EXAM · N10-009 · STUDY GUIDE

CompTIA Network+

Complete Notes · Key Concepts · Ports & Protocols · Exam Tips · Practice Q&A · Acronym Reference

N10-009
Exam Number
90
Max Questions
90 min
Time Limit
720/900
Passing Score
9–12 mo
Recommended Exp.
Exam Domain Weights
1.0 Networking Concepts
23%
2.0 Network Implementation
20%
3.0 Network Operations
19%
4.0 Network Security
14%
5.0 Network Troubleshooting
24%
DOMAIN 1

Networking Concepts

23% of Exam
1.1 OSI Reference Model

The OSI (Open Systems Interconnection) model breaks network communication into 7 layers. Data flows down on the sender side and up on the receiver side.

7
Application
HTTP, FTP, SMTP, DNS, SNMP, LDAP, SIP
Data
End-user protocols; what the user sees
6
Presentation
SSL/TLS (encryption), JPEG, MPEG
Data
Translation, compression, encryption/decryption
5
Session
RPC, NetBIOS, SIP (sessions)
Data
Opens, manages, and closes communication sessions
4
Transport
TCP, UDP
Segment / Datagram
End-to-end delivery, error recovery, flow control
3
Network
IP, ICMP, OSPF, EIGRP, BGP
Packet
Logical addressing (IP), routing between networks
2
Data Link
ARP, Ethernet, 802.11 Wi-Fi, STP
Frame
MAC addressing, switching, frames over local link
1
Physical
Cables, hubs, repeaters, transceivers
Bit
Raw bit transmission over physical media
Exam Tip Remember "All People Seem To Need Data Processing" (Application → Physical). Devices: Layer 1=Hub/Repeater · Layer 2=Switch/Bridge/NIC · Layer 3=Router/L3 Switch.
1.2 Networking Appliances & Functions
Device / FunctionDescription
RouterLayer 3 device; routes packets between networks using IP addresses
SwitchLayer 2 device; forwards frames within a LAN using MAC addresses
FirewallFilters traffic based on rules (ACLs); creates barrier between trusted and untrusted zones
IDSIntrusion Detection System – monitors and ALERTS but does NOT BLOCK traffic (passive)
IPSIntrusion Prevention System – monitors and ACTIVELY BLOCKS threats (inline)
Load BalancerDistributes incoming traffic evenly across multiple servers
Proxy ServerIntermediary between clients and internet; can cache, filter, and hide internal IPs
NASNetwork-Attached Storage – dedicated file-sharing device on a LAN
SANStorage Area Network – dedicated high-speed network for block-level storage
Wireless APConnects wireless clients to a wired network (bridges 802.11 to 802.3)
WAP ControllerCentrally manages multiple lightweight APs (vs. autonomous AP = self-managed)
CDNContent Delivery Network – edge servers cache content close to users to reduce latency
VPNVirtual Private Network – encrypted tunnel over public network for secure remote access
QoSQuality of Service – prioritizes certain traffic types (e.g., VoIP over browsing)
TTLTime to Live – field in IP header limiting how many hops a packet can travel
1.3 Cloud Concepts & Connectivity

Deployment Models

TermDefinition
Public CloudResources owned by 3rd-party provider, shared across tenants (AWS, Azure, GCP)
Private CloudResources used exclusively by one organization
Hybrid CloudCombination of public and private clouds
VPCVirtual Private Cloud – isolated private network within a public cloud

Service Models

TermDefinition
SaaSSoftware as a Service – remote access to software apps (e.g., Office 365, Gmail)
PaaSPlatform as a Service – dev platform for building apps (e.g., Heroku, Google App Engine)
IaaSInfrastructure as a Service – outsourced compute/storage/networking hardware resources

Cloud Terminology

TermDefinition
NFVNetwork Functions Virtualization – replaces physical network hardware with software
ScalabilityPlanned, deliberate addition of resources to handle increased load
ElasticityAutomatic, dynamic adjustment of resources based on real-time demand
MultitenancyMultiple users served by one application instance with isolated environments
Internet GatewayAllows cloud instances to send/receive unencrypted traffic to/from Internet
NAT GatewayTranslates private IPs to public IP; restricts inbound connections from outside
Direct ConnectDedicated private connection between on-prem network and cloud provider
NSGNetwork Security Group – granular firewall rules applied to individual virtual NICs
NSLNetwork Security List – subnet-level firewall rules (less granular than NSG)
1.4 Ports, Protocols & Traffic Types
PortProtocolNotes
20FTP (data)File transfer data; insecure – prefer SFTP/FTPS
21FTP (control)FTP session control; insecure
22SSH / SFTPSecure shell & secure file transfer; TCP
23TelnetInsecure remote login – REPLACE with SSH
25SMTPSend email between servers (client→server or server→server)
53DNSDomain Name System; both UDP and TCP
67DHCP (server)UDP – DHCP server listens here
68DHCP (client)UDP – DHCP client listens here
69TFTPTrivial FTP – no auth, no encryption; UDP
80HTTPHypertext Transfer Protocol; insecure
123NTPNetwork Time Protocol; UDP
161SNMP AgentUDP – agent receives requests
162SNMP ManagerUDP – manager receives traps/notifications
389LDAPLightweight Directory Access Protocol; TCP
443HTTPSHTTP over TLS; secure web traffic
445SMBServer Message Block – file/printer sharing
514SyslogLog messages; UDP
587SMTPSSMTP Secure – send email over TLS
636LDAPSLDAP over SSL/TLS
853DoTDNS over TLS
1433SQL ServerMicrosoft SQL Server database; TCP
3389RDPRemote Desktop Protocol; TCP
5060SIP (plain)Session Initiation Protocol (unencrypted)
5061SIP (TLS)SIP over TLS (encrypted)

IP Protocol Types & Traffic

TypeDescription
ICMPInternet Control Message Protocol – error messages, ping, traceroute
TCPConnection-oriented; 3-way handshake (SYN/SYN-ACK/ACK); reliable, ordered delivery
UDPConnectionless; no handshake; faster, used for streaming, DNS, DHCP, VoIP
GREGeneric Routing Encapsulation – tunneling protocol; NO encryption/auth itself
IPSec AHAuthentication Header – integrity + authentication; NO encryption
IPSec ESPEncapsulating Security Payload – confidentiality + integrity + auth (provides encryption)
IPSec IKEInternet Key Exchange – negotiates and sets up IPSec SAs, exchanges keys
UnicastOne-to-one traffic (specific destination IP)
MulticastOne-to-many (specific group; Class D: 224–239.x.x.x)
AnycastOne-to-nearest (IPv6 only – delivers to the nearest node in a group)
BroadcastOne-to-all within a network segment
1.5 Transmission Media & Transceivers

Wired Cable Types

Cable TypeSpecs / Use Case
Cat 5eMin for Gigabit Ethernet (1000BASE-T); 100m max; 1 Gbps
Cat 6Min for limited 10GbE (10GBASE-T @ 55m); 100m for 1 Gbps
Cat 6A10 Gbps up to 100m (augmented)
Cat 710 Gbps up to 100m; shielded
Cat 825/40 Gbps; ~30m; data center use
UTPUnshielded Twisted Pair – most susceptible to EMI/RFI
STPShielded Twisted Pair – reduces crosstalk and EMI
Multimode FiberLED-based; short distances; cheaper; up to 400 Gbps; SR/SX standards
Single-Mode FiberLaser-based; long distances (miles); more expensive; up to 400 Gbps; LR/LX standards
CoaxialUsed for cable TV and broadband; features central conductor; RG types
Twinaxial (DAC)Direct Attach Copper; short-range data center high-speed links
Plenum-ratedFire-retardant jacket (PVC/FEP); required in air-handling spaces (drop ceilings)

Ethernet Standards (802.3)

StandardDescription
10BASE2 (ThinNet)10 Mbps, thin coaxial cable
10BASE5 (ThickNet)10 Mbps, thick coaxial cable
1000BASE-T1 Gbps over copper twisted pair (Cat 5e+)
1000BASE-SX1 Gbps over multimode fiber (short range)
1000BASE-LX1 Gbps over single-mode fiber (long range)
10GBASE-SR10 Gbps over multimode fiber (short range)
10GBASE-LR10 Gbps over single-mode fiber (long range)
10GBASE-CR10 Gbps over twinaxial copper (DAC cable)
10GBASE-T10 Gbps over copper (Cat 6 @ 55m, Cat 6A @ 100m)

Connectors

ConnectorDescription
SCSubscriber Connector – fiber optic; push-pull coupling
LCLocal Connector – small form factor fiber; most common in data centers
STStraight Tip – older fiber connector; bayonet coupling
MPOMulti-Fiber Push On – up to 72 fibers; data center high-density
RJ11Telephone equipment; dial-up; 2-wire twisted pair
RJ45Standard Ethernet connector; 8-wire twisted pair; LAN
F-typeCoaxial; threaded (screw-on); cable TV / broadband modems
BNCBayonet Neill–Concelman; coaxial; twist-and-lock; older network/video
SFPSmall Form-factor Pluggable – modular, hot-swappable transceiver
QSFPQuad SFP – 4-channel version; higher bandwidth
1.6 Network Topologies, Architectures & Types
TopologyDescription
Star / Hub-and-SpokeAll devices connect to a central hub/switch. Most common LAN topology. Single point of failure at center.
MeshEvery node connects to every other node. Highest redundancy. Expensive. Used on WANs/Internet.
Point-to-PointDirect link between exactly two hosts. Simplest topology.
HybridCombination of two or more topologies.
Spine and LeafTwo-layer full-mesh in data centers. Every leaf connects to every spine. Max 2 hops between servers.
Three-Tier ModelCore (backbone, high-speed) → Distribution (routing/filtering) → Access (end devices)
Collapsed CoreCore + Distribution merged into one layer. Used in smaller networks to reduce cost.
North-South TrafficBetween a data center and external networks (Internet)
East-West TrafficBetween servers/devices within the same data center
1.7 IPv4 Network Addressing & Subnetting
ClassFirst OctetPrivate RangeDefault MaskUse
Class A1–12610.0.0.0–10.255.255.255255.0.0.0 (/8)Large networks
Class B128–191172.16.0.0–172.31.255.255255.255.0.0 (/16)Medium networks
Class C192–223192.168.0.0–192.168.255.255255.255.255.0 (/24)Small networks
Class D224–239MulticastN/AMulticast groups
Class E240–255ReservedN/AExperimental

Key Concepts

ConceptDetails
APIPA169.254.0.0/16 – auto-assigned when DHCP unavailable; local segment only
Loopback127.0.0.0/8 (commonly 127.0.0.1 = localhost) – test local NIC
RFC 1918Defines private IP ranges: 10.x.x.x, 172.16–31.x.x, 192.168.x.x
CIDRClassless Inter-Domain Routing – replaces classful design; uses prefix notation (/24)
VLSMVariable Length Subnet Mask – allows subnets of different sizes in same network
/30255.255.255.252 → 4 addresses, 2 hosts – used for point-to-point links
/26255.255.255.192 → 64 addresses, 62 hosts
/24255.255.255.0 → 256 addresses, 254 hosts (most common)
Exam Tip – Subnetting Total hosts = 2^(host bits). Usable = total − 2 (network address + broadcast). Network address = first IP, Broadcast = last IP.

/25=128 · /26=64 · /27=32 · /28=16 · /29=8 · /30=4 · /31=2 · /32=1
1.8 IPv6 & Modern Network Environments
ConceptDescription
IPv6 Format128-bit address expressed in 8 groups of 4 hex digits. :: compresses consecutive zeros.
Link-LocalFE80::/10 – equivalent to IPv4 APIPA; not routable; auto-configured
Global UnicastStarts with 2000–3FFF (2xxx or 3xxx); publicly routable; equivalent to public IPv4
Loopback::1 – equivalent to 127.0.0.1
AnycastIPv6-only one-to-nearest delivery type
SLAACStateless Address Autoconfiguration – devices auto-configure IPv6 without DHCP
TunnelingEncapsulates IPv6 packets in IPv4 headers to traverse IPv4 networks
Dual StackDevice runs both IPv4 and IPv6 simultaneously for migration
NAT64Allows IPv6-only devices to communicate with IPv4-only servers
Address ExhaustionPrimary reason IPv6 was developed (IPv4 ran out of addresses)

Modern Network Technologies

TechnologyDescription
SDNSoftware-Defined Network – software-based control of network; central policy management; application-aware
SD-WANSoftware-Defined WAN – software-managed WAN connections; transport agnostic
VXLANVirtual Extensible LAN – overcomes 4094 VLAN limit; uses Layer 2 encapsulation over Layer 3
ZTAZero Trust Architecture – no implicit trust; policy-based auth; continuous verification; least privilege
SASESecure Access Service Edge – combines networking + security into single cloud-based service
SSESecurity Service Edge – cloud security services only (subset of SASE)
IaCInfrastructure as Code – manage infrastructure through scripts/templates; version control; branching
NFVNetwork Functions Virtualization – replaces physical network hardware with software
DOMAIN 2

Network Implementation

20% of Exam
2.1 Routing Technologies
ConceptDescription
Static RoutingManually configured by admin; simple; high security (no updates exchanged); not scalable
Dynamic RoutingAutomatically discovers routes; adapts to changes; scalable for large networks
RIPRouting Information Protocol – distance-vector; max 15 hops; older, small networks
OSPFOpen Shortest Path First – link-state; most popular; uses cost (bandwidth); fast convergence; IGP
EIGRPEnhanced IGRP – hybrid (Cisco); uses composite metrics (BW, delay, load, reliability); IGP
BGPBorder Gateway Protocol – path-vector; used on the Internet between ASs; EGP
IS-ISIntermediate System to IS – link-state; large service provider networks; IGP
Admin DistanceValue ranking route trustworthiness; LOWER = more preferred
Prefix LengthLonger prefix (/28 > /24) = more specific route = preferred
NATNetwork Address Translation – maps private IPs to public IP
PATPort Address Translation – maps many private IPs to one public IP using port numbers
FHRPFirst Hop Redundancy Protocol – virtual IP shared among redundant gateway routers; auto-failover
VIPVirtual IP – shared address assigned to multiple devices for redundancy or load balancing
SubinterfaceLogical division of a physical interface; allows multiple VLANs on one physical port
Exam Tip Distance-vector (RIP – hop count) · Link-state (OSPF, IS-IS – full topology map) · Hybrid (EIGRP – combines both) · Path-vector (BGP – AS path). IGPs route within an AS; BGP is the only EGP.
2.2 Switching Technologies
ConceptDescription
VLANVirtual LAN – logical grouping of devices regardless of physical location; reduces broadcast domains
VLAN DatabaseCentrally stores all configured VLANs on a switch
SVISwitch Virtual Interface – logical interface for inter-VLAN routing
Native VLANHandles untagged frames on a trunk port (default VLAN 1)
Voice VLANDedicated VLAN for VoIP traffic to ensure QoS
802.1Q TaggingStandard method to tag frames with VLAN ID on trunk ports
Link Aggregation (LACP)Combines multiple physical ports into one logical channel for bandwidth and redundancy
Half-duplexCommunication in one direction at a time
Full-duplexSimultaneous two-way communication
STPSpanning Tree Protocol – prevents switching loops by blocking redundant paths
RSTPRapid STP – faster convergence than STP; preferred
MTUMaximum Transmission Unit – max data size per frame (standard Ethernet = 1500 bytes)
Jumbo FramesEthernet frames larger than standard 1518 bytes (typically 9000 bytes)
Port Mirroring (SPAN)Copies traffic from one port to another for analysis with a packet sniffer
Exam Tip – STP Port States Blocking → Listening → Learning → Forwarding → Disabled. Root bridge selected by lowest Bridge ID (priority + MAC). Root port = best path to root bridge. Designated port = best port on each segment. Blocked port = prevents loops.
2.3 Wireless Technologies
StandardFrequencyMax SpeedNotes
802.11a5 GHz54 MbpsWi-Fi 1; older; 5 GHz only
802.11b2.4 GHz11 MbpsWi-Fi 2; long range; slow
802.11g2.4 GHz54 MbpsWi-Fi 3; backward compatible with b
802.11n2.4 + 5 GHz600 MbpsWi-Fi 4; MIMO; dual-band
802.11ac5 GHz6.9 GbpsWi-Fi 5; MU-MIMO
802.11ax2.4 + 5 + 6 GHz9.6 GbpsWi-Fi 6/6E; OFDMA; 6E adds 6 GHz

Wireless Concepts

ConceptDescription
2.4 GHz bandLongest range; most interference; only 3 non-overlapping channels (1, 6, 11); 11 channels total
5 GHz bandShorter range; less interference; more non-overlapping channels
6 GHz bandNewest (Wi-Fi 6E only); shortest range; least congestion; most channels
Band SteeringGuides dual-band devices to the best available frequency
802.11hAmendment for spectrum and power management (DFS/TPC) in 5 GHz
SSIDService Set Identifier – the Wi-Fi network name users see
BSSIDMAC address of the AP; unique per AP in a network
BSSBasic Service Set – one AP + its clients
ESSExtended Service Set – multiple APs with same SSID (roaming)
WPA2Uses AES/CCMP; PSK (home) or Enterprise (RADIUS server) modes
WPA3Strongest current Wi-Fi encryption; SAE replaces PSK; required for large secure networks
WPSWi-Fi Protected Setup – security risk; should be disabled
WEPWired Equivalent Privacy – deprecated; vulnerable; do not use
Captive PortalRestricts access until user completes action (login/accept terms)
Autonomous APSelf-managed; no controller required; good for small deployments
Lightweight APRequires Wireless LAN Controller (WLC) for centralized management
Omnidirectional360-degree coverage; standard for indoor APs
DirectionalFocused beam; used for long-range point-to-point links (Yagi, dish, parabolic)
2.4 Physical Installations
ConceptDescription
MDFMain Distribution Frame – main hub connecting internal networks to outside cabling
IDFIntermediate Distribution Frame – connects MDF wiring to end devices on a floor/area
Rack Units (U)1U = 1.75 inches; standard racks typically 42U tall
Port-side ExhaustHot air exits from the port side; faces hot aisle
Port-side IntakeCool air enters from port side; ports face cold aisle
Patch PanelCopper cable management device with multiple ports
Fiber Distribution PanelTermination and management point for fiber-optic cables
UPSUninterruptible Power Supply – provides emergency power during outages
PDUPower Distribution Unit – supplies and monitors power to multiple devices
BlackoutComplete power outage
BrownoutPartial voltage drop (not full outage)
HVACControls temperature, humidity, and air quality in data centers
Fire SuppressionGaseous/clean agent systems preferred (NOT water or foam near equipment)
US Voltage110–120V (standard residential/commercial)
Europe Voltage220–240V
DOMAIN 3

Network Operations

19% of Exam
3.1 Organizational Processes & Documentation
Document TypePurpose
Physical DiagramShows physical hardware, cables, and their connections
Logical DiagramShows IP addressing, VLANs, routing, and traffic flow (no physical detail)
Layer 1 DiagramPhysical connections: cabling and hardware
Layer 2 DiagramMAC addresses, switches, and network topology
Layer 3 DiagramIP addressing, routing protocols, logical subnets
Rack DiagramShows physical placement of equipment in server racks
Cable Maps/DiagramsPhysical paths and connections between network components
IPAMIP Address Management – tools to plan, track, and manage IP addresses
Asset InventoryRecords of hardware, software, licenses, and warranties
SLAService Level Agreement – defines service quality/availability requirements between provider and user
Wireless Heat MapVisual representation of wireless signal coverage/strength
EOLEnd of Life – product no longer manufactured or sold
EOSEnd of Support – no more patches, bug fixes, or technical assistance
Golden ConfigurationOptimized, pre-approved ideal configuration baseline
DecommissioningFormal process of removing/retiring hardware or software
Change ManagementFormal process for tracking and approving network changes
3.2 Network Monitoring Technologies
ConceptDescription
SNMPSimple Network Management Protocol – UDP-based; monitors network devices
SNMP AgentSoftware on managed device; receives requests on UDP 161
SNMP Manager (NMS)Monitors devices; receives traps on UDP 162
MIBManagement Information Base – virtual database on device holding config/state info
SNMP TrapUnsolicited alert sent from agent to manager
SNMPv1/v2cUse community strings (passwords); send data UNENCRYPTED
SNMPv3Adds encryption and stronger authentication; only version with encryption
Community StringActs as a password in SNMPv1/v2c
Flow DataMonitors network traffic patterns and usage statistics (NetFlow, sFlow)
Packet CaptureCaptures and inspects actual packet contents (Wireshark, tcpdump)
Protocol AnalyzerTool that captures and inspects network traffic (Wireshark, packet sniffer)
SyslogProtocol for sending log/event messages (UDP 514); Syslog collector aggregates them
SIEMSecurity Info and Event Management – collects, aggregates, analyzes log data; detects anomalies
API IntegrationAutomated communication and data exchange between monitoring systems
Port MirroringCopies traffic from ports to a monitoring port (SPAN) for analysis
Baseline MetricsStandard performance measurements under normal conditions; used to detect anomalies
NmapNetwork discovery tool; identifies hosts, services, and topology
ICMPUsed to send echo requests (ping) to confirm device availability
3.3 Disaster Recovery Concepts
ConceptDescription
RPORecovery Point Objective – max acceptable data loss; how far back can you restore?
RTORecovery Time Objective – max allowable time to restore business functions after disaster
MTTRMean Time To Repair – average time to repair a failed component
MTBFMean Time Between Failures – higher MTBF = MORE reliable (fails less often)
Cold SitePhysical space only; no equipment; cheapest; slowest recovery
Warm SiteHas some hardware/software; partial data backups; needs configuration before use
Hot SiteFully equipped and operational; ready to take over immediately; fastest; most expensive
Active-ActiveAll nodes handle traffic simultaneously; no single point of failure; complex/costly
Active-PassiveOne node active, backup passive; simpler/cheaper; brief failover delay
Tabletop ExerciseDiscussion-based DR simulation in a controlled environment
Validation TestHands-on execution of actual recovery processes
3.4 IPv4/IPv6 Network Services – DHCP & DNS

DHCP

TermDefinition
ScopePool of IP addresses DHCP server can assign to clients
ReservationPermanent IP assignment based on MAC address
LeaseDuration a client can use an assigned IP address
OptionsAdditional settings provided with IP (gateway, DNS, subnet mask)
Relay Agent / IP HelperAllows DHCP server to assign IPs across multiple subnets
ExclusionsIP addresses removed from pool (reserved for static devices)
SLAACStateless Address Autoconfiguration – IPv6 auto-config without DHCP
APIPA SymptomDevice gets 169.254.x.x address = DHCP scope exhausted or server unreachable

DNS Record Types

Record / ConceptDescription
AMaps hostname → IPv4 address (32-bit)
AAAAMaps hostname → IPv6 address (128-bit)
CNAMECanonical Name – alias for another hostname (multiple names to same IP)
MXMail Exchange – points to mail server for a domain
TXTText record – used for email security (SPF, DKIM, DMARC); not used for traffic routing
NSNameserver – specifies authoritative DNS servers for a domain
PTRPointer – reverse lookup; maps IP address → hostname (opposite of A/AAAA)
SOAStart of Authority – administrative info about a DNS zone
DNSSECDNS Security Extensions – ensures integrity and authenticity of DNS data
DoHDNS over HTTPS – hides DNS queries in regular HTTPS web traffic (port 443)
DoTDNS over TLS – encrypts DNS queries using dedicated TLS connection (port 853)
Forward ZoneMaps hostnames to IP addresses
Reverse ZoneMaps IP addresses to hostnames (uses PTR records)
Authoritative DNSHolds original records for a domain (Primary or Secondary)
Non-AuthoritativeResponds using cached or forwarded data
Recursive LookupDNS server contacts multiple servers on client behalf to fully resolve
Hosts FileLocal file on machine; overrides DNS for name resolution
3.5 Network Access & Management Methods
Method / ConceptDescription
Site-to-Site VPNEncrypted tunnel connecting two networks (e.g., two office sites)
Client-to-Site VPNIndividual user connects securely to a remote network (remote access VPN)
Clientless VPNVPN access through a web browser (HTTPS); no client software needed
Split TunnelOnly certain traffic goes through VPN; rest uses public internet (saves bandwidth)
Full TunnelAll traffic routed through VPN
SSHSecure Shell – encrypted command-line remote access (port 22); replaces Telnet
RDPRemote Desktop Protocol – GUI-based remote access (port 3389); Windows
APIApplication Programming Interface – automated communication between systems
Console AccessPhysical port connection for direct device management; used when network is down
Jump Box/HostDedicated intermediary system for secure access to devices in protected segments
In-Band ManagementManaging devices through the same network used for data (SSH, HTTPS, RDP, SNMP)
Out-of-Band ManagementSeparate management network; works even when main network is down (console port)
NTPNetwork Time Protocol – synchronizes clocks over network
PTPPrecision Time Protocol – nanosecond precision; financial/industrial systems
NTSNetwork Time Security – protects time synchronization data from attacks
DOMAIN 4

Network Security

14% of Exam
4.1 Basic Network Security Concepts
ConceptDescription
CIA TriadConfidentiality, Integrity, Availability – core principles of information security
PKIPublic Key Infrastructure – hierarchical system for creating/managing digital certificates
Self-Signed CertNot trusted by browsers by default; used in internal/dev environments; no 3rd-party CA
IAMIdentity and Access Management – framework for controlling access to digital resources
MFAMultifactor Authentication – requires 2+ categories (know/have/are/somewhere)
SSOSingle Sign-On – one login grants access to multiple connected systems
RADIUSRemote Authentication Dial-In User Service – centralized AAA for remote access users
LDAPLightweight Directory Access Protocol – manages user accounts, groups, devices
SAMLSecurity Assertion Markup Language – exchanges authentication/authorization data
TACACS+AAA protocol primarily for managing access to network devices (Cisco)
TOTPTime-Based One-Time Password – generates OTP based on current time + secret key
Least PrivilegeUsers get minimum access needed for their responsibilities
RBACRole-Based Access Control – permissions tied to roles/job functions
GeofencingControls device usage based on geographic location
HoneypotDecoy system mimicking real systems; attracts attackers; monitors for threats
HoneynetNetwork of multiple honeypots
PCI DSSPayment Card Industry Data Security Standards – protects credit cardholder data
GDPRGeneral Data Protection Regulation – governs privacy of EU citizens personal data
IoTInternet of Things – interconnected devices with sensors
IIoTIndustrial IoT – IoT for industrial applications
SCADASupervisory Control and Data Acquisition – specific type of ICS
ICSIndustrial Control System – control/automation systems in industrial settings
OTOperational Technology – hardware/software monitoring/controlling physical industrial processes
BYODBring Your Own Device – employees use personal devices for work
Screened SubnetSemi-trusted zone (DMZ) between trusted internal and untrusted external networks
4.2 Network Attack Types
AttackDescription
DoSDenial of Service – overwhelms target from a single source
DDoSDistributed DoS – multiple compromised systems flood target; harder to defend
VLAN HoppingBypasses VLAN segmentation using unauthorized VLAN tags
MAC FloodingOverwhelms switch CAM table with fake MACs; causes switch to broadcast all traffic
ARP SpoofingAttacker sends fake ARP packets to associate their MAC with a legitimate IP
ARP PoisoningDevice ARP cache contains incorrect IP-to-MAC mappings
DNS PoisoningRemaps domain names to rogue IPs in a DNS resolver cache
DNS SpoofingAttacker intercepts DNS query and responds with forged record
Rogue DHCPUnauthorized DHCP server causes IP conflicts, wrong gateway/DNS settings
Evil TwinRogue AP with same SSID as legitimate AP; used for eavesdropping
On-Path AttackAttacker intercepts and modifies traffic between two parties (MITM)
PhishingSocial engineering: disguised as legitimate to steal credentials/info
Dumpster DivingSearching trash for sensitive discarded documents or media
Shoulder SurfingObserving screen/keyboard to steal info; countered by privacy filters
TailgatingFollowing authorized person into a restricted area without permission
MalwareHarmful programs: viruses, worms, ransomware, trojans
WormSelf-propagating malware that spreads across networks without user action
4.3 Network Security Defense Techniques
TechniqueDescription
Device HardeningDisable unused ports/services; change default passwords; apply firmware updates
NACNetwork Access Control – controls which devices can join network (port security, 802.1X, MAC filtering)
802.1XIEEE standard – switch acts as authenticator; requires RADIUS server; used for port security
Port SecurityLimits which MAC addresses can connect to a switch port
MAC FilteringNetwork access based on 48-bit hardware address
ACLAccess Control List – rule-based traffic filtering; implicit deny at end
URL FilteringBlocks/allows access to websites based on URL
Content FilteringInspects data streams for keywords, file types, or patterns
UTMUnified Threat Management – single device providing multiple security services
Trusted ZonePrivate/internal network (LAN, intranet)
Untrusted ZonePublic networks (Internet, guest Wi-Fi)
Screened SubnetBuffer zone (DMZ) with publicly accessible servers outside main firewall
Data in TransitProtect with VPN, IPSec, TLS
Data at RestProtect with encryption (archived files, DB records, backup files)
Key ManagementSecure handling of encryption keys
DOMAIN 5

Network Troubleshooting

24% of Exam
5.1 Troubleshooting Methodology
StepDescription
Step 1Identify the problem – gather info, question users, identify symptoms, check for changes, duplicate issue
Step 2Establish a theory of probable cause – question the obvious; consider top-to-bottom or bottom-to-top OSI
Step 3Test the theory – confirm or deny; if wrong, establish new theory or escalate
Step 4Establish a plan of action – resolve problem and identify potential effects
Step 5Implement the solution or escalate as necessary
Step 6Verify full system functionality and implement preventive measures
Step 7Document findings, actions, outcomes, and lessons learned
Exam Tip – OSI Approach Top-to-bottom (Layer 7 down) = suspected application/software issue. Bottom-to-top (Layer 1 up) = suspected hardware/physical issue. Divide and conquer = start at a middle layer (e.g., Layer 3) and work outward.
5.2 & 5.3 Cable Issues & Network Service Problems
IssueDetails
Incorrect CableWrong type: single-mode vs multimode, Cat 5 in GbE → replace with Cat 5e+
AttenuationSignal loss over distance; solved by repeaters/switches, not transceivers alone
CrosstalkInterference between adjacent wire pairs; STP cable reduces this
EMI/RFIExternal electromagnetic interference; fiber immune; STP reduces; UTP most susceptible
Improper TerminationWrong pinouts; use cable tester to diagnose
TX/RX TransposedWrong TIA/EIA standard or wrong pin assignments; use crossover or check MDI-X
Auto MDI-XInterface automatically detects and configures connection type (straight-through vs crossover)
CRC ErrorsCyclic Redundancy Check failures = transmission errors; often bad cable or NIC
RuntsEthernet frames smaller than 64 bytes; caused by collisions or faulty devices
GiantsFrames exceeding 1518 bytes; caused by misconfigured MTU or faulty equipment
Packet DropsLost packets due to congestion, buffer overflow, or network issues
Error DisabledPort shut down by switch due to errors, security violations, or config issues
Administratively DownPort manually shut down for maintenance or policy
SuspendedPort temporarily inactive due to network conditions or security policies

Network Service Problems

IssueCause / Solution
Network LoopMultiple active paths causing endless packet circulation; prevented by STP/RSTP
Incorrect VLANDevices on same switch cannot communicate if on different VLANs
ACL MisconfigurationImplicit deny may block legitimate traffic; ACL evaluated top-down
Wrong Default GatewayDevice can reach local LAN but not external networks
Wrong Subnet MaskDevice may think other hosts are on different network; causes local comm failure
Duplicate IPTwo devices share same IP; caused by static assignment errors or rogue DHCP
DHCP ExhaustionNo more IPs to assign; devices get APIPA address (169.254.x.x)
Routing LoopPackets circulate between routers; mitigated by route poisoning, split horizon, TTL
5.4 & 5.5 Performance Issues & Troubleshooting Tools

Performance Issues

IssueSolution / Notes
Congestion/ContentionToo many devices competing for bandwidth; use QoS
BottleneckingSingle component limits overall performance; fix with hardware/software upgrades
LatencyDelay in data delivery; CDN reduces latency for geographically distant users
JitterVariable delay (especially VoIP quality); use QoS to prioritize voice traffic
Packet LossDetected with ping, tracert, traceroute
Channel Overlap2.4 GHz: use channels 1, 6, 11 (non-overlapping); increasing width = more throughput but more interference
Wireless Signal LossDo NOT switch to lower frequency; check AP placement, obstructions
Roaming IssuesEnsure all APs broadcast same SSID, use identical encryption, adequate overlap
Client DisassociationUse security features preventing deauthentication attacks

Software Tools (CLI Commands)

ToolFunction
pingTests reachability; detects packet loss; sends ICMP echo requests
traceroute (Linux)Displays hops between source and destination (IPv4)
tracert (Windows)Same as traceroute but for Windows
nslookupTroubleshoots DNS issues on Windows
digDNS query tool on Linux/macOS
tcpdumpCommand-line packet capture utility (Linux)
netstat -aDisplays all active TCP connections and listening ports
netstat -bShows application names accessing the network (Windows)
ipconfig /allFull TCP/IP config for all adapters (Windows)
ipconfig /releaseReleases DHCP-assigned IP address (Windows)
ipconfig /renewRenews DHCP-assigned IP address (Windows)
ifconfigDisplays TCP/IP settings on Linux (older; replaced by ip command)
ipModern Linux replacement for ifconfig
arp -aDisplays ARP cache (IP-to-MAC mapping table)
NmapNetwork discovery; identifies hosts, services, open ports, topology
WiresharkGUI protocol analyzer; captures and inspects packets

Switch/Router Show Commands

CommandPurpose
show mac-address-tableDisplays MAC-to-port mapping table on a switch
show routeDisplays routing table on router or Layer 3 switch
show interfaceStatus and performance of network interfaces (up/down, errors, stats)
show configCurrent device configuration (interfaces, routing, VLANs, settings)
show arpDisplays ARP table (IP-to-MAC mappings)
show vlanVLAN configuration (IDs, names, port assignments)
show powerPoE power information; useful for troubleshooting PoE issues

Hardware Tools

ToolFunction
Cable TesterVerifies cable integrity and connectivity; detects incorrect pinouts
Toner & Probe KitTraces and identifies individual wires within a cable bundle
Optical Power MeterTests signal strength in fiber-optic links
PoE TesterVerifies PoE compatibility between switch and connected devices
Network TapPassive monitoring device; captures traffic without interrupting flow
Wi-Fi AnalyzerDetects Wi-Fi networks, signal strength, channel usage, interference
Network Heat MapVisual map of wireless signal coverage (identifies weak areas)
Visual Fault LocatorLocates faults in fiber-optic cables using visible red laser light
Speed TesterMeasures bandwidth (upload/download speed) and latency
LLDPLink Layer Discovery Protocol – vendor-neutral; devices advertise identity to neighbors
CDPCisco Discovery Protocol – Cisco-proprietary; shares device info between Cisco devices
Q&A

Practice Questions

Click to reveal answers
OSI Model
QWhat PDU is used at Layer 4 (TCP)?
Segment
QWhat PDU is used at Layer 4 (UDP)?
Datagram
QWhat PDU is used at Layer 2?
Frame
QWhat PDU is used at Layer 3?
Packet
QWhat PDU is used at Layer 1?
Bit
QWhat layers use "data" as the PDU?
Layers 5, 6, and 7 (Session, Presentation, Application)
QWhat device operates at Layer 1?
Hub, repeater, network cabling, modem
QWhat device operates at Layer 2?
Switch, bridge, NIC, wireless access point
QWhat device operates at Layer 3?
Router, Layer 3 switch (multilayer switch)
QWhere does encryption/decryption happen in OSI?
Layer 6 (Presentation Layer)
QWhere are sessions opened/closed?
Layer 5 (Session Layer)
QARP operates at which OSI layer?
Layer 2 (Data Link)
Routing & Switching
QWhat protocol prevents switching loops?
STP (Spanning Tree Protocol) and RSTP (Rapid STP)
QIn STP, which switch becomes root bridge?
The switch with the LOWEST Bridge ID (priority + MAC address)
QWhat is a blocked port in STP?
A port that does not forward traffic to prevent loops; listens to BPDUs only
QWhich routing protocol is distance-vector?
RIP (Routing Information Protocol)
QWhich routing protocols are link-state?
OSPF and IS-IS
QWhich is a hybrid routing protocol?
EIGRP
QWhich protocol is used for Internet routing between ASs?
BGP (Border Gateway Protocol) – path-vector, EGP
QLower administrative distance means?
More preferred route (lower AD = more trusted)
QMore specific prefix (/28 vs /24) means?
Longer prefix (/28) is more specific and preferred
QWhat allows multiple devices to share one public IP?
PAT (Port Address Translation) – a form of NAT
QWhat does FHRP provide?
Virtual IP shared among redundant routers for gateway failover
QWhat handles inter-VLAN routing on a switch?
SVI (Switch Virtual Interface)
QWhat protocol enables link aggregation?
LACP (Link Aggregation Control Protocol)
Security
QIDS vs IPS: key difference?
IDS detects and alerts (passive). IPS detects and BLOCKS (active, inline).
QWhat is ARP spoofing?
Attacker sends fake ARP packets to associate their MAC with a legitimate IP address.
QWhat is MAC flooding?
Overwhelms switch CAM table with fake MACs, causing switch to broadcast all traffic.
QWhat is an evil twin attack?
Rogue AP with same SSID as legitimate AP, used to intercept wireless traffic.
QWhat does 802.1X do?
Port-based network access control; switch acts as authenticator with a RADIUS server.
QWhat is the principle of least privilege?
Users get only the minimum access needed for their job responsibilities.
QWPA2 vs WPA3: key difference?
WPA3 uses SAE (Simultaneous Authentication of Equals) instead of PSK; stronger.
QWhat is a screened subnet (DMZ)?
Buffer zone between trusted internal network and untrusted Internet with public-facing servers.
QWhat is RADIUS used for?
Centralized AAA (Authentication, Authorization, Accounting) for remote access users.
QWhat is TACACS+ used for?
AAA protocol primarily for managing access to network devices (routers, switches).
QWhat does the CIA triad stand for?
Confidentiality, Integrity, Availability – the three core principles of information security.
QACL last rule behavior?
Implicit deny any – traffic not matching any rule is automatically blocked.
Wireless
QWhich Wi-Fi standard supports 2.4 AND 5 AND 6 GHz?
802.11ax (Wi-Fi 6/6E)
QWhich frequency has best range but most interference?
2.4 GHz
QNon-overlapping channels in 2.4 GHz?
Channels 1, 6, and 11
QWhat does band steering do?
Guides dual-band capable devices to the best available frequency band.
Q802.11h is for?
Spectrum and power management in 5 GHz band (DFS/TPC)
QCaptive portal purpose?
Restricts network access until user completes a required action (login, accept terms).
QWhat is an ESSID?
SSID of an ESS (multiple APs with same SSID for seamless roaming).
QWPS should be?
Disabled – it is a known security risk.
QStrongest Wi-Fi encryption available?
WPA3 (specifically WPA3-SAE for personal networks)
Cabling & Physical
QMinimum cable for Gigabit Ethernet?
Cat 5e
QMinimum cable for 10 Gbps (limited range)?
Cat 6 (supports 10GBASE-T up to 55m)
QWhich cabling type is immune to EMI/RFI?
Fiber optic
QWhich cable for long-distance building-to-building links?
Single-mode fiber (can span miles)
QWhich cable uses laser technology?
Single-mode fiber
QWhich cable uses LED technology?
Multimode fiber
QWhat does plenum-rated cable provide?
Fire-retardant jacket (PVC/FEP) required in air-handling plenum spaces
QWhat is a DAC cable?
Direct Attach Copper (twinaxial) – short-range high-speed data center connections
QMPO connector used for?
High-density fiber connections (up to 72 fibers); data centers and high-speed networks
QRJ45 is used for?
Standard Ethernet network cabling (twisted-pair copper)
QRJ11 is used for?
Telephone equipment and dial-up networking
QBNC connector is?
Bayonet-style (twist-and-lock) connector used with coaxial cabling
QF-type connector is?
Threaded (screw-on) connector for coaxial; cable TV and broadband modems
QLC connector is?
Small form factor fiber-optic connector; most common in modern data centers
Cloud & Modern Networks
QSaaS vs PaaS vs IaaS?
SaaS = ready-to-use software (Office365). PaaS = dev platform (Heroku). IaaS = raw compute/storage (AWS EC2).
QWhat is a VPC?
Virtual Private Cloud – isolated private network within a public cloud environment.
QScalability vs Elasticity?
Scalability = planned gradual addition of resources. Elasticity = automatic real-time adjustment.
QWhat is NFV?
Network Functions Virtualization – replaces physical network hardware with software.
QWhat is ZTA?
Zero Trust Architecture – no implicit trust; continuous verification; least privilege access.
QSASE vs SSE?
SASE combines networking + security. SSE is security-only (subset of SASE).
QWhat is IaC branching?
Creates separate development paths that can be merged back into main configuration.
QConfiguration drift means?
A system diverges from its expected state due to manual changes outside automation scripts.
QDirect Connect vs VPN?
Direct Connect = dedicated private line to cloud. VPN = encrypted tunnel over Internet.
QNSG vs NSL?
NSG applies rules to individual virtual NICs (granular). NSL applies rules at subnet level (less granular).
TIPS

Exam Strategy & Instructor Tips

Know Your AcronymsCompTIA tests acronyms extensively. If you know what IPS, IDS, PAT, FHRP stand for, you can answer quickly.
Know Port NumbersEvery port in the exam objectives must be memorized. The table in objective 1.4 is the definitive list.
Master SubnettingExpect subnetting questions on /24, /25, /26, /27, /28, /30 and CIDR. Know network address, broadcast, first/last host, # of hosts.
Performance-Based QuestionsThe exam has ~6 simulator questions (drag-and-drop, type commands, configure diagrams). These take more time – practice labs!
Study Cisco CommandsThe exam includes real CLI: show commands, static routes, ARP, MAC table lookups. Practice Cisco Packet Tracer.
Know OSI LayersEvery device and protocol maps to an OSI layer. This is tested directly and indirectly throughout the exam.
Insecure vs SecureKnow which protocols are insecure (HTTP, Telnet, FTP, SNMP v1/v2) vs secure alternatives (HTTPS, SSH, SFTP, SNMPv3).
Time ManagementExam is 90 minutes for max 90 questions. Performance-based questions eat time. Flag and return if stuck.
Read CarefullyQuestions often contain the answer in the wording. Look for keywords like "long distance" (single-mode fiber), "prevents loops" (STP), "prioritize traffic" (QoS).
DNS Record TypesKnow ALL record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), TXT (email security), NS (nameservers), PTR (reverse).
REF

Critical Acronym Reference

ACLAccess Control List
AESAdvanced Encryption Standard
AHAuthentication Header (IPSec)
APAccess Point
APIApplication Programming Interface
APIPAAutomatic Private IP Addressing
ARPAddress Resolution Protocol
BGPBorder Gateway Protocol
BNCBayonet Neill-Concelman
BPDUBridge Protocol Data Unit
BSSIDBasic Service Set Identifier
BYODBring Your Own Device
CAMContent-Addressable Memory
CDNContent Delivery Network
CDPCisco Discovery Protocol
CIAConfidentiality, Integrity, Availability
CIDRClassless Inter-Domain Routing
CLICommand-Line Interface
CNAMECanonical Name (DNS)
DACDirect Attach Copper
DCIData Center Interconnect
DDoSDistributed Denial-of-Service
DHCPDynamic Host Configuration Protocol
DLPData Loss Prevention
DNSDomain Name System
DNSSECDNS Security Extensions
DoHDNS over HTTPS
DoSDenial-of-Service
DoTDNS over TLS
EAPExtensible Authentication Protocol
EIGRPEnhanced Interior Gateway Routing Protocol
EOLEnd-of-Life
EOSEnd-of-Support
ESPEncapsulating Security Payload (IPSec)
ESSIDExtended Service Set Identifier
FCFibre Channel
FHRPFirst Hop Redundancy Protocol
FTPFile Transfer Protocol
GDPRGeneral Data Protection Regulation
GREGeneric Routing Encapsulation
GUIGraphical User Interface
HTTPHypertext Transfer Protocol
HTTPSHTTP Secure
IaaSInfrastructure as a Service
IaCInfrastructure as Code
IAMIdentity and Access Management
ICMPInternet Control Message Protocol
ICSIndustrial Control System
IDFIntermediate Distribution Frame
IDSIntrusion Detection System
IIoTIndustrial Internet of Things
IKEInternet Key Exchange
IoTInternet of Things
IPAMIP Address Management
IPSIntrusion Prevention System
IPSecInternet Protocol Security
IS-ISIntermediate System to IS
LACPLink Aggregation Control Protocol
LCLocal Connector (fiber)
LDAPLightweight Directory Access Protocol
LDAPSLDAP over SSL
LLDPLink Layer Discovery Protocol
MACMedia Access Control
MDFMain Distribution Frame
MFAMultifactor Authentication
MIBManagement Information Base
MPOMulti-Fiber Push On
MTBFMean Time Between Failures
MTTRMean Time To Repair
MTUMaximum Transmission Unit
MXMail Exchange (DNS)
NACNetwork Access Control
NASNetwork-Attached Storage
NATNetwork Address Translation
NFVNetwork Functions Virtualization
NICNetwork Interface Card
NSName Server (DNS)
NTPNetwork Time Protocol
NTSNetwork Time Security
OTOperational Technology
OSPFOpen Shortest Path First
OSIOpen Systems Interconnection
PaaSPlatform as a Service
PATPort Address Translation
PCI DSSPayment Card Industry Data Security Standards
PDUPower Distribution Unit
PKIPublic Key Infrastructure
PoEPower over Ethernet
PSKPre-Shared Key
PTPPrecision Time Protocol
PTRPointer (DNS reverse lookup)
QoSQuality of Service
QSFPQuad Small Form-Factor Pluggable
RADIUSRemote Authentication Dial-In User Service
RBACRole-Based Access Control
RDPRemote Desktop Protocol
RIPRouting Information Protocol
RPORecovery Point Objective
RSTPRapid Spanning Tree Protocol
RTORecovery Time Objective
SaaSSoftware as a Service
SAMLSecurity Assertion Markup Language
SANStorage Area Network
SASESecure Access Service Edge
SCSubscriber Connector (fiber)
SCADASupervisory Control and Data Acquisition
SDNSoftware-Defined Network
SD-WANSoftware-Defined WAN
SFPSmall Form-Factor Pluggable
SFTPSecure File Transfer Protocol
SIEMSecurity Info and Event Management
SIPSession Initiation Protocol
SLAService-Level Agreement
SLAACStateless Address Autoconfiguration
SMBServer Message Block
SMTPSimple Mail Transfer Protocol
SNMPSimple Network Management Protocol
SOAStart of Authority (DNS)
SSHSecure Shell
SSIDService Set Identifier
SSOSingle Sign-On
SSESecurity Service Edge
STStraight Tip (fiber connector)
STPSpanning Tree Protocol / Shielded Twisted Pair
SVISwitch Virtual Interface
TACACS+Terminal Access Controller Access Control System+
TCPTransmission Control Protocol
TFTPTrivial File Transfer Protocol
TLSTransport Layer Security
TOTPTime-Based One-Time Password
TTLTime to Live
UDPUser Datagram Protocol
UPSUninterruptible Power Supply
URLUniform Resource Locator
UTMUnified Threat Management
UTPUnshielded Twisted Pair
VIPVirtual IP
VLANVirtual Local Area Network
VLSMVariable Length Subnet Mask
VoIPVoice over IP
VPCVirtual Private Cloud
VPNVirtual Private Network
VXLANVirtual Extensible LAN
WAFWeb Application Firewall
WANWide Area Network
WPAWi-Fi Protected Access
WPSWi-Fi Protected Setup (avoid!)
ZTAZero Trust Architecture
REF

Port Number Quick Reference

20FTP data
21FTP control
22SSH & SFTP
23Telnet (insecure!)
25SMTP
53DNS
67DHCP server
68DHCP client
69TFTP
80HTTP
123NTP
161SNMP agent
162SNMP traps
389LDAP
443HTTPS
445SMB
514Syslog
587SMTPS
636LDAPS
853DoT
1433SQL Server
3389RDP
5060SIP
5061SIP/TLS