These CompTIA Network+ sample questions are scenario-based, matching the style of the real N10-009 exam rather than simple definition recall. Each question below includes the correct answer and a full explanation of why the right option works and why the strongest distractor does not, so you can check your reasoning, not just your final pick.
Reading a definition and answering a scenario question are different skills, and CompTIA Network+ leans heavily on the second one. The sample questions below are written in that scenario style: a short situation, four options, and one correct answer, with an explanation that walks through why the distractor is tempting and why it is still wrong.
Each question is labeled with the domain it belongs to. Work through them without looking at the answer first, then read the full explanation even if you got it right — the reasoning behind the general rule matters more than any single question.
Question 1
Domain: Network operations
A regulated financial services firm has 125 servers in its cloud hot-site failover plan. Auditors require all 125 VMs to fail over as one orchestrated unit during the annual DR test. The cloud DR service has a hard limit of 100 VMs per recovery plan. Which approach should the DR team use?
- A. Create a separate recovery plan for each VM and start them all from the portal.
- B. Put all 125 VMs in one recovery plan and use the service's one-click failover.
- C. Request an increase to the recovery-plan VM limit before the annual test.
- D. Create two recovery plans and start both from a single automation script.
Answer: D
Explanation: This is correct because the recovery plan limit is a hard boundary: a 125-VM plan cannot be created, so the fleet must be split into multiple plans. Using two recovery plans and launching them from one automation script preserves the auditors' "single orchestrated unit" requirement while staying under the 100-VM cap. The strongest distractor is the single-plan answer; it appears to be the simplest one-click failover, but it exceeds the documented service limit. The quota-increase answer fails if the provider documents the limit as fixed, and the one-plan-per-VM answer has no central orchestration and creates 125 manual failover actions. The general rule: when a DR service has a hard scale limit, partition the workload into separate failover containers and use automation to coordinate them as one logical failover.
Question 2
Domain: Network operations
Two surgical suites in a hospital share one multicast-enabled LAN. Each suite runs a PTP grandmaster clock because its imaging hardware requires PTP-level precision, but both were left on the default PTP domain, so their sync messages occupy the same multicast address space and devices follow whichever grandmaster announces first. The hospital must keep the suites' time domains isolated, but the imaging vendor will not allow VLAN or switch changes, and separate cabling is not possible. What should be configured?
- A. Replace PTP with NTP and enable NTS in both suites.
- B. Move each suite's PTP devices to a separate VLAN.
- C. Configure a transparent clock at the core switch.
- D. Assign a unique PTP domain number to each suite.
Answer: D
Explanation: The correct option is assigning a unique PTP domain number to each suite: the PTP domain field is precisely the mechanism that allows multiple time domains to coexist on the same LAN without changing the physical or switched network. Because both suites were left on the default domain, their announcements were visible to each other. The strongest distractor is the separate-VLAN option; VLANs would isolate PTP multicast traffic, but the scenario explicitly forbids VLAN or switch changes, so it fails. A transparent clock corrects propagation delay, not domain overlap, and NTP with NTS provides authenticated time but lacks PTP precision and does not separate PTP domains. The general rule is to use PTP domains to isolate time synchronization on a shared network and to reserve NTS for NTP authentication rather than PTP domain separation.
Question 3
Domain: Network troubleshooting
A university research group uses a site-to-site VPN to connect a remote lab to a campus file server. Users report poor performance to the file server: high latency, timeouts, and packet loss. Local file sharing between lab workstations is normal. The lab router's VPN configuration identifies the remote campus network as 10.50.20.0/24, which is the same range as the lab's internal LAN. What should the technician do first?
- A. Increase the bandwidth of the lab's internet circuit to reduce loss.
- B. Configure QoS to prioritize file traffic between the lab and campus.
- C. Change the VPN remote range or the lab LAN to a different subnet.
- D. Replace the lab router with a faster VPN-capable hardware model.
Answer: C
Explanation: The correct first step is to eliminate the address-space overlap. The lab LAN and the VPN remote range both use the same 10.50.20.0/24, so hosts cannot make a single, unambiguous forwarding decision for that destination: traffic meant for the campus file server can be treated as local or sent down the wrong path. Reconfiguring one side to a different subnet restores correct routing. The circuit-bandwidth option is the strongest distractor because high latency, timeouts, and packet loss look like WAN congestion, but the addressing detail points to a routing conflict, not a lack of bandwidth. General rule: before tuning performance, verify that local and VPN address spaces do not overlap; overlapping ranges must be renumbered or translated before QoS, hardware, or link upgrades can help.
Question 4
Domain: Network implementation
A gaming studio's edge has two routers, each with a different ISP uplink. The servers in the DMZ must use one default gateway address, but the studio also wants both ISP links to carry outbound game-telemetry traffic. Which protocol should be used?
- A. A single GLBP group with one virtual IP and both routers as forwarders
- B. Two HSRP groups, each with its own virtual IP and one active router
- C. A single VRRP group whose virtual IP is shared by the two routers
- D. Two VRRP groups, each with its own virtual IP and one active router
Answer: A
Explanation: The constraint is a single default gateway address that must still use both upstream links. GLBP is the FHRP that allows multiple routers in one virtual gateway to be active forwarders while presenting a single virtual IP, so hosts get different virtual MACs and traffic spreads across both routers. The strongest distractor is the two-HSRP-group design because it is a real way to load-balance across two routers, but it requires two virtual IPs and therefore two default gateways, which violates the stem's single-gateway constraint. A single VRRP group provides redundancy but keeps one router idle, so it also fails the both-links requirement. The general rule is that HSRP and VRRP allow one forwarding router per virtual IP group, while GLBP removes that per-group single-forwarder ceiling.
Question 5
Domain: Networking concepts
A global ecommerce retailer is connecting a new cloud VPC to an existing data center over a VPN tunnel. The only RFC1918 space on the data center network is 10.0.0.0/8 and 172.16.0.0/12, and it cannot be renumbered. The VPC must use an RFC1918 private block. Which IPv4 CIDR block should be assigned to the VPC so that no routes overlap?
- A. 10.10.0.0/16
- B. 192.168.0.0/16
- C. 172.31.0.0/16
- D. 169.254.10.0/24
Answer: B
Explanation: The 192.168.0.0/16 block is correct because the VPC must use RFC1918 private space and the on-premises network already uses the other two RFC1918 blocks: 10.0.0.0/8 and 172.16.0.0/12. The strongest distractor is the 172.31.0.0/16 range, which is the familiar cloud default VPC range; it falls inside 172.16.0.0/12, so VPN routes would overlap even though the prefix uses a different second octet. The 10.10.0.0/16 range is inside 10.0.0.0/8, while 169.254.10.0/24 is link-local and not RFC1918. The general rule for hybrid designs is to check a proposed cloud CIDR against every on-premises prefix across the whole CIDR, not just the first octet; 172.16.0.0/12 covers 172.16.0.0 through 172.31.255.255.
Question 6
Domain: Networking concepts
A university research group is adding IPv6 to a subnet for grant-funded instruments. The instruments are mobile and must obtain network configuration automatically when connected. The grant requires an automated, centralized record of which IPv6 address is assigned to each instrument at any time. Which address configuration method should the team implement?
- A. Stateless DHCPv6 for network configuration
- B. Stateful DHCPv6 with a lease database
- C. Stateless address autoconfiguration (SLAAC)
- D. Static IPv6 addresses in an asset database
Answer: B
Explanation: The controlling constraint is the grant's need for an automated, centralized address record. Stateful DHCPv6 assigns addresses from the server's lease database, so the server can log or query which IPv6 address was assigned to each instrument at any time. SLAAC is the strongest distractor: it is stateless and automatic, but each client builds its own address, so no central server records the assignment. Static addresses can be documented in an asset database, but they are not automatically assigned, and stateless DHCPv6 supplies settings such as DNS rather than assigning addresses. The general rule is that IPv6 address accountability requires stateful DHCPv6, not SLAAC.
Question 7
Domain: Network security
A media streaming company's network team monitors edge caching servers. Security policy requires all management traffic to be authenticated and encrypted; unencrypted community strings are prohibited. One engineer argues SNMPv2c with a long community string imposes less CPU load on the edge devices. Which SNMP configuration should the team deploy?
- A. SNMPv3 with SHA authentication but no privacy encryption
- B. SNMPv3 with SHA authentication and AES-128 privacy encryption
- C. SNMPv2c with read-only community string limited by ACL
- D. SNMPv2c with long community string on a management VLAN
Answer: B
Explanation: This is correct because the compliance constraint requires both authentication and encryption, not just one of them. SNMPv3 with SHA authentication and AES-128 privacy encryption provides the authPriv security level: SHA verifies the message source and AES-128 encrypts the management data. The strongest distractor is SNMPv3 with SHA authentication but no privacy encryption: it authenticates the sender but leaves the MIB data readable, so it fails the confidentiality half of the policy. The SNMPv2c options, even with ACLs or a management VLAN, still transmit community strings and management data in plaintext, so no amount of access control satisfies an encryption mandate. The rule: when a security requirement says authenticated and encrypted, choose a protocol or security level that provides both services; authentication alone or network isolation is not a substitute for encryption.
Question 8
Domain: Network operations
An airline's network team is rolling out new gate display switches. Management requires an auditable history of every change request with the requester, the approval date, and the current status. The airline already pays for a service desk tool that can be configured for this. The budget office says to meet the requirement at the lowest possible additional cost. What should the team do?
- A. Ask each technician to keep every approval email in the airline's shared change management mailbox.
- B. Purchase a dedicated enterprise change management platform with automated approval workflows and dashboards.
- C. Configure the existing service desk tool to record requester, approval date, and status for each request.
- D. Use a shared spreadsheet with change IDs, requesters, approval dates, and status for each request.
Answer: C
Explanation: The constraint is the lowest additional cost while preserving an auditable history. The option that configures the existing service desk tool meets the tracking need without a new purchase. The enterprise change management platform option also appears to meet the audit requirement, so it is the strongest distractor, but it fails because it adds cost. The mailbox and spreadsheet options are inexpensive but do not provide a controlled, auditable record of approvals and status changes. The general rule is to use an existing approved tool with the smallest configuration change before buying a premium solution.
Question 9
Domain: Network implementation
A university research group is adding a storage appliance to a 10 GbE switch. The appliance has four ports that must be treated as one logical link by the cluster software. The grant's network-compliance policy requires link aggregation to use an IEEE standard protocol; proprietary negotiation is not allowed. Which configuration meets the requirement?
- A. Connect two interfaces to each of two switches with STP.
- B. Use PAgP so the switch negotiates the bundled links.
- C. Configure an IEEE 802.3ad LACP port channel.
- D. Create a static channel with all four interfaces enabled.
Answer: C
Explanation: The LACP option is correct because the compliance policy requires link aggregation to use an IEEE standard negotiation protocol, and LACP is that protocol. The static channel option is the strongest distractor: it would create one logical link and can work, but it is statically configured and does not use the required standards-based negotiation. PAgP negotiates but is proprietary, and the spanning-tree design does not form a single logical link. The general rule is that when a standards mandate is present, use IEEE 802.3ad/802.1AX LACP rather than static bundling or a vendor-specific protocol.
Where these questions came from
These nine questions are drawn from across the exam's five domains: Network troubleshooting, Networking concepts, Network implementation, Network operations, and Network security. They are written in the same scenario style as the real N10-009 exam — a situation with a constraint, four plausible-looking options, and one answer that satisfies every stated requirement.
What to do next
If several of these felt harder than expected, go back to the exam objectives for the domains you missed rather than moving straight to more questions. Once you are consistently confident across all five domains, our practice test puts the same style of question under the real exam's time limit. You can also check the study plan to see how these domains should be sequenced, and the exam format page for exactly how scoring works.
Exam facts on this page come from CompTIA’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.