21 Network Operations Practice Questions & Answers

Every Network Operations practice question from the CompTIA Network+ Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A technician must determine which patch panel port and which switch port a specific office wall jack terminates on. Which piece of network documentation answers this directly?
- A.The cable map✓ Answer
- B.The asset inventory
- C.The wireless heat map
- D.The logical network diagram
A cable map records both ends of every cable run — wall jack, patch panel position, and the switch port it patches into — and is kept consistent through a formal labeling scheme, so it is the only document that resolves a jack to a port. A logical diagram deliberately omits physical cabling and shows only VLANs, subnets, and traffic flow, and an asset inventory tracks devices rather than cable terminations.
Source: CompTIA Network+ — Network Operations domain; ANSI/TIA-606 labeling standardReport a problem with this question
2. An engineer needs to know which VLAN a server belongs to, which IP subnet it is addressed in, and how traffic is routed to it. Which type of diagram is designed to show that information?
- A.The logical network diagram✓ Answer
- B.The rack elevation diagram
- C.The cable map
- D.The physical network diagram
A logical diagram represents the network as addressing and forwarding see it — VLANs, IP subnets, gateways, and the path traffic takes — without regard to where equipment physically sits. Physical diagrams, rack elevations, and cable maps all describe placement and media, which cannot tell you a server's VLAN or subnet membership.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
3. Before ordering two 2U servers, an administrator must confirm that enough contiguous rack units are free in a cabinet and consider how the added equipment affects that cabinet's power and airflow. Which document is intended for this?
- A.The cable map
- B.The asset inventory
- C.The rack elevation diagram✓ Answer
- D.The logical network diagram
A rack elevation diagram shows, unit by unit, which device occupies which rack unit and its front or rear orientation, which is exactly what space, weight, power draw, and airflow planning require. The other documents record addressing, cable terminations, or ownership data and contain no representation of physical rack space.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
4. A network team repeatedly encounters duplicate IP addresses, exhausted DHCP pools, and static reservations left behind by decommissioned hosts. Which practice is specifically intended to prevent these problems?
- A.IP address management (IPAM)✓ Answer
- B.Maintaining a rack diagram
- C.Performing a wireless site survey
- D.Forwarding all device logs to a syslog collector
IPAM is the authoritative record of every subnet and every address allocation, and because it is normally integrated with the address assignment and name services it detects conflicts and reclaims addresses when a host is decommissioned. Logging, rack drawings, and wireless surveys document other dimensions of the network entirely and cannot arbitrate address ownership.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
5. A distribution switch is still operating correctly, but the manufacturer has declared that model end-of-support. Why does end-of-support, rather than end-of-life alone, force a replacement plan?
- A.End-of-support only means the model is no longer sold, so security patches keep being released
- B.End-of-support means the warranty expired, but the vendor continues to supply firmware fixes
- C.End-of-support means the vendor will issue no further patches, updates, or fixes, so newly discovered vulnerabilities on that device will never be remediated✓ Answer
- D.End-of-support only requires removing the device from the asset inventory and has no security consequences
End-of-life marks the point at which a product stops being sold or manufactured while limited support and security fixes may continue, whereas end-of-support terminates all patches, updates, and vendor assistance. Once no fixes will ever be issued, every future vulnerability in that device is permanently unpatchable, which is a security and compliance trigger to replace hardware that otherwise still works.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
6. Users report that the network 'feels slow.' Monitoring shows the main uplink averaging 45% utilization and round-trip latency of 12 ms. What does the team need in order to decide whether these figures actually represent a problem?
- A.The golden (baseline) configuration stored for the uplink switch
- B.The service-level agreement signed with the circuit provider
- C.A performance baseline of these same metrics captured over a representative period of normal operation✓ Answer
- D.The asset inventory record for the uplink switch
A performance baseline is a recorded reference of normal behavior across peak and off-peak periods, and without it a raw number such as 45% utilization is meaningless because there is nothing to compare it against and no defensible threshold. Note that a configuration baseline or golden configuration is a different artifact entirely: it defines approved settings, not normal metric ranges.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
7. A compliance requirement states that network management polling must authenticate the management station and encrypt the contents of every management message. Which SNMP configuration satisfies both requirements?
- A.SNMP v2c with a long, non-default community string
- B.SNMP v3 using the authPriv security level✓ Answer
- C.SNMP v3 using the noAuthNoPriv security level
- D.SNMP v2c with the default read-only community string
Only SNMP v3 provides real authentication and message integrity plus a privacy (encryption) service, and the authPriv security level is the one that enables both; authNoPriv authenticates without encrypting and noAuthNoPriv does neither. A community string in v2c is transmitted in cleartext and functions as a shared password, so lengthening it hides nothing from anyone able to capture the traffic.
Source: RFC 3414 (SNMP User-based Security Model); CompTIA Network+ — Network Operations domainReport a problem with this question
8. A monitoring design requires that a device be able to send an unsolicited notification when a link fails, and that the sender learn whether the management station actually received it so the notification can be retransmitted if it was lost. Which SNMP mechanism meets this requirement?
- A.A scheduled SNMP GET poll issued by the manager
- B.An SNMP inform✓ Answer
- C.An SNMP SET operation
- D.An SNMP trap
An inform is an agent-initiated notification that the receiver must acknowledge, so the sender can detect loss and retransmit; a trap is fire-and-forget and, being carried over a connectionless transport, gives the agent no indication that it was ever delivered. A GET poll is manager-initiated rather than event-driven, and SET writes a value to the agent instead of reporting an event.
Source: RFC 3416 (SNMP protocol operations); CompTIA Network+ — Network Operations domainReport a problem with this question
9. In the syslog severity scale, which numeric value and label identify the most severe condition a device can report?
- A.7, Debug
- B.0, Emergency✓ Answer
- C.1, Alert
- D.4, Warning
Syslog severity runs from 0 to 7 with the scale inverted relative to intuition: 0 Emergency is the most severe and 7 Debug the least, with Alert, Critical, Error, Warning, Notice, and Informational in between. This matters operationally because configuring a device to log at severity 7 sends every debug message to the collector, which can flood storage and the management link.
Source: RFC 5424 (the Syslog Protocol)Report a problem with this question
10. For capacity planning, a team must identify which internal hosts consumed the most bandwidth over the past week, to which destinations and over which ports, using a method that does not require storing terabytes of traffic. Which monitoring method fits best?
- A.Flow data exported by the routers and switches to a collector✓ Answer
- B.SNMP traps from the edge devices
- C.Syslog messages from each switch
- D.Full packet capture on the core uplink
Flow data records conversation metadata — source and destination address, source and destination port, protocol, ingress interface, and packet and byte counts — which is exactly what top-talker and capacity analysis needs, at a tiny fraction of the storage cost because no payload is kept. Full packet capture would answer the same question but stores complete frames including payload, and syslog and traps report events rather than per-conversation volume.
Source: RFC 7011 (IPFIX protocol specification); CompTIA Network+ — Network Operations domainReport a problem with this question
11. A forensic analysis must see every frame crossing a heavily loaded 1 Gbps link, including frames with CRC errors, and must not add load to the switch or risk silently dropping traffic. Which capture method best meets these constraints?
- A.A passive network TAP installed inline on the link✓ Answer
- B.A remote mirror (RSPAN) session carried across switches
- C.Flow data exported to a collector
- D.A switch port mirror (SPAN) session to a monitor port
A passive TAP sits in the physical path and copies the signal in hardware, so it consumes no switch CPU, cannot be starved by a busy control plane, and passes through errored frames that a switch would normally discard. Mirroring depends on switch resources and drops frames whenever the mirrored traffic exceeds the monitor port's capacity, and flow data records metadata only, with no frames to examine at all.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
12. A monitoring system sends a probe to every router and firewall each minute, records whether the device responded, and produces an uptime percentage used for service-level reporting. Which category of monitoring is this?
- A.Availability monitoring✓ Answer
- B.Performance monitoring
- C.Configuration monitoring
- D.Traffic analysis
Availability monitoring answers only the binary question of whether a device or service is reachable, and aggregating those results over time is what produces uptime figures for service-level reporting. Performance monitoring measures how well a reachable device is running against its baseline, traffic analysis examines what is flowing and between whom, and configuration monitoring compares running configurations against the approved baseline.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
13. A business states that a failure of the order-processing system must never cost more than 15 minutes of transactions. Which recovery metric is being defined, and what does it primarily dictate?
- A.Recovery time objective (RTO); it dictates how often backups must run
- B.Recovery point objective (RPO); it dictates how frequently data must be backed up or replicated✓ Answer
- C.Mean time between failures (MTBF); it dictates the hardware refresh interval
- D.Mean time to repair (MTTR); it dictates how quickly staff must respond to a ticket
RPO is the maximum tolerable amount of data loss measured backward from the moment of the incident, so a 15-minute RPO requires backups, snapshots, or replication at least every 15 minutes. RTO is the separate, forward-looking limit on how long the service may stay down, and it is improved by faster restore capability or standby infrastructure rather than by backing up more often.
Source: CompTIA Network+ — Network Operations domain; NIST contingency planning guidance (SP 800-34)Report a problem with this question
14. Which metric is the average elapsed time required to restore a failed but repairable device to service, making it a measure of maintainability rather than of how often failures occur?
- A.Recovery point objective (RPO)
- B.Mean time between failures (MTBF)
- C.Mean time to repair (MTTR)✓ Answer
- D.Recovery time objective (RTO)
MTTR averages the actual repair durations observed from detection to restoration, so it describes how maintainable a system is and is commonly written into service-level agreements. MTBF averages the operating time between failures and therefore describes reliability; both raise availability, since availability equals MTBF divided by the sum of MTBF and MTTR, but they do so by different levers, and RPO and RTO are targets set by the business rather than measured averages.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
15. An organization must be able to resume operations at an alternate facility within roughly four hours, but cannot fund a continuously replicated, fully staffed duplicate data center. Which recovery site type best matches these constraints?
- A.A cold site
- B.A warm site✓ Answer
- C.No alternate site, relying on off-site backup media shipped in after an incident
- D.A hot site
A warm site is partially equipped, with hardware and software already installed and data restored from backups or periodic replication, which typically brings recovery within hours at moderate cost. A cold site provides only conditioned space, power, and connectivity and would take days, a hot site meets the shortest recovery targets but at the highest sustained cost, and relying on shipped media alone cannot meet a four-hour target.
Source: CompTIA Network+ — Network Operations domain; NIST contingency planning guidance (SP 800-34)Report a problem with this question
16. Compared with an active-passive cluster, which statement correctly describes an active-active cluster?
- A.One node forwards traffic while the other stays idle, which removes any need to size nodes for the full load
- B.It eliminates the need for a failover mechanism, because traffic distribution means no individual node can fail
- C.It provides no increase in aggregate capacity over a single node under normal conditions
- D.All nodes forward traffic at the same time, so state must be synchronized between them and each surviving node must be sized to absorb the full load if a peer fails✓ Answer
In an active-active design every node handles production traffic simultaneously, which adds aggregate capacity but requires session or state synchronization so a flow is not broken when it moves, and it forces each node to be provisioned for the whole load because losing one node removes part of the total capacity. Active-passive keeps a standby idle and is simpler and more deterministic, but adds no capacity and still incurs failover time.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
17. A response team meets in a conference room and talks through the disaster recovery plan step by step, confirming roles, decision authority, and contact lists. No system is failed over and nothing is restored. How should this exercise be classified, and what does it not establish?
- A.A tabletop exercise, which validates roles and exposes gaps in the plan but does not prove the recovery itself works✓ Answer
- B.A configuration audit, which confirms devices match the golden configuration
- C.A full failover test of the recovery site, which also verifies data integrity
- D.A validation test, which proves the documented RTO can be met
A tabletop exercise is discussion-based: nothing in production is touched, so it is cheap and low-risk and is excellent for testing whether people, roles, and contact procedures hold together. Only a validation test — actually restoring from backup or failing over to the recovery site — demonstrates that the documented recovery point and recovery time objectives are achievable in practice.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
18. In a data center, racks are arranged so that equipment air intakes on facing rows draw from one shared aisle while exhausts discharge into the adjacent aisles. What is the primary purpose of this arrangement?
- A.It keeps hot exhaust air from being drawn back into equipment intakes, so intake temperatures stay uniform and cooling remains effective✓ Answer
- B.It increases the number of usable rack units in each cabinet
- C.It shortens patch cable runs and lowers cabling cost
- D.It is required in order to bond and ground the racks correctly
Hot-aisle and cold-aisle layout separates supply air from exhaust air so that heated discharge cannot recirculate into the front of neighboring equipment, which is what causes local hot spots and thermal shutdowns even when the room average looks acceptable. Grounding, cable length, and rack unit capacity are governed by other design decisions entirely.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
19. At what point in the change management process must a documented rollback (back-out) plan exist for a firmware upgrade on a core switch?
- A.Before implementation, as part of the approved change request, together with a current configuration backup✓ Answer
- B.Immediately after the change fails its post-implementation validation
- C.Only for emergency changes, since standard and normal changes are reviewed in advance
- D.At the next scheduled review, once the change has run in production for a full cycle
The rollback plan and a verified configuration backup are prerequisites for approval, because once a change has degraded a production service there is no time to design a recovery path and the saved configuration may no longer be obtainable from the failed device. Writing the plan afterward defeats its purpose, and the requirement applies to any change that can affect service, not only emergencies.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
20. An application that worked yesterday is now unreachable from one building. No hardware alarms are present and monitoring shows all devices up. Which record should the technician consult first?
- A.The rack elevation diagram
- B.The wireless heat map
- C.The change and service request records covering recent changes to that path✓ Answer
- D.The asset inventory
When something that previously worked stops working and no failure is reported, the most probable cause is a change, so the ticketed change record — which captures who requested what, on which systems, when, and with what approval — is the fastest path to the cause and gives the audit trail needed to reverse it. Rack drawings, heat maps, and inventories describe steady-state facts and record nothing about what was modified.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question
21. An automated comparison reports that a switch's running configuration no longer matches the approved baseline (golden) configuration. Investigation shows the difference came from a change that was properly requested, risk-assessed, and approved. What is the correct next step?
- A.Immediately revert the running configuration to the stored baseline
- B.Delete the baseline and treat whatever is running as authoritative, without review
- C.Promote the approved change into a new version of the baseline configuration and refresh the stored configuration backup✓ Answer
- D.Disable configuration monitoring for that device so the alerts stop
Configuration drift is resolved in one of two ways: revert production if the difference was unauthorized, or, when the change was approved, version the baseline forward so the standard template reflects reality and any replacement device is built the same way. Leaving the baseline stale would cause future rebuilds to silently undo an approved change, and silencing the monitor removes the only control that detects drift at all.
Source: CompTIA Network+ — Network Operations domainReport a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →

1. A technician must determine which patch panel port and which switch port a specific office wall jack terminates on. Which piece of network documentation answers this directly?

2. An engineer needs to know which VLAN a server belongs to, which IP subnet it is addressed in, and how traffic is routed to it. Which type of diagram is designed to show that information?

3. Before ordering two 2U servers, an administrator must confirm that enough contiguous rack units are free in a cabinet and consider how the added equipment affects that cabinet's power and airflow. Which document is intended for this?

4. A network team repeatedly encounters duplicate IP addresses, exhausted DHCP pools, and static reservations left behind by decommissioned hosts. Which practice is specifically intended to prevent these problems?

5. A distribution switch is still operating correctly, but the manufacturer has declared that model end-of-support. Why does end-of-support, rather than end-of-life alone, force a replacement plan?

6. Users report that the network 'feels slow.' Monitoring shows the main uplink averaging 45% utilization and round-trip latency of 12 ms. What does the team need in order to decide whether these figures actually represent a problem?

7. A compliance requirement states that network management polling must authenticate the management station and encrypt the contents of every management message. Which SNMP configuration satisfies both requirements?

8. A monitoring design requires that a device be able to send an unsolicited notification when a link fails, and that the sender learn whether the management station actually received it so the notification can be retransmitted if it was lost. Which SNMP mechanism meets this requirement?

9. In the syslog severity scale, which numeric value and label identify the most severe condition a device can report?

10. For capacity planning, a team must identify which internal hosts consumed the most bandwidth over the past week, to which destinations and over which ports, using a method that does not require storing terabytes of traffic. Which monitoring method fits best?

11. A forensic analysis must see every frame crossing a heavily loaded 1 Gbps link, including frames with CRC errors, and must not add load to the switch or risk silently dropping traffic. Which capture method best meets these constraints?

12. A monitoring system sends a probe to every router and firewall each minute, records whether the device responded, and produces an uptime percentage used for service-level reporting. Which category of monitoring is this?

13. A business states that a failure of the order-processing system must never cost more than 15 minutes of transactions. Which recovery metric is being defined, and what does it primarily dictate?

14. Which metric is the average elapsed time required to restore a failed but repairable device to service, making it a measure of maintainability rather than of how often failures occur?

15. An organization must be able to resume operations at an alternate facility within roughly four hours, but cannot fund a continuously replicated, fully staffed duplicate data center. Which recovery site type best matches these constraints?

16. Compared with an active-passive cluster, which statement correctly describes an active-active cluster?

17. A response team meets in a conference room and talks through the disaster recovery plan step by step, confirming roles, decision authority, and contact lists. No system is failed over and nothing is restored. How should this exercise be classified, and what does it not establish?

18. In a data center, racks are arranged so that equipment air intakes on facing rows draw from one shared aisle while exhausts discharge into the adjacent aisles. What is the primary purpose of this arrangement?

19. At what point in the change management process must a documented rollback (back-out) plan exist for a firmware upgrade on a core switch?

20. An application that worked yesterday is now unreachable from one building. No hardware alarms are present and monitoring shows all devices up. Which record should the technician consult first?

21. An automated comparison reports that a switch's running configuration no longer matches the approved baseline (golden) configuration. Investigation shows the difference came from a change that was properly requested, risk-assessed, and approved. What is the correct next step?