Ditch the Fluff: CompTIA Network+ (N10-009) Practice That Actually Works

A rogue DHCP server occurs when an unauthorized or misconfigured DHCP server assigns incorrect IP addresses, default gateways, or DNS settings to clients.

•In this scenario:

•The user can ping the gateway, meaning local network communication is working.

•However, they cannot access network resources, which suggests incorrect IP configuration (likely due to a rogue DHCP server assigning the wrong gateway or DNS).

•Why not the other options?

•VLAN hopping (A): This is an attack that exploits VLAN configurations to gain access to unauthorized VLANs. It would not typically cause multiple users to lose network access.

•Distributed DoS (C): A DDoS attack floods a network or service with traffic, but this issue is more likely misconfigured IP settings than an actual attack.

•Evil twin (D): This refers to a fraudulent Wi-Fi network mimicking a legitimate one. Since the users are on a wired network (ipconfig output checked), this is not applicable.

NetFlow (and similar flow technologies like IPFIX/sFlow in concept) is used to collect traffic-flow metadata such as source/destination IPs, ports, protocols, interfaces, and byte/packet counts over time. In Network+ (N10-009) operations and monitoring objectives, flow data is ideal for identifying top talkers and top destinations across the network on a given day because it provides summarized, queryable information at scale without capturing every packet payload. An administrator can review reports to determine which destination IPs/hosts consumed the most bandwidth, which applications were most active, and what time ranges saw spikes—perfect for historical analysis.

SNMP is great for polling device counters (interface utilization, errors, CPU) but it does not natively tell you the “top destination” by conversation/flow without additional flow awareness. Packet capture can reveal exact conversations and payloads, but it is heavy, localized, and not efficient for infrastructure-wide daily top-destination reporting. traceroute maps the path to a destination and helps isolate routing/path issues; it does not provide usage statistics. Therefore, NetFlow is the best fit.

===========

If the three new employees can communicate with each other’s devices, that strongly suggests their local Layer 2/Layer 3 connectivity is working (same VLAN/subnet, switching is fine, and they have IP addressing that allows local communication). The fact that they cannot access company resources (often on other subnets, servers, or the internet via internal routing) points to a problem with how these new endpoints are being addressed or routed beyond their local segment.

The most likely shared root cause affecting only “new employees” is DHCP scope/pool configuration. If the DHCP pool is exhausted, mis-scoped, or handing out incorrect options (such as an incorrect default gateway, wrong subnet mask, or an address range tied to an isolated VLAN), users could still talk locally but fail to reach resources outside their subnet. Modifying the DHCP server pool (expanding the scope, correcting the scope network, or ensuring the correct options are assigned) would resolve this with minimal changes.

A gateway routing table issue would typically affect many users, not just three new ones. DNS misconfiguration on the router would more commonly cause name-resolution problems, not block all resource access (and wouldn’t be isolated to only new employees). A workstation firewall would not usually prevent access to “company resources” in a way that consistently affects three new devices while still allowing peer connectivity.

A load balancer is designed to distribute user requests across multiple servers to ensure high availability and performance.

Breakdown of Options:

A. Router – Directs traffic between networks, not between web servers.

B. Switch – Works at Layer 2, does not distribute web traffic.

C. Firewall – Secures network traffic, but does not distribute load.

D. Load balancer – ✅ Correct answer. Optimizes web traffic distribution across multiple servers.

An Extended Service Set Identifier (ESSID) allows multiple access points to share the same SSID, enabling seamless roaming for users. This means that users can move between different access points within the same ESSID without losing connection or having to reauthenticate. This provides a better user experience, especially in large environments such as office buildings or campuses.References: CompTIA Network+ study materials. ​

The correct answer is B. EOL documentation . If a network engineer wants to confirm whether a device is still receiving updates, patches, or vendor support, the first thing to review is the vendor’s End-of-Life (EOL) and often related End-of-Support (EOS) documentation. These documents show whether the device is still actively supported, whether firmware and security updates are still being issued, and when that support is scheduled to stop.

This is important in network operations because devices that are no longer supported can become security risks and operational liabilities. Once a vendor declares a product end-of-life or end-of-support, future bug fixes, feature releases, and security updates may no longer be available. That directly affects patch management, lifecycle planning, and risk assessment.

The other choices do not answer the question as directly. A baseline configuration shows the intended device settings, not the support status. Asset inventory licensing helps track ownership, software entitlements, or subscriptions, but it does not prove that updates are still being released. Software development life cycle refers to the process of building software, not the support state of a deployed network device.

For Network+ exam purposes, when the question asks whether updates are still being released, the best source is the vendor’s EOL documentation .

IPv4 addresses are divided into classes:

Class A: Supports 16,777,214 hosts (large enterprises).

Class B: Supports 65,534 hosts (medium to large networks).

Class C: Supports 254 hosts (small to medium networks).

Class D: Used for multicast, not for assigning IPs to hosts.

Step-by-step Calculation:

The network will have 150 users initially, with a projected growth of 10 users, totaling 160 users.

Each user has two devices, so 160 × 2 = 320 IP addresses needed.

A Class C subnet has 254 usable IPs by default, which is not sufficient.

A Class B subnet can support thousands of hosts, making it the most appropriate option.

Incorrect Options:

A. Class D: Reserved for multicast, not for host assignments.

C. Class A: Overkill for a network of this size.

D. Class C: Cannot support 320 hosts without subnetting, making Class B the best choice.

A warm site typically has a full infrastructure ready, but it lacks the most up-to-date data or is not immediately operational. It requires some configuration or data restoration to become fully functional.

=================

A screenshot of a computer AI-generated content may be incorrect.

A screenshot of a computer AI-generated content may be incorrect.

A screenshot of a computer AI-generated content may be incorrect.

This scenario describes a successful forward DNS lookup (hostname → IP address) but a failed reverse DNS lookup (IP address → hostname). Reverse lookups rely on a PTR (Pointer) record, which is stored in a reverse lookup zone (in-addr.arpa for IPv4, ip6.arpa for IPv6). If the engineer can resolve the hostname to an IP, that indicates an A record (or possibly AAAA for IPv6) exists and is functioning. But when querying the IP directly and receiving no hostname, the most likely issue is that the reverse mapping is not configured—meaning the PTR record is missing.

An MX record is used for mail exchange routing, not hostname resolution. A CNAME provides an alias from one hostname to another and does not create reverse mappings. An AAAA record maps a hostname to an IPv6 address; it is not used for reverse lookups of an IP to a name. Network+ objectives emphasize understanding common DNS record types and the difference between forward and reverse resolution, making PTR the correct missing record here.

The correct solution is NTP (Network Time Protocol). Accurate timestamps across servers, firewalls, and network devices are critical for correlating logs during incident response. NTP synchronizes device clocks to a trusted time source, ensuring consistency across the network.

A. Syslog centralizes logs but does not synchronize time.

B. SMTP is email transfer, unrelated to time.

D. SNMP monitors devices but does not correct time discrepancies.

By implementing NTP, analysts can ensure that logs from different devices are time-aligned, which is essential for reconstructing attack timelines and detecting anomalies.

References (CompTIA Network+ N10-009):

Domain: Network Operations — Time synchronization, NTP, log correlation.

This scenario describes a duplicate IP address. The ARP table shows two different MAC addresses (0c00.1134.0001 and 0c00.1298.d239) associated with the same IP address (192.168.1.10), which leads to ARP table conflicts and intermittent connectivity.

From Andrew Ramdayal’s guide:

“Duplicate IP addresses occur when two devices on the same network are assigned the same IP address, causing network conflicts. Common issues include manual configuration errors or DHCP lease issues. Resolution includes using IP management tools and avoiding overlaps in DHCP and static IP assignments.”

Border Gateway Protocol (BGP) is the primary protocol used to route traffic on the public internet. It allows ISPs and large networks to exchange routing information, making it an Exterior Gateway Protocol (EGP).

Breakdown of Options:

A. BGP – Correct answer. Used for internet routing and exchanges routing information between ISPs.

B. OSPF – An Interior Gateway Protocol (IGP) used for routing within an autonomous system (not the public internet).

C. EIGRP – Cisco’s proprietary IGP, used within private networks, not the public internet.

D. RIP – An older distance-vector protocol, not scalable for the internet.

Understanding Switches:

Layer 2 (Data Link Layer): Traditional switches operate primarily at Layer 2, where they use MAC addresses to forward frames within a local network.

Layer 3 (Network Layer): Layer 3 switches, also known as multilayer switches, can perform routing functions using IP addresses to forward packets between different networks.

Capabilities of Multilayer Switches:

VLANs and Inter-VLAN Routing: Multilayer switches can handle VLAN (Virtual Local Area Network) configurations and perform inter-VLAN routing, enabling communication between different VLANs.

Routing Protocols: They can run routing protocols like OSPF (Open Shortest Path First) and EIGRP (Enhanced Interior Gateway Routing Protocol) to manage traffic between networks.

Comparison with Other Devices:

Hub: Operates only at Layer 1 (Physical Layer) and simply repeats incoming signals to all ports.

Transceiver: Also operates at Layer 1, converting electrical signals to optical signals and vice versa.

Modem: Primarily operates at Layer 1 and Layer 2, modulating and demodulating signals for transmission over different types of media.

Practical Application:

Multilayer switches are commonly used in enterprise networks to optimize performance and manage complex routing and switching requirements within a single device.