22 Networking, Virtualization & Cloud Practice Questions & Answers

Every Networking, Virtualization & Cloud practice question from the CompTIA A+ Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A technician is publishing an internal web application that must encrypt all traffic between the user's browser and the server. Which TCP port must be allowed through the firewall?
- A.TCP 143
- B.TCP 80
- C.TCP 443✓ Answer
- D.TCP 3389
HTTPS carries HTTP inside a TLS session and is assigned to TCP 443, so that port must be open for encrypted web traffic to reach the server. TCP 80 is plain HTTP, which would leave credentials and page content readable on the wire; 143 is IMAP and 3389 is RDP, neither of which serves web pages.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, TCP/UDP ports and protocols (HTTPS = TCP 443); IANA service name and port number registryReport a problem with this question
2. A security audit finds that administrators manage a server over Telnet, sending usernames and passwords across the network in cleartext. Which protocol and port should replace it?
- A.SMTP on TCP 25
- B.Telnet on TCP 23 with a longer password
- C.SSH on TCP 22✓ Answer
- D.FTP on TCP 21
SSH on TCP 22 is the encrypted replacement for Telnet: it negotiates a cryptographic session before authentication, so credentials and command output are never exposed on the wire. A stronger password does not help, because Telnet on port 23 transmits it unencrypted; FTP (21) is also cleartext and is a file transfer protocol, and SMTP (25) sends mail.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, TCP/UDP ports and protocols (Telnet TCP 23 insecure vs. SSH TCP 22 encrypted)Report a problem with this question
3. A help desk technician must open a full graphical remote session to a Windows server that sits behind a firewall. Which port must the firewall permit?
- A.TCP 22
- B.TCP 445
- C.TCP 3389✓ Answer
- D.UDP 53
Remote Desktop Protocol uses port 3389, so a graphical remote-control session fails unless that port is reachable. Port 22 (SSH) gives an encrypted command line rather than a desktop, 445 is SMB file and printer sharing, and 53 is DNS name resolution.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, TCP/UDP ports and protocols (RDP = 3389)Report a problem with this question
4. After a firewall change, Windows users can ping the file server by IP but can no longer map drives to its shares or connect to shared printers. Which port was most likely blocked?
- A.TCP 389
- B.TCP 110
- C.TCP 23
- D.TCP 445✓ Answer
Windows file and printer sharing runs on SMB/CIFS, which listens on TCP 445; ICMP pings still succeed because they do not use that port, which is exactly why connectivity looks fine while shares fail. Port 389 is LDAP directory lookups, 110 is POP3 mail retrieval, and 23 is Telnet.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, TCP/UDP ports and protocols (SMB/CIFS = TCP 445)Report a problem with this question
5. A user reads company mail on a phone, a tablet, and a laptop and wants messages to stay on the server so that read status and folders match on every device. Which retrieval protocol and port fits?
- A.LDAP on TCP 389
- B.POP3 on TCP 110
- C.SMTP on TCP 25
- D.IMAP on TCP 143✓ Answer
IMAP (TCP 143) keeps the mailbox on the server and synchronizes folder structure and read/unread state, so every device sees the same view. POP3 (TCP 110) is designed to download messages to one client and typically removes them from the server, SMTP (TCP 25) only sends mail, and LDAP (TCP 389) queries a directory service.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, TCP/UDP ports and protocols (POP3 110 vs. IMAP 143 vs. SMTP 25)Report a problem with this question
6. A technician is asked why voice-over-IP and live video calls are carried over UDP instead of TCP. Which explanation is correct?
- A.TCP is preferred for voice because its three-way handshake removes jitter
- B.UDP avoids handshakes and retransmission, keeping delay low — a packet that arrives late is useless in a live conversation anyway✓ Answer
- C.UDP guarantees ordered, acknowledged delivery with less overhead than TCP
- D.UDP encrypts real-time media, while TCP does not
UDP is a best-effort transport with no connection setup and no retransmission, so it delivers media with minimal delay; TCP's acknowledgements and resends would add latency to rebuild audio that has already passed the moment it was needed. Encryption is a separate function of neither transport, and it is TCP — not UDP — that guarantees ordered, acknowledged delivery.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, comparing TCP (reliable, acknowledged) and UDP (best-effort, low overhead)Report a problem with this question
7. A workstation shows the address 169.254.13.7 with mask 255.255.0.0 and no default gateway. It can reach a few other machines on the same LAN but nothing on other subnets or the internet. What does this indicate?
- A.The ISP has assigned a temporary public address
- B.The client could not reach a DHCP server and self-assigned an APIPA link-local address✓ Answer
- C.The network adapter hardware has failed
- D.The DNS server addresses are misconfigured on the client
Any address in 169.254.0.0/16 is self-assigned by the client when no DHCP server answers, which is why there is no gateway and no off-subnet reachability; troubleshooting should target the DHCP service, the link, or the path to the DHCP server. A DNS problem would still allow connections by IP address, and a dead NIC would produce no link and no address at all.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, IP addressing (APIPA 169.254.0.0/16 automatic private addressing); RFC 3927 IPv4 link-local addressingReport a problem with this question
8. Which of the following is a private IPv4 address that cannot be routed on the public internet and must be translated by NAT?
- A.172.20.5.10✓ Answer
- B.192.169.1.10
- C.11.10.0.5
- D.172.40.5.10
The reserved private ranges are 10.0.0.0/8, 172.16.0.0 through 172.31.255.255, and 192.168.0.0/16, so 172.20.5.10 falls inside the 172.16–172.31 block. 172.40.5.10 is above that boundary, 192.169.1.10 is one octet outside 192.168, and 11.x.x.x is outside the 10.0.0.0/8 block — all three are public addresses.
Source: RFC 1918 private address allocations, as tested in the CompTIA A+ Core 1 Networking domain (public vs. private addressing)Report a problem with this question
9. A workstation is set to IP 192.168.10.24, mask 255.255.255.0, gateway 192.168.11.1. It reaches other hosts on its own LAN normally but cannot reach anything on the internet. What is the cause?
- A.192.168.x.x addresses cannot be used with a /24 mask
- B.With a 255.255.255.0 mask the host's network is 192.168.10.x, so the gateway at 192.168.11.1 is on a different subnet and is unreachable as a next hop✓ Answer
- C.DNS resolution is failing on the workstation
- D.The subnet mask is too small for internet access
The subnet mask decides which part of the address is the network: 255.255.255.0 makes 192.168.10.0 the local network, so 192.168.11.1 lies outside it. A host can only forward off-subnet traffic to a gateway that is inside its own subnet, so local traffic still works while everything beyond the LAN fails. A DNS failure would instead let connections by IP address succeed.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, IP addressing (subnet mask and default gateway relationship)Report a problem with this question
10. Which statement correctly describes IPv6 addressing?
- A.IPv6 requires NAT because its address space is smaller than IPv4's
- B.Addresses are 128 bits long, written as eight groups of four hexadecimal digits; one run of consecutive zero groups may be compressed with '::', and broadcast is replaced by multicast and anycast✓ Answer
- C.Addresses are 64 bits long and written in dotted decimal like IPv4
- D.IPv6 hosts send broadcasts to 255.255.255.255 exactly as IPv4 hosts do
IPv6 was created to escape IPv4 address exhaustion, so it uses a 128-bit address written as eight hexadecimal quartets, with '::' allowed once per address to collapse a single run of zero groups. Because the huge address space removes the need for address conservation, NAT is not required, and IPv6 has no broadcast at all — it uses multicast and anycast instead.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, IPv4 vs. IPv6 addressing concepts (128-bit hexadecimal notation, zero compression, no broadcast)Report a problem with this question
11. An administrator must publish an SPF policy listing which mail servers are authorized to send messages for the company's domain. Which DNS record type holds it?
- A.MX
- B.TXT✓ Answer
- C.A
- D.CNAME
SPF — like DKIM and DMARC — is published as free-form text inside a DNS TXT record, which receiving mail servers query to validate the sending source. An MX record designates the servers that receive mail for a domain, an A record maps a hostname to an IPv4 address, and a CNAME makes one name an alias for another.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, DNS record types (A, AAAA, CNAME, MX, TXT used for SPF/DKIM/DMARC); RFC 7208, SPF published in DNS TXT recordsReport a problem with this question
12. A network printer must always answer at the same IP address, but the administrator wants it to keep getting its configuration from the DHCP server rather than being configured by hand. What should be done?
- A.Shorten the lease time for the scope
- B.Add that address to the DHCP exclusion list
- C.Create a DHCP reservation that binds the printer's MAC address to that IP address✓ Answer
- D.Enlarge the DHCP scope so more addresses are available
A reservation ties a specific MAC address to a specific address in the scope, so the device always receives the same lease while its mask, gateway, and DNS settings still come from DHCP. An exclusion does the opposite — it removes an address from the pool so DHCP never hands it out — and lease length or scope size does not pin an address to one device.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, DHCP concepts (scope, lease, reservation, exclusion)Report a problem with this question
13. Which statement best describes the functional difference between a switch and a hub?
- A.A switch assigns IP addresses to clients, while a hub depends on a DHCP server
- B.A hub filters traffic by IP address, while a switch does not examine addresses at all
- C.A switch routes traffic between different IP networks, while a hub forwards traffic within one network
- D.A switch learns MAC addresses and forwards each frame only out the port where the destination sits, while a hub repeats every incoming frame out all other ports✓ Answer
A switch works at Layer 2: it builds a table of MAC addresses per port and forwards frames selectively, which gives each port its own collision domain and keeps traffic off ports that do not need it. A hub is a simple repeater with no address awareness, so every device sees all traffic and shares one collision domain; routing between IP networks is the router's job, not the switch's.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, networking hardware devices (hub vs. Layer 2 switch vs. Layer 3 router)Report a problem with this question
14. A laptop several interior walls away from the access point keeps dropping off the 5 GHz SSID but stays connected on the 2.4 GHz SSID. Which explanation best fits?
- A.2.4 GHz signals travel farther and pass through walls better, although that band is more crowded and offers only three non-overlapping 20 MHz channels✓ Answer
- B.2.4 GHz is immune to interference from Bluetooth devices and microwave ovens
- C.5 GHz always outperforms 2.4 GHz, so the client radio must be defective
- D.5 GHz provides fewer channels, which forces clients onto overlapping channels
Lower-frequency 2.4 GHz signals attenuate less through walls and cover more distance, while 5 GHz offers more channels and higher throughput over a shorter, more obstruction-sensitive range — so 5 GHz is not automatically the better band. The 2.4 GHz band is in fact the noisy one, shared with Bluetooth, cordless phones, and microwave ovens, which is why a Wi-Fi analyzer site survey is used to pick a clean, non-overlapping channel.
Source: CompTIA A+ Core 1 exam objectives — Networking domain, wireless networking technologies (2.4 GHz vs. 5 GHz range/throughput trade-off, channel selection and interference)Report a problem with this question
15. A 400 m (about 1,300 ft) link must be run between two buildings, passing close to motor control panels and other heavy electrical equipment. Which media choice best fits the requirement?
- A.Coaxial cable, which is unaffected by distance
- B.Cat 6 twisted pair, which supports that distance if it is shielded
- C.Fiber optic cable, which carries light and is therefore immune to electromagnetic interference while easily exceeding copper Ethernet's roughly 100 m limit✓ Answer
- D.A powered USB extension cable
Fiber transmits pulses of light rather than electrical signals, so nearby motors and power equipment cannot induce noise on it, and it supports runs far longer than the roughly 100 m maximum of a copper Ethernet channel. Shielding does not extend twisted pair past that limit, coaxial is still copper and distance-limited, and USB is a peripheral bus, not a building-to-building network medium.
Source: CompTIA A+ Core 1 exam objectives — network media characteristics (fiber vs. copper: EMI immunity and distance); IEEE Ethernet 100 m copper channel limit. Adjacent to the Networking domain; media types are covered under the hardware domain.Report a problem with this question
16. A datacenter installs virtualization software directly onto bare server hardware, with no general-purpose operating system running beneath it. What is this software called?
- A.A Type 2 (hosted) hypervisor
- B.A Type 1 (bare-metal) hypervisor✓ Answer
- C.A thin client
- D.A container runtime engine
A Type 1 hypervisor runs directly on the hardware and manages CPU, memory, and I/O for its guests itself, which is why it delivers better performance and a smaller attack surface for production datacenters. A Type 2 hypervisor is an application installed on top of an existing desktop or server OS, a container engine shares the host kernel instead of virtualizing hardware, and a thin client is an endpoint device.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, hypervisor types (Type 1 bare-metal vs. Type 2 hosted)Report a problem with this question
17. Why do containers typically start in seconds and consume far less memory and disk than full virtual machines running the same application?
- A.Containers run directly on dedicated physical hardware, bypassing the host entirely
- B.Each container includes its own guest operating system kernel, which is smaller than a hypervisor
- C.Containers share the host operating system's kernel and package only the application and its dependencies, so there is no separate guest OS to boot✓ Answer
- D.Containers emulate hardware, which gives them stronger isolation than virtual machines
A virtual machine abstracts a whole computer — virtual CPU, memory, disk, and NIC — and must boot a complete guest OS, whereas a container is only an isolated process set on the shared host kernel, so the OS overhead disappears. That sharing is also the trade-off: containers are lighter and faster but provide weaker isolation than a VM with its own kernel.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, virtualization concepts (containers vs. virtual machines)Report a problem with this question
18. A development team wants to deploy application code while the provider supplies and maintains the servers, operating system, and language runtime. The team still writes and controls the application itself. Which cloud service model is this?
- A.IaaS
- B.SaaS
- C.A privately owned on-premises datacenter
- D.PaaS✓ Answer
Platform as a Service sits between the other two: the provider manages everything up through the OS and runtime, and the customer is responsible only for the application code and its data. With IaaS the customer would also have to install and patch the operating system, and with SaaS the application itself is finished and supplied by the provider, leaving nothing for the team to write.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, cloud service models; NIST SP 800-145 definition of Platform as a ServiceReport a problem with this question
19. An organization runs virtual machines on a public IaaS provider. Who is responsible for installing operating system security updates inside those VMs?
- A.The customer, because in IaaS the provider delivers virtualized compute, storage, and networking while the customer manages the OS, applications, and data✓ Answer
- B.The provider, because IaaS by definition includes managed operating systems
- C.Neither party, because virtual machines are isolated and therefore cannot be attacked
- D.The provider, because it owns and operates the physical hardware
Shared responsibility in IaaS draws the line at the virtualization layer: the provider secures the facilities, hardware, and hypervisor, and everything installed inside the guest — OS, middleware, applications, and data — belongs to the customer. Isolation between guests does not patch software, so an unpatched guest OS remains exploitable over the network.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, cloud service models and shared responsibility; NIST SP 800-145 definition of Infrastructure as a ServiceReport a problem with this question
20. Several county health agencies that must all meet the same patient-privacy regulations jointly fund and share one cloud environment built for that requirement. Which deployment model is this?
- A.Private cloud
- B.Hybrid cloud
- C.Community cloud✓ Answer
- D.Public cloud
A community cloud is shared by several distinct organizations that have a common mission, policy, or compliance requirement, and they share its cost and governance. A public cloud is open to any paying customer, a private cloud serves a single organization, and a hybrid cloud is the orchestrated combination of a private and a public environment.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, cloud deployment models; NIST SP 800-145 definition of community cloudReport a problem with this question
21. An online retailer's cloud platform automatically adds compute capacity as traffic surges during a sale and releases that capacity once traffic falls back. Which cloud characteristic does this describe?
- A.High availability
- B.File synchronization
- C.Elasticity✓ Answer
- D.Multitenancy
Elasticity is the ability to scale resources both up and back down automatically in response to demand, which is what keeps cost aligned with actual load. High availability is about staying reachable through failures using redundancy, multitenancy means several customers share the same underlying infrastructure while staying logically separated, and file synchronization keeps copies of files current across devices.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, cloud characteristics (elasticity vs. availability vs. multitenancy)Report a problem with this question
22. A company uploaded backup data to cloud object storage with no transfer charge, but restoring several terabytes back to its own datacenter produced a large bill. Which cloud concept explains this?
- A.Stored data is billed only the first time it is read
- B.Restoring data requires converting the deployment model from public to hybrid
- C.Metered utilization bills for egress — data leaving the provider's network — while ingress into the cloud is typically free✓ Answer
- D.Cloud providers bill per file rather than per gigabyte
Cloud services use metered utilization, and providers generally do not charge to receive data but do charge for the volume of data transferred out of their network, so large restores and bulk downloads carry a real cost. That asymmetry is a planning factor for backup and disaster-recovery designs, and it has nothing to do with the deployment model or with per-file pricing.
Source: CompTIA A+ Core 1 exam objectives — Virtualization and Cloud Computing domain, cloud characteristics (metered utilization, data ingress vs. egress)Report a problem with this question

Practice questions written to the published CompTIA A+ Core 1 and Core 2 exam objectives and to standard IT support practice. CompTIA and A+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. The exam objectives are revised periodically — confirm the current objectives and exam requirements with CompTIA before testing. About the CompTIA A+ certification →

1. A technician is publishing an internal web application that must encrypt all traffic between the user's browser and the server. Which TCP port must be allowed through the firewall?

2. A security audit finds that administrators manage a server over Telnet, sending usernames and passwords across the network in cleartext. Which protocol and port should replace it?

3. A help desk technician must open a full graphical remote session to a Windows server that sits behind a firewall. Which port must the firewall permit?

4. After a firewall change, Windows users can ping the file server by IP but can no longer map drives to its shares or connect to shared printers. Which port was most likely blocked?

5. A user reads company mail on a phone, a tablet, and a laptop and wants messages to stay on the server so that read status and folders match on every device. Which retrieval protocol and port fits?

6. A technician is asked why voice-over-IP and live video calls are carried over UDP instead of TCP. Which explanation is correct?

7. A workstation shows the address 169.254.13.7 with mask 255.255.0.0 and no default gateway. It can reach a few other machines on the same LAN but nothing on other subnets or the internet. What does this indicate?

8. Which of the following is a private IPv4 address that cannot be routed on the public internet and must be translated by NAT?

9. A workstation is set to IP 192.168.10.24, mask 255.255.255.0, gateway 192.168.11.1. It reaches other hosts on its own LAN normally but cannot reach anything on the internet. What is the cause?

10. Which statement correctly describes IPv6 addressing?

11. An administrator must publish an SPF policy listing which mail servers are authorized to send messages for the company's domain. Which DNS record type holds it?

12. A network printer must always answer at the same IP address, but the administrator wants it to keep getting its configuration from the DHCP server rather than being configured by hand. What should be done?

13. Which statement best describes the functional difference between a switch and a hub?

14. A laptop several interior walls away from the access point keeps dropping off the 5 GHz SSID but stays connected on the 2.4 GHz SSID. Which explanation best fits?

15. A 400 m (about 1,300 ft) link must be run between two buildings, passing close to motor control panels and other heavy electrical equipment. Which media choice best fits the requirement?

16. A datacenter installs virtualization software directly onto bare server hardware, with no general-purpose operating system running beneath it. What is this software called?

17. Why do containers typically start in seconds and consume far less memory and disk than full virtual machines running the same application?

18. A development team wants to deploy application code while the provider supplies and maintains the servers, operating system, and language runtime. The team still writes and controls the application itself. Which cloud service model is this?

19. An organization runs virtual machines on a public IaaS provider. Who is responsible for installing operating system security updates inside those VMs?

20. Several county health agencies that must all meet the same patient-privacy regulations jointly fund and share one cloud environment built for that requirement. Which deployment model is this?

21. An online retailer's cloud platform automatically adds compute capacity as traffic surges during a sale and releases that capacity once traffic falls back. Which cloud characteristic does this describe?

22. A company uploaded backup data to cloud object storage with no transfer charge, but restoring several terabytes back to its own datacenter produced a large bill. Which cloud concept explains this?