ExamFinch.com My Study

Study guide

How to Use Labs, Practice, and PBQ Workflow

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

How to Use Labs, Practice, and PBQ Workflow

Key Takeaways Explain This Topic AI

Labs convert abstract concepts into operational memory through a predict-observe-change-test-explain-restore loop.

PBQs reward careful reading, topology labeling, and eliminating impossible device placements before moving any item.

Review practice questions for reasoning quality, not just the score, and log why each miss happened.

Command-output practice should focus on what the output proves and, equally, what it does not yet prove.

An APIPA address in 169.254.0.0/16 proves a failed DHCP lease but not which cause failed it.

Last updated: June 2026

Labs Make Network+ Stick

Reading a definition tells you what a DHCP server does. A lab shows you the lease, the assigned default gateway, the DNS option, renewal behavior, and the failure mode when the scope is exhausted or the relay is blocked. N10-009 rewards that operational understanding, especially in its performance-based questions.

You do not need expensive hardware. Free or low-cost tools cover almost every objective: Cisco Packet Tracer and GNS3 for routing/switching/VLANs, a couple of virtual machines for DHCP/DNS services, your own OS command line for diagnostics, and Wireshark for packet-level confirmation. The goal is repeatable, reversible labs.

Match the lab tool to the objective so you are not fighting the simulator. Layer 2 and Layer 3 behavior (VLANs, trunking, static and dynamic routing, NAT) is best practiced in Packet Tracer or GNS3, where you can break a trunk and watch a VLAN go unreachable. Service behavior (DHCP scopes, DNS records, lease renewal) is best learned on two small VMs where you control the server side and the client side.

Diagnostic fluency (reading ip / ipconfig , tracert / traceroute , nslookup / dig , netstat / ss , and arp ) comes from your own OS, and packet-level proof comes from Wireshark capturing the actual DHCP DISCOVER/OFFER/REQUEST/ACK exchange or a DNS query and response.

The Lab Loop

  • Step Action Example
  • 1 Predict "If DNS is wrong, IP pings may work but names fail."
  • 2 Observe baseline Record IP, gateway, DNS, route, link status, working tests
  • 3 Change one thing Disable DHCP, change a VLAN, block a port, alter DNS
  • 4 Test Use ping, traceroute/tracert, nslookup/dig, ipconfig/ip, netstat/ss
  • 5 Explain Write what the output proves and what remains unproven
  • 6 Restore Return the lab to a known-good state

Changing exactly one variable per cycle is the discipline the exam expects, because troubleshooting questions punish candidates who change several things at once and cannot isolate the cause.

High-Value Lab Topics

  • Topic Build or simulate What to prove
  • DHCP Client, scope, gateway, DNS option Client addressing depends on correct lease options
  • DNS A record, CNAME, failed resolver Name failure is not always network failure
  • VLANs Access port, 802.1Q trunk, wrong VLAN Layer 2 segmentation controls broadcast domains
  • Routing Two subnets and a gateway Traffic leaves the local subnet only through a route
  • NAT/PAT Private client to public destination Source translation changes the return-path behavior
  • Wireless SSID, channel, WPA2/WPA3 auth Association, signal, and authentication are separate clues
  • VPN IPsec tunnel policy and route Encrypted paths still need routing and allowed traffic

PBQ-Style Workflow

Performance-based questions look busy and weigh more than single recall items, so slow the first 30 seconds down.

  • Move Why it helps
  • Read the task verb first "Configure", "match", "place", and "troubleshoot" require different behavior
  • Label known-good facts Prevents changing items that already satisfy the requirement
  • Identify boundaries Internet edge, DMZ, access layer, distribution/core, wireless, server VLAN
  • Eliminate impossible choices A modem is not a Layer 3 firewall; a switch access port is not a WAN circuit
  • Check constraints Secure protocol, least privilege, redundancy, cost, or minimal downtime
  • Review before submit PBQs often penalize one misplaced item in an otherwise correct topology

If a single PBQ is consuming five minutes with no progress, use the exam's flag feature, complete the rest of the test, and return with leftover time. PBQs that stall early in the exam are the most common reason candidates run out of clock.

Practice Question Review Template

Do not just mark a question right or wrong.

  • Field Example entry
  • Topic DNS troubleshooting
  • My answer Replace the switch
  • Correct reasoning IP connectivity works; name resolution fails
  • Miss type Jumped layers too quickly
  • Repair drill Five scenarios distinguishing DNS, gateway, DHCP, and link issues
  • Scenario: Command Output Reasoning

A workstation shows an address in the 169.254.0.0/16 (APIPA) range. That output proves only one thing: the client did not receive a usable DHCP lease and self-assigned an address. It does not prove the DHCP server is down. The real cause could be a wrong VLAN, a blocked DHCP relay/helper, an exhausted scope, a disconnected cable, a bad wireless association, or local firewall interference.

Good practice explains both sides: what the evidence proves and what still needs confirmation. Compare it to a /8 misread: a 255.0.0.0 mask is not what 169.254.x.x means; APIPA always uses a /16 mask. Likewise, a successful tracert that dies at the first internal hop points to the local gateway or its uplink, not to the remote server. Training yourself to state the boundary of each piece of evidence is the single habit that most improves troubleshooting scores.

Apply the same discipline to other common outputs. A ping to the loopback 127.0.0.1 that succeeds proves only that the local TCP/IP stack works; it says nothing about the cable, switch, or gateway. A ping to your own IP, then to the default gateway, then to a remote host, is the classic outward-expanding test: the first failure in that sequence localizes the boundary of the problem. An arp -a table that is missing the gateway's MAC address points to Layer 2 reachability, not DNS.

And a netstat / ss listing showing a service listening on the expected port (for example 443 for HTTPS) rules out the application being down, redirecting your suspicion toward a firewall rule or a routing path. Each command answers a narrow question; the skill is choosing the command whose answer most cleanly narrows the search.