21 Network Troubleshooting Practice Questions & Answers

1. 1. A technician responding to a report that a user cannot reach a file server has questioned the user, confirmed that nothing was changed on the workstation, and reproduced the failure on that same PC. According to the structured troubleshooting methodology, what should the technician do NEXT?

   • A.Establish a theory of probable cause✓ Answer
   • B.Escalate the ticket to the server team
   • C.Implement a fix by reimaging the PC
   • D.Document the outcome and close the ticket

   Questioning the user, determining whether anything has changed, and duplicating the problem are all activities inside the first step, identify the problem. Because that step is finished, the immediately following step is to establish a theory of probable cause, where 'question the obvious' belongs. Documentation is the final step, and escalation becomes appropriate only after a theory cannot be confirmed or at the implementation step.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

2. 2. A technician theorizes that a user's intermittent connectivity is caused by a failing patch cable. After swapping in a known-good cable, the symptoms are exactly the same. What is the appropriate next action?

   • A.Build a plan of action based on the original cable theory anyway
   • B.Establish a new theory of probable cause or escalate the issue✓ Answer
   • C.Document that the cable was the cause and close the ticket
   • D.Verify full system functionality and implement preventive measures

   The third step is to test the theory to determine the cause: if the theory is confirmed, the technician determines the next steps to resolve the problem, but if it is NOT confirmed, the methodology requires establishing a new theory or escalating. Only a confirmed theory may advance to a plan of action, so continuing to act on a disproved theory would waste time and risk masking the real fault.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

3. 3. After confirming that a distribution switch is causing repeated outages, a technician schedules the replacement for a maintenance window and writes down every VLAN, uplink, and PoE device that will lose connectivity while the swap is performed. This work belongs to which step of the troubleshooting methodology?

   • A.Establish a plan of action to fix the problem✓ Answer
   • B.Verify full functionality and prevent recurrence
   • C.Test the theory to determine the actual cause
   • D.Identify the problem and duplicate it if possible

   Listing what else will be affected and choosing when the change may safely occur is the 'identify potential effects' portion of the fourth step, establishing a plan of action. It sits deliberately after the theory has been confirmed and before the solution is implemented, so that impact and change control are considered while the change can still be adjusted.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

4. 4. A technician replaces a failed fiber transceiver. The switch port now shows link and the technician can ping the server from the switch. According to the methodology, what must happen BEFORE documenting the findings and actions?

   • A.Duplicate the original problem to prove the repair
   • B.Escalate to the vendor to confirm the part failed
   • C.Verify full system functionality with the user✓ Answer
   • D.Establish a new theory for the transceiver failure

   A link light and a successful ping only prove the physical and network layers are up; the sixth step requires verifying FULL system functionality, which means confirming with the user that the application or task that generated the ticket now works, plus preventive measures where applicable. Documenting findings, actions, outcomes, and lessons learned is the final step.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

5. 5. A server connects to a switch over a 40 m certified copper run. Ping between the two succeeds with normal round-trip times, but large file transfers crawl. The switch interface counters show a steadily rising late collision count and FCS errors, while the server NIC counters show runts and CRC errors. What is the most likely cause?

   • A.A duplex mismatch between the switch port and the server NIC✓ Answer
   • B.Egress congestion on the switch uplink during business hours
   • C.An MTU mismatch causing oversized frames to be discarded
   • D.Alien crosstalk from cables bundled too tightly in the pathway

   A duplex mismatch produces exactly this split signature: the half-duplex side detects late collisions and FCS errors because the full-duplex side transmits whenever it wants, while the full-duplex side logs runts and CRC errors from the frames the other end aborted. Small, low-rate traffic such as ping still succeeds, so throughput only collapses under sustained load; the fix is to make both ends match, with autonegotiation on both sides preferred.

   Source: IEEE 802.3 (CSMA/CD half-duplex operation and autonegotiation); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

6. 6. A technician reads an interface summary on a building uplink: 'input errors 0, CRC 0, runts 0, giants 0, output drops 184532', and utilization peaks at 98 percent every afternoon while the link stays up. What do these counters prove?

   • A.A jumbo-frame or MTU mismatch between the two switches
   • B.Egress congestion is tail-dropping frames as buffers fill✓ Answer
   • C.A damaged cable or a nearby EMI source is corrupting frames
   • D.The far-end port negotiated the wrong speed and duplex

   Drops (discards) are counted when a packet arrives for a queue whose buffer is already full, which is a capacity problem, not a corruption problem. Corruption would raise CRC/FCS counters, frames below the 64-byte minimum would raise runts, and frames above the maximum would raise giants; all of those read zero here, so only oversubscription of the egress link remains. The remedy is more capacity on the link or QoS to protect the traffic that matters.

   Source: IEEE 802.3 (Ethernet frame size limits and MAC error counters); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

7. 7. Thirty-five PoE cameras were installed on a single access switch. The first cameras added work perfectly, but the last several never power on or reboot in a loop. Each drop passes a wiremap test, and any failing camera powers up normally when moved to a different switch. What should the technician check, and what is the most likely cause?

   • A.Check 'show mac-address-table' — a loop is flapping the MACs
   • B.Check 'show route' — the camera subnet has no default route
   • C.Check 'show vlan' — the cameras landed in the wrong VLAN
   • D.Check 'show power' — the switch PoE budget is exhausted✓ Answer

   A switch's power sourcing equipment has a finite total wattage budget; once the sum of the connected powered devices exceeds it, the switch denies or cycles power to the devices it cannot support, which is why the last ones added fail while their cabling tests clean and they work elsewhere. Wrong VLAN, loops, or missing routes would break traffic, not power delivery.

   Source: IEEE 802.3af/at/bt (Power over Ethernet, PSE power budget); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

8. 8. A new 1000BASE-T drop links intermittently and shows errors under load. The installer measured the horizontal cable run at 115 m from the patch panel to the wall jack, with a 3 m patch cord at each end; the cable is Category 6 and both terminations are correct. What is the best explanation?

   • A.One end was terminated T568A and the other T568B
   • B.The channel exceeds the 100 m twisted-pair limit✓ Answer
   • C.A crossover cable is required between these devices
   • D.Category 6 cannot carry 1 Gbps; Category 6A is required

   Balanced twisted-pair Ethernet is specified for a 100 m channel, which the structured cabling standard divides into a 90 m permanent link plus up to 10 m of combined patch cords; 115 m of horizontal cable alone already breaks that budget. Attenuation grows with distance, so the received signal falls below the receiver's threshold and the link becomes intermittent and error-prone under load rather than failing outright.

   Source: IEEE 802.3 (100 m balanced twisted-pair channel); ANSI/TIA-568 (90 m permanent link plus 10 m patch cords)Report a problem with this question

9. 9. A workstation has no link light. On the switch, the port state is reported as err-disabled. What does that state mean and what does it require?

   • A.The switch itself disabled it; clear the cause to recover✓ Answer
   • B.An administrator shut the port down; just re-enable it
   • C.The port is suspended by a link-aggregation config mismatch
   • D.Spanning tree is blocking a redundant path; leave it be

   Err-disabled means the switch's own protection logic took the port out of service in response to a detected condition such as a port-security violation, BPDU guard, or repeated link flapping, so simply re-enabling it without removing the trigger will only disable it again. That is distinct from administratively down, which is a human-issued shutdown, and from suspended, which indicates a link-aggregation configuration mismatch with the other bundle members.

   Source: CompTIA Network+ — Network Troubleshooting domain (port status: administratively down, err-disabled, suspended)Report a problem with this question

10. 10. A host is configured with the address 192.168.10.75/28 and default gateway 192.168.10.1. It can reach a printer at 192.168.10.70 but cannot reach the gateway or any remote network. What is wrong?

    • A.The /28 mask puts the host in a subnet without .1✓ Answer
    • B.An incorrect DNS address is breaking name resolution
    • C.A duplicate IP address is in use by another host
    • D.The host is patched into the wrong VLAN on the switch

    A /28 mask yields blocks of 16 addresses, so 192.168.10.75 belongs to 192.168.10.64/28 (usable 192.168.10.65 through 192.168.10.78), which includes the printer at .70 but not the gateway at .1. The host therefore cannot ARP for a gateway that its own mask says is off-subnet, so local peers inside the block still work while everything remote fails — the classic pattern of an incorrect subnet mask rather than a wrong gateway address alone.

    Source: RFC 4632 (CIDR prefix arithmetic); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

11. 11. Since a new branch VLAN was created, no client on it has ever received an address. A PC on that VLAN shows 'IPv4 Address 169.254.18.44, Subnet Mask 255.255.0.0, Default Gateway (blank)' while its switch port shows link and the correct VLAN. Clients on the VLAN that hosts the DHCP server get addresses normally. What is the most likely cause?

    • A.A duplicate IP conflict with another host on the VLAN
    • B.The DNS addresses handed out by DHCP are unreachable
    • C.A split pair in the cabling is blocking broadcast frames
    • D.The router interface for that VLAN has no DHCP relay entry✓ Answer

    A 169.254.x.x address with a 255.255.0.0 mask and no gateway is APIPA link-local self-assignment, which a client uses only after it receives no DHCP offer at all. Because routers do not forward broadcasts, a client on a routed VLAN can only reach a DHCP server on another subnet through a relay agent, so a VLAN that has never worked while the server's own VLAN works points squarely at the missing helper address.

    Source: RFC 3927 (IPv4 link-local addressing); RFC 2131 (DHCP relay agent); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

12. 12. A user reports connectivity that works for a few seconds and then stops, repeatedly. On a neighboring host, 'arp -a' shows 192.168.1.50 mapped to 00-1A-2B-3C-4D-5E, and a minute later the same address mapped to 00-50-56-9A-11-22. The user's operating system has displayed an address conflict warning. What is happening?

    • A.The DHCP scope is exhausted and leases are handed out twice
    • B.Two devices are using the same IP address on that subnet✓ Answer
    • C.A switching loop is flapping one MAC between two ports
    • D.The default gateway is set outside the host's own subnet

    One IP address resolving to two different MAC addresses over time is the definitive fingerprint of a duplicate address, most often a static address configured inside the DHCP scope, because each host answers ARP requests for it and neighbors keep overwriting their cache. Note the contrast with a loop, where one MAC address appears on two ports rather than one IP mapping to two MACs; the offending port is found by looking the second MAC up in the switch MAC address table.

    Source: RFC 826 (ARP); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

13. 13. After a contractor patched a second cable between the same pair of access switches, every user in one VLAN loses connectivity, switch CPU utilization sits near 100 percent, and the log repeatedly reports the same MAC address moving between two ports. What is the cause?

    • A.A Layer 2 switching loop is flooding the broadcast domain✓ Answer
    • B.Asymmetric routing returns replies over another path
    • C.The extra link exhausted the DHCP scope for that VLAN
    • D.A duplicate IP address is answering the ARP requests

    Without spanning tree blocking one of two parallel paths, broadcast and unknown-unicast frames circulate endlessly and multiply, saturating the segment and driving switch CPU to its limit. MAC address table instability — the same source MAC learned alternately on both ports — is the diagnostic signature, and the entire broadcast domain goes down rather than a single host.

    Source: IEEE 802.1D (spanning tree loop prevention); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

14. 14. Clients can ping an application server and load its web interface, but a database client that connects on TCP 1433 times out. The router ACL protecting the server subnet contains, in order, a permit for ICMP to the server and a permit for TCP 443 to the server, and no other entries. What explains the failure?

    • A.A routing loop is dropping the traffic, which would also produce TTL-expired messages
    • B.The server's default gateway is misconfigured, which breaks only long-lived sessions
    • C.The implicit deny at the end of the ACL discards TCP 1433 because no entry permits it✓ Answer
    • D.An MTU mismatch is fragmenting database traffic and the fragments are being discarded

    An ACL is evaluated top-down, the first match wins, and an implicit deny-all sits at the end, so any traffic that is not explicitly permitted is silently discarded. The signature symptom is exactly this: basic reachability and one permitted application work while a single other port or protocol fails, which points to the rule set rather than to addressing or routing.

    Source: CompTIA Network+ — Network Troubleshooting domain (ACL evaluation order and implicit deny); IANA Service Name and Transport Protocol Port Number RegistryReport a problem with this question

15. 15. A Wi-Fi analyzer in a 2.4 GHz office shows three access points at 20 MHz width: AP1 on channel 1, AP2 on channel 6, and AP3 on channel 8. Clients near AP2 and AP3 report heavy retransmissions and poor throughput. What is the best corrective action?

    • A.Move AP3 to channel 11, clear of both AP1 and AP2✓ Answer
    • B.Move AP3 to channel 6 to share the channel with AP2
    • C.Raise AP3 transmit power to overcome the interference
    • D.Widen AP3 to a 40 MHz channel for more capacity

    In the 2.4 GHz band, channel centers are only 5 MHz apart while a 20 MHz channel is far wider, so channel numbers must be five apart — 1, 6 and 11 — to avoid overlapping; channel 8 partially overlaps both 6 and 11 and corrupts frames outright rather than merely forcing devices to take turns. Moving AP3 to channel 6 would only downgrade the problem to co-channel contention, raising power worsens interference and creates asymmetric power, and 40 MHz width is unworkable in a band this narrow.

    Source: IEEE 802.11 (2.4 GHz channel spacing and 20 MHz channel width); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

16. 16. Every client associated with one access point in a 5 GHz deployment drops simultaneously, then reassociates roughly a minute later, and the AP is afterward operating on a different channel. Wired users are unaffected and the AP's logs show no authentication failures. What is the most likely cause?

    • A.The wireless passphrase changed, forcing reauthentication
    • B.The AP radio is failing and the hardware needs replacing
    • C.The AP detected radar on a DFS channel and had to move✓ Answer
    • D.An attacker is flooding spoofed deauthentication frames

    Channels subject to dynamic frequency selection are shared with radar systems, so on radar detection the AP must vacate the channel immediately and move elsewhere, dropping every associated client at the same instant. The combination of a whole-AP simultaneous drop, a clean return, and a changed operating channel with no authentication errors is the DFS fingerprint; a deauthentication attack would not relocate the AP to a new channel.

    Source: IEEE 802.11 (dynamic frequency selection, radar detection requirement); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

17. 17. Warehouse staff using wireless VoIP handsets stay associated to the first AP they joined even after walking well past two other APs, with the handset reporting -82 dBm before the call finally drops. All APs share the same SSID and security settings, use different non-overlapping channels, and provide about 20 percent cell overlap. What is the best remedy?

    • A.Raise transmit power on every AP for a stronger signal
    • B.Put all APs on one common channel to avoid handoffs
    • C.Give each AP a unique SSID so users pick the nearest
    • D.Tune the roaming threshold and enable fast roaming✓ Answer

    The client, not the AP, decides when to roam, so a handset that clings to a distant AP down at -82 dBm is a sticky client and the fix is to make roaming trigger earlier and complete faster: a roaming or minimum-signal threshold plus the amendments that provide fast transition, neighbor reports, and BSS transition management. Raising transmit power makes it worse by creating asymmetric power and more co-channel interference, a single shared channel forces all APs to contend for the same airtime, and unique SSIDs break seamless roaming entirely.

    Source: IEEE 802.11 amendments for fast BSS transition, radio resource measurement, and wireless network management; CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

18. 18. VoIP users report audio that sounds choppy and robotic although calls stay connected. Monitoring of the call path reports one-way delay steady at 40 ms, packet loss at 0.1 percent, and inter-packet arrival intervals varying between 5 ms and 80 ms. Which statement best describes the problem?

    • A.Latency is excessive; the path must be shortened
    • B.Jitter is excessive; add a jitter buffer or QoS✓ Answer
    • C.Bandwidth is insufficient; the circuit needs upgrading
    • D.Packet loss is excessive; a link is dropping frames

    Jitter is variation in the inter-packet arrival interval, and a codec that expects a packet at a fixed cadence produces choppy, robotic audio when packets arrive unevenly; industry guidance for real-time voice generally targets jitter under about 30 ms, and the measured 5 to 80 ms spread is far outside that. The steady 40 ms one-way delay rules out a latency problem and 0.1 percent loss is well inside the commonly cited 1 percent target, so neither of those explains the symptom.

    Source: CompTIA Network+ — Network Troubleshooting domain (latency, jitter, and packet loss); ITU-T G.114-derived industry guidance for one-way transmission timeReport a problem with this question

19. 19. In a break room, wireless throughput collapses for a few minutes at a time and then recovers. A Wi-Fi analyzer shows only one nearby AP, low channel utilization from 802.11 sources, and no other SSIDs, yet client retry rates are very high during the outages. Which tool will identify the cause?

    • A.An RF spectrum analyzer✓ Answer
    • B.A wired protocol analyzer
    • C.A time-domain reflectometer
    • D.A wired throughput tester

    A Wi-Fi analyzer can only report what it can decode as 802.11 frames, so an interferer that transmits raw energy in the same band is invisible to it even though it corrupts frames and drives retries up. A spectrum analyzer measures RF energy regardless of protocol, which is the only way to see microwave ovens, cordless phones, analog cameras, and similar non-Wi-Fi sources; the other tools examine copper, packets, or capacity, none of which is the failing layer here.

    Source: CompTIA Network+ — Network Troubleshooting domain (Wi-Fi analyzer versus spectrum analyzer)Report a problem with this question

20. 20. A user cannot open intranet.example.com, but browsing directly to 10.20.5.40 loads the site normally. A name lookup from the user's PC returns 'Name: intranet.example.com Address: 10.20.5.12'. The server was migrated to 10.20.5.40 during the last maintenance window. What does this output prove?

    • A.Two servers share one IP address and are conflicting
    • B.DNS returns the stale address; fix it and flush caches✓ Answer
    • C.A firewall is blocking the web port to that server
    • D.The user's default gateway address is misconfigured

    Reaching the service by address while the name fails isolates the fault to name resolution, and the lookup output shows precisely why: the record still points to the pre-migration address. The remedy is to update the address record and clear cached copies on resolvers and clients, since a record's time-to-live keeps the old answer alive until it expires; a gateway, firewall, or duplicate-address fault would also have broken the connection made by IP address.

    Source: RFC 1035 (DNS resource records and caching TTL); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

21. 21. A newly terminated Category 6 drop passes a basic wiremap test with all eight conductors mapped straight through, pin for pin, and no opens or shorts. Yet the link only negotiates 100 Mbps, and when forced to 1 Gbps it produces continuous CRC errors. What is the most likely fault and which tool confirms it?

    • A.Reversed transmit and receive pairs, fixed by auto-MDIX
    • B.An over-length run, confirmed with an optical light meter
    • C.An open conductor, located with a tone generator and probe
    • D.A split pair, detected with a certification tester✓ Answer

    A split pair keeps end-to-end continuity on every pin, so a basic wiremap tester declares it good, but because two conductors are drawn from different twisted pairs the noise cancellation of the twist is lost and near-end crosstalk rises sharply at the higher frequencies gigabit signalling uses. Only a qualification or certification tester, which measures performance parameters such as crosstalk rather than just continuity, will reveal it — a toner locates cables, and a light meter applies to fiber, not copper.

    Source: ANSI/TIA-568 (pair twist and near-end crosstalk performance); CompTIA Network+ — Network Troubleshooting domain (cable tester versus certification tester)Report a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →