NodnPort pairs
- 20/21 FTP
- 22 SSH and SFTP
- 53 DNS
- 67/68 DHCP
- 443 HTTPS
- 587 SMTPS on the N10-009 table
Study guide · Flashcards & memory notes
Network+ Flashcards & Memory Notes
40 recall cards for the facts Network+ (N10-009) keeps asking you to separate: layers and ports, routes and VLANs, services and attacks, and the troubleshooting order.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Layers and addresses
OSI, ports, private ranges, and subnet size.
1.1Which OSI layer uses a MAC address?
Data link, layer 2. A switch forwards frames here. A router uses layer 3.
1.2Which OSI layer chooses a path between IP networks?
Network, layer 3. The port number is layer 4. The cable is layer 1.
1.3How does TCP differ from UDP?
TCP retransmits lost segments and keeps order. UDP does not. DHCP, NTP, and most DNS lookups use UDP.
1.4Which ports does FTP use, and where is SFTP?
FTP uses TCP 21 for control and 20 for data. SFTP is SSH on TCP 22, not a secure mode of FTP.
1.5Which DHCP port is the server, and which is the client?
UDP 67 is the server and UDP 68 is the client. Both are DHCP. Blocking either stops address assignment.
1.6Which port does the N10-009 table give SMTPS?
TCP 587. Port 465 is implicit SMTPS and is not the number printed in that table.
1.7Name the three RFC 1918 private blocks.
10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 172.32.0.1 is outside the second block, so it is public.
1.8What does an address in 169.254.0.0/16 mean?
APIPA. DHCP did not answer. It is not an RFC 1918 address you planned.
1.9How many usable hosts are in a /26?
62. A /26 has 64 addresses. Subtract the network and broadcast addresses.
1.10What is the IPv6 loopback, and what is a link-local prefix?
Loopback is ::1. Link-local addresses start with fe80::. Dual stack runs IPv4 and IPv6 together.
Deck 2 · Routes, VLANs, and wireless
How a packet, a frame, and a radio are chosen.
2.1Which route wins when two prefixes both match?
The longest prefix. Administrative distance is used only when the prefixes are the same length.
2.2What does a lower administrative distance mean?
That source is more trusted. Connected is 0, static is 1, OSPF is 110, and RIP is 120.
2.3How do OSPF and BGP differ?
OSPF is link-state inside an autonomous system. BGP is path-vector between autonomous systems.
2.4How does PAT differ from one-to-one NAT?
PAT also translates ports, so many private hosts share one public address. One-to-one NAT maps a single host.
2.5What is the VIP in a first-hop redundancy protocol?
The gateway address hosts keep using if the active router fails. The standby router takes it over.
2.6What does 802.1Q do to a frame, and what is the native VLAN?
It inserts a VLAN tag. The native VLAN is sent untagged. Both ends of the trunk must agree.
2.7What does spanning tree block?
A redundant link that would let frames loop. The lowest bridge ID becomes the root.
2.8Which 2.4 GHz channels do not overlap?
1, 6, and 11. Channel 1 next to channel 2 interferes. 6 GHz requires WPA3.
2.9How do SSID, BSSID, and ESSID differ?
SSID is the name. BSSID is one radio's MAC. ESSID is the same name across access points so clients can roam.
2.10How does a lightweight access point differ from an autonomous one?
A lightweight AP takes its configuration from a controller. An autonomous AP is configured on its own.
Deck 3 · Services and security
DNS, DHCP, VPN, recovery, and the attacks that poison a table.
3.1How do an A record and an AAAA record differ?
A is IPv4. AAAA is IPv6. A PTR record is the reverse lookup.
3.2What does a DHCP relay do?
It forwards the client's broadcast to a DHCP server on another subnet. Without it, that server never hears the request.
3.3How do split tunnel and full tunnel differ?
A split tunnel sends only listed networks into the VPN. A full tunnel sends all traffic.
3.4How do in-band and out-of-band management differ?
In-band uses the production network. Out-of-band uses a separate path, such as a console, that still works when production does not.
3.5What is RPO, and what is RTO?
RPO is how much data you can lose. RTO is how long you can be down. A hot site meets a short RTO. A cold site does not.
3.6How do RADIUS and TACACS+ differ?
RADIUS uses UDP and combines authentication with authorization. TACACS+ uses TCP and separates them.
3.7What is an evil twin?
A rogue access point advertising a trusted SSID. A rogue DHCP server instead hands out its own gateway.
3.8What does ARP poisoning change?
The IP-to-MAC mapping, so traffic goes to the attacker. DNS poisoning changes the name-to-IP answer instead.
3.9What is a screened subnet?
A segment that faces untrusted networks, with internal systems behind it. An ACL enforces that boundary.
3.10How do SNMPv2c and SNMPv3 differ?
v2c uses a community string in clear text. v3 authenticates and can encrypt. Traps use UDP 162. Queries use UDP 161.
Deck 4 · Troubleshooting
The method, the symptom, and the command that answers it.
4.1What is the Network+ troubleshooting order?
Identify, theorize, test, plan, implement or escalate, verify, then document. Do not replace hardware before you identify the problem.
4.2A host reaches its own subnet and nothing else. What is wrong?
The default gateway is missing or wrong. A bad mask would also hide some local hosts. The cable is fine if the subnet answers.
4.3New clients receive 169.254 addresses. What ran out?
The DHCP pool, or the server is unreachable. 169.254 is APIPA, not a planned private range.
4.4What do late collisions on an interface usually mean?
A duplex mismatch. CRC errors and runts point more at a damaged cable or interference.
4.5How does error-disabled differ from administratively down?
Error-disabled means the switch shut the port after a violation. Administratively down means someone configured it shut.
4.6What does ping test, and what does traceroute add?
Ping tests whether an address answers. Traceroute shows which hop stops answering.
4.7Which table does show mac-address-table display?
The switch CAM: which port learned each MAC. show route is the routing table. show arp is IP to MAC.
4.8When do you use a toner instead of a cable tester?
To trace which cable end belongs to which port. A tester checks the wiremap. A visual fault locator is for fiber.
4.9A fiber link lights on one side only. What was swapped?
Transmit and receive. A single-mode optic in a multimode port is a different mismatch.
4.10Clients on 2.4 GHz are slow, and the cable plant tests clean. What overlaps?
Adjacent channels, such as 1 and 2. Use 1, 6, and 11. This is not a duplex problem.
Memory notes
Groupings that make the highest-yield Network+ facts easier to recall.
Masks
/24 has 254 hosts, /25 has 126, /26 has 62, /27 has 30, /28 has 14, /29 has 6, and /30 has 2. Subtract two from the address count.
Route order
Longest prefix, then lowest administrative distance, then lowest metric. Connected 0, static 1, OSPF 110.
Recovery
RPO is data. RTO is time. Hot, then warm, then cold. Full tunnel sends everything. Split tunnel sends a list.
Poison
ARP poisoning swaps a MAC. DNS poisoning swaps an address. An evil twin copies an SSID. A rogue DHCP server copies the offer.
Seven steps
Identify, theorize, test, plan, implement, verify, document. A link light is not the end of identify.
Continue the Network+ study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 720 passing score, five domain weights, and the N10-008 comparison.
Core Notes
Reference notes for layers, ports, routing, switching, wireless, services, and troubleshooting.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for ports, masks, and the troubleshooting order.
Practice Exams
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Related Tools
Useful companions while you study.
Scientific Calculator
Calculate trigonometric functions, logarithms, powers, roots, factorials, and advanced expressions.
Unit Converter
Convert length, weight, volume, temperature, area, speed, pressure, and other measurements.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Time Calculator
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Legal Disclaimer
NodnWebTools provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and Network+ are trademarks of CompTIA, Inc. NodnWebTools is not affiliated with, endorsed by, or sponsored by CompTIA.