The short answer
Here are five original N10-009 practice questions, one from each domain, including one where you choose two answers. Each answer is hidden until you open it, and each explanation says why the right option works and why the closest wrong one does not.
These are written by us for practice. They are not copies of exam content, and they only suggest the style of the real thing.
How to use these
Try each question without looking at the answer. Write down your choice, and how sure you are. Then open the explanation. If you were right for the wrong reason, treat it as a miss. If you were wrong, go back to the matching topic in the domains explained page.
Question 1 (Networking Concepts)
A monitoring server at a head office polls the routers at a warehouse using SNMP. It must also receive the traps those routers send when a link fails. A firewall at the warehouse edge sits between them. Which two ports must the firewall allow? Choose two.
- A. UDP 123
- B. UDP 162
- C. UDP 69
- D. UDP 161
- E. TCP 636
Show the answer and explanation
Correct answers: B and D. SNMP uses two well-known UDP ports. Agents on managed devices listen on UDP 161 for polling requests from the manager. The manager listens on UDP 162 for traps that agents send on their own. Allowing both lets the server poll and also receive alerts. The closest wrong option is UDP 123, because it is easy to remember as “a monitoring port”, but it belongs to NTP, which keeps clocks in sync. UDP 69 is TFTP, and TCP 636 is LDAPS.
Question 2 (Network Implementation)
A technician scans for Wi-Fi in a clinic and sees the network name Clinic-Staff listed four times. Each entry has a different 48-bit hexadecimal identifier and a different signal strength. What do these four identifiers represent?
- A. The SSIDs of four separate wireless networks
- B. Channel numbers assigned to the access points
- C. The BSSIDs, each being the MAC address of one access point radio
- D. Four copies of the ESSID, one per client device
Show the answer and explanation
Correct answer: C. The basic service set identifier (BSSID) is the MAC address of the access point radio a client connects to. When several access points broadcast the same network name, a scanner lists one entry per radio, each with its own BSSID and signal level. The closest wrong option is A, because the SSID is the shared name, Clinic-Staff, and it is the same on every entry. Channel numbers are small integers, not 48-bit hexadecimal values, and the ESSID is not tied to individual clients.
Question 3 (Network Operations)
A badge scanner at a loading dock must always receive the address 172.16.8.40. Administrators also want the scanner to get its gateway and DNS settings from the DHCP server, so that all changes stay in one place. What should they configure?
- A. A static address typed into the scanner’s own settings
- B. A DHCP exclusion that removes 172.16.8.40 from the scope
- C. A DHCP reservation that ties 172.16.8.40 to the scanner’s MAC address
- D. A shorter lease time for the whole scope
Show the answer and explanation
Correct answer: C. A reservation binds one address to one client, usually by MAC address. The scanner always gets 172.16.8.40, and it still receives its gateway, DNS and other options from the server. The closest wrong option is B: an exclusion keeps the address out of the pool entirely, so the DHCP server never hands it out, and the scanner would have to be set up by hand. A static address (A) bypasses DHCP and breaks the “one place for changes” goal. A shorter lease time (D) only changes how often clients renew.
Question 4 (Network Security)
Logs on a branch-office switch show one access port learning more than 8,000 different source MAC addresses in under a minute. Soon after, the user on that port is able to capture unicast traffic meant for colleagues. Which attack is most likely happening?
- A. ARP poisoning
- B. VLAN hopping
- C. MAC flooding
- D. Rogue DHCP server
Show the answer and explanation
Correct answer: C. In MAC flooding, the attacker sends frames with huge numbers of fake source addresses until the switch’s address table is full. The switch then forwards unknown unicast frames out of many ports, so the attacker can see other users’ traffic. The closest wrong option is ARP poisoning (A). It also redirects traffic, but it targets host ARP caches with false IP-to-MAC answers and does not fill the switch table. VLAN hopping abuses trunking, and a rogue DHCP server hands out bad addressing. Port security with a MAC limit is a common defense.
Question 5 (Network Troubleshooting)
In a hotel conference room, a DHCP scope offers 100 addresses. Attendees who arrived early are online. Around 130 people are now in the room, and the latest arrivals show 169.254.x.x addresses. The DHCP server is running and keeps renewing existing leases. What is the most likely cause?
- A. The DHCP address pool is exhausted
- B. A rogue DHCP server is answering clients
- C. The default gateway is misconfigured
- D. The DNS server is unreachable
Show the answer and explanation
Correct answer: A. A client that gets no DHCP offer gives itself a link-local address in the 169.254.0.0/16 range. Early arrivals work and the server still renews leases, so it is up, but it has no free addresses to offer new clients. With 130 devices and 100 addresses, the numbers fit. The closest wrong option is B: a rogue server would hand out ordinary-looking but wrong settings, not leave clients with link-local addresses. A wrong gateway or unreachable DNS would not stop address assignment at all.
Reading your results
Five questions are far too few to judge readiness. Use them to spot your style: do you rush stems, miss “choose two”, or mix up neighbors such as RPO and RTO? Fixing those habits is worth points on its own. The exam question types guide explains how to read each style.
FAQ
Are these the same as the questions on the exam?
No. They are original practice questions that test the same kind of knowledge. Nobody outside CompTIA can know the exam’s exact questions, and you should be wary of anyone who claims to.
Will performance-based questions look like these?
No. Performance-based questions are hands-on tasks, such as matching or configuring, so a multiple-choice page cannot show them.
Why do you explain the wrong options?
Because exam questions often use a plausible neighbor concept as a distractor. Knowing why the neighbor is wrong is what makes the right answer stick.
More guides for N10-009
- Network+ N10-009 Exam Format and Scoring
- Network+ N10-009 Study Plan: 4 and 8 Weeks
- Is Network+ N10-009 Hard? An Honest Look
- Network+ N10-009 Prerequisites
- N10-009 Renewal and Retakes Explained
- Is N10-009 Worth It? An Honest Look
- N10-009 Cheat Sheet: Key Facts to Review
- N10-009 vs SY0-801: Which First?
- CCNA vs Network+: Which Exam First?
Next step
Use your weak spots to pick a domain in the domains explained page. For many more questions in this style, with full explanations, see the N10-009 practice tests.