The short answer
Network+ N10-009 has five domains: Networking Concepts (23%), Network Implementation (20%), Network Operations (19%), Network Security (14%) and Network Troubleshooting (24%). Concepts supply the vocabulary, implementation and operations apply it, security protects it, and troubleshooting tests all of it together.
The topic lists below follow CompTIA’s N10-009 exam objectives. CompTIA says its example lists are not exhaustive, so treat them as a core, not a ceiling.
1.0 Networking Concepts (23%)
What it covers. The OSI model; appliances (routers, switches, firewalls, IDS and IPS, load balancers, proxies, NAS and SAN, access points); cloud models and connectivity; ports and protocols; transmission media, cabling and connectors (DAC, plenum, SFP and QSFP, LC, SC, MPO) and transceivers; topologies, including three-tier and spine-and-leaf models and north-south versus east-west traffic; IPv4 addressing and subnetting (APIPA, RFC 1918, VLSM, CIDR, address classes); GRE and IPsec (AH, ESP, IKE); and modern environments such as SD-WAN, VXLAN, zero trust, SASE and SSE, Infrastructure as Code and IPv6 transition methods.
In practice. You pick the right port for a firewall rule, size a subnet for 60 hosts, or choose between single-mode and multimode fiber for a building link.
Typical traps.
- Mixing up similar ports: SFTP and SSH share 22, LDAP is 389 and LDAPS is 636, SMTP is 25 while SMTPS is 587 in the CompTIA list.
- Confusing SASE (security plus networking) with SSE (the security half).
- Forgetting that a /27 gives 30 usable hosts, not 32.
- Treating “public cloud” and “multitenancy” as the same thing.
What to practice. Subnetting on paper, the CompTIA port table, and a one-line purpose for every appliance. Do ten subnetting problems daily for two weeks.
2.0 Network Implementation (20%)
What it covers. Routing (static, dynamic with BGP, EIGRP and OSPF, administrative distance, NAT and PAT, first hop redundancy); switching (VLANs, trunking, 802.1Q, link aggregation, spanning tree, MTU and jumbo frames); wireless (channels, bands, SSID and BSSID, encryption, antennas, guest networks); and physical installation (IDF and MDF, rack size and port-side exhaust or intake, patch panels and fiber distribution panels, UPS and PDUs, temperature, humidity and fire suppression).
In practice. You decide why two hosts in different VLANs cannot talk without a Layer 3 device, or which Wi-Fi channels avoid overlap.
Typical traps.
- Route selection: CompTIA lists administrative distance, prefix length and metric under route selection. In practice a router first picks the most specific (longest) prefix, then prefers the lowest administrative distance between sources, then the lowest metric.
- The native VLAN versus a tagged VLAN on a trunk.
- Calling 2.4 GHz channels 1, 6 and 11 “non-overlapping” and then forgetting why.
- Mixing up omnidirectional and directional antennas for a long corridor.
What to practice. Draw a small two-switch, two-VLAN network and trace a packet. Sketch the WPA2 versus WPA3 differences.
3.0 Network Operations (19%)
What it covers. Documentation (diagrams, asset inventory, IPAM, SLAs, heat maps); life-cycle (EOL, EOS, patching and decommissioning) and change management; configuration baselines; monitoring (SNMP, flow data, packet capture, syslog, SIEM, port mirroring); disaster recovery (RPO, RTO, MTTR, MTBF, hot, warm and cold sites, active-active versus active-passive); DHCP, SLAAC, DNS record types and DNSSEC, DoH and DoT; time protocols (NTP, PTP, NTS); and VPN and management access methods (site-to-site and client-to-site, clientless, split and full tunnel, SSH, API, console, jump boxes, in-band versus out-of-band).
In practice. You pick a DHCP reservation for a printer, explain what a CNAME record does, or choose a recovery design from RPO and RTO targets.
Typical traps.
- RPO is about data loss; RTO is about downtime. Many mix them up under stress.
- A reservation is not an exclusion, and neither is a static address.
- SNMP uses UDP 161 for polling and UDP 162 for traps.
- In-band versus out-of-band management: out-of-band works even when the production network is down.
What to practice. A one-page table of DNS records, a one-page table of DR terms, and a hands-on DHCP scope in a lab.
4.0 Network Security (14%)
What it covers. Encryption, certificates and PKI, identity and access management (MFA, SSO, RADIUS, LDAP, SAML, TACACS+), geofencing, role-based access control, key management, data locality, physical security, honeypots, risk terms, the CIA triad, compliance (PCI DSS, GDPR), segmentation (IoT, OT, guest, BYOD), trusted versus untrusted zones; attacks (DoS and DDoS, VLAN hopping, MAC flooding, ARP and DNS poisoning, rogue devices, evil twin, on-path attacks, social engineering, malware); and defenses (hardening, NAC, port security, 802.1X, ACLs, MAC and URL filtering, content filtering, screened subnets).
In practice. You name the attack from a symptom, or choose the right control for it.
Typical traps.
- The 802.1X roles: supplicant, authenticator, authentication server.
- ARP poisoning attacks host caches; MAC flooding attacks the switch table.
- A rogue AP is any unauthorized AP; an evil twin copies a legitimate SSID.
- Authentication, authorization and accounting are different things.
What to practice. Match each attack to one symptom and one control. Write them on a single sheet.
5.0 Network Troubleshooting (24%)
What it covers. The troubleshooting method (identify the problem, form a theory, test it, plan, implement, verify, document); cable and interface problems (cable categories 5 to 8, STP versus UTP, improper termination, transposed TX/RX, crosstalk, attenuation, CRC errors, runts, giants, drops, administratively down and suspended interfaces, error-disabled ports, PoE budgets, transceiver mismatches); service problems (STP loops, wrong VLAN, ACLs, routing, DHCP exhaustion, wrong gateway or mask, duplicate IPs); performance problems (congestion, latency, jitter, packet loss, wireless interference and roaming); and tools (protocol analyzer, ping, traceroute, nslookup, dig, netstat, arp, tcpdump, nmap, LLDP and CDP, toner, cable tester, taps, visual fault locator, speed tester, Wi-Fi analyzer, show commands).
In practice. A user reports “the internet is down” and you work out which layer is at fault.
Typical traps.
- Jumping to a fix before testing the theory.
- Picking a tool that checks the wrong layer.
- Reading a 169.254.x.x address as a DHCP server fault when the pool may be empty or the path blocked.
- Mixing up congestion (too much traffic) and a bottleneck (the slowest hop).
What to practice. Work from the symptom to the layer. Run each command on a real machine and read the output until it is routine.
How to use this page
Compare your weakest domain with its weighting. A weak 14% domain costs less than a weak 24% domain, but it still costs. Use the study plan to schedule the work.
FAQ
Which domain is the largest?
Network Troubleshooting at 24%, followed by Networking Concepts at 23%.
Are the percentages exact question counts?
No. They show how much of the exam each domain represents. The exact number of questions per domain varies from one exam form to another.
Are performance-based questions tied to one domain?
CompTIA does not say. Prepare to apply any domain’s skills hands-on.
More guides for N10-009
- Network+ N10-009 Exam Format and Scoring
- Is Network+ N10-009 Hard? An Honest Look
- Network+ N10-009 Prerequisites
- N10-009 Renewal and Retakes Explained
- Is N10-009 Worth It? An Honest Look
- N10-009 Cheat Sheet: Key Facts to Review
- N10-009 vs SY0-801: Which First?
- CCNA vs Network+: Which Exam First?
Next step
Read the sample questions to see how these domains show up in questions. Then, if you want a full set for each domain, the N10-009 practice tests cover all five in the same proportions.