ExamFinch.com My Study

Study guide

Subnetting and VLSM Design Lab

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

Subnetting and VLSM Design Lab

Key Takeaways Explain This Topic AI

Performance-based questions reward a repeatable method - size networks, allocate largest first, then verify - more than mental shortcuts.

Variable Length Subnet Masking (VLSM) allocates larger subnets before smaller ones so aligned address space is not wasted or trapped.

Each subnet design must identify network ID, usable host range, broadcast address, prefix length, and default gateway.

Plan for growth, point-to-point links, management networks, and reserved space before assigning any addresses.

Fast verification checks block size, overlap, gateway placement inside the subnet, and host capacity.

Last updated: June 2026

Why Subnetting PBQs Matter on N10-009

The CompTIA Network+ N10-009 exam contains a maximum of 90 questions in 90 minutes, a mix of multiple-choice and performance-based questions (PBQs) . PBQs usually appear in the first few minutes of the exam, are weighted more heavily than single multiple-choice items, and consume time quickly. The passing score is 720 on a 100-900 scale. A common mistake is to burn fifteen minutes on the first subnetting PBQ - flag it, move on, and return after answering the faster multiple-choice items.

Subnetting PBQs typically ask you to complete a table, drag subnets into the correct slot, or choose the best mask for several departments. The safest approach is always the same: size each network, allocate the largest network first, then verify that no ranges overlap.

Scenario

You are given the private block 10.40.8.0/22 . Design subnets for a branch office:

  • Network Required usable hosts Notes
  • Staff 220 User workstations and printers
  • Voice 110 IP phones
  • Wireless corporate 70 Managed laptops
  • Servers 26 Local services and appliances
  • Network management 12 Switch, AP, and firewall management
  • WAN link A 2 Point-to-point link
  • WAN link B 2 Point-to-point link

The /22 spans 10.40.8.0 through 10.40.11.255 - that is 1024 total addresses. A /22 borrows two host bits from a /24, so it covers four contiguous /24 blocks (8, 9, 10, 11).

Step 1: Choose Prefix Lengths

Usable hosts = 2^(host bits) - 2. The minus two accounts for the reserved network and broadcast addresses.

  • Required usable hosts Smallest prefix Usable hosts Block size
  • 220 /24 254 256
  • 110 /25 126 128
  • 70 /25 126 128
  • 26 /27 30 32
  • 12 /28 14 16
  • 2 /30 2 4
  • 2 /30 2 4

Note that 70 hosts will not fit in a /26 (62 usable), so it rounds up to a /25. This rounding catches many test takers.

Step 2: Allocate Largest to Smallest

  • Network Subnet Usable range Broadcast Gateway
  • Staff 10.40.8.0/24 .8.1 - .8.254 10.40.8.255 10.40.8.1
  • Voice 10.40.9.0/25 .9.1 - .9.126 10.40.9.127 10.40.9.1
  • Wireless 10.40.9.128/25 .9.129 - .9.254 10.40.9.255 10.40.9.129
  • Servers 10.40.10.0/27 .10.1 - .10.30 10.40.10.31 10.40.10.1
  • Management 10.40.10.32/28 .10.33 - .10.46 10.40.10.47 10.40.10.33
  • WAN A 10.40.10.48/30 .10.49 - .10.50 10.40.10.51 10.40.10.49
  • WAN B 10.40.10.52/30 .10.53 - .10.54 10.40.10.55 10.40.10.53

Unused space remains from 10.40.10.56 through 10.40.11.255 - roughly 456 addresses for growth, another VLAN, loopbacks, or future WAN circuits.

PBQ Method (Repeatable Six Steps)

Write host requirements from largest to smallest.

Convert each requirement to the smallest prefix that fits (round up).

Start at the first address in the assigned block.

Move forward by the block size of each subnet (block size = 256 minus the mask value in the interesting octet).

Place the default gateway at the first usable address consistently.

Verify each broadcast address is exactly one less than the next network ID - no gaps, no overlap.

Fast Mask Reference

Memorize this table cold; it eliminates arithmetic under pressure.

  • Prefix Mask Usable hosts Block size
  • /24 255.255.255.0 254 256
  • /25 255.255.255.128 126 128
  • /26 255.255.255.192 62 64
  • /27 255.255.255.224 30 32
  • /28 255.255.255.240 14 16
  • /29 255.255.255.248 6 8
  • /30 255.255.255.252 2 4

A fast trick: the interesting octet is wherever the mask is neither 255 nor 0. The block size is 256 minus that octet value. For /27 (mask .224) the block size is 256 - 224 = 32, so subnets start at .0, .32, .64, .96, and so on.

Worked Mental Check

Given 10.40.10.32/28, which subnet does host 10.40.10.40 belong to? Block size for /28 is 16, so subnets begin at .0, .16, .32, .48. Address .40 falls in the .32 block; usable range .33 - .46; broadcast .47. The gateway .33 is valid; .47 would be the broadcast and must never be a gateway.

Common PBQ Traps

Allocating small subnets first, leaving no aligned space for a larger network.

Using the broadcast or network address as a host or gateway.

Forgetting a /30 has only two usable addresses for a point-to-point link.

Overlapping two subnets in the same range because block size was miscalculated.

Choosing a prefix that meets today's count but ignores a stated growth requirement.

Mixing CIDR notation with the wrong dotted-decimal mask (for example pairing /26 with 255.255.255.128).