NetworkingOctober 14, 202619 min read

Network+ Scenario Questions: How to Read and Answer Them (2026)

Most of the Network+ is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.

  • Max 90Questions
  • 90 minTime
  • 720 (100-900)Pass mark
  • ~1 minPer question
  • do NEXT / FIRSTKey qualifier
Network+ scenario questions decoded - keywords, qualifiers and traps

Table of Contents

Network+ looks like a facts exam: ports, cable types, subnet masks, OSI layers. Then you sit it and find that many items describe a technician in the middle of a job and ask what to do NEXT, what to check FIRST, or what the MOST likely cause is. Network Troubleshooting is the largest domain on N10-009 at 24 percent, and objective 5.1 is CompTIA's own seven-step troubleshooting methodology, so the order of the steps is tested in its own right.

That changes how you read. The stem tells you which step the technician has already reached. The right answer is the step after it, and a perfectly good fix can be wrong because it comes too early. The rest is a symptom lexicon: 169.254 means DHCP never answered, late collisions mean duplex, good signal with heavy retransmissions means channel overlap. This page teaches both, with three original worked scenarios and a lexicon of the symptom phrases that keep recurring.

The one rule for reading Network+ stems

Every troubleshooting stem tells you where the technician is in CompTIA's seven steps; answer with the step that comes next, not the fix you would eventually apply.

CompTIA writes options that are all reasonable things to do on a network, so knowledge alone rarely separates them. What separates them is order: test before you change, plan before you implement, verify after you change. Reading for position turns four plausible answers into one.

Read it like this

  • Read the question line before the scenario
  • Mark the last step the stem says is done
  • Name the OSI layer of the symptom

Not like this

  • Pick a fix just because it would work
  • Re-gather facts the stem already gave you
  • Let vendor names or ticket counts steer you

The 5-step decode routine

Run the same five steps on every scenario. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.

  1. ~5s

    Read the ask

    Read the final line first. Note the qualifier (NEXT, FIRST, MOST likely, BEST) and what it wants back: a cause, a tool, a command or an action.

  2. ~10s

    Place the technician

    Find the last thing the stem says was done: users questioned, a change found, a theory formed, a fix applied. Map it to one of the seven steps; the answer lives in the next one.

  3. ~15s

    Translate the symptom

    Turn each symptom into a layer and a short list of causes: 169.254.x.x is DHCP, CRC errors and late collisions are Layer 1/2, failed names with working pings are DNS.

  4. ~10s

    Strike the noise

    Cross out details that would not change the answer if deleted: vendor, model, ticket counts, job titles, how long the user has worked there.

  5. ~20s

    Eliminate by step and layer

    Remove options from the wrong step, then from the wrong layer, then any that break a stated constraint. Choose from what is left.

Anatomy of a Network+ scenario

Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:

  • Constrainta hard requirement that eliminates options
  • Qualifierthe word that ranks the survivors
  • Keywordpoints at a specific service, control or concept
  • Noiselooks important, changes nothing
Scenario 1 · 5.0 Network TroubleshootingSingle answer

A theory, but nothing tested

Since 8:00 a.m., only users on the third floor1 cannot reach the file server. A technician checks the change log and finds that the third-floor access switch was replaced overnight2 with a newer model from the same vendor3. The help desk has logged 14 tickets so far.4 Based on the timing, the technician suspects the new switch's user ports were left in the default VLAN5 but has not run any commands on the switch yet6. The technician must decide what to do NEXT7.

Which of the following should the technician do NEXT?

  1. 1Keyword. Scope is one floor, so the fault sits in something only that floor shares: its switch or closet, not the server.
  2. 2Keyword. This is 'determine if anything has changed', already done. Identifying the problem is complete; do not go back to it.
  3. 3Noise. Model and vendor do not change which step comes next, and no option depends on them.
  4. 4Noise. Ticket count shows impact, not cause. It might raise priority but does not move the technician to a different step.
  5. 5Constraint. A theory of probable cause now exists. Step two is done, so the next step is to test that theory.
  6. 6Constraint. Nothing has been tested. Any option that applies or verifies a fix jumps ahead of the method.
  7. 7Qualifier. NEXT means the step immediately after the last completed one, not the step that ends the outage fastest.
  1. AMove the third-floor user ports into the correct VLAN and ask users to try again.OutThis is probably the eventual fix, but it implements a change before the theory is tested and before a plan exists. On a NEXT item, the right fix in the wrong step is a wrong answer.
  2. BRun show vlan on the new switch to check which VLAN the user ports are in.AnswerA theory exists and nothing has been checked, so the next step is to test the theory. show vlan confirms or rules it out without changing anything in production.
  3. CAsk the third-floor users when the problem started and what they were doing.OutThat is identifying the problem, which is already complete: the start time, scope and recent change are all in the stem. Going back a step wastes what you were given.
  4. DEscalate the ticket to the vendor that supplied the replacement switch.OutThe objectives place escalation after a theory fails its test, or at implementation when the fix is beyond your scope. Nothing has been tested yet, so escalating is premature.

The lesson: On a NEXT item, find the last step the stem completed; the answer is the following step, even when a later step would end the outage sooner.

Two more: decode them yourself

Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.

Scenario 2 · 2.0 Network ImplementationSingle answer

Interference the textbook fix can't touch

A warehouse uses handheld scanners that support only 2.4GHz. Three APs with overlapping coverage are set to channels 1, 3 and 6 at 20MHz width. Scanners near the channel 3 AP report high retransmissions and frequent disconnects, even though a survey shows strong signal throughout the floor. The APs run current firmware and use WPA2-Enterprise. Management requires the administrator to keep all three APs in service and wants the change that will BEST reduce the errors.

Which of the following should the administrator do to BEST resolve the issue?

  1. AMove all three APs to the 5GHz band.
  2. BReassign the APs to channels 1, 6 and 11.
  3. CIncrease the channel width to 40MHz.
  4. DPower off the AP on channel 3.
Decode it and show the answer

A warehouse uses handheld scanners that support only 2.4GHz1. Three APs with overlapping coverage are set to channels 1, 3 and 62 at 20MHz width. Scanners near the channel 3 AP report high retransmissions and frequent disconnects3, even though a survey shows strong signal throughout the floor4. The APs run current firmware and use WPA2-Enterprise5. Management requires the administrator to keep all three APs in service6 and wants the change that will BEST7 reduce the errors.

  1. 1Constraint. Kills any band change. Moving to 5GHz or 6GHz is the usual cure for 2.4GHz trouble, but these clients cannot follow.
  2. 2Keyword. In 2.4GHz only channels 1, 6 and 11 avoid overlapping at 20MHz. Channel 3 overlaps both of its neighbors.
  3. 3Keyword. Corrupted frames get resent. Retransmissions alongside good signal point to interference, not to a coverage gap.
  4. 4Constraint. Rules out coverage and transmit-power fixes. The problem is not too little signal, so more power cannot help.
  5. 5Noise. Security mode and firmware have no effect on channel overlap, and no option hinges on either of them.
  6. 6Constraint. Kills the option that removes the overlapping AP, even though switching it off would stop the interference.
  7. 7Qualifier. BEST means the option that meets every stated constraint, not merely one that makes things somewhat better.
  1. AMove all three APs to the 5GHz band.OutEliminated by the 2.4GHz-only scanners. It is the right instinct for a crowded 2.4GHz network, which is exactly why it is offered.
  2. BReassign the APs to channels 1, 6 and 11.AnswerRemoves the overlap at its source while keeping every AP on 2.4GHz and in service. Channels 1, 6 and 11 are the non-overlapping 20MHz set in 2.4GHz.
  3. CIncrease the channel width to 40MHz.OutA 40MHz channel uses about half of the 2.4GHz band, so three APs cannot avoid overlapping and interference gets worse. Wider channels only help where there is clean spectrum.
  4. DPower off the AP on channel 3.OutIt would stop the interference, but the stem requires all three APs to stay in service. A fix that breaks a stated requirement cannot be BEST.

The lesson: When the textbook answer appears, test it against every constraint first; it is often there because one line of the stem rules it out.

Scenario 3 · 3.0 Network OperationsChoose two

New VLAN, no leases

An administrator creates VLAN 40 for new IP phones on a Layer 3 switch and gives its SVI the address 10.40.0.1/24. The company's only DHCP server sits on VLAN 10. Phones connected to VLAN 40 ports boot but show 169.254.x.x addresses, while clients on every other VLAN lease addresses from the same server. The phones draw power from the switch over PoE. Company policy requires every endpoint to use DHCP. The administrator needs the two changes that will let the phones obtain addresses.

Which of the following should the administrator configure? (Choose two.)

  1. AA DHCP relay (IP helper) on the VLAN 40 SVI pointing to the DHCP server
  2. BA DHCP scope for 10.40.0.0/24 with 10.40.0.1 as the default gateway option
  3. CStatic IP addresses on each phone from the 10.40.0.0/24 range
  4. DA longer lease time on the VLAN 10 scope
  5. EPoE+ (802.3at) on the VLAN 40 ports
Decode it and show the answer

An administrator creates VLAN 40 for new IP phones1 on a Layer 3 switch and gives its SVI the address 10.40.0.1/24. The company's only DHCP server sits on VLAN 102. Phones connected to VLAN 40 ports boot but show 169.254.x.x addresses3, while clients on every other VLAN lease addresses from the same server4. The phones draw power from the switch over PoE5. Company policy requires every endpoint to use DHCP6. The administrator needs the two7 changes that will let the phones obtain addresses.

  1. 1Keyword. A new VLAN is a new broadcast domain and subnet. Anything DHCP needs per subnet must be added for it.
  2. 2Keyword. DHCP discovery is a broadcast and routed interfaces do not forward broadcasts, so clients on another VLAN need a relay.
  3. 3Keyword. APIPA: the phones sent DHCP discovers and got no offer. The failure is in reaching or answering the server.
  4. 4Constraint. The server is healthy and reachable from elsewhere. Restarting it fixes nothing; the gap is specific to VLAN 40.
  5. 5Noise. The phones boot and self-assign addresses, so power is fine. PoE is bait for a hardware answer.
  6. 6Constraint. Kills static addressing, even though static IPs on 10.40.0.0/24 would get the phones talking.
  7. 7Qualifier. Two changes, so each correct option is likely half of one fix. Check that neither works alone.
  1. AA DHCP relay (IP helper) on the VLAN 40 SVI pointing to the DHCP serverAnswerForwards the phones' broadcast discovers to the server as unicast, carrying 10.40.0.1 as the relay address so the server knows which subnet is asking.
  2. BA DHCP scope for 10.40.0.0/24 with 10.40.0.1 as the default gateway optionAnswerWithout a scope matching the relay address, the server has nothing to offer VLAN 40. Relay and scope together complete the path; either alone still leaves APIPA.
  3. CStatic IP addresses on each phone from the 10.40.0.0/24 rangeOutWould work technically, but the stem requires DHCP for every endpoint. Working while breaking a stated policy is still wrong.
  4. DA longer lease time on the VLAN 10 scopeOutLease time matters when a pool runs out. No VLAN 40 request reaches the server at all, and a VLAN 10 address would be on the wrong subnet anyway.
  5. EPoE+ (802.3at) on the VLAN 40 portsOutThe phones already boot and self-assign addresses, so they have power. This option answers the noise, not the symptom.

The lesson: In a Choose two, look for the pair that completes one path end to end; each half alone leaves the symptom in place, and a fix that breaks policy still loses.

Now do it at exam speed

The Network+ app has 2,700+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.

App StoreGoogle PlayFree Network+ practice test

Keyword decoder: what the stem is telling you

These phrases recur in Network+ stems. Each one narrows the answer before you read the options.

When the stem saysIt points toUsually the wrong pick
Addressing and DHCP
Host shows a 169.254.x.x addressAPIPA: no DHCP offer arrived. Check link, VLAN, relay and scopeChanging DNS servers; the host has no routable address yet
New VLAN gets 169.254.x.x, other VLANs lease fineMissing DHCP relay (IP helper) on the new SVI, or no scope for that subnetRestarting the DHCP server that serves every other VLAN
Early arrivals get addresses, later ones get 169.254.x.xAddress pool exhaustion: enlarge the scope or shorten the lease timeA relay fault, which would fail every client on that subnet
Pings by IP work, names do not resolveDNS: wrong DNS server setting or missing record; test with nslookup or digDefault gateway changes; routed traffic already works
Local hosts reachable, nothing off the subnetIncorrect or missing default gateway on the hostReplacing the cable; local traffic proves the link works
IP address conflict warning, intermittent dropsDuplicate IP, often a static address inside the DHCP scope; add an exclusionReplacing the NIC, which keeps the same configured address
Reaches some same-subnet hosts but not othersIncorrect subnet mask: the host misjudges which addresses are localA gateway fault, which would cut off every remote host
Cabling and interfaces
Late collisions on one end, CRC errors on the otherDuplex mismatch: one side half duplex, one full; set both ends to matchReplacing the cable before checking speed and duplex settings
CRC errors rising on a copper run past motors or lightsEMI on UTP: reroute or use shielded (STP) cable; check run lengthVLAN or IP changes; this is a Layer 1 fault
Giants counter increasing on an interfaceMTU mismatch, such as jumbo frames enabled on one end onlyDuplex mismatch, which shows as runts and late collisions instead
New fiber patch, link stays down on both endsTX/RX transposed, wrong fiber type, or mismatched transceiversA copper cable tester or toner, which cannot test glass
Port status shows err-disabledA protection feature such as port security tripped; clear the cause, then re-enableTreating it as administratively down, which is a deliberate shutdown
New PoE cameras stay dark, older devices finePoE budget exceeded or wrong PoE standard; check show powerVLAN changes; an unpowered device never reaches the network
Switching and routing
Network crawls after a second cable joins two switchesSwitching loop and broadcast storm: check spanning tree port statesMore bandwidth; a loop saturates any link speed
Device works on one switch port, fails on anotherIncorrect VLAN assignment on the new port; confirm with show vlanReinstalling drivers on a device that works elsewhere
Two routes to one destination, traffic takes the unexpected oneRoute selection: longest prefix first, then administrative distance, then metricAssuming the lowest metric always wins across protocols
traceroute stops at the same hop every timeA routing problem or ACL/firewall at or just beyond that hopThe client NIC; packets already crossed earlier routers
Wireless
Good signal, high retransmissions on 2.4GHzChannel overlap or interference; use non-overlapping channels 1, 6 and 11Raising transmit power, which adds to the interference
Connection drops when users walk between APsRoaming misconfiguration: mismatched SSID or security settings, or poor cell overlapWider channels, which do nothing for handoff
Weak signal or low RSSI at the far end of the floorInsufficient coverage: add or move an AP; confirm with a survey or heat mapRe-channeling, which cures interference, not distance
Method and tools
Theory formed, nothing checked yetTest the theory: the next methodology step, before any changeApplying the fix: the right action at the wrong step
Find which patch panel port a wall jack usesToner (tone generator and probe)A cable tester, which checks pairs but not where they run

The qualifier words

The qualifier decides between options that all work. On the Network+ these words carry a specific meaning:

NEXT

The step right after the last one the stem says is complete, in CompTIA's seven-step order.

Theory formed, nothing tested: NEXT is to test the theory, not to apply the fix.

FIRST

With nothing done yet, the earliest step in the method; within a step, the quickest and least disruptive check.

A user reports no access and nothing is known: confirm the symptom and what changed before swapping hardware.

MOST likely

The single cause that explains every symptom given, not just the loudest one.

Late collisions on one end and CRC errors on the other: MOST likely a duplex mismatch, not a bad cable.

BEST

Several options may work; pick the one that meets every stated constraint with the fewest side effects.

Moving to 5GHz works in general but is not BEST when the clients only support 2.4GHz.

Choose two

Usually two halves of one fix, or two separate requirements. Each pick must be needed, and neither should duplicate the other.

A new VLAN gets APIPA addresses: DHCP relay plus a scope for the subnet; either alone fails.

How the wrong answers are built

Distractors are not random. Most wrong options on the Network+ fall into one of these patterns:

  1. The right fix, too early

    The tellApplies a change while the stem shows the theory has not been tested.

    Why it temptsIt probably would solve the problem, and on a real ticket you might just do it.

  2. Back to step one

    The tellRe-gathers information the stem already supplied: when it started, who is affected, what changed.

    Why it temptsQuestioning users sounds careful and methodical.

  3. Wrong layer

    The tellA Layer 3 or Layer 7 change for a Layer 1 or 2 symptom, such as a DNS change for a 169.254.x.x host.

    Why it temptsIt names a real service connected to the complaint, such as 'cannot browse'.

  4. Breaks a stated constraint

    The tellWorks technically but violates a requirement in the stem: static IPs under a DHCP policy, 5GHz for 2.4GHz-only clients.

    Why it temptsIt is the textbook answer for the general case.

  5. Brute force

    The tellReboot, replace hardware, factory reset or escalate before anything has been tested.

    Why it temptsIt often clears the symptom, so it feels decisive.

Time budget by question type

Question typeBudgetTactic
Short recall item (port, tool, term)20-30 secAnswer from memory without rereading and bank the time for PBQs and long stems.
Troubleshooting scenario (NEXT, FIRST, MOST likely)60-75 secRead the ask first, mark the last completed step, then eliminate by step and layer.
Stem with command output or logs~90 secRead the question line, then scan the output only for the field it asks about: status, counters, VLAN, mask or gateway.
Performance-based question (simulation)5-6 min eachIf one looks long, skip it and finish the multiple-choice items; CompTIA lets you return to simulation PBQs and saves your work.

How to practise reading, not just content

Knowing the material is half of it. These drills train the reading:

Step tagging

Cover the options of any troubleshooting question and write which of the seven steps the stem has reached. Reveal the options only then, and strike every one that does not belong to the next step.

Reverse symptom cards

Write a cause on the front of a card (duplex mismatch, missing IP helper, PoE budget) and the symptoms a stem would show on the back. Quiz yourself from the symptom side, because that is the side the exam shows you.

One-field output reading

Collect real show interface, show vlan and ipconfig output from a home lab or simulator. Give yourself 20 seconds per screen to name the one field that explains the fault.

The Network+ at a glance

QuestionsMaximum of 90
Time90 minutes
Passing score720 on a 100-900 scale
Question typesMultiple-choice and performance-based (simulation PBQs)
Going back / flaggingSimulation PBQs can be skipped and revisited; work is saved
FeeUSD 399 (CompTIA list price, single voucher)
DeliveryPearson VUE test centers or online with a remote proctor

Practise the reading, not just the facts

Work Network+ questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.

App StoreGoogle PlayFree Network+ practice test

FAQ

Are these real Network+ exam questions?

No. Every scenario on this page is original, written against CompTIA's published N10-009 objectives to show how stems are built and how to read them. CompTIA prohibits brain-dump material and can revoke certifications from people who use it. Use these to practice reading, and check your knowledge against the official objectives document.

What order is the CompTIA troubleshooting methodology in?

Objective 5.1 lists seven steps: identify the problem; establish a theory of probable cause; test the theory to determine the cause; establish a plan of action to resolve the problem and identify potential effects; implement the solution or escalate as necessary; verify full system functionality and implement preventive measures if applicable; document findings, actions, outcomes and lessons learned. N10-009 says documentation happens throughout the process, not only at the end.

How many questions are on N10-009, and how long do I get?

CompTIA lists a maximum of 90 questions, a mix of multiple-choice and performance-based, in 90 minutes. The passing score is 720 on a scale of 100 to 900. CompTIA does not publish how many PBQs appear or how the scaled score converts to a percentage, so treat any percent-correct figure you see quoted as a guess.

Can I skip performance-based questions and come back to them?

Yes. CompTIA lists Network+ among the exams that use simulation PBQs, and says simulation PBQs can be skipped and revisited, that your work is saved when you move to another item, and that each has a reset button. CompTIA also states that partial credit may be given on PBQs, so a partly finished simulation is worth submitting.

Is a new version of Network+ coming soon?

As of October 2026, CompTIA's Network+ page lists V9, exam code N10-009, launched June 20, 2024, with retirement usually three years after launch and estimated for 2027. The page does not name a successor exam or a confirmed retirement date, so N10-009 is the exam to prepare for. Check the official page before you book.

Sources

Figures on this page come from CompTIA and the other primary sources below:

Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with CompTIA before you book.