CompTIA Network+ Cheat Sheet 2026 — Ports, Subnetting, Protocols

Exam facts at a glance

• Up to 90 questions, multiple choice, multiple response, and PBQs.
• 90 minutes.
• $358 USD per attempt.
• Passing score: 720/900 (scaled, roughly 80%).
• Valid 3 years.
• Retake wait: 14 calendar days, every failed attempt.
• Pearson VUE test center or Pearson OnVUE online. Closed book.
• Full exam-format details: Network+ Exam Guide 2026.

OSI model layers

Mnemonic: “All People Seem To Need Data Processing” (7 to 1, Application to Physical).

Port numbers to memorize cold

Subnetting quick-reference

Formula: usable hosts = 2^(32−CIDR) − 2. The −2 always accounts for the network address and the broadcast address. Full walkthrough with worked examples: Subnetting Explained.

IPv6 address types

• Global unicast — publicly routable, equivalent to a public IPv4 address.
• Link-local — fe80::/10, auto-assigned, never routed off the local segment.
• Unique local — fc00::/7, private-range equivalent, not internet-routable.
• Multicast — ff00::/8, one-to-many delivery, replaces IPv4 broadcast (IPv6 has no broadcast).
• Anycast — one address shared by multiple hosts; the network routes to the nearest one.

Cable and connector standards

PoE tiers: PoE (15.4W) → PoE+ (30W) → PoE++ Type 3 (60W) → PoE++ Type 4 (100W).

Wireless standards

2.4 GHz non-overlapping channels: 1, 6, 11 — the exam expects you to know these by heart for interference/troubleshooting questions.

Routing protocols at a glance

• OSPF — link-state, open standard, fast convergence, uses cost as metric.
• EIGRP — Cisco-originated, advanced distance-vector, uses composite metric (bandwidth + delay).
• BGP — path-vector, the protocol that runs the internet, used for site-to-site and ISP connections.
• RIP — distance-vector, hop-count metric (max 15 hops), legacy but still referenced.
• Static routing — manually configured, no overhead, does not adapt to topology changes.

Security acronyms and attack types

• On-path attack (formerly MITM) — attacker intercepts traffic between two parties.
• ARP spoofing — forging ARP replies to redirect traffic on the local segment.
• MAC flooding — overwhelming a switch's MAC table to force it into hub-like broadcast behavior.
• VLAN hopping — exploiting trunk misconfiguration to access another VLAN.
• DNS poisoning — corrupting DNS cache to redirect users to malicious destinations.
• 802.1X — port-based network access control, typically paired with RADIUS and EAP.
• Zero Trust — continuous verification, least privilege, micro-segmentation; “never trust, always verify.”
• SASE — SD-WAN plus security services (SWG, CASB, ZTNA) converged into one cloud-delivered service.

High availability and disaster recovery

• RTO (Recovery Time Objective) — how long to get back online. About time.
• RPO (Recovery Point Objective) — how much data loss is acceptable. About data.
• Hot site — fully operational duplicate, near-instant failover.
• Warm site — partially equipped, hours to days to activate.
• Cold site — basic facility only, days to weeks to activate.
• 3-2-1 backup rule — 3 copies of data, on 2 different media types, with 1 copy off-site.

CLI troubleshooting tools

The 7-step troubleshooting methodology

1. Identify the problem
2. Establish a theory of probable cause
3. Test the theory
4. Establish a plan of action
5. Implement the solution or escalate
6. Verify full system functionality and implement preventive measures
7. Document findings, actions, and lessons learned

This exact order is a common PBQ drag-and-drop item — memorize it precisely, including that documentation is always last.

Top trap-question patterns

1. Usable hosts vs total addresses — always subtract 2 (network + broadcast) unless the question explicitly asks for total addresses.
2. Cat6 vs Cat6a distance — Cat6 only hits 10 Gbps at 55 m; the full 100 m run drops it to 1 Gbps. Cat6a holds 10 Gbps at 100 m.
3. RTO vs RPO — time question is RTO, data question is RPO.
4. “MITM” as a distractor — CompTIA uses “on-path attack” now; MITM as an option is usually wrong or outdated phrasing.
5. EIGRP vs OSPF metric confusion — OSPF uses cost, EIGRP uses a composite bandwidth/delay metric.

Exam-day pocket guide

• Up to 90 questions, 90 minutes. PBQs eat disproportionate time (5-8 min each) — budget accordingly.
• Flag anything past 2 minutes and return at the end.
• “Usable hosts” almost always means subtract 2. Re-read the question stem for “usable” vs “total.”
• If a question uses “of the cloud / in the cloud”-style precise vendor terminology, take it at face value — it is testing the term directly, not a trick.
• On drag-and-drop troubleshooting-step PBQs, documentation is always the last step.
• Passing score is scaled (720/900) — do not try to count correct answers during the exam.

Frequently asked questions