Prepare for the Network+ CompTIA Network+ Exam

Free Network+ Practice Questions (With Answers)

5 real questions from the Network+ bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Network Implementations [Static vs Dynamic]

   A small branch office has only one internet connection and one route to headquarters. Which routing approach is most appropriate for this scenario?

   • A.OSPF – link-state IGP
   • B.EIGRP – hybrid Cisco IGP
   • C.BGP – exterior routing
   • D.Static routing – manual routes
   Show answer and explanation

   Correct answer: D

   Correct. With only one path, static routing is simplest. There's no benefit to dynamic routing's path selection when only one path exists.

   Why the other options are wrong

   A. Incorrect. OSPF is a dynamic routing protocol that adds complexity unnecessary for a single-path network.

   B. Incorrect. EIGRP is a dynamic protocol that would waste resources when there's only one possible route.

   C. Incorrect. BGP is for inter-domain routing between autonomous systems—overkill for a simple branch office.

2. Question 2Network Operations [Remote Access]

   A security audit finds that VPN users authenticate with username and password only. What additional control significantly strengthens remote access security?

   • A.More frequent password changes
   • B.Longer passwords with increased minimum length requirements
   • C.Shared VPN credentials for teams
   • D.Multi-factor authentication (MFA)
   Show answer and explanation

   Correct answer: D

   Correct. MFA requires something you know (password) plus something you have (token, phone) or something you are (biometric). Even if credentials are stolen, attackers can't access the VPN without the second factor.

   Why the other options are wrong

   A. Incorrect. Frequent changes often lead to weaker passwords. Modern guidance recommends MFA over rotation.

   B. Incorrect. While stronger passwords help, they remain a single factor. Credential theft still compromises access.

   C. Incorrect. Shared credentials eliminate individual accountability and make credential compromise affect multiple users.

3. Question 3Network Troubleshooting [Common Issues - Network]

   A user's computer has IP address 169.254.x.x. What does this indicate?

   • A.DHCP failure with APIPA self-assignment
   • B.Successful DHCP assignment
   • C.Static IP was manually configured on the workstation
   • D.IPv6 transition address was auto-assigned instead
   Show answer and explanation

   Correct answer: A

   Correct. 169.254.x.x is an APIPA (Automatic Private IP Addressing) address, assigned when DHCP fails. The device can communicate with other APIPA devices but lacks proper network access.

   Why the other options are wrong

   B. Incorrect. DHCP servers don't assign 169.254.x.x addresses—these are self-assigned.

   C. Incorrect. While possible to statically assign 169.254.x.x, it's almost always APIPA auto-assignment.

   D. Incorrect. IPv6 transition addresses use different formats. 169.254.x.x is IPv4 APIPA.

4. Question 4Network Troubleshooting [Hardware Tools]

   A technician needs to trace a specific network cable through a bundle of cables in a ceiling. Which tool set is most appropriate?

   • A.Protocol analyzer
   • B.OTDR – tests fiber optic cable for faults
   • C.Cable certifier – tests copper specs
   • D.Tone generator and probe
   Show answer and explanation

   Correct answer: D

   Correct. A tone generator sends a signal on the cable, and the probe (amplifier) detects that tone, allowing the technician to trace the specific cable through bundles or walls.

   Why the other options are wrong

   A. Incorrect. Protocol analyzers capture network traffic—they don't help with physical cable tracing.

   B. Incorrect. OTDR tests fiber characteristics—this scenario involves tracing copper cables.

   C. Incorrect. Certifiers test performance but require access to both ends—they don't trace through bundles.

5. Question 5Network Security [Wireless Security]

   A retail chain with 500 stores deploys a wireless network for inventory scanners and point-of-sale terminals. The security team needs to ensure PCI DSS compliance. The CTO proposes using WPA2-PSK with a single shared passphrase rotated monthly across all stores. The security team rejects this. Which is the MOST compelling reason?

   • A.WPA2-PSK with AES encryption is deprecated and no longer considered secure for any business payment environment
   • B.Monthly rotation across 500 stores risks lockouts, and the single shared passphrase means one store's compromise exposes all stores
   • C.WPA2-PSK cannot efficiently support the large number of simultaneous devices across a 500-store retail deployment without dedicated controller hardware at each site
   • D.Monthly passphrase rotation across 500 stores violates PCI DSS requirements for minimum password change frequency
   Show answer and explanation

   Correct answer: B

   Correct. PSK's fundamental weakness at scale: one compromised passphrase at any store — through a disgruntled employee, a phishing attack, or a shoulder-surfed device — gives an attacker access to the wireless network at all 500 locations. PCI DSS requires per-device or per-user authentication for cardholder data environments. WPA2-Enterprise with 802.1X and per-device certificates eliminates this blast radius.

   Why the other options are wrong

   A. Incorrect. WPA2-PSK is not deprecated — it remains widely deployed and is acceptable for low-sensitivity environments. The problem is specific to this use case, not the protocol itself.

   C. Incorrect. WPA2-PSK has no meaningful limit on connected devices — this is not a scalability constraint.

   D. Incorrect. Monthly rotation is actually more frequent than PCI DSS minimum requirements. The PCI DSS concern is the shared passphrase model, not its rotation schedule.