On this page
Intro
CompTIA Network+ is aimed at people who design, configure, manage and troubleshoot wired and wireless networks. This guide turns the N10-009 exam outline into manageable study tasks, with CertMonk as one option for reviewing what you learn. The exam scope comes from CompTIA’s Network+ page; the study plan below is our suggested approach.
Exam at a glance
| Detail | N10-009 |
|---|---|
| Exam code | N10-009, Network+ V9 |
| Questions | Maximum of 90 |
| Time | 90 minutes |
| Passing score | 720 on a scale of 100–900 |
| Question types | Multiple-choice and performance-based |
| Languages | English, German, Japanese, Portuguese and Spanish |
| Price | Check the vendor’s site for current pricing |
| Retirement | See CompTIA’s page for the current retirement date |
Source: CompTIA’s exam details, reviewed November 7, 2026.
Version update: CompTIA’s page lists N10-009 as the current Network+ exam and does not announce a successor at the time of this review. Confirm the version on the vendor’s page before you book, and match your study materials to it.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Networking concepts | 23% | Know how models, protocols, addressing and common network designs fit together. |
| Network implementation | 20% | Set up and configure the devices, routes, services and connections that make a network work. |
| Network operations | 19% | Keep a network healthy through monitoring, documentation, availability planning and change control. |
| Network security | 14% | Understand the controls and attack types that affect network devices and traffic. |
| Network troubleshooting | 24% | Follow a method to find and resolve connectivity and performance problems. |
Domain labels and weights follow CompTIA’s exam page. Use the full official exam objectives as your coverage checklist; a domain’s weight should help allocate attention without becoming a reason to skip smaller topics.
What each domain really tests
Networking concepts
This domain is the vocabulary and mental model of networking. Learn the layered models well enough to say which layer a device, protocol or problem belongs to, and why that matters. Compare transport behaviors, common ports and services, and the way addresses are assigned and resolved.
Practice subnetting by hand until it stops feeling like a trick. Draw a small network, label each segment with its address range, and explain which device forwards traffic between segments. Also compare network types and topologies, including cloud-connected designs, and note what each one gains and gives up.
Network implementation
Here you move from knowing terms to making things work. Study routing at a conceptual level: how a device chooses a path, what static and dynamic approaches have in common, and what a default route does. Pair that with switching topics such as VLANs, trunks and loop prevention.
Wireless belongs here too. Compare standards, frequency bands, channel choices and the reasons coverage can look fine on a map yet behave poorly in a room. For each service you study, such as addressing, name resolution or time, write a sentence on what breaks when it is missing.
Network operations
Operations is about running a network after it is built. Learn what monitoring data tells you, what a baseline is for, and why documentation and diagrams matter when someone else has to take over. Review availability ideas such as redundancy and recovery, and connect them to the business need they serve.
Add change management to your notes. A sensible technical change still needs a plan, approval, a way back and a record. Walk through one imaginary change from request to review, and list the evidence you would want at each step.
Network security
Keep three ideas separate: the weakness, the attack that uses it and the control that reduces the risk. Study device hardening, access control, segmentation, and secure remote access, then compare the attack types that target networks, wireless clients and users.
Do not treat every security tool as interchangeable. For each control, write what it can see, where it sits and what it cannot stop. That habit helps when a scenario asks which measure fits a described situation.
Network troubleshooting
This is the heaviest domain, so give it steady attention across the whole plan. Learn a repeatable method: identify the problem, gather information, form a theory, test it, plan a fix, verify the result and document it. Then practice applying it to symptoms rather than memorizing causes.
Know what common command-line and diagnostic tools report, and which layer each one helps you inspect. Work through cable, interface, addressing, name-resolution, routing and wireless symptoms. In each case, write the first thing you would check and what the answer would tell you.
The coverage above is organized from CompTIA’s published domain summary; the note-taking exercises are study suggestions.
A realistic 30-day study plan
Treat this as a starting schedule, not a deadline you must meet. Aim for a focused session most days, with time for reading, recall and review. If you are new to IT support, add time for basic computer and operating-system skills before you compress the plan.
Days 1–7: build the vocabulary
Save the exam objectives and mark each topic as familiar, uncertain or new. Spend the week on networking concepts: layered models, addressing, ports and common services. After each session, close your notes and explain one idea aloud.
Keep a learning log with three columns: topic, misunderstanding and next action. A next action should be specific, such as redoing a subnetting exercise or comparing two protocols. “Study more” is too broad to help tomorrow.
Days 8–14: implement and configure
Cover switching, routing and wireless. Alternate reading with a session that produces something: a diagram, an addressing table or a short written explanation. At the end of the week, revisit week one without looking at your notes first.
Reserve one session for catching up. If several concepts are still unclear, reduce the new material instead of lengthening your study days.
Days 15–21: operations and security
Study monitoring, documentation, availability and change management, then move to security. Use untimed practice to expose reasoning gaps, and return to the relevant topic before trying again.
End the week with mixed review from every domain so far. Record correct guesses as uncertain knowledge. They need follow-up even though a practice score may count them as correct.
Days 22–28: troubleshoot and pace yourself
Give troubleshooting several separate sessions. Write short symptom-to-method walkthroughs and say them aloud. Include timed practice once you can explain the material without help. Afterward, separate knowledge gaps from rushed reading or time-management problems.
Days 29–30: make a readiness decision
Review concise notes and remaining uncertainties. Check your exam version and booking details directly with the vendor. If important topics still feel unfamiliar, use your log to plan another week; finishing a calendar is not evidence that learning is complete.
Common mistakes and how to avoid them
- Mixing exam versions. Put N10-009 on your study checklist and confirm that each resource covers that version.
- Memorizing ports without context. Add the service, the direction of traffic and a sentence about why the port matters.
- Skipping hands-on practice. Subnetting, command output and diagrams need repetition, not just reading.
- Jumping to a fix too quickly. In troubleshooting, follow the method and state the evidence behind each step.
- Counting lucky guesses as mastery. Flag them for review alongside incorrect responses.
- Repeating a familiar set until the score rises. Return to the underlying concept and explain it without answer choices.
How to use practice questions well
Begin untimed. Read the explanation for your selected answer and for each alternative, then identify the distinction you missed. Wrong-answer explanations matter because they can reveal why a familiar term does not fit the situation being described.
CertMonk offers explanations for every answer choice, randomized practice tests, timed practice and an untimed learning mode, plus flip-card flashcards, study games and progress by exam domain. Use those tools for different jobs: explanations for reasoning, flashcards and games for recall, and domain progress to choose what to review next.
After a practice session, choose a small number of gaps to repair. Read the relevant material, write a short explanation and revisit it later. Add timed practice when the concepts feel more stable. Treat practice results as feedback about your preparation, not a prediction of your exam result.
Free practice questions
Use the free samples below to explore the format and review the explanations without a purchase.
Before deploying VoIP across the WAN, a team defines targets for the network metrics that most directly affect call quality. Which metrics should be included? (Choose three.)
Choose 3.
- AOne-way latency
- BDHCP lease duration
- CJitter
- DPacket loss
- EDNS TTL values
Show the answer and explanation
Answer: A. One-way latency and C. Jitter and D. Packet loss
Correct. Long delay makes conversation awkward; one-way targets are commonly kept below 150 ms.
Correct. Delay variation has to stay within what the phones’ jitter buffers can absorb.
Correct. Voice packets that are lost cannot be retransmitted in time, so each loss becomes a gap or glitch in the audio.
Why not the others
- B. Lease duration affects how often phones renew their addresses, not the quality of calls in progress.
- E. DNS TTLs control how long lookups are cached. They do not affect audio once a call is set up.
Takeaway: Real-time traffic depends on latency, jitter and packet loss; set targets for all three and protect voice with QoS.
Source: ITU-T Recommendation G.114: One-way transmission time
A VoIP provider tells a customer that its phones register with the provider’s servers using SIP over TLS rather than plain SIP. The customer’s firewall currently allows only the standard unencrypted SIP port. Which port must be added for the phones’ signaling?
- ATCP or UDP 5060
- BTCP 443
- CTCP 5061
- DTCP 1720
Show the answer and explanation
Answer: C. TCP 5061
Correct. SIP over TLS (SIPS) uses TCP 5061 by default, while plain SIP uses 5060.
Why not the others
- A. Port 5060 is standard unencrypted SIP, which the firewall already allows. SIP over TLS uses its own default port.
- B. TCP 443 is HTTPS. Some cloud phones tunnel over it, but it is not the standard SIP-over-TLS port.
- D. TCP 1720 is H.323 call signaling, a different VoIP protocol family. It would not carry the phones’ SIP registrations.
Takeaway: SIP signaling: 5060 in cleartext, 5061 over TLS. The audio itself travels separately as RTP on dynamic UDP ports.
A storage team wants jumbo frames for iSCSI traffic between servers and an array on one VLAN. Which configuration is required for them to work?
- AA jumbo MTU on the default gateway only
- BA jumbo MTU on the servers only; switches adapt automatically
- CThe same jumbo MTU on every device and port in the path
- DA jumbo MTU on the array only
Show the answer and explanation
Answer: C. The same jumbo MTU on every device and port in the path
Correct. Jumbo frames work only when every device and interface along the path accepts the larger MTU.
Why not the others
- A. The storage traffic stays on the VLAN; the gateway is not in the path.
- B. Switches do not adapt; a port at 1500 drops the larger frames.
- D. The senders and switches must match too.
Takeaway: Jumbo frames must be enabled consistently end to end; any 1500-byte hop silently drops them.
Source: Cisco: Troubleshoot Switch Port and Interface Problems
A monitoring server polls 500 switches every five minutes. The team wants to learn about an interface going down within seconds, without polling every device every few seconds. What should be configured?
- AFlow export from every switch to a flow collector
- BSNMP traps sent when a link changes state
- CPoll all switches every five seconds instead
- DA larger MIB file on the monitoring server
Show the answer and explanation
Answer: B. SNMP traps sent when a link changes state
Correct. A trap is an unsolicited notification the agent sends as soon as an event such as link-down occurs, so the manager hears about it in seconds without extra polling.
Why not the others
- A. Flow export summarizes conversations through the switch. It is not an interface-state alerting mechanism and would only show traffic dropping, indirectly and later.
- C. Faster polling would detect the change sooner, but polling 500 devices every five seconds loads the network, the switches’ CPUs and the server, which the team wants to avoid.
- D. A MIB only describes the objects so data can be interpreted. Loading more MIB definitions does not change when or how often data is sent.
Takeaway: SNMP polling (manager asks, UDP 161) gives regular statistics; traps and informs (agent tells, UDP 162) report events immediately. Informs are acknowledged.
Source: RFC 3416: Version 2 of the Protocol Operations for SNMP
A company requires that all internet traffic from remote employees’ laptops, not only traffic to internal systems, pass through the corporate web proxy and inspection stack while the VPN is connected. Which VPN configuration meets this requirement?
- AA clientless SSL VPN portal serving selected internal web applications
- BA full-tunnel VPN that sends all laptop traffic through the corporate network
- CA site-to-site IPsec tunnel between headquarters and each branch office
- DA split-tunnel VPN that sends only internal subnets through the tunnel
Show the answer and explanation
Answer: B. A full-tunnel VPN that sends all laptop traffic through the corporate network
Correct. A full tunnel routes every destination through the VPN, so internet-bound traffic reaches the corporate proxy and inspection controls.
Why not the others
- A. A clientless portal proxies specific internal applications. The laptop’s general internet traffic never enters the corporate network.
- C. A site-to-site tunnel links two networks through their gateways. It does not run on a remote laptop, so a home worker’s internet traffic would never enter it, let alone reach the corporate proxy.
- D. Split tunneling sends internet traffic directly from the home connection, bypassing the corporate inspection the policy requires.
Takeaway: Full tunnel sends everything through the corporate network for inspection at the cost of bandwidth; split tunnel sends only corporate destinations through the VPN.
Source: NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and BYOD Security
FAQ
Is N10-009 still available?
As of this review date, CompTIA lists N10-009 as the current Network+ exam on its Network+ page. Check that page for retirement information before you book.
Is Network+ only a multiple-choice exam?
No. CompTIA lists both multiple-choice and performance-based questions in its exam details. Include hands-on practice, such as reading command output and working through configuration scenarios, in your preparation.
What experience does CompTIA recommend?
CompTIA recommends A+ certification and 9 to 12 months of hands-on experience as a junior network administrator or network support technician. Use that recommendation to judge your starting point and how much time to allow.
Is 30 days enough to prepare?
It can be a useful planning window, but your starting knowledge and available time decide whether it is realistic. Extend it if you cannot yet explain the topics or apply them to a described problem.
Which domain should I study first?
Start with networking concepts, because the other domains build on layers, addressing and protocols. Troubleshooting carries the largest weight, so keep returning to it throughout the plan.
How should I decide what to revise next?
Start with concepts you cannot explain and mistakes that recur across practice sessions. Use domain weights to balance the remaining schedule, while keeping every domain on your checklist.
Next step
Try free practice questions → https://app.certmonk.app/samples
