CompTIA A+ / Network+ / Security+ CompTIA Network+: Implementation, Operations & Wireless (N10-009) Syllabus

What is Spanning Tree Protocol (STP) and which standard defines it?

STP (IEEE 802.1D) prevents Layer 2 switching loops by blocking redundant paths, leaving a single active loop-free path. It elects a root bridge and places redundant ports into a blocking state.

What is the purpose of the STP root bridge and how is it elected?

The root bridge is the reference point of the spanning tree from which all path costs are calculated. It is elected as the switch with the lowest bridge ID (bridge priority + MAC address); lowest priority wins, MAC breaks ties.

What does the switch feature 'PortFast' do?

PortFast moves an access port directly to the STP forwarding state, skipping listening and learning, for ports connected to end devices. It speeds up host connectivity but should not be used on ports linking to other switches.

What is BPDU Guard and why is it used?

BPDU Guard disables (err-disables) a port if it receives a BPDU. It is applied to PortFast/access ports to prevent unauthorized switches from being connected and altering the spanning-tree topology.

What does port security on a switch protect against?

Port security restricts which and how many MAC addresses can use a switch port. It mitigates MAC flooding/CAM table overflow attacks and unauthorized device connections, often shutting down or restricting a violating port.

What is DHCP snooping and what attack does it prevent?

DHCP snooping classifies switch ports as trusted or untrusted and only allows DHCP server responses on trusted ports. It prevents rogue DHCP server attacks and is a foundation for Dynamic ARP Inspection.

Which 802.11 standard introduced 5 GHz with up to 54 Mbps, and which standard operates in both 2.4 and 5 GHz?

802.11a introduced 5 GHz at up to 54 Mbps. 802.11n (Wi-Fi 4) operates in both 2.4 GHz and 5 GHz bands, using MIMO for higher throughput.

Match the Wi-Fi generation names to their 802.11 standards (Wi-Fi 4, 5, 6, 6E).

Wi-Fi 4 = 802.11n; Wi-Fi 5 = 802.11ac (5 GHz only); Wi-Fi 6 = 802.11ax (2.4 & 5 GHz); Wi-Fi 6E = 802.11ax extended into the 6 GHz band.

Compare the 2.4 GHz and 5 GHz Wi-Fi bands in terms of range and throughput.

2.4 GHz offers longer range and better wall penetration but lower throughput and only 3 non-overlapping channels. 5 GHz offers higher throughput and many more channels but shorter range and weaker penetration.

Which three channels are non-overlapping in the 2.4 GHz band?

Channels 1, 6, and 11 are the standard non-overlapping channels in the 2.4 GHz band (each ~20 MHz wide), used to avoid co-channel interference in adjacent access points.

What is the difference between an SSID and a BSSID?

The SSID is the human-readable wireless network name. The BSSID is the MAC address of the access point's radio identifying a specific basic service set. Multiple APs sharing one SSID form an ESS (extended service set).

In wireless design, what is a heat map / site survey used for?

A wireless site survey produces a heat map showing signal strength coverage. It is used to plan AP placement, channel assignment, and power levels, and to identify dead zones, interference, and overlap before or after deployment.

Why should overlapping access points in an ESS use non-overlapping channels?

To avoid co-channel and adjacent-channel interference. Overlapping coverage on the same channel causes contention; assigning non-overlapping channels (e.g. 1/6/11) lets clients roam seamlessly while minimizing interference.

Compare WPA2 and WPA3 wireless security.

WPA2 uses AES-CCMP encryption and a 4-way handshake (vulnerable to KRACK/offline dictionary attacks). WPA3 adds SAE (Simultaneous Authentication of Equals) for stronger handshake protection, forward secrecy, and protection against offline cracking.

What encryption algorithm does WPA2 use, and what weak protocols did it replace?

WPA2 uses AES with CCMP. It replaced WEP (which used the weak RC4 cipher and a flawed IV) and original WPA (which used TKIP), both considered insecure.

What is the difference between WPA personal (PSK) and WPA enterprise modes?

Personal/PSK mode uses a single shared pre-shared key for all users. Enterprise mode uses 802.1X with a RADIUS server to authenticate each user individually with unique credentials and dynamic keys.

In network monitoring, what does SNMP do and what are its main message types?

SNMP (Simple Network Management Protocol) collects and organizes device metrics. Key messages: Get (manager reads a value), Set (manager writes a value), and Trap (agent asynchronously alerts the manager of an event).

What is the difference between a baseline and a threshold in performance monitoring?

A baseline is a record of normal performance over time used for comparison. A threshold is a defined limit that, when crossed, triggers an alert or action (e.g. CPU > 90%).

What does NetFlow/flow data provide that SNMP polling typically does not?

NetFlow records conversation-level metadata (source/destination IP, ports, protocol, byte counts) to show who is talking to whom and which applications consume bandwidth, whereas SNMP mainly polls device counters and status.

Define the metrics latency, jitter, and packet loss.

Latency is the time delay for a packet to travel end to end. Jitter is the variation in latency between packets. Packet loss is the percentage of packets that fail to reach the destination. All three degrade real-time apps like VoIP.

What is the difference between RTO and RPO in disaster recovery?

RTO (Recovery Time Objective) is the maximum acceptable time to restore a service after an outage. RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last good backup must be).

Compare MTBF and MTTR.

MTBF (Mean Time Between Failures) measures average reliability — how long a system runs before failing. MTTR (Mean Time To Repair) measures average time to restore it after a failure. High availability needs high MTBF and low MTTR.

What is the difference between an active-active and active-passive high-availability cluster?

Active-active: all nodes handle traffic simultaneously, providing load balancing plus redundancy. Active-passive: one node serves traffic while a standby node takes over only when the active node fails.

Compare cold, warm, and hot disaster-recovery sites.

Cold site: facility/power only, no equipment or data — slowest to recover, cheapest. Warm site: hardware and connectivity in place, data restored from backup — moderate. Hot site: fully mirrored, real-time replicated, near-instant failover — most expensive.

What is FHRP and name a common protocol that implements it?

FHRP (First Hop Redundancy Protocol) provides default-gateway redundancy by sharing a virtual IP among multiple routers. Examples: VRRP (open standard), HSRP (Cisco), and GLBP.

What is the difference between an SLA, an MOU, and an NDA?

An SLA (Service Level Agreement) defines guaranteed service metrics (e.g. uptime). An MOU (Memorandum of Understanding) is a non-binding statement of intent between parties. An NDA (Non-Disclosure Agreement) legally protects confidential information.

What is the difference between AUP and BYOD policies?

An AUP (Acceptable Use Policy) defines how users may use organizational network resources. A BYOD (Bring Your Own Device) policy governs how personally owned devices may connect to and be managed on the corporate network.

List the steps of the CompTIA network troubleshooting methodology in order.

1) Identify the problem. 2) Establish a theory of probable cause. 3) Test the theory. 4) Establish a plan of action. 5) Implement the solution or escalate. 6) Verify full system functionality (and implement preventive measures). 7) Document findings, actions, and outcomes.

In troubleshooting, why is the step 'document findings, actions, and outcomes' important?

Documentation creates a knowledge base for faster future resolution, supports change management, helps identify recurring issues, and ensures consistency when others encounter the same problem.

What physical-layer problem does exceeding the maximum cable length cause, and what is the Cat 5e/Cat 6 copper limit?

Exceeding maximum length causes attenuation (signal loss) and unreliable links. The limit for twisted-pair copper Ethernet (Cat 5e/Cat 6) is $100\,\text{m}$ total (90 m solid horizontal run + 10 m patch cables).

What is the difference between crosstalk and EMI as cabling issues, and how are they mitigated?

Crosstalk is signal bleed between adjacent wire pairs (mitigated by proper twists and using shielded/STP cable). EMI is interference from external sources like motors or fluorescent lights (mitigated by shielding, fiber, or rerouting cable away from the source).

When troubleshooting connectivity, what does the ping command verify and what does traceroute add?

ping verifies end-to-end reachability and measures round-trip latency using ICMP echo request/reply. traceroute/tracert maps each Layer 3 hop along the path, helping locate where packets are delayed or dropped.