CompTIA · free study guide

CompTIA Network+ study guide

CompTIA Network+

Free CompTIA Network+ study guide and exam blueprint. 90 questions in 90 minutes. Written from CompTIA's N10-009 objectives v6.0, last checked 15 August 2026. Domain weightings, glossary, and practice questions with worked explanations.

Written from CompTIA's N10-009 objectives v6.0. Last checked against that document on 15 August 2026.
90 questions 90 minutes 5 domains
Orientation

The exam that asks what broke.

Network+ is not a vocabulary test. It gives you a symptom and expects you to name the cause and the tool that proves it. Almost a quarter of the paper is troubleshooting alone, and most of the rest is written so that knowing a definition without knowing what happens when it is misconfigured will not earn the mark.

Two things that catch people out
Subnetting under time pressure. You have roughly one minute per question and subnetting questions take longer than that unless the arithmetic is automatic. Practice until you are not calculating, you are recognizing.

Performance-based questions. A handful of items drop you into a simulated task rather than offering four options. They usually come first, they take longer, and candidates who work through them in order run out of time. Skip them, finish the multiple choice, then return.

What you are walking into

Up to 90 questions in 90 minutes, a mix of multiple choice and performance-based items. You need 720 on a scale of 100 to 900. That looks like about 80%, but CompTIA uses scaled scoring where harder items carry more weight, so it is not a clean percentage and you should not treat it as one.

There is no hard prerequisite. CompTIA recommends A+ or equivalent knowledge and nine to twelve months of networking experience, but plenty of people pass without either. What is not optional is hands-on familiarity: this exam is written by people who expect you to have plugged things in.

Where the marks are

Troubleshooting at 24% and networking concepts at 23% are 47% of the exam between them. Splitting your study time evenly across five domains means under-preparing for nearly half the paper and over-preparing for security, which carries the lightest weight at 14%.

That security weighting surprises people who came from Security+. CompTIA deliberately moved the deeper security material onto that track, so here you get network-layer hardening and common attacks rather than a security curriculum.

What changed in N10-009

This version launched in June 2024 and shifted weight toward troubleshooting and operations while trimming security. If your material does not say N10-009 on it, replace it. The additions reflect what networks actually look like now:

Your study plan

Exam objectives

What the exam is made of.

Five domains. Troubleshooting is the largest, and it is the one that rewards experience over memorization.

23%Networking Concepts20%Implementation19%Operations14%Security24%Troubleshooting
Five domains Up to 90 questions · 90 minutes · 720/900

Read the bar as a budget for your hours. Troubleshooting and concepts together are 47%. Security is 14%, the smallest slice, and over-studying it is the most common misallocation among people arriving from a security background.

The five domains

DomainWeightWhat it covers
1.0 Networking Concepts23%OSI model, appliances, cloud concepts, ports and protocols, traffic types, transmission media, topologies, IPv4 addressing and subnetting, IPv6, plus SDN, SD-WAN, VXLAN and zero trust.
2.0 Network Implementation20%Routing and switching configuration, VLANs, spanning tree, wireless deployment and standards, and physical installation.
3.0 Network Operations19%Documentation, life-cycle management, change and configuration management, monitoring, disaster recovery metrics, and remote access.
4.0 Network Security14%Logical and physical security, common attacks, hardening, segmentation and access control. The smallest domain.
5.0 Network Troubleshooting24%The largest domain. The methodology, cable and wireless faults, general network issues, and the tools that isolate each.

The format

QuestionsMaximum 90. Multiple choice plus performance-based simulations.
Time90 minutes. Roughly one minute per question.
Pass mark720 on a 100 to 900 scale. Scaled, so not a clean percentage.
PrerequisiteNone required. A+ and 9 to 12 months of networking experience recommended.
DeliveryPearson VUE, test center or online proctored.
ValidityThree years, renewable through CompTIA's continuing education program.
What this mock does not include
Performance-based questions. Those are simulated tasks, and no practice tool outside CompTIA's own reproduces them faithfully. Everything else here matches: the domain weighting, the clock, and the question style. Treat the PBQs as a separate thing to prepare for with hands-on practice, not something a question bank can substitute for.
Domain 1 23%

Networking concepts.

Nearly a quarter of the exam, and the foundation every other domain leans on. This is also where subnetting lives, which is the single most time-consuming thing on the paper.

The OSI model

Learn the layers in both directions, and learn what lives at each. The exam uses layer numbers as shorthand constantly, and troubleshooting questions often hinge on identifying which layer a symptom belongs to.

LayerNameWhat lives there
7ApplicationHTTP, FTP, DNS, SMTP. What the user interacts with.
6PresentationEncryption, compression, encoding formats.
5SessionEstablishing, managing and ending sessions.
4TransportTCP and UDP. Ports, segmentation, reliability.
3NetworkIP addressing and routing. Routers live here.
2Data linkMAC addresses, frames, switches.
1PhysicalCables, connectors, signaling, hubs.

A useful diagnostic habit the exam rewards: a cable fault is layer 1, a VLAN or MAC issue is layer 2, an IP or routing issue is layer 3, and a port or firewall issue is layer 4.

Ports and protocols to know cold

PortProtocolPortProtocol
20, 21FTP161, 162SNMP
22SSH, SFTP, SCP389LDAP
23Telnet443HTTPS
25SMTP445SMB
53DNS514Syslog
67, 68DHCP636LDAPS
69TFTP1433SQL Server
80HTTP3306MySQL
110POP33389RDP
123NTP5060, 5061SIP
143IMAP

Also know which use TCP and which use UDP. DNS uses both (UDP for queries, TCP for zone transfers and large responses). DHCP, TFTP, SNMP and Syslog are UDP. Most of the rest are TCP.

IPv4 addressing and subnetting

The subnetting numbers worth memorizing
/24 = 256 addresses, 254 usable. /25 = 128 (126). /26 = 64 (62). /27 = 32 (30). /28 = 16 (14). /29 = 8 (6). /30 = 4 (2), the classic point-to-point link. Knowing these instantly turns a two-minute calculation into a five-second recall, and the clock is the real adversary here.

IPv6

Topologies, media and traffic types

Modern additions in N10-009

ConceptWhat it means
SDNSoftware-defined networking: separating the control plane from the data plane so the network is programmed centrally.
SD-WANApplying that centralized, application-aware control to wide-area links, often across mixed transports.
VXLANEncapsulation that extends layer 2 segments across a layer 3 network, lifting the VLAN limit.
Zero trustNever trust, always verify. No implicit trust from being inside the perimeter.
SASE / SSEDelivering networking and security together from the cloud, close to the user rather than backhauled.
IaCInfrastructure as code: defining network configuration in version-controlled files rather than by hand.
Domain 2 20%

Network implementation.

Configuration: routing, switching, wireless and the physical layer. This domain assumes you have done the work, and questions are written from the perspective of someone standing at a console.

Routing

ProtocolTypeNotes
StaticManualNo overhead, no adaptation. Fine for stub networks and default routes.
OSPFLink state, interiorUses cost based on bandwidth. Areas, with area 0 as the backbone.
EIGRPAdvanced distance vector, interiorCisco-originated. Fast convergence, uses bandwidth and delay.
RIPDistance vector, interiorHop count, maximum 15. Largely legacy but still examined.
BGPPath vector, exteriorThe routing protocol of the internet. Routes between autonomous systems.

Switching

Wireless

StandardCommon nameBands
802.11nWi-Fi 42.4 and 5 GHz
802.11acWi-Fi 55 GHz
802.11axWi-Fi 6 / 6E2.4, 5, and 6 GHz for 6E

Physical installation

MDF is the main distribution frame, the primary point where external circuits meet the internal network. IDFs are intermediate frames distributed through a building, connected back to the MDF.

Know the power vocabulary: a UPS provides battery power through short outages and allows clean shutdown; a PDU distributes power within a rack. Environmental factors, particularly heat and humidity, are examinable because they cause failures that look like network faults.

Domain 3 19%

Network operations.

The day-to-day work of keeping a network running and documented. N10-009 leaned harder into this than previous versions, reflecting what junior staff actually get handed.

Documentation

Life-cycle and change management

Monitoring

MethodWhat it gives you
SNMPDevice metrics by polling, plus traps sent by the device when something happens.
SyslogEvent messages centralized on a collector, with severity levels.
Flow data (NetFlow and similar)Who talked to whom, how much, and on what ports. Traffic patterns rather than packet contents.
Packet captureThe actual packets. Highest detail, highest effort, usually via a port mirror or a network tap.
SIEMAggregating and correlating logs across systems to surface patterns.

Disaster recovery metrics

Four abbreviations the exam tests by definition and by scenario. Learn them precisely, because they are easy to blur.

TermMeaning
RPORecovery point objective: how much data you can afford to lose, measured backward in time. Drives backup frequency.
RTORecovery time objective: how long you can afford to be down. Drives recovery design.
MTTRMean time to repair: the average time to restore after a failure.
MTBFMean time between failures: the average time a component runs before failing.

Recovery sites: a cold site is space and power only; a warm site has equipment but needs data and configuration; a hot site is ready to run; active-active means both sites carry load already. Cost rises across that list, and so does speed of recovery.

Remote access

Domain 4 14% · smallest

Network security.

The smallest domain at 14%, and deliberately so: CompTIA moved the deeper security material onto the Security+ track. What is here is network-layer, and the attack list is the part most worth drilling.

Core concepts

Authentication and access

TechnologyWhat it does
RADIUSCentralized authentication, commonly behind 802.1X and wireless enterprise mode. Encrypts only the password.
TACACS+Similar role, separates authentication, authorization and accounting, and encrypts the whole payload. Common for device administration.
LDAPDirectory lookup for users and groups. LDAPS is the encrypted form on 636.
SAMLExchanging authentication assertions between identity provider and service, which is how much web SSO works.
MFATwo or more factors: something you know, have, or are.
802.1XPort-based access control. The port passes no traffic until authentication succeeds.

Common attacks

Expect to be given a symptom and asked to name the attack. Learn these by what they look like from the defender's seat.

AttackWhat it does
ARP spoofing / poisoningSends forged ARP replies so traffic for another host reaches the attacker. Enables on-path interception.
MAC floodingOverwhelms the switch MAC table so it floods frames to all ports, exposing traffic.
VLAN hoppingReaches a VLAN the attacker should not, via double tagging or switch spoofing.
DNS poisoning / spoofingCorrupts name resolution so a legitimate name resolves to a hostile address.
Rogue DHCPAn unauthorized DHCP server hands out addresses and a hostile default gateway.
Evil twinA malicious access point impersonating a legitimate SSID.
On-pathThe attacker sits between two parties and can read or alter traffic.
DoS / DDoSExhausts a resource so legitimate users cannot be served. DDoS uses many sources.
Social engineeringPhishing, tailgating, pretexting. The technical controls are bypassed by asking a person.

Hardening and segmentation

Domain 5 24% · largest

Troubleshooting.

The largest domain, and the one that separates people who have worked on networks from people who have read about them. The methodology itself is testable, in order, and it is free marks.

CompTIA's seven-step methodology, in order
1. Identify the problem. Gather information, question users, determine what changed.
2. Establish a theory of probable cause. Question the obvious first.
3. Test the theory to determine the cause. If it is not confirmed, establish a new theory or escalate.
4. Establish a plan of action to resolve the problem and identify potential effects.
5. Implement the solution or escalate as necessary.
6. Verify full system functionality and, if applicable, implement preventive measures.
7. Document findings, actions and outcomes.

Questions give you a scenario mid-process and ask what comes next. The two most commonly missed: testing the theory comes before planning a fix, and documentation is last, not optional.

The tools, and what each proves

ToolUse it to
pingTest reachability and round-trip time. Uses ICMP, which some devices block.
traceroute / tracertShow the path and where it stops. The last responding hop points at the problem area.
nslookup / digQuery DNS directly. Proves whether a failure is name resolution or connectivity.
ipconfig / ifconfig / ipShow local addressing. A 169.254 address here means DHCP failed.
netstatShow active connections and listening ports on the host.
arpShow the MAC-to-IP table. Duplicate or unexpected entries point at spoofing or a duplicate address.
nmapDiscover hosts and open ports across a network.
tcpdump / WiresharkCapture and inspect actual packets when nothing else explains the behavior.
iperfMeasure achievable throughput between two endpoints.
Cable tester / wire mapConfirm continuity and correct pinout.
Tone generator and probeFind which cable is which in a bundle or patch panel.
OTDRLocate a break or high loss along a fiber run, by distance.
Spectrum analyzerIdentify RF interference affecting wireless.

Cable and physical faults

Common network issues and their signatures

SymptomLikely cause
Host has a 169.254.x.x addressDHCP unreachable or scope exhausted. APIPA self-assignment.
Can reach by IP but not by nameDNS. Resolution is failing while connectivity is fine.
Intermittent connectivity for some hosts onlyDuplicate IP address, or a rogue DHCP server issuing conflicting configuration.
Network-wide slowdown, high broadcast trafficSwitching loop, typically spanning tree disabled or misconfigured.
Certificate and authentication failures across many systemsTime drift. NTP is not synchronizing.
Wireless drops when moving between areasRoaming or coverage gap; check overlap and signal levels with a survey.
Wireless slow in a dense office at 2.4 GHzChannel overlap. Only 1, 6 and 11 are non-overlapping.
Traffic reaches the gateway but goes no furtherMissing or incorrect route, or an ACL denying the traffic.

The habit the exam rewards: work up the OSI layers. Confirm the physical link, then addressing, then routing, then the application. Most wrong answers in troubleshooting questions are correct actions taken in the wrong order.

Reference

Glossary.

The terms this exam is built from, grouped so the ones that get confused sit together.

OSI layers
7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data link, 1 Physical.
Layer shorthand for faults
Cable = L1. VLAN or MAC = L2. IP or routing = L3. Port or firewall = L4.
Unicast / multicast / anycast / broadcast
One to one / one to many subscribers / one to the nearest / one to all on the segment (IPv4 only).
RFC 1918 private ranges
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
APIPA
169.254.0.0/16. Self-assigned when DHCP fails. A diagnostic finding, not a configuration.
Subnet sizes
/24 = 254 usable, /25 = 126, /26 = 62, /27 = 30, /28 = 14, /29 = 6, /30 = 2.
SLAAC / dual stack / tunneling
IPv6 self-configuration from router advertisements / running v4 and v6 together / carrying v6 across v4.
Single-mode vs multimode fiber
Long distance, narrow core, laser / shorter runs, larger core, cheaper optics.
Copper distance limit
100 meters for Ethernet. Exceeding it causes attenuation.
SDN / SD-WAN / VXLAN
Central control separated from forwarding / that applied to WAN links / layer 2 extended across layer 3.
Zero trust / SASE / SSE
No implicit trust by location / networking and security delivered together from the cloud.
OSPF / EIGRP / RIP / BGP
Link state, cost / advanced distance vector / hop count, max 15 / path vector, between autonomous systems.
NAT vs PAT
Address translation / many private addresses to one public via ports. PAT is what most networks run.
FHRP
VRRP, HSRP. A virtual IP so hosts keep a gateway when a router fails.
802.1Q
VLAN tagging on trunk links. Access port = one VLAN untagged; trunk = several tagged.
Spanning Tree
Blocks redundant paths to prevent switching loops and broadcast storms.
LACP
Link aggregation: several physical links bonded into one logical link.
802.1X
Port-based access control. No traffic passes until authentication succeeds.
MTU / jumbo frames
1500 bytes standard / around 9000. Must match end to end or fragmentation follows.
Non-overlapping 2.4 GHz channels
1, 6 and 11.
WPA2 vs WPA3
AES-CCMP / adds SAE, resisting offline dictionary attacks on the handshake.
MDF vs IDF
Main distribution frame, where external circuits land / intermediate frames distributed through the building.
UPS vs PDU
Battery through outages and clean shutdown / power distribution within a rack.
EOL vs EOS
No longer sold / no longer patched. EOS is the security exposure.
RPO vs RTO
How much data you can lose (drives backup frequency) / how long you can be down (drives recovery design).
MTTR vs MTBF
Mean time to repair / mean time between failures.
Cold / warm / hot / active-active
Space and power / equipment but needs data / ready to run / both sites already carrying load.
Split vs full tunnel
Only corporate traffic through the VPN / everything through it.
SNMP / Syslog / flow data / packet capture
Polled metrics and traps / event messages / who talked to whom / the actual packets.
Port mirror vs tap
Switch copies traffic to a monitor port / a hardware device inserted in the link.
RADIUS vs TACACS+
Encrypts only the password, common for 802.1X and wireless / encrypts the whole payload, separates AAA, common for device admin.
ARP spoofing / MAC flooding / VLAN hopping
Forged ARP replies redirect traffic / overwhelms the MAC table so frames flood / reaches a VLAN it should not.
Evil twin / rogue DHCP
Malicious AP impersonating an SSID / unauthorized DHCP server handing out a hostile gateway.
DHCP snooping / dynamic ARP inspection
Blocks rogue DHCP / blocks ARP spoofing. Switch features that defeat those named attacks.
Seven-step methodology
Identify, theory, test theory, plan of action, implement or escalate, verify plus prevention, document.
Attenuation / crosstalk / EMI
Loss over distance / signal bleeding between pairs / outside interference. Fiber is immune to EMI.
Duplex mismatch
Link is up but performance is terrible, with collisions and late collisions rising.
OTDR / spectrum analyzer
Locates a fiber break by distance / identifies RF interference.
Common questions

CompTIA Network+ exam questions, answered

How many questions are on the CompTIA Network+ exam?

The CompTIA Network+ exam has 90 questions and lasts 90 minutes. CompTIA uses a scaled score rather than a published percentage, so there is no fixed pass mark to quote.

What is on the CompTIA Network+ exam?

The exam covers 5 domains: Networking Concepts (23%), Implementation (20%), Operations (19%), Security (14%), Troubleshooting (24%). These weightings come from CompTIA's N10-009 objectives v6.0.

Is this CompTIA Network+ material current?

Yes. This guide was written from CompTIA's own published outline, N10-009 objectives v6.0, and last checked against that document on 15 August 2026. That date is shown on every page so you can judge for yourself rather than take our word for it.

Are there free CompTIA Network+ practice questions?

Yes. Sample questions with full worked explanations are free and need no account. The complete question bank and the full-length 90-question timed mock are paid.

Practise it

The guide above is free. The question bank and the full-length timed mock are the paid part.

Open Network+ →
Other exams:
PMP · CAPM · PMI-ACP · PSM I · PRINCE2 · ITIL · ISTQB CTFL · CC · Security+ · CISSP · AWS CCP

Cutscores is independent and is not affiliated with, authorised by, endorsed by or sponsored by CompTIA or any certification body. Network+ and all certification names and marks are the property of their respective owners, and are used here only to describe which exam this material prepares you for. We do not reproduce live exam content.