21 Network Troubleshooting Practice Questions & Answers

1. 1. A technician responding to a report that a user cannot reach a file server has questioned the user, confirmed that nothing was changed on the workstation, and reproduced the failure on that same PC. According to the structured troubleshooting methodology, what should the technician do NEXT?

   • A.Establish a theory of probable cause, questioning the obvious first✓ Answer
   • B.Escalate the ticket to the server team
   • C.Implement a solution by reimaging the workstation
   • D.Document the findings, actions, and outcomes and close the ticket

   Questioning the user, determining whether anything has changed, and duplicating the problem are all activities inside the first step, identify the problem. Because that step is finished, the immediately following step is to establish a theory of probable cause, where 'question the obvious' belongs. Documentation is the final step, and escalation becomes appropriate only after a theory cannot be confirmed or at the implementation step.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

2. 2. A technician theorizes that a user's intermittent connectivity is caused by a failing patch cable. After swapping in a known-good cable, the symptoms are exactly the same. What is the appropriate next action?

   • A.Build a plan of action based on the original cable theory anyway
   • B.Establish a new theory of probable cause or escalate the issue✓ Answer
   • C.Document that the cable was the cause and close the ticket
   • D.Verify full system functionality and implement preventive measures

   The third step is to test the theory to determine the cause: if the theory is confirmed, the technician determines the next steps to resolve the problem, but if it is NOT confirmed, the methodology requires establishing a new theory or escalating. Only a confirmed theory may advance to a plan of action, so continuing to act on a disproved theory would waste time and risk masking the real fault.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

3. 3. After confirming that a distribution switch is causing repeated outages, a technician schedules the replacement for a maintenance window and writes down every VLAN, uplink, and PoE device that will lose connectivity while the swap is performed. This work belongs to which step of the troubleshooting methodology?

   • A.Establish a plan of action to resolve the problem and identify potential effects✓ Answer
   • B.Verify full system functionality and implement preventive measures
   • C.Test the theory to determine the cause
   • D.Identify the problem

   Listing what else will be affected and choosing when the change may safely occur is the 'identify potential effects' portion of the fourth step, establishing a plan of action. It sits deliberately after the theory has been confirmed and before the solution is implemented, so that impact and change control are considered while the change can still be adjusted.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

4. 4. A technician replaces a failed fiber transceiver. The switch port now shows link and the technician can ping the server from the switch. According to the methodology, what must happen BEFORE documenting the findings and actions?

   • A.Duplicate the original problem again to prove the repair
   • B.Escalate to the hardware vendor to confirm the old transceiver was defective
   • C.Verify full system functionality by confirming with the user that the original task works, and implement preventive measures if applicable✓ Answer
   • D.Establish a new theory to explain why the transceiver failed

   A link light and a successful ping only prove the physical and network layers are up; the sixth step requires verifying FULL system functionality, which means confirming with the user that the application or task that generated the ticket now works, plus preventive measures where applicable. Documenting findings, actions, outcomes, and lessons learned is the final step.

   Source: CompTIA Network+ — Network Troubleshooting domain (structured troubleshooting methodology)Report a problem with this question

5. 5. A server connects to a switch over a 40 m certified copper run. Ping between the two succeeds with normal round-trip times, but large file transfers crawl. The switch interface counters show a steadily rising late collision count and FCS errors, while the server NIC counters show runts and CRC errors. What is the most likely cause?

   • A.A duplex mismatch between the switch port and the server NIC✓ Answer
   • B.Egress congestion on the switch uplink during business hours
   • C.An MTU mismatch causing oversized frames to be discarded
   • D.Alien crosstalk from cables bundled too tightly in the pathway

   A duplex mismatch produces exactly this split signature: the half-duplex side detects late collisions and FCS errors because the full-duplex side transmits whenever it wants, while the full-duplex side logs runts and CRC errors from the frames the other end aborted. Small, low-rate traffic such as ping still succeeds, so throughput only collapses under sustained load; the fix is to make both ends match, with autonegotiation on both sides preferred.

   Source: IEEE 802.3 (CSMA/CD half-duplex operation and autonegotiation); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

6. 6. A technician reads an interface summary on a building uplink: 'input errors 0, CRC 0, runts 0, giants 0, output drops 184532', and utilization peaks at 98 percent every afternoon while the link stays up. What do these counters prove?

   • A.A jumbo-frame or MTU mismatch exists between the two switches
   • B.The link is congested and frames are being tail-dropped when the egress buffer fills, so more capacity or QoS is needed✓ Answer
   • C.The cable is damaged or running past an EMI source and is corrupting frames
   • D.The far-end port is negotiating the wrong speed and must be hard-coded

   Drops (discards) are counted when a packet arrives for a queue whose buffer is already full, which is a capacity problem, not a corruption problem. Corruption would raise CRC/FCS counters, frames below the 64-byte minimum would raise runts, and frames above the maximum would raise giants; all of those read zero here, so only oversubscription of the egress link remains.

   Source: IEEE 802.3 (Ethernet frame size limits and MAC error counters); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

7. 7. Thirty-five PoE cameras were installed on a single access switch. The first cameras added work perfectly, but the last several never power on or reboot in a loop. Each drop passes a wiremap test, and any failing camera powers up normally when moved to a different switch. What should the technician check, and what is the most likely cause?

   • A.Check 'show mac-address-table' — a switching loop is flapping the camera MAC addresses
   • B.Check 'show route' — the camera subnet is missing a default route
   • C.Check 'show vlan' — the failing cameras were placed in the wrong VLAN
   • D.Check the PoE budget with 'show power' — the total PSE wattage available is less than the combined draw of the attached powered devices✓ Answer

   A switch's power sourcing equipment has a finite total wattage budget; once the sum of the connected powered devices exceeds it, the switch denies or cycles power to the devices it cannot support, which is why the last ones added fail while their cabling tests clean and they work elsewhere. Wrong VLAN, loops, or missing routes would break traffic, not power delivery.

   Source: IEEE 802.3af/at/bt (Power over Ethernet, PSE power budget); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

8. 8. A new 1000BASE-T drop links intermittently and shows errors under load. The installer measured the horizontal cable run at 115 m from the patch panel to the wall jack, with a 3 m patch cord at each end; the cable is Category 6 and both terminations are correct. What is the best explanation?

   • A.The pairs were terminated to T568A on one end and T568B on the other
   • B.The channel exceeds the 100 m twisted-pair limit, so attenuation degrades the signal past the point of a reliable link✓ Answer
   • C.The link needs a crossover cable because both ends are the same device type
   • D.Category 6 cable cannot support 1 Gbps and Category 6A is required at any length

   Balanced twisted-pair Ethernet is specified for a 100 m channel, which the structured cabling standard divides into a 90 m permanent link plus up to 10 m of combined patch cords; 115 m of horizontal cable alone already breaks that budget. Attenuation grows with distance, so the received signal falls below the receiver's threshold and the link becomes intermittent and error-prone under load rather than failing outright.

   Source: IEEE 802.3 (100 m balanced twisted-pair channel); ANSI/TIA-568 (90 m permanent link plus 10 m patch cords)Report a problem with this question

9. 9. A workstation has no link light. On the switch, the port state is reported as err-disabled. What does that state mean and what does it require?

   • A.The switch itself disabled the port after a violation such as port security, BPDU guard, or repeated flapping; the underlying cause must be fixed and the port then recovered or bounced✓ Answer
   • B.An administrator manually shut the port down, so it only needs to be re-enabled
   • C.The port is suspended because its link-aggregation settings do not match the other member ports
   • D.Spanning tree placed the port in blocking state to break a redundant path

   Err-disabled means the switch's own protection logic took the port out of service in response to a detected condition, so simply re-enabling it without removing the trigger will only disable it again. That is distinct from administratively down, which is a human-issued shutdown, and from suspended, which indicates a link-aggregation configuration mismatch with the other bundle members.

   Source: CompTIA Network+ — Network Troubleshooting domain (port status: administratively down, err-disabled, suspended)Report a problem with this question

10. 10. A host is configured with the address 192.168.10.75/28 and default gateway 192.168.10.1. It can reach a printer at 192.168.10.70 but cannot reach the gateway or any remote network. What is wrong?

    • A.The mask places the host in 192.168.10.64/28, a subnet that does not contain 192.168.10.1, so the host has no reachable gateway✓ Answer
    • B.The DNS server address is incorrect, so name resolution and routing both fail
    • C.The host has a duplicate IP address that another device is also using
    • D.The host was patched into the wrong VLAN on the access switch

    A /28 mask yields blocks of 16 addresses, so 192.168.10.75 belongs to 192.168.10.64/28 (usable 192.168.10.65 through 192.168.10.78), which includes the printer at .70 but not the gateway at .1. The host therefore cannot ARP for a gateway that its own mask says is off-subnet, so local peers inside the block still work while everything remote fails — the classic pattern of an incorrect subnet mask rather than a wrong gateway address alone.

    Source: RFC 4632 (CIDR prefix arithmetic); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

11. 11. Since a new branch VLAN was created, no client on it has ever received an address. A PC on that VLAN shows 'IPv4 Address 169.254.18.44, Subnet Mask 255.255.0.0, Default Gateway (blank)' while its switch port shows link and the correct VLAN. Clients on the VLAN that hosts the DHCP server get addresses normally. What is the most likely cause?

    • A.The PC has a duplicate IP address conflict with another host on the VLAN
    • B.The DNS server addresses handed out by DHCP are unreachable from the branch
    • C.The horizontal cabling to the PC has a split pair that blocks broadcast frames
    • D.The router interface for the new VLAN is missing a DHCP relay (IP helper) entry, so the broadcast DISCOVER never reaches the server✓ Answer

    A 169.254.x.x address with a 255.255.0.0 mask and no gateway is APIPA link-local self-assignment, which a client uses only after it receives no DHCP offer at all. Because routers do not forward broadcasts, a client on a routed VLAN can only reach a DHCP server on another subnet through a relay agent, so a VLAN that has never worked while the server's own VLAN works points squarely at the missing helper address.

    Source: RFC 3927 (IPv4 link-local addressing); RFC 2131 (DHCP relay agent); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

12. 12. A user reports connectivity that works for a few seconds and then stops, repeatedly. On a neighboring host, 'arp -a' shows 192.168.1.50 mapped to 00-1A-2B-3C-4D-5E, and a minute later the same address mapped to 00-50-56-9A-11-22. The user's operating system has displayed an address conflict warning. What is happening?

    • A.The DHCP scope is exhausted, so leases are being handed out twice
    • B.Two devices are using the same IP address, typically a static assignment made inside the DHCP scope; the second device can be located from the switch MAC address table✓ Answer
    • C.A switching loop is causing the same MAC address to flap between two switch ports
    • D.The host's default gateway is set to an address outside its own subnet

    One IP address resolving to two different MAC addresses over time is the definitive fingerprint of a duplicate address, because each host answers ARP requests for it and neighbors keep overwriting their cache. Note the contrast with a loop, where one MAC address appears on two ports rather than one IP mapping to two MACs; the offending port is found by looking the second MAC up in the switch MAC address table.

    Source: RFC 826 (ARP); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

13. 13. After a contractor patched a second cable between the same pair of access switches, every user in one VLAN loses connectivity, switch CPU utilization sits near 100 percent, and the log repeatedly reports the same MAC address moving between two ports. What is the cause?

    • A.A Layer 2 switching loop is flooding broadcasts because spanning tree is not blocking the redundant link✓ Answer
    • B.Asymmetric routing is sending replies back over a different path than the requests
    • C.The DHCP scope for that VLAN has been exhausted by the extra link
    • D.A duplicate IP address is causing both switches to reply to the same ARP requests

    Without spanning tree blocking one of two parallel paths, broadcast and unknown-unicast frames circulate endlessly and multiply, saturating the segment and driving switch CPU to its limit. MAC address table instability — the same source MAC learned alternately on both ports — is the diagnostic signature, and the entire broadcast domain goes down rather than a single host.

    Source: IEEE 802.1D (spanning tree loop prevention); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

14. 14. Clients can ping an application server and load its web interface, but a database client that connects on TCP 1433 times out. The router ACL protecting the server subnet contains, in order, a permit for ICMP to the server and a permit for TCP 443 to the server, and no other entries. What explains the failure?

    • A.A routing loop is dropping the traffic, which would also produce TTL-expired messages
    • B.The server's default gateway is misconfigured, which breaks only long-lived sessions
    • C.The implicit deny at the end of the ACL drops TCP 1433 because no entry explicitly permits it✓ Answer
    • D.An MTU mismatch is fragmenting database traffic and the fragments are being discarded

    An ACL is evaluated top-down, the first match wins, and an implicit deny-all sits at the end, so any traffic that is not explicitly permitted is silently discarded. The signature symptom is exactly this: basic reachability and one permitted application work while a single other port or protocol fails, which points to the rule set rather than to addressing or routing.

    Source: CompTIA Network+ — Network Troubleshooting domain (ACL evaluation order and implicit deny); IANA Service Name and Transport Protocol Port Number RegistryReport a problem with this question

15. 15. A Wi-Fi analyzer in a 2.4 GHz office shows three access points at 20 MHz width: AP1 on channel 1, AP2 on channel 6, and AP3 on channel 8. Clients near AP2 and AP3 report heavy retransmissions and poor throughput. What is the best corrective action?

    • A.Move AP3 to channel 11 so the three APs sit on non-overlapping channels✓ Answer
    • B.Move AP3 to channel 6 so it shares a channel with AP2
    • C.Increase the transmit power of AP3 so its signal overcomes the interference
    • D.Set AP3 to a 40 MHz channel width to give clients more capacity

    In the 2.4 GHz band, channel centers are only 5 MHz apart while a 20 MHz channel is far wider, so channel numbers must be five apart — 1, 6 and 11 — to avoid overlapping; channel 8 partially overlaps both 6 and 11 and corrupts frames outright rather than merely forcing devices to take turns. Moving AP3 to channel 6 would only downgrade the problem to co-channel contention, raising power worsens interference and creates asymmetric power, and 40 MHz width is unworkable in a band this narrow.

    Source: IEEE 802.11 (2.4 GHz channel spacing and 20 MHz channel width); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

16. 16. Every client associated with one access point in a 5 GHz deployment drops simultaneously, then reassociates roughly a minute later, and the AP is afterward operating on a different channel. Wired users are unaffected and the AP's logs show no authentication failures. What is the most likely cause?

    • A.The wireless passphrase was changed, forcing all clients to reauthenticate
    • B.The AP radio is failing intermittently and the hardware must be replaced
    • C.The AP was operating on a DFS channel, detected radar, and was required to stop transmitting and move to another channel✓ Answer
    • D.An attacker is flooding spoofed deauthentication frames at that AP

    Channels subject to dynamic frequency selection are shared with radar systems, so on radar detection the AP must vacate the channel immediately and move elsewhere, dropping every associated client at the same instant. The combination of a whole-AP simultaneous drop, a clean return, and a changed operating channel with no authentication errors is the DFS fingerprint; a deauthentication attack would not relocate the AP to a new channel.

    Source: IEEE 802.11 (dynamic frequency selection, radar detection requirement); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

17. 17. Warehouse staff using wireless VoIP handsets stay associated to the first AP they joined even after walking well past two other APs, with the handset reporting -82 dBm before the call finally drops. All APs share the same SSID and security settings, use different non-overlapping channels, and provide about 20 percent cell overlap. What is the best remedy?

    • A.Raise the transmit power on every AP so the handsets always have a strong signal
    • B.Configure all APs onto a single common channel so handoffs become unnecessary
    • C.Give each AP a unique SSID so users can manually select the nearest one
    • D.Address the sticky-client behavior by tuning the minimum signal threshold for roaming and enabling the standards for fast transition, neighbor reports, and BSS transition management✓ Answer

    The client, not the AP, decides when to roam, so a handset that clings to a distant AP down at -82 dBm is a sticky client and the fix is to make roaming trigger earlier and complete faster: a roaming or minimum-signal threshold plus the amendments that provide fast transition, neighbor reports, and BSS transition management. Raising transmit power makes it worse by creating asymmetric power and more co-channel interference, a single shared channel forces all APs to contend for the same airtime, and unique SSIDs break seamless roaming entirely.

    Source: IEEE 802.11 amendments for fast BSS transition, radio resource measurement, and wireless network management; CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

18. 18. VoIP users report audio that sounds choppy and robotic although calls stay connected. Monitoring of the call path reports one-way delay steady at 40 ms, packet loss at 0.1 percent, and inter-packet arrival intervals varying between 5 ms and 80 ms. Which statement best describes the problem?

    • A.Latency is excessive and the path must be shortened or rerouted
    • B.Jitter — the variation in packet arrival times — is excessive; a jitter buffer or QoS prioritization smooths it at the cost of a little added delay✓ Answer
    • C.Bandwidth is insufficient and the circuit must be upgraded
    • D.Packet loss is excessive and a faulty link is discarding frames

    Jitter is variation in the inter-packet arrival interval, and a codec that expects a packet at a fixed cadence produces choppy, robotic audio when packets arrive unevenly; industry guidance for real-time voice generally targets jitter under about 30 ms, and the measured 5 to 80 ms spread is far outside that. The steady 40 ms one-way delay rules out a latency problem and 0.1 percent loss is well inside the commonly cited 1 percent target, so neither of those explains the symptom.

    Source: CompTIA Network+ — Network Troubleshooting domain (latency, jitter, and packet loss); ITU-T G.114-derived industry guidance for one-way transmission timeReport a problem with this question

19. 19. In a break room, wireless throughput collapses for a few minutes at a time and then recovers. A Wi-Fi analyzer shows only one nearby AP, low channel utilization from 802.11 sources, and no other SSIDs, yet client retry rates are very high during the outages. Which tool will identify the cause?

    • A.A spectrum analyzer, which shows raw RF energy from non-802.11 sources such as a microwave oven or cordless device✓ Answer
    • B.A protocol analyzer performing a packet capture on the wired uplink
    • C.A time-domain reflectometer connected to the AP's copper drop
    • D.A throughput tester run between a client and the internet circuit

    A Wi-Fi analyzer can only report what it can decode as 802.11 frames, so an interferer that transmits raw energy in the same band is invisible to it even though it corrupts frames and drives retries up. A spectrum analyzer measures RF energy regardless of protocol, which is the only way to see microwave ovens, cordless phones, analog cameras, and similar non-Wi-Fi sources; the other tools examine copper, packets, or capacity, none of which is the failing layer here.

    Source: CompTIA Network+ — Network Troubleshooting domain (Wi-Fi analyzer versus spectrum analyzer)Report a problem with this question

20. 20. A user cannot open intranet.example.com, but browsing directly to 10.20.5.40 loads the site normally. A name lookup from the user's PC returns 'Name: intranet.example.com Address: 10.20.5.12'. The server was migrated to 10.20.5.40 during the last maintenance window. What does this output prove?

    • A.Two servers share the same IP address, producing an address conflict
    • B.Name resolution is returning a stale address, so the DNS record must be corrected and cached copies flushed or allowed to expire✓ Answer
    • C.A firewall is blocking the web port between the user and the server
    • D.The user's default gateway is misconfigured, which is why only names fail

    Reaching the service by address while the name fails isolates the fault to name resolution, and the lookup output shows precisely why: the record still points to the pre-migration address. The remedy is to update the address record and clear cached copies on resolvers and clients, since a record's time-to-live keeps the old answer alive until it expires; a gateway, firewall, or duplicate-address fault would also have broken the connection made by IP address.

    Source: RFC 1035 (DNS resource records and caching TTL); CompTIA Network+ — Network Troubleshooting domainReport a problem with this question

21. 21. A newly terminated Category 6 drop passes a basic wiremap test with all eight conductors mapped straight through, pin for pin, and no opens or shorts. Yet the link only negotiates 100 Mbps, and when forced to 1 Gbps it produces continuous CRC errors. What is the most likely fault and which tool confirms it?

    • A.Transmit and receive are transposed, which auto-MDIX would have corrected
    • B.The run is over length, which an optical light meter would confirm by measuring loss
    • C.An open conductor on one pin, which a tone generator and probe will locate
    • D.A split pair — the pins map correctly but the conductors are not kept within their twisted pairs, so crosstalk appears only at higher frequencies; a qualification or certification tester is needed to detect it✓ Answer

    A split pair keeps end-to-end continuity on every pin, so a basic wiremap tester declares it good, but because two conductors are drawn from different twisted pairs the noise cancellation of the twist is lost and near-end crosstalk rises sharply at the higher frequencies gigabit signalling uses. Only a qualification or certification tester, which measures performance parameters such as crosstalk rather than just continuity, will reveal it — a toner locates cables, and a light meter applies to fiber, not copper.

    Source: ANSI/TIA-568 (pair twist and near-end crosstalk performance); CompTIA Network+ — Network Troubleshooting domain (cable tester versus certification tester)Report a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →