CompTIA Network+ (V9): study guide and free practice questions The ideas the Network+ N10-009 exam tests, one page each: what the standards and vendor docs say (IETF RFCs, IEEE, NIST, Cisco, Microsoft), the traps the questions set, and real practice questions to try. Every page links to its sources.
10 free practice questions Drawn from every domain. Pick an answer to see why each option is right or wrong.
A client sends its first request to a well-known port; the server replies from a freshly chosen port and uses it for the rest of the UDP transfer. Which of the following protocols does this? Right. In the game that’s Renown for your Networking Concepts building.
Not that one: D is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.
Your answer A. FTPFTP does open a separate data connection, so the shape feels familiar. But FTP is a TCP protocol: the control channel is TCP 21 and the data channel is TCP 20 or a passive-mode port, not a UDP port the server picks for one transfer. Your answer B. SFTPSFTP runs inside an SSH session on TCP 22, and everything, commands and file data, travels over that single encrypted connection. There is no second port and no UDP. Your answer C. SMBSMB is the file and printer sharing protocol on TCP 445. A client stays connected to that port for the whole session; nothing moves to a freshly chosen port. The answer D. TFTPRFC 1350 section 1 states that TFTP 'has been implemented on top of the Internet User Datagram protocol (UDP)'.
Show the full explanation and doc quotes Section 4 describes the connection: each end chooses a transfer identifier used as its UDP port, the requesting host 'sends its initial request to the known TID 69 decimal' on the server, and the response 'uses a TID chosen by the server as its source TID', after which 'the two chosen TID's are then used for the remainder of the transfer.'
Written from www.rfc-editor.org/rfc/rfc1350.html
Two directly connected devices are linked with one end set to full duplex and the other to half duplex. Which of the following interfaces records late collisions? Right. In the game that’s Renown for your Network Implementation building.
Not that one: C is right. In the game your Network Implementation building would lose a little Renown, and this question would come back later.
Your answer A. The full-duplex interfaceA full-duplex interface transmits and receives at the same time by design and does not run collision detection, so it can never log a collision. It shows the mismatch as frame check sequence errors and runts instead. Your answer B. Both the half-duplex and full-duplex interfacesOnly the half-duplex end still senses the carrier. The full-duplex end has no notion of a collision, so the count cannot climb at both ends. The answer C. The half-duplex interfaceCisco's auto-negotiation guide states that for the duplex mismatch scenario, the late collision is seen on the half-duplex side. Your answer D. Neither interfaceThe half-duplex end transmits while the full-duplex end is also sending, detects the overlap late in its transmission and counts a late collision. A rising late-collision counter is the classic sign of this mismatch.
Two offices link their internal networks with an IPSec security association that ends on a security gateway at each site. Which of the following IPSec modes does the architecture require? Right. In the game that’s Renown for your Network Operations building.
Not that one: C is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.
Your answer A. Transport modeTransport mode is for end-to-end protection between the two systems that actually send and receive the traffic. When the ends are gateways forwarding other hosts' packets, RFC 4301 requires tunnel mode so that the whole original packet, header included, travels inside a new outer header. Your answer B. Split tunnelSplit tunnel describes a remote-access client that sends only corporate-bound traffic through the VPN and the rest directly to the Internet. It is a routing choice on a client, not a mode of IPSec encapsulation. The answer C. Tunnel modeRFC 4301 defines two kinds of security association, transport mode and tunnel mode, and rules that, apart from two narrow exceptions, 'whenever either end of a security association is a security gateway, the SA MUST be tunnel mode'. Your answer D. Full tunnelFull tunnel is the opposite client policy, where all of a remote user's traffic goes through the VPN. Like split tunnel, it belongs to client-to-site VPNs and says nothing about how two gateways encapsulate packets.
Show the full explanation and doc quotes A gateway-to-gateway link protects packets that neither gateway originated, so each original packet is carried whole inside a new outer IP header addressed between the gateways.
Written from www.rfc-editor.org/rfc/rfc4301.txt
A browser and a web server that both support current TLS settle on a deprecated SSL version after a third party alters their handshake. Which of the following is that third party most likely setting up? Right. In the game that’s Renown for your Network Security building.
Not that one: D is right. In the game your Network Security building would lose a little Renown, and this question would come back later.
Your answer A. Denial-of-serviceThe connection is not being stopped; it completes on an older protocol. Forcing weaker encryption keeps traffic flowing so the third party can work on it, which is the opposite of denying service. Your answer B. DNS poisoningDNS poisoning corrupts a resolver's cache so a name points to the wrong address. Nothing in the handshake depends on that, and the endpoints here reached each other correctly. Your answer C. VLAN hoppingVLAN hopping is a switching attack that gets frames onto another VLAN. Changing which TLS or SSL version two endpoints agree on is a different attack. The answer D. On-path attackMITRE ATT&CK T1557 says downgrade attacks 'can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS)'.
Show the full explanation and doc quotes A party that alters the handshake so the endpoints fall back to deprecated SSL is setting itself up to read or change the session: an on-path attack.
Written from attack.mitre.org/techniques/T1557/
A technician must capture every frame sent to or from one network adapter on the local segment, whatever IP address it happens to use. Which of the following tcpdump filter primitives should be used? Right. In the game that’s Renown for your Network Troubleshooting building.
Not that one: B is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.
Your answer A. ip hostThe ip host primitive selects frames by IPv4 address. If the adapter changes address, uses several, or sends non-IP traffic such as ARP, those frames fall outside the filter; the technician wants the hardware address, which does not change. The answer B. ether hostThe pcap-filter manual defines 'ether host' as true 'if the source or the destination Ethernet ... address of the packet is' the given hardware address, which may be a numerical MAC-48 address. Your answer C. src hostsrc host also matches at the IP layer and only on the source side, so it would miss everything sent to the adapter. Direction qualifiers narrow a filter; they do not move it down to the Ethernet layer. Your answer D. dst netdst net selects frames whose destination falls inside an IP network prefix. It captures far more than one host and nothing sent by the host, and like the others it keys on IP rather than on the adapter.
Show the full explanation and doc quotes The plain 'host' primitive matches 'the source or the destination ARP/IPv4/IPv6/RARP address', so it follows the IP address, not the adapter.
Written from www.tcpdump.org/manpages/pcap-filter.7.html
A company lets each remote employee's laptop, configured with VPN software, authenticate to a gateway at headquarters and then reach internal servers from home or while traveling. Which of the following VPN types is this? Right. In the game that’s Renown for your Networking Concepts building.
Not that one: C is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.
Your answer A. Site-to-site VPNA site-to-site VPN protects traffic between two gateways, joining whole networks such as a branch and headquarters. Individual laptops connecting from home or the road each need their own connection to the gateway. Your answer B. Clientless VPNA clientless VPN gives a user access through a web browser, with no VPN software installed. These laptops each have VPN software configured, which is the client in client-to-site. The answer C. Client-to-site VPNNIST SP 800-77 Rev. 1 section 2.4.2 describes the remote access architecture: the organization deploys a VPN gateway, and 'each remote access user then establishes a VPN connection between their remote device (host) and the VPN gateway', after authenticating, and 'the user's remote device needs to have a VPN connection configured'. Your answer D. Direct ConnectDirect Connect is CompTIA's term for a dedicated private circuit between an organization and a cloud provider. It links networks, not individual remote laptops, and is not a VPN.
Brief spikes and sags on a building's electrical supply have erased a switch's memory contents and later caused one of its components to fail. Which of the following installation factors needs attention? Right. In the game that’s Renown for your Network Implementation building.
Not that one: D is right. In the game your Network Implementation building would lose a little Renown, and this question would come back later.
Your answer A. HumidityHumidity matters for a server room, but it reaches equipment through the air, not through the electrical supply where the spikes and sags occurred. Your answer B. Fire suppressionFire suppression systems put out fires. They do not filter or steady the power that reaches a switch. Your answer C. TemperatureHeat shortens component life, but the stem traces the damage to the building's electrical supply rather than the room's air. The answer D. VoltageCisco's hardware installation guide for a data center switch states: 'Overvoltage, undervoltage, and transients (spikes) can erase data from memory or cause components to fail.' Spikes and sags are voltage problems, so voltage is the installation factor to address.
A company cannot afford a fully equipped alternate site, but its recovery time objective rules out the long setup of a site with no hardware or telecommunications. Which of the following DR sites fits? Right. In the game that’s Renown for your Network Operations building.
Not that one: C is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.
Your answer A. Hot siteA hot site is configured with the necessary hardware, infrastructure and personnel and has a short setup time, but its cost is medium to high. The company has ruled out paying for a fully equipped site. Your answer B. Cold siteA cold site provides space, power and environmental controls but no hardware or telecommunications, which is why its setup time is long. That is exactly the delay the recovery time objective cannot absorb. The answer C. Warm siteNIST SP 800-34 Rev. 1 compares alternate sites by cost and setup time. Your answer D. Mirrored siteA mirrored site is identical to the primary and mirrors data in real time. SP 800-34 calls it the most expensive choice, well beyond a budget that cannot cover a fully equipped site.
A company's cookie-based SSO covers its own web applications, but a partner's application on a different domain still prompts users for credentials. Which of the following carries authentication state to the partner's domain? Right. In the game that’s Renown for your Network Security building.
Not that one: A is right. In the game your Network Security building would lose a little Renown, and this question would come back later.
The answer A. SAMLThe OASIS SAML technical overview explains that cookie-based SSO products fail across sites because 'browser cookies are never transmitted between DNS domains, the authentication state information in the cookies from one domain is never available to another domain'. Your answer B. RADIUSRADIUS carries a network access server's authentication, authorization and accounting exchanges with a central server, such as a wireless controller checking a user's password. It is not a mechanism for telling a partner's website that a browser user has already logged in elsewhere. Your answer C. LDAPLDAP is how an application looks up and verifies credentials in a directory. Both the company's and the partner's applications may use it, but each lookup is a fresh authentication; LDAP does not transport the fact that a user already authenticated at another domain. Your answer D. TACACS+TACACS+ authenticates and authorizes administrators logging in to routers, switches and firewalls. It has nothing to do with web applications or with passing a user's session between domains.
Show the full explanation and doc quotes SAML was standardized to carry that authentication state between domains as a signed assertion from an identity provider to a service provider, so the partner's application can accept the user's existing login instead of asking for credentials again.
Written from docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
Latency across a long WAN link is constantly high but shows almost no variation, even when the link is idle. Which of the following most likely accounts for it? Right. In the game that’s Renown for your Network Troubleshooting building.
Not that one: B is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.
Your answer A. CongestionIf traffic were the cause, the delay would drop when the link went idle and climb when it was busy. A delay that stays put regardless of load is not queueing in front of other packets. The answer B. Propagation delayRFC 7679 says the minimum one-way delay observed on a path indicates the delay due only to propagation and transmission, while values above the minimum indicate congestion. Your answer C. JitterJitter is the name for delay that changes from packet to packet. The scenario describes the opposite, a steady delay, so jitter is the thing that is absent here. Your answer D. BottleneckingA bottleneck is a point where demand exceeds capacity, and its signature is delay and loss that appear under load. On an idle link there is nothing to queue behind, so a bottleneck cannot produce the constant delay seen.
Show the full explanation and doc quotes A high delay that does not vary and persists on an idle link is that minimum: it is set by the distance the signal travels, not by traffic.
Written from www.rfc-editor.org/rfc/rfc7679.html
Certopolis is an independent study game. It is not affiliated with, endorsed by or sponsored by CompTIA, and its questions are not the exams' questions. Exam names are trademarks of their owners.