, architectures and network types Partly taught

mesh · hybrid · star/hub and spoke · spine and leaf · point to point · three-tier hierarchical · collapsed core · north-south and east-west traffic

Spanning tree: a loop on purpose, and the protocol that breaks it OSPF: routers that find their own routes OSPF network types, DR election and LSAs VXLAN: one tenant network across a routed fabric
1.7 IPv4 addressing Taught

public and private · RFC 1918 · APIPA · loopback · VLSM · CIDR · address classes

Addresses and subnets: on my network, or through the router?VLSM: one block, subnets cut to size DHCP: how a device gets its address Route summarisation: one route for many subnets TCP and UDP: ports, connections and datagrams A home router: NAT, one port forward, and the firewall Static NAT, address pools and overload
1.8 Modern network environments Taught

SDN and SD-WAN · VXLAN · zero trust architecture · SASE/SSE · infrastructure as code · IPv6 address exhaustion · tunneling · dual stack · NAT64

IPv6 dual stack: IPv6 beside IPv4 Beyond IPv6 basics: NAT64, DNS64 and anycast GRE tunnels: a private link across a network that will not carry it VPN: a private tunnel across a hostile network IPsec: two offices, one untrusted network between them VXLAN: one tenant network across a routed fabric Network automation: Ansible pushes the config SDN: one controller programs every switch Zero trust with mutual TLS

2.0 Network implementation · 20%

1 taught, 2 partly, 1 without a lab

2.1 Routing technologies Taught

static routing · BGP · EIGRP · OSPF · administrative distance, prefix length and metric · NAT and PAT · FHRP · virtual IP · subinterfaces

Routing across hops: how a packet finds a server three routers away Static routes, by hand Route summarisation: one route for many subnets First-hop redundancy: one gateway address, two routers VLANs: many networks on one switch A home router: NAT, one port forward, and the firewall Static NAT, address pools and overload RIP: routing by rumour OSPF: routers that find their own routes BGP: how the networks of the internet find each other BGP policy: local preference, MED, communities and RPKI Container networking: namespaces, veth and a bridge
2.2 Configure switching Partly taught

VLANs · VLAN database · SVI · native VLAN · voice VLAN · 802.1Q tagging · link aggregation · speed and duplex · spanning tree · MTU and jumbo frames

Spanning tree: a loop on purpose, and the protocol that breaks it Rapid Spanning Tree: the blocked port takes over in about a second Link aggregation: two cables, one link VLANs: many networks on one switch VLANs across switches: trunks MTU and fragmentation: when a packet is too big for the next link
2.3 Configure wireless Partly taught

channels and width · 2.4, 5 and 6 GHz · band steering · SSID, BSSID and ESSID · mesh, ad hoc and infrastructure · WPA2 and WPA3 · guest networks and captive portals · PSK vs enterprise · antennas · autonomous vs lightweight APs

Wi-Fi: joining a wireless network Wi-Fi security: WPA2, WPA3 and the evil twin Hotel Wi-Fi: who is on your path 802.1X and RADIUS: logging in to a switch port
2.4 Physical installations No lab yet

IDF and MDF · racks · patch and fiber panels · power: UPS and PDU · environment: humidity, fire, temperature

3.0 Network operations · 19%

3 taught, 2 partly, 0 without a lab

3.1 Organizational processes and procedures Partly taught

diagrams and documentation · asset inventory · IPAM · SLA · life-cycle management · change management · configuration management

Router config backups: TFTP, SCP and a restore Network automation: Ansible pushes the config
3.2 Network monitoring Taught

SNMP · flow data · packet capture · baselines and anomaly alerts · log aggregation and syslog · SIEM · API integration · port mirroring · discovery, traffic, performance and availability monitoring · configuration monitoring

Load balancing: one address, many servers SNMP: asking devices how they are Central syslog: every device's log in one place NetFlow: who talks to whom A honeypot: the host nobody should touch IDS and IPS: Suricata watching, then blocking Packet forensics: reading an incident from a capture file Log correlation: one event, many logs, a rule that joins them Reconnaissance: mapping a network before you touch it Network automation: Ansible pushes the config
3.3 Disaster recovery Partly taught

RPO and RTO · MTTR and MTBF · cold, warm and hot sites · active-active · active-passive · tabletop and validation tests

Load balancing: one address, many servers
3.4 IPv4 and IPv6 network services Taught

DHCP scopes, leases, reservations and options · DHCP relay · SLAAC · DNS record types · forward and reverse zones · authoritative and recursive · primary and secondary · DNSSEC · DoH and DoT · hosts file · NTP · PTP and NTS

DHCP: how a device gets its address DHCP relay The DNS tree: how a name is found DNS zones, zone transfers and encrypted DNS The path of an email NTP: keeping clocks right, and what a wrong one breaks PTP and NTS: time that is precise, and time that is proven IPv6 basics: addresses that build themselves IPv6 addressing: address kinds, anycast and DHCPv6 SPF, DKIM and DMARC: proving who sent an email DNSSEC: signed answers, and a resolver that checks them How DNS works, and how a lie in DNS hijacks you
3.5 Network access and management methods Taught

site-to-site VPN · client-to-site VPN · clientless VPN · split and full tunnel · SSH · GUI · API · console · jump box · in-band vs out-of-band

HTTP up close: requests, answers and connections Out-of-band management: a way in that does not depend on the network The bastion: one guarded door into a private network VPN: a private tunnel across a hostile network IPsec: two offices, one untrusted network between them A REST API that changes the network

4.0 Network security · 14%

1 taught, 2 partly, 0 without a lab

4.1 Basic network security concepts Partly taught

encryption in transit · encryption at rest · PKI and self-signed certificates · MFA, SSO, RADIUS, LDAP · SAML and TACACS+ · least privilege and RBAC · geofencing · physical security · honeypots and honeynets · risk, vulnerability, exploit, threat, CIA · audits and compliance · segmentation: IoT, OT, guest, BYOD

TLS certificates: chains, trust and what breaks them A honeypot: the host nobody should touch A weak password, guessed AAA with RADIUS: who logs in to the router, what they may do, and a log of it 802.1X and RADIUS: logging in to a switch port LDAP: one directory for every login Kerberos: one login, tickets for everything Two-factor SSH with a one-time code Single sign-on: one login, many services Zero trust with mutual TLS
4.2 Attacks and their impact Partly taught

DoS and DDoS · VLAN hopping · MAC flooding · ARP poisoning and spoofing · DNS poisoning and spoofing · rogue DHCP · rogue access point · evil twin · on-path attack · social engineering · malware

Switching: how a switch learns where everyone is VLANs across switches: trunks Wi-Fi security: WPA2, WPA3 and the evil twin Incident response: working a live compromise by the runbook ARP spoofing: the machine in the middle How DNS works, and how a lie in DNS hijacks you Rogue DHCP: the server nobody checked Layer 2 security: the switch says no SYN flood: half-open connections and how a server resists DNS amplification: a small lie, a large flood
4.3 Apply network security features Taught

disable unused ports and services · change default passwords · port security · 802.1X · MAC filtering · key management · ACLs · URL and content filtering · trusted and untrusted zones · screened subnet

TLS certificates: chains, trust and what breaks them Wi-Fi security: WPA2, WPA3 and the evil twin Access control lists: who may cross the router, and where to say so Drop or reject: what a firewall tells a scanner A stateful firewall: replies come home, nothing new gets in A forward proxy: the office's one way out to the web A reverse proxy and a web application firewall Reconnaissance: mapping a network before you touch it A weak password, guessed Layer 2 security: the switch says no 802.1X and RADIUS: logging in to a switch port

5.0 Network troubleshooting · 24%

1 taught, 4 partly, 0 without a lab

5.1 The troubleshooting method Partly taught

identify the problem · theory of probable cause · test the theory · plan and implement · verify and prevent · document findings

Addresses and subnets: on my network, or through the router?Routing across hops: how a packet finds a server three routers away ICMP: what the network tells you about your packets Incident response: working a live compromise by the runbook
5.2 Cabling and physical interface faults Partly taught

wrong cable · signal degradation · improper termination · interface counters: CRC, runts, giants, drops · port status: error disabled, administratively down · PoE budget · transceiver mismatch

Interface errors: reading the counters Layer 2 security: the switch says no
5.3 Faults in network services Taught

spanning tree loops, root and port roles · wrong VLAN · ACLs · routing table and default routes · address pool exhaustion · wrong default gateway · wrong or duplicate IP address · wrong subnet mask

A bare machine: networking by hand Addresses and subnets: on my network, or through the router?ARP and MAC addresses: who is behind this IP address?Routing across hops: how a packet finds a server three routers away Spanning tree: a loop on purpose, and the protocol that breaks it VLANs: many networks on one switch Access control lists: who may cross the router, and where to say so Drop or reject: what a firewall tells a scanner DHCP starvation: every address taken
5.4 Performance problems Partly taught

congestion and bottlenecks · bandwidth and throughput · latency · packet loss · jitter · wireless interference and channel overlap · signal loss and coverage · disassociation and roaming

A home network, from the laptop's point of view Routing across hops: how a packet finds a server three routers away TCP performance: bandwidth, delay, the window and loss Quality of service: a call and a backup on one slow line Interface errors: reading the counters
5.5 Tools and commands to solve problems Partly taught

protocol analyzer · ping, traceroute, nslookup, dig · tcpdump · netstat, ip, arp · nmap · LLDP/CDP · speed tester · hardware tools · device show commands

ARP and MAC addresses: who is behind this IP address?Routing across hops: how a packet finds a server three routers away TCP and UDP: ports, connections and datagrams The DNS tree: how a name is found TCP performance: bandwidth, delay, the window and loss LLDP and CDP: what is plugged in where Interface errors: reading the counters Packet forensics: reading an incident from a capture file Reconnaissance: mapping a network before you touch it

Practice exam

A timed practice exam in the Network+ format, built from the labs' questions in the exam's own domain weights.

Open the Network+ practice exam