CompTIA Network+ Cheat Sheet 2026 — Ports, Subnetting, Protocols

Exam facts at a glance

• Up to 90 questions, multiple choice, multiple response, and PBQs.
• 90 minutes.
• $369 USD per attempt.
• Passing score: 720/900 (scaled, roughly 80%).
• Valid 3 years.
• Retake wait: 14 calendar days, every failed attempt.
• Pearson VUE test center or Pearson OnVUE online. Closed book.
• Full exam-format details: Network+ Exam Guide 2026.

OSI model layers

Mnemonic: “All People Seem To Need Data Processing” (7 to 1, Application to Physical).

Port numbers to memorize cold

Subnetting quick-reference

Formula: usable hosts = 2^(32−CIDR) − 2. The −2 always accounts for the network address and the broadcast address. Full walkthrough with worked examples: Subnetting Explained.

IPv6 address types

• Global unicast — publicly routable, equivalent to a public IPv4 address.
• Link-local — fe80::/10, auto-assigned, never routed off the local segment.
• Unique local — fc00::/7, private-range equivalent, not internet-routable.
• Multicast — ff00::/8, one-to-many delivery, replaces IPv4 broadcast (IPv6 has no broadcast).
• Anycast — one address shared by multiple hosts; the network routes to the nearest one.

Cable and connector standards

PoE tiers: PoE (15.4W) → PoE+ (30W) → PoE++ Type 3 (60W) → PoE++ Type 4 (100W).

Wireless standards

2.4 GHz non-overlapping channels: 1, 6, 11 — the exam expects you to know these by heart for interference/troubleshooting questions.

Routing protocols at a glance

• OSPF — link-state, open standard, fast convergence, uses cost as metric.
• EIGRP — Cisco-originated, advanced distance-vector, uses composite metric (bandwidth + delay).
• BGP — path-vector, the protocol that runs the internet, used for site-to-site and ISP connections.
• RIP — distance-vector, hop-count metric (max 15 hops), legacy but still referenced.
• Static routing — manually configured, no overhead, does not adapt to topology changes.

Security acronyms and attack types

• On-path attack (formerly MITM) — attacker intercepts traffic between two parties.
• ARP spoofing — forging ARP replies to redirect traffic on the local segment.
• MAC flooding — overwhelming a switch's MAC table to force it into hub-like broadcast behavior.
• VLAN hopping — exploiting trunk misconfiguration to access another VLAN.
• DNS poisoning — corrupting DNS cache to redirect users to malicious destinations.
• 802.1X — port-based network access control, typically paired with RADIUS and EAP.
• Zero Trust — continuous verification, least privilege, micro-segmentation; “never trust, always verify.”
• SASE — SD-WAN plus security services (SWG, CASB, ZTNA) converged into one cloud-delivered service.

High availability and disaster recovery

• RTO (Recovery Time Objective) — how long to get back online. About time.
• RPO (Recovery Point Objective) — how much data loss is acceptable. About data.
• Hot site — fully operational duplicate, near-instant failover.
• Warm site — partially equipped, hours to days to activate.
• Cold site — basic facility only, days to weeks to activate.
• 3-2-1 backup rule — 3 copies of data, on 2 different media types, with 1 copy off-site.

CLI troubleshooting tools

PBQ quick-reference: what to expect

Performance-based questions are the part of N10-009 a static cheat sheet can only partially prepare you for — they test interaction, not recall — but knowing the shape of each PBQ type in advance removes the “what is this interface even asking me to do” shock that costs candidates the most time. Most candidates see 3 to 6 PBQs, and each typically runs 5 to 8 minutes versus roughly a minute for a multiple-choice item.

Time-budget rule: if a PBQ is not resolving after 2 to 3 minutes, flag it and move on to the multiple-choice questions, then return at the end if time allows. A single stuck PBQ eating 10+ minutes is one of the most common, avoidable causes of running out of time on easier questions later in the exam.

The 7-step troubleshooting methodology

This exact order is a common PBQ drag-and-drop item — memorize it precisely, including that documentation is always last.

Top trap-question patterns

1. Usable hosts vs total addresses — always subtract 2 (network + broadcast) unless the question explicitly asks for total addresses.
2. Cat6 vs Cat6a distance — Cat6 only hits 10 Gbps at 55 m; the full 100 m run drops it to 1 Gbps. Cat6a holds 10 Gbps at 100 m.
3. RTO vs RPO — time question is RTO, data question is RPO.
4. “MITM” as a distractor — CompTIA uses “on-path attack” now; MITM as an option is usually wrong or outdated phrasing.
5. EIGRP vs OSPF metric confusion — OSPF uses cost, EIGRP uses a composite bandwidth/delay metric.

Exam-day pocket guide

• Up to 90 questions, 90 minutes. PBQs eat disproportionate time (5-8 min each) — budget accordingly.
• Flag anything past 2 minutes and return at the end.
• “Usable hosts” almost always means subtract 2. Re-read the question stem for “usable” vs “total.”
• If a question uses “of the cloud / in the cloud”-style precise vendor terminology, take it at face value — it is testing the term directly, not a trick.
• On drag-and-drop troubleshooting-step PBQs, documentation is always the last step.
• Passing score is scaled (720/900) — do not try to count correct answers during the exam.

Frequently asked questions