A technician wants to filter traffic by TCP and UDP port numbers. Port numbers belong to which layer of the OSI model?
Studying from your own notes? Make my own practice test
About this test
This free Network+ practice test has 15 questions, written by the StudyPDF team from the published CompTIA Network+ exam objectives. It samples all five domains: networking concepts, implementation, operations, security and troubleshooting. You will meet multiple choice, select all that apply and fill in the blank, including a few subnet and addressing calculations. Answer all 15 questions, then check your score and read the explanation for every question. It tests concepts that stay the same across exam versions.
All 15 questions at a glance
Prefer to read before you play? Every question in the sampler is listed below. Answers and explanations stay collapsed until you open them.
1.A technician wants to filter traffic by TCP and UDP port numbers. Port numbers belong to which layer of the OSI model?
- A. Network
- B. Transport
- C. Session
- D. Data link
Answer: B. Transport
The transport layer, layer 4, uses port numbers to deliver data to the right service on a host, and it is where TCP and UDP work. The network layer uses IP addresses, and the data link layer uses MAC addresses. A quick way to place a problem is to ask which kind of address or identifier is involved.
2.An administrator wants encrypted remote command-line access to a switch in place of Telnet. Which protocol and default port should be used?
- A. Telnet on TCP 23
- B. RDP on TCP 3389
- C. SNMP on UDP 161
- D. SSH on TCP 22
Answer: D. SSH on TCP 22
SSH gives an encrypted command-line session and listens on TCP 22 by default. Telnet sends everything, including passwords, in clear text, which is why it is replaced. RDP is for graphical remote desktop sessions on Windows, and SNMP is for monitoring and management data.
3.Which set contains only non-overlapping channels in the 2.4 GHz wireless band in the United States?
- A. 1, 3, 5
- B. 6, 8, 10
- C. 1, 6, 11
- D. 2, 4, 6
Answer: C. 1, 6, 11
Each 2.4 GHz channel is about 20 MHz wide, but the channel numbers are only 5 MHz apart. Channels need to be about five numbers apart to avoid overlapping, which is why access points close to each other are usually set to 1, 6 and 11. Overlapping channels cause interference and slow performance.
4.Complete the sentence.
A switch forwards frames using _____ addresses, while a router forwards packets between networks using _____ addresses.
Options for blank 1: MAC, IP, port
Options for blank 2: MAC, IP, VLAN
Answer: MAC, IP
A switch works at layer 2 and learns which MAC address sits behind which port. A router works at layer 3 and chooses a path by looking up the destination IP address in its routing table. A layer 3 switch can do both jobs, which is why the layer matters more than the box.
5.Hundreds of internal hosts with private addresses reach the internet through a single public IP address. Which technology makes this possible by tracking each connection's source port number?
- A. VLAN trunking
- B. DHCP relay
- C. Port address translation (PAT)
- D. Spanning tree
Answer: C. Port address translation (PAT)
PAT, also called NAT overload, rewrites the source address to the shared public address and uses a different source port for each connection, so replies can be sent back to the right host. Plain NAT maps one private address to one public address. VLAN trunking, DHCP relay and spanning tree do not translate addresses.
6.Which standard adds a VLAN tag to Ethernet frames on a trunk link between two switches?
- A. 802.1X
- B. 802.1Q
- C. 802.3af
- D. 802.11ax
Answer: B. 802.1Q
IEEE 802.1Q inserts a tag that says which VLAN a frame belongs to, so one trunk link can carry many VLANs. 802.1X is port-based network access control, 802.3af is Power over Ethernet, and 802.11ax is Wi-Fi 6. Remember that the standard number tells you the area it belongs to.
7.Two switches are connected by two cables. Soon the network slows to a crawl as broadcast traffic circles endlessly. Which protocol is designed to prevent this?
- A. Spanning Tree Protocol (STP)
- B. Dynamic Host Configuration Protocol (DHCP)
- C. Network Time Protocol (NTP)
- D. Border Gateway Protocol (BGP)
Answer: A. Spanning Tree Protocol (STP)
Redundant links between switches create a loop, and Ethernet frames have no time to live, so a broadcast can circle until the switches are overwhelmed, which is a broadcast storm. STP blocks the redundant path and can bring it back if the main link fails. DHCP, NTP and BGP do not stop layer 2 loops.
8.Which of the following are dynamic routing protocols?
Select all that apply.
- A. OSPF
- B. BGP
- C. STP
- D. EIGRP
- E. SNMP
Answer: A. OSPF, B. BGP, D. EIGRP
OSPF, BGP and EIGRP all let routers learn routes from each other and adapt when the network changes. OSPF and EIGRP are usually used inside an organization, and BGP is used between networks on the internet. STP prevents switching loops and SNMP is for monitoring, so neither one builds a routing table.
9.Complete the sentence.
A DHCP client gets its address in four steps: Discover, Offer, _____, Acknowledge.
Options for blank 1: Request, Renew, Release, Reject
Answer: Request
The client broadcasts a Discover, a server answers with an Offer, the client sends a Request for that offer and the server confirms with an Acknowledge. The first letters spell DORA. Renew and Release happen later in the lease, and Reject is not a step in this exchange.
10.A company needs to restore operations within minutes of losing its main site and accepts the highest cost. Which kind of disaster recovery site fits?
- A. Cold site
- B. Warm site
- C. Hot site
- D. Offsite tape vault
Answer: C. Hot site
A hot site has equipment running and data kept current, so it can take over almost at once. A warm site has hardware but needs data restored and some setup. A cold site is little more than space and power and takes the longest. The more quickly a site can take over, the lower the recovery time objective and the higher the cost.
11.Which of the following attacks target how switches and local addressing work at layer 2?
Select all that apply.
- A. MAC flooding
- B. ARP spoofing
- C. DNS cache poisoning
- D. VLAN hopping
- E. Phishing
Answer: A. MAC flooding, B. ARP spoofing, D. VLAN hopping
MAC flooding fills a switch's address table so that it starts sending frames out of every port. ARP spoofing sends false answers that tie an attacker's MAC address to another host's IP address. VLAN hopping gets traffic into a VLAN it should not reach. DNS cache poisoning works against name resolution and phishing works on people, so neither one is a layer 2 attack.
12.Complete the sentence.
A host has the address 172.16.5.70 with a /27 mask. The broadcast address of its subnet is 172.16.5._____.
Options for blank 1: 63, 79, 95, 127
Answer: 95
A /27 mask is 255.255.255.224, so the block size is 256 minus 224, which is 32. The subnets start at 0, 32, 64 and 96, and 70 falls in the block that starts at 64. That makes 64 the network address and 95 the last address, the broadcast, with 30 usable hosts between them.
13.A workstation can reach every device on its own subnet but none on other subnets. Its IP address and subnet mask are correct. Which setting is the most likely cause?
- A. The default gateway
- B. The DNS server address
- C. The NTP server address
- D. The MAC address
Answer: A. The default gateway
Traffic for other subnets goes to the default gateway, so a missing or wrong gateway breaks everything beyond the local network while local traffic still works. A wrong DNS server would break name lookups but not access by IP address. A wrong NTP server only affects the clock.
14.Which tools are used to test or locate faults in physical cabling?
Select all that apply.
- A. Wi-Fi analyzer
- B. Cable tester
- C. Optical time-domain reflectometer (OTDR) for fiber
- D. Protocol analyzer
- E. Time-domain reflectometer (TDR) for copper
Answer: B. Cable tester, C. Optical time-domain reflectometer (OTDR) for fiber, E. Time-domain reflectometer (TDR) for copper
A cable tester checks wiring for opens, shorts and swapped pairs. A TDR on copper and an OTDR on fiber send a pulse down the cable and measure reflections to find about where a break or bad connection is. A Wi-Fi analyzer measures wireless signals, and a protocol analyzer reads packets, which only exist once the link works.
15.A monitoring server polls network devices for interface counters and also receives unsolicited alerts when a link goes down. Which protocol does this?
- A. SMTP
- B. SIP
- C. LDAP
- D. SNMP
Answer: D. SNMP
SNMP lets a manager poll devices for values such as interface counters and lets devices send traps when something happens. SMTP is for sending email, SIP sets up voice and video calls, and LDAP is for directory lookups. A baseline of normal values is what makes the polled numbers useful.
What the Network+ exam covers and what this page practices
CompTIA Network+ is a certification for junior network administrators and network support technicians. When this page was last checked, in October 2026, CompTIA listed version V9, exam code N10-009, launched on June 20, 2024. The exam has a maximum of 90 questions, which mix multiple choice and performance-based questions, and lasts 90 minutes. The passing score is 720 on a scale of 100 to 900. CompTIA recommends the A+ certification and 9 to 12 months of hands-on experience, and says a version usually retires about three years after launch, which for V9 means an estimated 2027.
The objectives have five domains. Networking concepts is 23 percent: the OSI model, ports and protocols, topologies and IPv4 and IPv6 addressing. Network implementation is 20 percent: routing, switching, wireless and physical installation. Network operations is 19 percent: documentation, monitoring, disaster recovery and network services. Network security is 14 percent. Network troubleshooting is the largest at 24 percent.
This sampler uses 15 questions spread over all five domains. It cannot reproduce the performance-based questions, which are hands-on simulations. Check CompTIA's own pages for the current objectives, price and retirement date before you book anything.
How to use this sampler and what to practice first
Take all 15 questions in one sitting without notes, then read the explanation for every question, including the ones you got right. Treat each miss as a topic. If you missed the broadcast address question and the switch and router question, the gap is addressing at layers 2 and 3, not two separate facts.
Network+ questions are mostly short scenarios: a symptom or a requirement, and you pick the technology or the cause. Name the OSI layer first. A problem that involves MAC addresses, VLANs or loops lives at layer 2. IP addresses, routes and gateways are layer 3. Port numbers and TCP and UDP behavior are layer 4. That one habit removes two or three wrong choices on many questions.
Subnetting is the skill that most rewards practice, because it is a calculation and not a memory item. Learn the block size trick: subtract the last non-255 octet of the mask from 256 to get the block size, then count up in blocks to find where an address falls. Write a short list in your own words of the common ports, the wireless channel rules and the order of the disaster recovery sites. Then use a free network simulator or a home lab to configure a VLAN and a static route yourself, because the performance-based questions ask you to do things, not just recognize them.
How StudyPDF builds full practice tests from your own study material
Fifteen questions can show you which domain needs the most work. They cannot get you ready on their own, and a generic set does not know which course or study guide you use.
StudyPDF works from your material instead. Upload your Network+ study guide, your course slides or your own notes. Then press New material, pick a practice test, choose those files as the sources and set how long it should be. You get a test written from those exact pages, and every explanation cites where the answer comes from. Narrow one to a single domain, such as troubleshooting, and run it again after you review.
Bo is the tutor for the rest. Ask why an answer is right and Bo explains it from your own pages, with a hint first if you want one.
You do not have to upload anything to start. Name a topic instead, for example subnetting or VLANs, and you get practice questions on it. Starting is free.
Written by the StudyPDF team. Last updated August 19, 2026.
Good to know
Is this Network+ practice test really free?
Yes. All 15 questions, the score screen and every explanation are free to play in your browser, and there is no paywall on this page.
Which Network+ exam version and passing score does this follow?
When this page was last checked, CompTIA listed version V9, exam code N10-009, with a maximum of 90 questions in 90 minutes and a passing score of 720 on a scale of 100 to 900. CompTIA says versions usually retire about three years after launch. The questions test concepts that stay the same across versions, but confirm the current version, objectives and price on CompTIA's own site before you book.
Are these real Network+ questions, and are you affiliated with CompTIA?
No. The StudyPDF team wrote all 15 questions and explanations from the published exam objectives. None comes from the real exam, from a vendor's bank or from recalled exam items. StudyPDF is not affiliated with CompTIA, and CompTIA and Network+ are marks of CompTIA, Inc. Use the official CompTIA objectives to check what is on the current exam.
Can I get more Network+ questions from my own study material?
Yes. Upload your Network+ study guide, course slides or notes to StudyPDF, and Bo builds full-length practice tests from those exact pages, with explanations that cite where each answer came from. If you only have a paper book, name a topic instead, for example subnetting or VLANs, and Bo writes a test from that.
Need more than a sampler?
Upload your own prep book, slides or notes and Bo builds full-length practice tests from your exact materials, tracks which concepts you keep missing and targets your weak spots. Free to start.