Cyber Questline
On this page
Back to Network+

Advanced Networking, Virtualization, and Security

CompTIA Network+ N10-009 Study GuideCourse MapHigh-Yield Memory AnchorsModule 1: IPv6Why IPv6 ExistsIPv6 AddressingIPv6 In ActionIPv4 And IPv6 TunnelingModule 2: WAN ConnectivityIP TunnelingWAN TechnologiesDSL, Cable, Satellite, CellularRemote Desktop And VPNsWAN TroubleshootingModule 3: Wireless Networking802.11 Basics802.11 StandardsPoEAntennasWireless SecurityModule 4: Virtualization And Cloud ComputingVirtualization BasicsCloud BasicsInfrastructure as CodeEnterprise VirtualizationModule 5: Data CentersClassic Data Center ArchitectureNAS And SANModern Data CentersHigh AvailabilityDocumentationModule 6: Integrating Networked DevicesNetwork TypesIoTVoIPICS And SCADAModule 7: Network OperationsWhat Network Operations IncludesHardening And Security PoliciesChange ManagementPatching And UpdatingRisk ManagementPoints Of FailureIncident Response And ForensicsDisaster Recovery And Business ContinuityModule 8: Protecting NetworksSecurity Concepts And Defense In DepthCommon AttacksPhysical SecurityNetwork HardeningDMZFirewallsModule 9: Network MonitoringMonitoring GoalsSNMPLogsSystem MonitoringSIEMModule 10: Network TroubleshootingTroubleshooting MethodLayered TroubleshootingQuick Symptom MappingN10-009 Modern Networking AdditionsWireless Regulatory FeaturesVXLAN OverlaysCloud Network ControlsCloud Service And Deployment ModelsSeptember 2026 Worked ExamplesIPv6 Router And On-Link LifetimesFlow Records And Monitoring EvidenceRecovery Tests And Data CurrencyIndependent Management PathsCertificate And Administrative IdentityFirst-Hop Defense And Static DevicesOrdered Security RulesMAC Table Exhaustion EvidencePoE Power At Each EndpointAuthoritative SourcesFinal Exam Checklist
CompTIA Network+ N10-009
Reviewed 2026-09-08Search libraryPractice

CompTIA Network+ N10-009 Study Guide

Course: Advanced Networking, Virtualization, and Security Source basis: Coursera course videos and readings reviewed on 2026-06-19 Technical audit: All local questions and guide text reviewed on 2026-09-08 against N10-009 and the public primary references below; the original course materials were not re-accessed.

Purpose: Exam-focused study notes for IPv6, WANs, wireless, cloud, data centers, operations, security, monitoring, and troubleshooting.

Course Map

High-Yield Memory Anchors

Module 1: IPv6

Why IPv6 Exists

IPv6 addresses IPv4 exhaustion and simplifies large-scale addressing. It provides a massive 128-bit address space and supports features such as stateless address autoconfiguration.

Key advantages:

IPv6 Addressing

IPv6 addresses are 128 bits, written as eight groups of four hexadecimal digits.

Example:

Compression rules:

Example:

Important IPv6 address types:

IPv6 does not use broadcast. Multicast and anycast fill many use cases.

IPv6 In Action

IPv6 hosts commonly use:

NDP uses ICMPv6 messages for neighbor solicitation, neighbor advertisement, router solicitation, and router advertisement.

Address assignment, on-link determination, and default-router selection are distinct. A DHCPv6 address does not supply the ordinary default gateway. RAs can also carry DNS resolver information through RDNSS options; clients may instead use a supported DHCPv6 information service. Match the design to client support. See IPv6 Router And On-Link Lifetimes for the separate RA fields.

IPv4 And IPv6 Tunneling

Tunneling helps connect IPv6 across IPv4 or vice versa during transition.

Concepts:

Exam point:

Module 2: WAN Connectivity

IP Tunneling

Tunneling encapsulates one packet inside another. It is used for VPNs, IPv6 transition, private traffic over public networks, and provider networks.

Common tunneling use cases:

WAN Technologies

WANs connect networks across distance. Options vary by availability, bandwidth, latency, cost, and reliability.

Technologies:

DSL, Cable, Satellite, Cellular

DSL:

Cable:

Satellite:

Cellular:

Remote Desktop And VPNs

Remote desktop provides graphical access to systems. Secure it carefully.

VPNs provide encrypted tunnels over untrusted networks.

Types:

VPN protocols/concepts:

WAN Troubleshooting

Check:

Module 3: Wireless Networking

802.11 Basics

Wi-Fi is based on IEEE 802.11 standards.

Common terms:

Lightweight access points (APs) join a dedicated controller for centralized configuration and policy. Autonomous APs are managed individually; controllerless clusters distribute control among peers. Mesh describes the wireless interconnection topology and does not by itself specify who manages the APs. RFC 5415 describes centralized control and provisioning through CAPWAP.

A captive portal limits access to the wider network until the user completes a web-based step, such as accepting terms or authenticating. The portal is an access workflow, not wireless-link encryption; WLAN encryption is a separate control. RFC 8952.

802.11 Standards

Know common generations:

2.4 GHz:

5 GHz:

6 GHz:

Range and throughput depend on transmit limits, antennas, client capability, obstacles, interference, and channel width. A band name alone does not guarantee either. Band steering encourages a choice; the client ultimately decides association and roaming. Do not use one universal coverage-overlap percentage as a pass/fail rule.

For conventional 20 MHz operation in the 2.4 GHz band where channels 1-11 are permitted, channels 1, 6, and 11 form the standard three-channel non-overlapping plan. This does not make a channel free of interference or contention, and permitted channels depend on the regulatory region. Cisco wireless RF reference.

PoE

Power over Ethernet supplies power and data over Ethernet cabling.

Standards:

Use cases:

Antennas

Common antenna types:

Deployment concerns:

Wireless Security

Wireless client connection pathWireless troubleshooting is easier when you separate RF, authentication, addressing, and routing.
ClientSSID and signal
Access pointChannel, band, power
Auth servicePSK, 802.1X, RADIUS
DHCP/DNSAddress and names
GatewayLAN/WAN access

Security standards:

Authentication:

Threats:

Hardening:

Module 4: Virtualization And Cloud Computing

Virtualization Basics

Virtualization abstracts physical resources.

Types:

Hypervisors:

VM concepts:

Cloud Basics

Cloud characteristics:

Service models:

Deployment models:

Infrastructure as Code

IaC manages infrastructure through versioned configuration.

Benefits:

Examples:

Enterprise Virtualization

Enterprise virtualization adds:

Networking concerns:

Module 5: Data Centers

Classic Data Center Architecture

Traditional data centers often use hierarchical designs:

Goals:

In a three-tier hierarchy, access connects endpoints such as servers, distribution aggregates access switches and commonly applies routing or policy boundaries, and core provides fast backbone connectivity between distribution blocks. Smaller designs may combine distribution and core roles. Cisco hierarchical LAN roles.

NAS And SAN

NAS:

SAN:

Exam contrast:

Modern Data Centers

Modern designs may include:

High Availability

HA reduces downtime.

Techniques:

Terms:

In active-active operation, both sites or nodes serve production work concurrently. In active-passive operation, a standby takes over the protected service after the active instance fails. An active-active design still needs sufficient surviving capacity, working dependencies, and appropriate data synchronization to sustain service after a failure. NIST SP 800-34 Rev. 1, hot-site workload example.

Documentation

Document:

IP address management (IPAM) records address blocks, subnets, allocations, and ownership so teams can track usage and avoid conflicting assignments. Microsoft IPAM overview.

A surveyed wireless heat map plots measured signal coverage against a floor plan, helping locate weak areas; a predictive map is an estimate, not a substitute for those measurements. A service-level agreement (SLA) states measurable service commitments, such as availability and response targets, with agreed measurement conditions.

Before changing a device, retain a verified, accessible backup of its current production configuration and a rollback plan. A diagram or an unverified old configuration is not an adequate restore copy.

Module 6: Integrating Networked Devices

Network Types

Know the scale/scope terms:

IoT

IoT devices include sensors, cameras, appliances, controllers, and smart devices.

Risks:

Controls:

VoIP

Voice over IP carries voice over packet networks.

Requirements:

Common protocols/concepts:

For packet voice, jitter means variation in packet delay, which can make arrivals uneven even when average latency is acceptable. Latency is the delay itself, packet loss means missing packets, and bandwidth is transmission capacity; these are different measurements. RFC 3393, packet delay variation.

ICS And SCADA

Industrial control systems manage physical processes. SCADA supervises and controls industrial environments.

Risks:

Controls:

Module 7: Network Operations

What Network Operations Includes

Network operations keeps networks reliable, secure, documented, and recoverable.

Work includes:

Hardening And Security Policies

Hardening reduces attack surface.

Examples:

Policies provide standard expectations for acceptable use, passwords, remote access, data handling, and incident response.

Change Management

Change management prevents unnecessary outages.

Common elements:

Patching And Updating

Patch process:

Risk Management

Risk combines likelihood and impact.

Responses:

Points Of Failure

Single points of failure reduce availability.

Mitigations:

Incident Response And Forensics

One useful incident-handling workflow (not a claim that every framework uses identical phase names):

Forensics focuses on preserving evidence and chain of custody.

Disaster Recovery And Business Continuity

DR restores systems after disruption. BC keeps the business functioning.

Know:

A cold site supplies space and basic facilities but still needs equipment and system setup. A warm site has staged equipment and connectivity but needs production software or data restoration and startup work. A hot site has operational equipment and production software with current or near-current data, reducing activation work. These names do not guarantee a particular recovery time; verify the actual readiness against the RTO and RPO. NIST SP 800-34 Rev. 1, sections 3.4.3 and 5.1.5.

Module 8: Protecting Networks

Security Concepts And Defense In Depth

Defense in depth uses multiple controls so one failure does not expose everything.

Layers:

Common Attacks

Rogue DHCP:

DoS/DDoS:

On-path attack:

Spoofing:

Password attacks:

VLAN hopping:

Malware:

Social engineering:

Physical Security

Controls:

Tailgating is an unauthorized person's entry by following an authorized person through a controlled door without independently obtaining access approval. A badge check or controlled-entry procedure must verify each entrant, not just the first person through the door.

Network Hardening

Hardening examples:

DMZ

DMZ and defense-in-depth placementPublic services belong in a controlled zone so compromise does not automatically expose the internal LAN.
InternetUntrusted traffic
Edge firewallNAT, ACLs, filtering
DMZWeb/VPN/mail relay
Internal firewallTighter east-west rules
LANUsers, data, admin systems

A DMZ isolates public-facing systems from internal trusted networks.

Use cases:

Goal:

Firewalls

Firewall types/concepts:

Rules usually consider:

Stateful inspection tracks connection state so a policy can distinguish replies from newly initiated sessions. Stateless packet filtering evaluates packets without that connection context. URL-category filtering classifies web destinations, while MAC-address filtering matches link-layer addresses; neither alone supplies stateful reply handling. See NIST SP 800-41 Rev. 1, section 2.1.2.

Module 9: Network Monitoring

Monitoring Goals

Monitoring helps detect outages, performance problems, capacity issues, and security events.

Monitor:

SNMP

SNMP monitors and manages network devices.

Simple Network Management Protocol (SNMP) agents normally receive polling requests on UDP 161. Notification receivers listen on UDP 162 for traps or informs. These are separate destination roles, not an interchangeable port pair. RFC 3417, section 3.2.

Components:

Versions:

A MIB defines managed objects identified by OIDs. A trap is unacknowledged; an inform expects a response and can be retried. Neither replaces polling, log retention, and alert ownership. Check counters over a measured interval rather than treating a device's lifetime total as a current event rate.

Logs

Logs support troubleshooting, auditing, and incident response.

Centralize logs where possible.

Important:

System Monitoring

Common monitored items:

SIEM

SIEM collects, normalizes, correlates, and alerts on security events.

Use cases:

Module 10: Network Troubleshooting

Troubleshooting Method

Troubleshooting loopThe method is circular because verification and documentation feed the next incident.
Identify problem
Establish theory
Test theory
Plan action
Implement fix
Verify function
Document

Use a repeatable process:

  1. Identify the problem.
  2. Establish a theory.
  3. Test the theory.
  4. Establish a plan.
  5. Implement the solution or escalate.
  6. Verify full functionality.
  7. Document findings, actions, and outcomes.

Layered Troubleshooting

Start with physical and move upward when appropriate:

Quick Symptom Mapping

N10-009 Modern Networking Additions

Wireless Regulatory Features

Wireless channel selection is constrained by the regulatory domain. A channel available in one country or band may be restricted in another, and an AP must use the region configured for its actual installation location.

802.11h introduced mechanisms associated with regulatory operation in portions of the 5 GHz band:

DFS behavior can create an apparent outage while an AP performs channel availability checks or vacates a radar-affected channel. Review controller events before treating every channel change as interference or hardware failure.

Nearby 802.11 amendments solve different problems:

VXLAN Overlays

VXLAN is a data-center overlay that carries Layer 2 Ethernet frames across a routed Layer 3 underlay. A VXLAN tunnel endpoint (VTEP) encapsulates and decapsulates the traffic, commonly on a virtual switch or leaf switch.

Key evidence:

VXLAN does not replace routing. The underlay must still provide IP reachability between VTEPs, and an overlay control plane or learning method must associate endpoints with the correct VTEP.

RFC 7348 describes the overlay format and its 24-bit VNI.

Cloud Network Controls

Cloud network policy commonly operates at more than one scope:

Stateful means return traffic for an allowed flow is tracked and permitted automatically. Stateless controls evaluate packets independently, so both inbound and outbound rules may be required. Provider terminology varies, but N10-009 scenarios commonly reveal the answer through stateful versus stateless behavior and workload versus subnet scope.

For a concrete provider example, AWS security groups are stateful. Do not assume another provider's security-list terminology implies identical behavior.

Use least privilege:

Cloud Service And Deployment Models

Service models describe which layers the provider manages:

Deployment models describe how environments are owned and integrated:

A company using on-premises regulated databases with public-cloud virtual machines is using a hybrid deployment. If the company manages those VM operating systems and applications, the cloud service is IaaS.

Additional characteristics:

September 2026 Worked Examples

An RA's Router Lifetime controls whether its sender is eligible as a default router. A prefix option has separate valid/preferred lifetimes, an autonomous flag for SLAAC, and an on-link flag. A zero Router Lifetime can remove the default router while a previously assigned SLAAC address remains valid. DHCPv6 does not substitute a normal default-gateway option. RFC 4861.

For example, an RA with Router Lifetime 0 and a still-valid autonomous /64 can leave a client with a global address but no default route. Check all available routers, not just whether an address exists. An address's prefix does not itself prove that another address is on-link: the host uses learned or configured on-link information and applicable redirects. Multiple prefixes can exist on one VLAN. RFC 5942.

Flow Records And Monitoring Evidence

IPFIX exports records described by templates. A template containing addresses, ports, timestamps, and octet counts supports identifying large observed flows, not reconstructing HTTPS bodies. Example: 900 MB from a backup server and 50 MB from a workstation identify relative observed volume, not whether either transfer was authorized. Validate the template, sampling, export loss, direction, and counter semantics before drawing conclusions. RFC 7011.

Pair flow data with time-aligned interface counters, application checks, and access-controlled logs. A 95% interface utilization sample with increasing egress discards suggests congestion; CRC errors suggest corrupted frames. A healthy ping is weaker than a completed application transaction. A flow collector, SNMP manager, syslog collector, SIEM, and packet analyzer expose different evidence and should not be treated as interchangeable.

Recovery Tests And Data Currency

Measure time to validated service, not merely time to start a restored VM. Separately establish the last recoverable business transaction. In this original example:

Disruption                         16:00
Last transaction present in restore 15:52
Application validated available     16:21
Targets                             RTO 25 min; RPO 5 min
Result                              21 min recovery: meets RTO
                                    8 min data gap: misses RPO

A green backup job does not prove usable data, dependencies, application configuration, or recovery targets. Exercise restore and validation steps, preserve measured results, and fix the gap under an assigned owner. AWS recovery validation guidance.

Warm, hot, and cold sites describe readiness, not a guaranteed recovery duration. Check application startup, current data, network dependencies, capacity, and staff access. A tabletop tests decisions and coordination; an approved recovery exercise tests the implementation. Both have value but supply different evidence.

Independent Management Paths

An independent management network can retain access when production forwarding breaks. Trace the complete administrative path: remote entry, console server, management switching, power, authentication, and DNS dependencies. A VLAN named OOB that still requires the failed production core is not independent of that failure. Cisco out-of-band guidance.

Use a protected jump host, individual identities, MFA where supported, narrow management reachability, and session records. Verify approved recovery access without depending on the same system under maintenance. Console access and SSH are connection methods; in-band/out-of-band describes dependency on the production path, not whether the interface is a CLI or GUI.

Certificate And Administrative Identity

For enterprise 802.1X, validate the server chain, time validity, intended name, usage, and applicable revocation status. If a profile expects radius.prod.example but the renewed certificate names radius.lab.example, encryption and a trusted issuer alone are insufficient. Correct the authorized certificate or formally migrate the profile; do not accept any presented name. RFC 9190.

RADIUS commonly centralizes network access authentication; TACACS+ is oriented toward device administration with separate authentication, authorization, and accounting, including command decisions. In a read-only administrator role, login can succeed while a configuration command is denied and recorded. Classic TACACS+ uses obfuscation that should not be mistaken for modern encrypted transport; protect the management network. RFC 8907.

SSO is not the same as permanent authorization. Federation assertions such as SAML convey identity information between parties, while the service still applies policy. Zero trust removes implicit trust based only on network location or ownership. Reassess identity and context and grant the privilege needed for the resource. NIST SP 800-207.

First-Hop Defense And Static Devices

DHCP snooping distinguishes approved server-facing paths and learns bindings. DAI can validate ARP against those bindings. Statically addressed devices may need verified static bindings or a supported ARP ACL. Example: an inventoried printer with a fixed IP/MAC can fail inspection after enablement because it never acquired a DHCP lease, not because every drop proves an attack. Preserve the VLAN's protection and add only the verified exception. Cisco DAI guidance.

Do not mark all endpoint ports trusted to fix one static device. Likewise, use RA Guard for unauthorized router advertisements rather than blocking all ICMPv6. Port security constrains MAC use but does not establish a human identity or guarantee prevention of a passive physical tap. Physical controls, 802.1X, secure management, and narrow traffic policy address different risks.

Ordered Security Rules

For a first-match ACL, rule order is part of the policy. If a broad permit for 10.90.0.0/16 precedes a deny for 10.90.12.0/24 to the same service, the deny cannot match those packets. Put the specific restriction first, retain the intended broader permission afterward, and validate both allowed and denied cases with counters. Not every firewall has the same evaluation semantics, so identify the rule model before applying this reasoning. Cisco ACL semantics.

Stateful rules track permitted flows; stateless rules need explicit directional coverage. A separate VLAN without restrictive routing policy is not sufficient isolation. Inspect source, destination, service, direction, rule ordering, and return path together.

MAC Table Exhaustion Evidence

An endpoint-only port suddenly presenting thousands of changing source MACs, a full table, and increased unknown-unicast flooding is consistent with MAC flooding. Correlate the port with inventory because downstream switches and virtualization hosts can legitimately present many MACs. Overflow behavior is platform-dependent; do not claim that every switch becomes an unrestricted hub. Cisco MAC table and port security.

Preserve timestamps and counters, identify the connected asset, and contain it through the approved incident process. Diagnosis here is observational. There is no need to generate flooding traffic or reproduce an attack. Apply endpoint-appropriate MAC limits and authentication after validating legitimate requirements.

PoE Power At Each Endpoint

Distinguish power sourcing equipment (PSE) from the powered device (PD). For the familiar two-pair maximums, 802.3af supplies 15.4 W at the PSE with 12.95 W available at the PD; 802.3at supports 30 W at the PSE and 25.5 W at the PD. Cable loss accounts for the difference. Higher 802.3bt types/classes provide more power, subject to port and device support. Cisco PoE power table.

An AP needing 25.5 W at the device requires an appropriate higher-power source, not just a switch with spare aggregate watts. Check per-port standard, negotiated class, total budget, cabling, and whether the device entered a reduced-function mode. UPS sizing must include the resulting total electrical load.

Authoritative Sources

Reviewed 2026-09-08. Technical references were used for factual verification; all questions and evidence examples are original defensive scenarios.

Final Exam Checklist