15 CompTIA Network+ Practice Questions with Explanations (2026)

Explanation

A /28 has 4 host bits (32 − 28 = 4), giving 2^4 = 16 total addresses. Subtract 2 for the network address (10.0.5.0) and broadcast address (10.0.5.15), leaving 14 usable hosts. Option A forgets to subtract the network and broadcast addresses; option C is the usable-host count for a /27.

Explanation

Link-local addresses (fe80::/10) are automatically assigned to every IPv6 interface and are never routed beyond the local segment — used for functions like neighbor discovery. Global unicast (A) is the internet-routable equivalent of a public IPv4 address. Unique local (B, fc00::/7) is the private-range equivalent but can still route within an organization’s internal network.

Explanation

Hybrid cloud specifically describes the combination of on-premises (or private cloud) infrastructure with public cloud resources, with workloads able to move between them. Multi-cloud (D) refers to using multiple public cloud providers, not a mix of on-prem and cloud. Community cloud (A) is shared infrastructure among organizations with common concerns, unrelated to this scenario.

Explanation

Untagged frames on an 802.1Q trunk are assigned to the native VLAN, which defaults to VLAN 1 unless explicitly reconfigured to a different VLAN. This is also a security consideration — leaving the native VLAN at the default is a common VLAN-hopping attack vector, which is why best practice is to change it.

Explanation

Cat6a supports 10 Gbps at the full 100-meter maximum distance. Cat6 (B) only supports 10 Gbps up to about 55 meters — at 90 meters it would drop to 1 Gbps. Cat5e (A) tops out at 1 Gbps regardless of distance.

Explanation

Wi-Fi 6E extends the 802.11ax (Wi-Fi 6) standard into the 6 GHz band specifically. Wi-Fi 6 itself (B) operates on 2.4 GHz and 5 GHz only — the 6 GHz extension is what earns the "E" designation. Wi-Fi 5 (A) is 5 GHz only and predates OFDMA and other Wi-Fi 6 efficiency features.

Explanation

This describes Recovery Point Objective (RPO) — the maximum acceptable amount of data loss, measured in time since the last good backup. Recovery Time Objective (A) measures how long the system can be down before it must be restored, a different axis entirely (time-to-restore vs. data-loss tolerance).

Explanation

Link Aggregation, commonly implemented via LACP (Link Aggregation Control Protocol), bundles multiple physical ports into one logical link, adding both bandwidth and failover redundancy. VRRP (A) provides gateway redundancy at Layer 3, not port bundling. Spanning Tree (C) prevents Layer 2 loops but does not combine links into one logical channel.

Explanation

NetFlow (and its open equivalent sFlow) exports detailed traffic-flow records — source/destination IP, ports, protocol, byte counts — purpose-built for bandwidth and traffic-pattern analysis. SNMP (A) polls device health metrics like CPU and interface status, not flow-level traffic detail. Syslog (C) collects event and error log messages, not traffic flow data.

Explanation

MAC flooding overwhelms a switch’s finite MAC address table with forged entries, forcing the switch into "fail-open" behavior where it floods frames to every port like a hub — letting the attacker see traffic not normally destined for their port. ARP spoofing (A) forges ARP replies to redirect traffic, a related but distinct Layer 2 attack.

Explanation

Zero Trust is defined by continuous verification and "never trust, always verify" — access is never granted based on network location alone, even for traffic already inside the corporate network. Perimeter security (C) is the older model Zero Trust replaces, which grants implicit trust to anything already inside the network boundary.

Explanation

EAP (Extensible Authentication Protocol), in variants like EAP-TLS or PEAP, is the authentication framework used within 802.1X port-based access control, typically validated against a RADIUS server. IPsec (B) secures data in transit for VPNs, a different layer of the security stack. WPA3 (D) is a wireless encryption standard, not the authentication framework itself.

Explanation

CompTIA’s 7-step methodology runs: identify the problem → establish a theory → test the theory → establish a plan of action → implement the solution → verify functionality → document. After confirming the theory, the next step is establishing a plan of action, not jumping straight to verification or documentation, which come later in the sequence.

Explanation

traceroute (tracert on Windows) reports the round-trip time at each hop along the path to a destination, making it the right tool for isolating where latency is introduced. ping (A) confirms basic end-to-end reachability and round-trip time but does not break the path down hop by hop.

Explanation

Checking the arp table reveals whether two different MAC addresses are mapping to the same IP address across the network, directly confirming a duplicate IP conflict. A cable tester (B) and tone generator/probe (D) are physical-layer tools for verifying cable continuity and tracing runs, not for diagnosing IP-layer conflicts.