Cyber Questline
On this page
Back to Network+

TCP/IP, Routing, and Wireless Networking

CompTIA Network+ N10-009 Study GuideCourse MapHigh-Yield Memory AnchorsModule 1: TCP/IP BasicsIP Addressing And BinaryARPSubnet MasksClassful AddressingCIDR SubnettingStatic And Dynamic AddressingSpecial IP AddressesModule 1 Troubleshooting CuesModule 2: RoutingRouter PurposeUnderstanding PortsNetwork Address TranslationPort ForwardingSOHO vs Enterprise RoutingStatic RoutesDynamic RoutingRIPEIGRPOSPFBGPModule 2 Troubleshooting CuesModule 3: TCP/IP ApplicationsTCP vs UDPICMP And IGMPHandy ToolsWiresharkNetstatWeb ServersFTPEmail Servers And ClientsSecuring EmailTelnet And SSHNTPModule 4: Network NamingDNS FundamentalsApplying DNSWindows Name ResolutionDynamic DNSDNS TroubleshootingModule 5: Securing TCP/IPMaking TCP/IP SecureSymmetric EncryptionAsymmetric EncryptionCryptographic HashesIdentification, Authentication, Authorization, AccountingAccess ControlKerberos And EAPSingle Sign-OnCertificates And TrustModule 6: Switch FeaturesSwitch ManagementVLANsInterVLAN RoutingTrunkingCisco Command ConceptsSwitch Port ProtectionPort BondingPort MirroringQuality of ServiceIDS vs IPSProxy ServersLoad BalancingN10-009 Resiliency And Cloud ServicesFirst Hop Redundancy And Virtual IPsPrecision And Secure TimeCloud Connectivity And DeliveryModern Secure Network EdgeSeptember 2026 Worked ExamplesPoint-To-Point Addressing ExceptionsRoute Installation And Failover EvidenceLACP Negotiation And CapacityDHCP Relay And Scope SelectionDNS Negative Caching And TransportPacket Evidence And Capture LimitsPath MTU And Tunnel EvidenceAdditional Service And Protocol DistinctionsAuthoritative SourcesFinal Exam Checklist
CompTIA Network+ N10-009
Reviewed 2026-09-08Search libraryPractice

CompTIA Network+ N10-009 Study Guide

Course: TCP/IP, Routing, and Wireless Networking Source basis: Coursera course videos and readings reviewed on 2026-06-19 Technical audit: All local questions and guide text reviewed on 2026-09-08 against N10-009 and the public primary references below; the original course materials were not re-accessed.

Purpose: Exam-focused study notes for TCP/IP, routing, network services, DNS, security, VLANs, and switch features.

Course Map

High-Yield Memory Anchors

Module 1: TCP/IP Basics

IP Addressing And Binary

IPv4 addresses are 32-bit numbers written as four decimal octets. Each octet represents 8 bits and ranges from 0 to 255.

Example:

Exam skill:

ARP

ARP, Address Resolution Protocol, resolves an IPv4 address to a MAC address on the local network.

Process:

  1. Host needs to send to a local IPv4 destination.
  2. Host checks ARP cache.
  3. If no entry exists, host broadcasts an ARP request.
  4. The owner of the IPv4 address replies with its MAC address.
  5. Sender uses that MAC address in the Ethernet frame.

Important exam distinctions:

Subnet Masks

A subnet mask identifies which bits are network bits and which bits are host bits.

Common masks:

Host formula for IPv4:

Supported /31 point-to-point links and /32 host routes are exceptions, explained under Point-To-Point Addressing Exceptions.

Classful Addressing

Classful addressing is older but still exam-relevant.

127.0.0.0/8 is loopback, not a normal Class A host network.

These are historical classes, not permission to assign every address in those ranges. Modern routing uses the explicit prefix, and special-purpose reservations still apply. 255.255.255.255 is the limited broadcast address, not an experimental host assignment.

CIDR Subnetting

Local-or-remote IPv4 decisionThe subnet mask decides whether a host ARPs locally or sends traffic to the default gateway.
Source IP + maskExample: 192.168.10.25/24
Destination IPExample: 192.168.10.80 or 10.20.0.5
Same subnet?Compare network portions
ARP for destinationSend frame directly
ARP for gatewayRouter handles remote network

CIDR, Classless Inter-Domain Routing, uses slash notation instead of rigid classful boundaries.

Important tasks:

Quick block sizes in the interesting octet:

Example:

Static And Dynamic Addressing

Static addressing is manually configured. It is useful for routers, servers, printers, infrastructure, and anything that must be predictable.

Dynamic addressing usually uses DHCP. DHCP leases IP configuration to clients.

DHCP commonly provides:

DHCP process memory aid: DORA.

DHCPv4 servers normally listen on UDP 67 and clients on UDP 68. A reservation associates a particular client identifier, often its MAC address, with a predictable address; an exclusion removes addresses from the dynamic pool. The router option supplies default-gateway information, distinct from the subnet-mask, DNS-server, and lease-time options. Keep reservations and IP address management (IPAM) records consistent. Sources: RFC 2131 and RFC 2132.

Special IP Addresses

Know these:

Module 1 Troubleshooting Cues

Module 2: Routing

Router Purpose

Routers connect IP networks. A router receives packets, checks the destination IP address, consults its routing table, and forwards traffic toward the next hop.

Key concepts:

Understanding Ports

In this course context, "ports" can mean physical interfaces or Layer 4 application ports.

Physical/router ports:

Layer 4 ports:

Network Address Translation

NAT translates IP addresses, often private internal addresses to a public external address.

Types:

PAT is what most homes and small offices use.

Why NAT matters:

NAT is not a complete security control by itself. It is often paired with firewall behavior.

Port Forwarding

Port forwarding allows inbound traffic from the internet to reach an internal host.

Example:

Security note:

SOHO vs Enterprise Routing

SOHO routers often combine:

Enterprise networks usually separate these functions across dedicated devices or managed platforms.

Enterprise routers support more advanced:

Static Routes

Static routes are manually configured.

Use cases:

Pros:

Cons:

Dynamic Routing

Dynamic routing protocols let routers exchange route information.

Benefits:

Costs:

RIP

RIP is an older distance-vector routing protocol.

Know:

EIGRP

EIGRP is an enhanced distance-vector interior routing protocol using DUAL. Its usual metric emphasizes minimum path bandwidth and cumulative delay; it is not simply hop count. A successor is a selected next hop, while a feasible successor meets a loop-free feasibility condition and may provide a fast alternate. Check neighbor compatibility, advertised prefixes, and metric settings when troubleshooting. RFC 7868 is Cisco's published informational description, not an IETF Standards Track protocol specification.

OSPF

OSPF is a link-state interior gateway protocol.

Know:

BGP

BGP is the major exterior gateway protocol of the internet.

Know:

Module 2 Troubleshooting Cues

Module 3: TCP/IP Applications

TCP vs UDP

TCP:

UDP:

Examples:

ICMP And IGMP

ICMP supports diagnostic and control messages.

Common uses:

IGMP manages IPv4 multicast group membership.

Handy Tools

Know these tools:

Wireshark

Wireshark captures and decodes network traffic.

Use it to:

Exam caution:

Netstat

Netstat shows network connections and listening ports.

Use cases:

Web Servers

Common web ports:

Web troubleshooting:

FTP

FTP uses TCP 21 for control. Traditional active/passive FTP can involve additional data connections.

Security point:

Email Servers And Clients

Common email protocols:

Common ports:

Port 587 is message submission, commonly secured using STARTTLS; port 465 is implicit-TLS submission. A port number alone does not prove TLS is enabled. N10-009's objectives label 587 as SMTPS, but operational diagnosis must distinguish submission with STARTTLS from implicit TLS. RFC 8314.

Securing Email

Email security concerns:

Common records/tools:

Telnet And SSH

Telnet:

SSH:

NTP

NTP synchronizes clocks.

Port:

Why it matters:

Module 4: Network Naming

DNS Fundamentals

DNS resolves names to records, most commonly hostnames to IP addresses.

Common record types:

DNS commonly starts with UDP 53, but TCP 53 is required for a full DNS implementation and can carry ordinary queries as well as AXFR transfers and retries after truncation. EDNS permits larger UDP messages, so 512 bytes is not a universal current limit. RFC 7766.

Applying DNS

DNS hierarchy:

Recursive resolver:

Authoritative server:

Caching:

Windows Name Resolution

Windows environments may use several name mechanisms:

Exam focus:

Dynamic DNS

Dynamic DNS updates DNS records automatically when IP addresses change.

Use cases:

DNS Troubleshooting

NXDOMAIN means the queried name does not exist. An existing name with no record of the requested type can instead return NOERROR with an empty answer. SERVFAIL indicates a server or validation failure, while REFUSED indicates refusal. A cached negative answer can remain after an authoritative record is added. See RFC 1035 and the negative-caching example below.

Process:

  1. Check IP connectivity first.
  2. Query known DNS server.
  3. Compare name vs direct IP access.
  4. Check correct DNS server settings.
  5. Check record type.
  6. Check TTL/caching.
  7. Check authoritative records.

Tools:

Module 5: Securing TCP/IP

Making TCP/IP Secure

TCP/IP was not originally designed around modern hostile networks. Security layers add confidentiality, integrity, authentication, authorization, and accountability.

Important security goals:

Symmetric Encryption

Symmetric encryption uses the same key for encryption and decryption.

Pros:

Cons:

Examples:

Asymmetric Encryption

Asymmetric encryption uses a public/private key pair.

Uses:

Pros:

Cons:

Cryptographic Hashes

A hash produces a fixed-length digest from input data.

Properties:

Examples:

Avoid weak/deprecated hashes such as MD5 and SHA-1 for security-sensitive uses.

Identification, Authentication, Authorization, Accounting

Identification:

Authentication:

Authorization:

Accounting:

AAA means Authentication, Authorization, and Accounting.

Access Control

Access control limits who or what can access resources.

Models:

Network examples:

Kerberos And EAP

Kerberos:

EAP:

Single Sign-On

SSO lets users authenticate once and access multiple systems.

Benefits:

Risks:

Certificates And Trust

Certificates bind public keys to identities. A certificate authority signs certificates so clients can validate trust.

Important certificate concepts:

Certificate error scenarios:

Module 6: Switch Features

Switch Management

Managed switches support configuration and monitoring.

Common management features:

Secure management:

A switch learns a frame's source MAC address with its ingress port and VLAN. For known unicast forwarding, it looks up the destination MAC address in that VLAN's table; learning and forwarding use different address fields. Cisco MAC address table creation.

Spanning Tree Protocol (STP) prevents Layer 2 forwarding loops by placing redundant paths in a nonforwarding state. A standby path can become active after a topology change; STP does not remove the physical redundancy. Cisco STP operation.

VLANs

VLAN trunk and inter-VLAN routingAccess ports carry one VLAN; trunks carry tags; a Layer 3 interface routes between VLANs.
VLAN 10 access portsUser workstations
802.1Q trunkTagged VLAN 10 + VLAN 20
Layer 3 switch/routerDefault gateway SVIs
VLAN 20 access portsServers or another team
Allowed VLAN listMismatch breaks reachability
ACLs/QoSPolicy after routing

VLANs divide a switch into separate Layer 2 broadcast domains.

Benefits:

Important:

InterVLAN Routing

InterVLAN routing allows communication between VLANs.

Methods:

Troubleshooting:

Trunking

Trunk links carry multiple VLANs between switches or between switch and router.

Common trunk tag:

Trunk concerns:

Cisco Command Concepts

Network+ does not require deep vendor certification, but you should recognize basic ideas:

Switch Port Protection

Port protection features include:

Exam idea:

Port Bonding

Port bonding/link aggregation combines multiple physical links into one logical link.

Benefits:

Common standard:

Port Mirroring

Port mirroring copies traffic from one or more ports/VLANs to a monitoring port.

Uses:

Vendor term:

Quality of Service

QoS prioritizes traffic.

Use cases:

QoS can classify, mark, queue, prioritize, shape, or police traffic.

IDS vs IPS

IDS:

IPS:

Placement matters:

Proxy Servers

A proxy acts on behalf of clients.

Uses:

Forward proxy serves clients. Reverse proxy protects or fronts servers.

Load Balancing

Load balancers distribute traffic across multiple servers.

Benefits:

Common concepts:

N10-009 Resiliency And Cloud Services

First Hop Redundancy And Virtual IPs

Hosts normally depend on one configured default-gateway address. If that gateway exists on only one router, the router becomes a first-hop single point of failure.

A First Hop Redundancy Protocol (FHRP) allows multiple routers to coordinate ownership of a virtual IP (VIP) and usually a virtual MAC address. Hosts use the VIP as their default gateway rather than a router's individual interface address.

Expected behavior:

Do not confuse an FHRP VIP with:

Troubleshooting checks include FHRP state, peer reachability, priority, preemption, the shared VIP, and whether hosts resolve the expected virtual MAC.

Precision And Secure Time

NTP is the general-purpose time protocol used by network devices and systems. Consistent time supports log correlation, authentication, certificates, automation, and incident investigation.

Precision Time Protocol (PTP) targets environments requiring much tighter synchronization, such as industrial controls, financial systems, and media production. PTP can use hardware timestamping and a hierarchy that includes grandmaster, boundary, and ordinary clocks.

Network Time Security (NTS) adds cryptographic protection to NTP. NTS helps clients authenticate the time source and protects time exchanges from manipulation. It improves NTP trust; it does not turn NTP into PTP or provide PTP-level precision.

NTS normally establishes keys using TLS over TCP 4460, then uses authenticated NTP exchanges over UDP 123 unless a different NTP endpoint is negotiated. A successful UDP 123 reachability check does not prove NTS key establishment works. NTS protects authentication/integrity; do not assume it encrypts the entire NTP packet. RFC 8915.

Choose by requirement:

When troubleshooting time, verify the selected source, reachability, offset, stratum or PTP role, authentication state, firewall rules, and whether the clock is stepping or gradually slewing.

Cloud Connectivity And Delivery

A VPC provides an isolated logical cloud network with subnets, route tables, address ranges, and security controls. Cloud gateways attach the VPC to other destinations:

Security groups are commonly stateful and associated with workloads or interfaces. Network security lists or network ACLs are often subnet-oriented and may be stateless, requiring explicit rules for both directions. Exact cloud-provider behavior varies, so read the scenario for stateful versus stateless and workload versus subnet scope.

Cloud service models:

Cloud deployment models:

Scalability means a design can grow. Elasticity means capacity can expand and contract dynamically. Multitenancy means isolated customers share provider infrastructure.

A content delivery network (CDN) caches eligible content at distributed edge locations. It improves user latency and reduces origin load. A CDN is not a private cloud circuit, a replacement for authoritative DNS, or a control for unrestricted backend access.

Modern Secure Network Edge

Secure Access Service Edge (SASE) combines networking and security in a cloud-delivered architecture. A SASE design can include:

Security Service Edge (SSE) contains the cloud-delivered security capabilities but excludes the WAN connectivity component. A requirement for both branch transport policy and security points to SASE; a requirement focused only on cloud-delivered user security may point to SSE.

SASE and SSE are architectural service models, not tunneling protocols. They may use VPNs, identity providers, endpoint posture, and regional points of presence, but those components do not individually equal SASE.

September 2026 Worked Examples

Point-To-Point Addressing Exceptions

A /31 has two addresses and is usable on a point-to-point link whose endpoints support RFC 3021. For 192.0.2.18/31, both .18 and .19 identify endpoints. Do not subtract network and broadcast addresses as with a conventional /30. A /32 identifies one exact IPv4 address or host route; it does not provide a two-host subnet. These exceptions do not justify using a /31 for a multiaccess client LAN. RFC 3021.

Route Installation And Failover Evidence

Separate route installation from forwarding. A device selects among sources advertising the same prefix using administrative distance or its vendor's preference rules; a protocol then has its own path-selection logic. Packet forwarding uses the longest matching installed prefix. OSPF route type matters before comparing costs across types. For two eligible intra-area paths to the same prefix, lower cost wins. RFC 2328, sections 11 and 16.

Example: a /24 route remains preferred for destinations inside it even when a /16 route comes from a more trusted source. A floating static default helps only when the preferred default is removed. If its directly connected next hop remains reachable during an upstream failure, track suitable provider-path health and verify withdrawal, backup routing, and failback. Prevent a health probe from succeeding over the wrong provider. Cisco static-route tracking.

LACP Negotiation And Capacity

Passive/passive endpoints both wait. Active/passive or active/active can negotiate when membership, link parameters, and VLAN handling are compatible. Check the actual bundle and member states, not only physical carrier. A configured minimum-links requirement can take the whole bundle down even while some members survive. Cisco EtherChannel guide.

Per-flow hashing typically keeps one TCP connection on one member. A four-link 1 Gb bundle offers aggregate capacity across flows, not a guaranteed 4 Gb single-stream transfer. Hash collisions can leave members unevenly used. Test multiple approved flows and inspect member counters before calling that a hardware fault. Cisco load distribution.

DHCP Relay And Scope Selection

A normal DHCPv4 relay carries requests from a client broadcast domain to a server and sets giaddr. For example, a relay address of 10.88.50.1 lets a server select the appropriate 10.88.50.0/24 scope in this ordinary design. A log saying no matching scope points to scope selection or activation, not a DNS option. More advanced relay selection options exist, so inspect the deployment's actual packet fields. RFC 2131.

Keep DHCP reservations, exclusions, and IPAM synchronized. A reservation ties an allocation to a client identifier, commonly a MAC for Ethernet clients; an exclusion keeps an address out of the dynamic pool. Do not delete active leases or expand a pool across subnet boundaries without checking address ownership and routing.

DNS Negative Caching And Transport

NXDOMAIN means the queried name does not exist; a NOERROR response with no requested record is a different result. A negative response may be cached using a TTL derived from its SOA record. Example: NXDOMAIN cached at 10:00 for 300 seconds can remain until 10:05 even when the record is created at 10:01. Changing the new positive record's TTL does not erase the old negative entry. Compare authoritative and recursive answers, then use approved targeted invalidation or await expiry. RFC 2308.

A UDP response marked TC=1 can lead to a TCP 53 retry. Inspect the retry and firewall counters when only larger DNS responses fail. Do not infer that every timeout is a missing record. RFC 7766.

DNSSEC authenticates signed DNS data but does not encrypt it. A client relying on a recursive resolver needs a trustworthy validation path; DNSSEC does not make an attacker-operated resolver honest. DoT and DoH protect transport to the selected resolver and do not replace DNSSEC data validation. RFC 4033.

SMTP normally uses MX records to locate mail exchangers. With no MX, SMTP may fall back to the domain's own address as an implicit exchanger; it cannot infer that a differently named mail1 host is intended. Thus missing MX alone is not proof that all mail must fail. RFC 5321, section 5.

Packet Evidence And Capture Limits

A capture describes one observation point. Sender-side transmit checksum offload can show an incomplete checksum before the NIC finishes it; an independent receiver capture can show the correct wire packet. Captured oversized buffers can also reflect segmentation offload rather than the physical wire MTU. Wireshark checksum documentation.

Check mirror oversubscription, capture drops, timestamps, and direction before inferring network loss. A nonresponding traceroute hop can be filtering or rate limiting its control-plane replies while forwarding later probes. Preserve the ICMP sender and type/code: an unreachable response reports a delivery failure, not a complete diagnosis. Clean CRC counters do not rule out egress queue drops.

Path MTU And Tunnel Evidence

Encapsulation consumes space. If a tunnel's effective inner MTU is 1380 bytes, a 1500-byte IPv4 packet with DF set cannot pass unchanged. Classic PMTUD depends on ICMP fragmentation-needed feedback; blocking that feedback can leave small exchanges working while larger transfers stall. RFC 1191.

For ordinary IPv4/TCP headers, a 1380-byte inner MTU suggests a maximum TCP payload near 1340 bytes before additional options. Do not confuse ping payload size, IP packet size, TCP MSS, and full Ethernet frame length. Scope permitted ICMP and use supported MTU/MSS policy; an MSS adjustment helps TCP, not every UDP application.

Additional Service And Protocol Distinctions

ServiceCommon transport and portDiagnostic distinction
TFTPUDP 69 for initial requestSubsequent transfer uses negotiated UDP endpoints
LDAP / LDAPSTCP 389 / 636STARTTLS on LDAP differs from implicit TLS
SMBTCP 445File sharing, not directory lookup
SyslogUDP 514 commonly; TLS commonly TCP 6514Sending a UDP event does not confirm delivery
SNMPUDP 161 requests; 162 notifications commonlyPolling and notifications have different destinations
SQL ServerTCP 1433 commonlyNamed or custom instances can use other ports
RDPTCP/UDP 3389 commonlyCheck actual listener and permitted transports
SIPUDP/TCP 5060; TLS TCP 5061 commonlySignaling ports do not define the negotiated RTP media path

These are conventional service associations, not proof of application identity. Consult the IANA service registry and the installed service configuration. ICMP, GRE, AH, and ESP are IP protocols, not TCP/UDP ports. IPsec key negotiation uses IKE; ESP supplies protected data transport, while bare GRE supplies encapsulation without confidentiality.

Lightweight Directory Access Protocol (LDAP) on TCP 389 can use STARTTLS to negotiate Transport Layer Security (TLS). LDAPS on TCP 636 starts TLS immediately. Do not infer that every connection on 389 is cleartext, or that a port number alone proves certificate validation. RFC 4513 describes LDAP STARTTLS; IANA's LDAP entries supply the port associations.

The direct-recall service review on 2026-09-20 also checked RFC 959 for FTP control/data connections, RFC 4253 for SSH transport, RFC 5905 for NTP, and RFC 3596 for AAAA records. The web and mail sections above retain the HTTP/3 and SMTP 587 STARTTLS versus 465 implicit-TLS distinctions.

Authoritative Sources

Reviewed 2026-09-08; all worked scenarios and values are original.

Final Exam Checklist