10 Free CompTIA Network+ (N10-009) PBQ-Style Practice Questions

Performance-based questions are where Network+ candidates lose the most points — not because the topics are hard, but because PBQs ask you to read something: a routing table, a DHCP exchange, a Wi-Fi scan, a firewall ruleset. Below are 10 original PBQ-style questions in the formats the real exam uses, each with a full explanation. Cover the question, commit to an answer, then check yourself.

How to use these: PBQs on the real exam are interactive (drag-and-drop, matching, simulations). In print form, the skill being tested is identical: interpret the exhibit, apply the concept, choose precisely. If you can explain why the right answer is right, you're ready.

The Questions

1. A technician views the routing table on a branch router:

Destination        Gateway            Interface
10.10.0.0/16      192.168.1.1        eth0
10.10.5.0/24      192.168.1.2        eth0
0.0.0.0/0         192.168.1.254      eth0

A packet arrives destined for 10.10.5.77. Which gateway forwards it?

A. 192.168.1.1
B. 192.168.1.2
C. 192.168.1.254
D. The packet is dropped; no route matches.

Correct answer: B. Explanation: Two routes match 10.10.5.77 — the /16 and the /24. Routers always use the longest prefix match (most specific route), so 10.10.5.0/24 wins and the packet goes to 192.168.1.2. The default route is only a last resort when nothing more specific matches. On the exam, when multiple routes cover a destination, the longest mask always wins.

2. Place these DHCP steps in the correct order:

A. Discover → Offer → Request → Acknowledge
B. Discover → Request → Offer → Acknowledge
C. Request → Discover → Offer → Acknowledge
D. Offer → Discover → Request → Acknowledge

Correct answer: A. Explanation: The DORA sequence is Discover (client broadcasts "any DHCP server out there?"), Offer (server proposes an address), Request (client formally asks for that address), Acknowledge (server confirms). A handy check: the client must discover before anyone can offer — that eliminates B, C, and D immediately.

3. A Wi-Fi site survey shows three access points on 2.4 GHz using channels 1, 6, and 11 — but users near the channel 6 AP report slow speeds and retransmissions. A neighboring office just installed an AP on channel 8. What is the most likely cause?

A. Channel 8 overlaps with channel 6, causing co-channel interference.
B. Channel 8 overlaps with channel 6, causing adjacent-channel interference.
C. The channel 6 AP is too close to the channel 1 AP.
D. 2.4 GHz only supports channels 1, 6, and 11; channel 8 is invalid.

Correct answer: B. Explanation: In 2.4 GHz, each channel is 20 MHz wide but spaced only 5 MHz apart, so only channels 1, 6, and 11 are non-overlapping. Channel 8 partially overlaps channel 6's frequency range — this is adjacent-channel interference, which is worse than co-channel interference because the radios can't coordinate (they can't "hear" each other to take turns). That's why the 1/6/11 plan exists. Channel 8 is a legal channel; it's just a bad neighbor.

4. A /26 subnet is carved from 192.168.10.0. How many usable host addresses does each subnet provide?

A. 62
B. 64
C. 30
D. 126

Correct answer: A. Explanation: A /26 leaves 6 host bits (32 − 26 = 6). 2⁶ = 64 total addresses, minus the network address and the broadcast address, leaves 62 usable. The classic trap is answering 64 — always subtract 2 for the network and broadcast IDs (unless the question specifies a /31 point-to-point link under RFC 3021).

5. A server log shows repeated outbound connections to an external IP on TCP port 53. The firewall policy permits DNS. What should the technician suspect?

A. Normal behavior; DNS always uses TCP port 53.
B. Possible DNS tunneling; DNS normally uses UDP port 53.
C. A misconfigured NTP client; NTP uses TCP port 53.
D. Normal behavior; the firewall explicitly permits it.

Correct answer: B. Explanation: Standard DNS queries use UDP port 53 (TCP is reserved for zone transfers and responses over 512 bytes). Malware frequently exfiltrates data via DNS tunneling — encoding stolen data in DNS queries — precisely because firewalls usually allow port 53 outbound. Repeated TCP/53 connections to an external host are a red flag worth investigating, not something to wave through because "DNS is allowed."

6. A company needs its public web server reachable as www.example.com, its mail delivered to mail.example.com, and a human-readable alias portal.example.com pointing at the web server. Which DNS record set is correct?

A. A record for www, MX record for mail, CNAME for portal → www
B. CNAME for www, A record for mail, MX for portal
C. PTR for www, A record for mail, CNAME for portal → mail
D. MX for www, CNAME for mail, A record for portal

Correct answer: A. Explanation: An A record maps a hostname to an IPv4 address (the web server). An MX record designates the mail server for the domain. A CNAME creates an alias pointing at another hostname (portal → www). PTR records are for reverse DNS, not forward lookups. The exam loves asking which record type fits a scenario — memorize A, AAAA, CNAME, MX, TXT, PTR, and SRV.

7. Users report they cannot reach a file server by hostname, but ping 10.20.4.15 (the server's IP) works fine. The technician has verified the workstation's IP, mask, and gateway. What is the logical next troubleshooting step?

A. Replace the workstation's network cable.
B. Check the workstation's DNS server settings and test name resolution.
C. Reboot the file server.
D. Add a static route to the file server.

Correct answer: B. Explanation: IP connectivity works but name resolution fails — that isolates the fault to DNS. The methodology matters here: test one layer at a time and move to the adjacent layer. Replacing cables or rebooting servers skips the evidence; the evidence says packets flow and names don't resolve, so DNS settings (nslookup/dig against the configured server) are the next step.

8. A switch port connects to another switch and must carry traffic for VLANs 10, 20, and 30. Which configuration is required?

A. Configure the port as an access port in VLAN 10.
B. Configure the port as a trunk using 802.1Q tagging.
C. Configure three access ports, one per VLAN.
D. Enable PortFast on the port.

Correct answer: B. Explanation: A single link carrying multiple VLANs must be a trunk, and 802.1Q is the standard tagging protocol that inserts a VLAN ID into each frame so the receiving switch can sort traffic back into the right VLANs. An access port carries exactly one VLAN (untagged) — that's the single most-tested VLAN distinction on Network+. PortFast is a spanning-tree edge-port optimization, unrelated to VLAN transport.

9. A technician must connect two switches directly. Both switches support auto-MDIX. Which cable type is appropriate?

A. Straight-through only; crossover will not work.
B. Crossover only; straight-through will not work.
C. Either cable type; auto-MDIX corrects the pinout automatically.
D. A rollover cable, as with console connections.

Correct answer: C. Explanation: Traditionally, like devices (switch-to-switch) needed a crossover cable. Auto-MDIX lets the port detect the cable type and swap its transmit/receive pairs automatically, so either cable works. On the exam, "both support auto-MDIX" is the signal that the cable-type question is a non-issue. Rollover cables are for console/management ports, never for Ethernet data links.

10. A small office upgrades its Wi-Fi and must choose between WPA2 and WPA3. Which statement about WPA3 is accurate?

A. WPA3 uses the same four-way handshake as WPA2, only with longer keys.
B. WPA3-Personal replaces the pre-shared key handshake with SAE, resisting offline dictionary attacks.
C. WPA3 is only available in Enterprise mode; Personal networks must stay on WPA2.
D. WPA3 encrypts with TKIP, which WPA2 deprecated.

Correct answer: B. Explanation: WPA3-Personal uses SAE (Simultaneous Authentication of Equals, the "Dragonfly" handshake) instead of WPA2's four-way handshake with a pre-shared key. SAE makes each authentication attempt interactive with the AP, which defeats the offline dictionary attacks that plagued weak WPA2 passwords. WPA3 exists in both Personal and Enterprise (192-bit) modes, and TKIP belongs to the long-dead WPA era — WPA2/WPA3 use AES-based CCMP/GCMP.

What to study next

If any of these felt shaky, that's your study list: longest-prefix-match routing, the DORA sequence, 2.4 GHz channel planning, host-bit math, DNS record types, the troubleshooting methodology (test adjacent layers), trunk vs. access ports, and WPA2 vs. WPA3. These topics appear on nearly every Network+ exam in some form.

Are PBQs hard on the real Network+ exam?: They're worth more points per question and can't be skipped strategically — you should answer every PBQ before the multiple-choice section, since they're weighted heavily. The formats (matching, drag-and-drop, simulations, exhibit interpretation) test the same concepts as multiple choice; the difficulty is reading exhibits carefully under time pressure.
How many PBQs are on the N10-009 exam?: CompTIA typically includes a small number of performance-based questions at the start of the exam (historically around 3–5), followed by the multiple-choice section, with 90 minutes total. Treat every PBQ as high-value and budget your time accordingly.

Want 620 more questions like these?

Get the full Network+ N10-009 practice bank — 620 original questions with detailed explanations, plus a free 30-question sample quiz and free sample PDF. No sign-up needed for the samples.

Start the Network+ Practice Exams