ExamFinch.com My Study

Study guide

Network Attacks and Scenario Cues

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

Network Attacks and Scenario Cues

Key Takeaways Explain This Topic AI

DoS and DDoS attack availability by exhausting bandwidth, sessions, application pools, or amplifying responses.

Layer 2 attacks include VLAN hopping (double-tagging), MAC flooding, ARP poisoning, and rogue DHCP.

DNS poisoning and rogue DNS redirect users while their devices still appear normally connected.

Evil twin APs and deauth abuse target the wireless edge; social engineering targets people directly.

Classify by asking what changed and which layer the symptom lives on.

Last updated: June 2026

Network Attacks and Their Cues

N10-009 attack questions describe symptoms first: user complaints, switch-table behavior, odd DHCP leases, wrong DNS answers, duplicate SSIDs, or packet captures. The fastest way to name the attack is to ask what changed and which layer it lives on.

Availability Attacks

  • Attack What happens Telltale cue
  • DoS (denial of service) One source disrupts a service A single host floods a web server
  • DDoS (distributed DoS) Many sources disrupt a service Traffic arrives from a botnet across many networks
  • Resource exhaustion CPU, memory, or session table fills Firewall sessions max out; app stops responding

Amplification/reflection Small spoofed request triggers a large response at the victim Huge DNS, NTP, or memcached responses flood the target

DDoS mitigation includes upstream filtering, scrubbing centers , CDN/WAF services, rate limiting, anycast, capacity planning, and provider runbooks. A local firewall rule cannot help once the Internet circuit itself is saturated upstream .

Layer 2 and Local Network Attacks

  • Attack Mechanism Symptom
  • VLAN hopping Trunk misuse or 802.1Q double-tagging Host reaches a VLAN it should not
  • MAC flooding Switch CAM table filled with bogus MACs Switch floods frames like a hub (fail-open)
  • ARP poisoning Forged IP-to-MAC replies Traffic detours through the attacker
  • Rogue DHCP Unauthorized DHCP server hands out leases Clients get wrong gateway/DNS/mask
  • On-path (MITM) Attacker relays/intercepts between two parties Sessions are observed or modified in transit

Layer 2 defenses: disable unused ports, set user ports to access mode, restrict allowed VLANs on trunks, harden the native VLAN, enable port security , DHCP snooping , dynamic ARP inspection (DAI) , IP source guard , and 802.1X .

DNS and Wireless Attacks

  • Attack What changes Impact
  • DNS poisoning A resolver cache or answer is falsified Users reach attacker-controlled addresses
  • Rogue DNS Clients are pointed at an unauthorized resolver Resolution is monitored or redirected
  • Evil twin A fake AP impersonates a legitimate SSID Users associate with the attacker's radio
  • Deauthentication 802.11 deauth frames force clients off Users reconnect to the rogue AP or lose service

Encrypted HTTPS connections blunt some DNS-redirection damage because certificate validation warns when a hostname does not match. That does not make DNS attacks harmless: attackers still redirect to lookalike domains, harvest clear-text traffic, or simply deny access.

Social Engineering

Social engineering manipulates people into unsafe actions. In network scenarios an attacker might call the help desk for a reset, send a phishing link to a fake VPN portal, drop a malicious QR code in a lobby, or tailgate into a wiring closet.

  • Technique Network security angle
  • Phishing Harvest VPN, SSO, or email credentials
  • Vishing Voice call pressures help desk or user
  • Smishing SMS link to a fake login or MFA prompt
  • Tailgating Unauthorized entry to a server/wiring room
  • Impersonation Pretends to be vendor, employee, or support
  • Worked Example: Reading an On-Path Capture

A user reports that a banking session showed a certificate warning. A packet capture shows the gateway's IP (192.168.1.1) suddenly associated with a workstation's MAC address, and that workstation forwarding the user's traffic on to the real gateway. This is the classic ARP-poisoning on-path attack : the attacker gratuitously announced "192.168.1.1 is at my MAC," so the victim sends gateway-bound frames to the attacker, who relays them. The certificate warning is the tell that traffic is being intercepted by something the legitimate server's certificate does not cover.

The fix on the exam is dynamic ARP inspection tied to DHCP snooping bindings, which drops the forged ARP replies before they reach the victim.

Distinguishing Look-Alike Attacks

The exam loves to pit similar attacks against each other, so anchor each to the layer it operates on:

ARP poisoning vs. DNS poisoning : ARP corrupts the local Layer 2 IP-to-MAC table; DNS corrupts name resolution at Layer 7. If the victim reaches the right IP but the wrong MAC, it is ARP; if a correct hostname returns a wrong IP, it is DNS.

Rogue DHCP vs. rogue DNS : a rogue DHCP server changes the gateway, mask, and DNS that clients are handed at lease time; a rogue DNS server only changes where names resolve. Wrong gateway plus wrong DNS together points to rogue DHCP.

Evil twin vs. deauth : the evil twin is the fake AP itself; deauthentication frames are the technique that kicks clients off the real AP so they roam to the twin. They are often described together.

DoS vs. DDoS vs. amplification : one source is DoS; many sources is DDoS; small spoofed requests yielding huge responses is amplification, a force-multiplier for DDoS.

Common Traps

ARP poisoning affects IP-to-MAC mapping; DNS poisoning affects name-to-IP resolution.

MAC flooding targets the switch CAM table , not the IP routing table.

Rogue DHCP causes DNS and gateway symptoms even when the real DHCP server is healthy.

An evil twin can copy a familiar SSID; the name alone never proves legitimacy.

A certificate warning is a symptom of interception, not proof of which attack; correlate it with ARP, DNS, or wireless evidence.

Volumetric DDoS often needs ISP or cloud coordination once the link is saturated.