Network+ N10-009 Domain 3: Network Operations — 9 practice questions with answers

Domain 3 is 19% of the CompTIA Network+ (N10-009) exam, which works out to roughly 17of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Network+ N10-009 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

3.1 Explain the purpose of organizational processes and procedures
3.2 Given a scenario, use network monitoring technologies
3.3 Explain disaster recovery (DR) concepts
3.4 Given a scenario, implement IPv4 and IPv6 network services
3.5 Compare and contrast network access and management methods

What to focus on

Operations is about running a network once it exists. Documentation (3.1) means knowing which document answers which question: a physical diagram shows ports and cabling, a logical diagram shows subnets and VLANs, a rack diagram shows placement, and change management and life-cycle records show what changed and when equipment goes end-of-support.

Monitoring (3.2) separates sources by what they reveal: SNMP polling and traps show device health, flow data such as NetFlow shows who is using bandwidth, syslog records events, and packet capture shows the conversation itself. A baseline is what makes any of it meaningful. Disaster recovery (3.3) uses RTO, RPO, MTTR and MTBF, plus hot, warm and cold sites and active-active versus active-passive designs.

Objective 3.4 covers the services every client depends on: DHCP scopes, reservations and relay; SLAAC for IPv6; DNS record types (A, AAAA, CNAME, MX, TXT, PTR, NS, SOA) and DNSSEC; and NTP. Objective 3.5 covers how administrators reach equipment: VPN types, jump boxes, in-band versus out-of-band management, console access, and API or GUI management.

Practice questions and explanations

1. A network engineer needs a document showing how switches, routers and firewalls are interconnected, including which ports connect to which, without showing IP addressing. Which document is this?
1. A) Logical network diagram
2. B) Physical network diagram
3. C) Rack diagram
4. D) IP address management (IPAM) record
Answer: B — Physical network diagram
A physical diagram shows devices, cabling and port-level connections as they physically exist. A logical diagram shows subnets, VLANs, IP addressing and traffic flow. A rack diagram shows device placement in a rack, and IPAM tracks address assignments. (Objective 3.1)
2. Before deploying a configuration change to a core switch, a team records the current performance values for CPU, memory and interface utilisation. What is this record called?
1. A) A baseline
2. B) A service-level agreement
3. C) A change request
4. D) A heat map
Answer: A — A baseline
A baseline captures normal performance so later measurements can be compared against it to spot degradation. An SLA defines agreed service targets, a change request documents a proposed change for approval, and a heat map visualises wireless coverage. (Objective 3.2)
3. A monitoring server polls routers for interface counters and receives unsolicited alerts from them when an interface goes down. Which protocol is being used?
1. A) Syslog
2. B) SNMP
3. C) NetFlow
4. D) ICMP
Answer: B — SNMP
SNMP lets a manager poll agents for values in the MIB (GET) and lets agents send traps when events occur, exactly the two behaviours described. Syslog carries log messages one way, NetFlow exports traffic flow records, and ICMP is used by ping and traceroute. SNMPv3 adds authentication and encryption. (Objective 3.2)
4. Management wants to know which applications are consuming most of the WAN bandwidth, with source and destination details. Which monitoring data provides this?
1. A) SNMP interface counters
2. B) Flow data such as NetFlow or IPFIX
3. C) Syslog severity levels
4. D) Ping round-trip times
Answer: B — Flow data such as NetFlow or IPFIX
Flow export (NetFlow, IPFIX, sFlow) records conversations by source, destination, ports and byte counts, which is what you need to attribute bandwidth to applications. SNMP counters show how full an interface is but not who is filling it, syslog records events, and ping measures latency. (Objective 3.2)
5. A company requires that, after a disaster, its network must be restored within four hours and lose no more than fifteen minutes of data. Which two metrics do these requirements define?
1. A) MTBF and MTTR
2. B) RTO of 4 hours and RPO of 15 minutes
3. C) RPO of 4 hours and RTO of 15 minutes
4. D) SLA and uptime percentage
Answer: B — RTO of 4 hours and RPO of 15 minutes
The Recovery Time Objective is how quickly service must be restored (4 hours); the Recovery Point Objective is the maximum acceptable data loss measured in time (15 minutes). MTBF and MTTR describe hardware reliability and repair time, and an SLA is the contract that might contain these targets. (Objective 3.3)
6. A disaster recovery site has power, cooling and network connectivity but no servers or data installed. Which type of site is this?
1. A) Hot site
2. B) Warm site
3. C) Cold site
4. D) Cloud site
Answer: C — Cold site
A cold site is a prepared facility with utilities but no equipment or data, so recovery takes the longest. A warm site has hardware and connectivity but needs recent data loaded, and a hot site is fully equipped and synchronised for near-immediate failover. (Objective 3.3)
7. Clients on VLAN 30 cannot obtain IP addresses, while the DHCP server sits on VLAN 10. Which router configuration allows the DHCP broadcasts to reach the server?
1. A) A DHCP reservation
2. B) DHCP relay (IP helper address)
3. C) A longer lease time
4. D) A DHCP exclusion range
Answer: B — DHCP relay (IP helper address)
DHCP Discover messages are broadcasts and routers do not forward broadcasts. A DHCP relay (Cisco's ip helper-address) on the VLAN 30 interface converts them to unicast and forwards them to the server on VLAN 10. Reservations, lease times and exclusions are server-side settings that do not help a broadcast cross a router. (Objective 3.4)
8. Which DNS record type maps a hostname to an IPv6 address?
1. A) A
2. B) AAAA
3. C) CNAME
4. D) PTR
Answer: B — AAAA
An AAAA (quad-A) record returns an IPv6 address; an A record returns IPv4. A CNAME aliases one name to another name, and a PTR record performs the reverse lookup from an address to a name. MX (mail) and TXT records are also tested. (Objective 3.4)
9. Administrators must manage servers in a restricted data-centre segment, but direct SSH from user workstations to those servers is prohibited by policy. Which approach satisfies the policy?
1. A) Connect through a jump box (bastion host) that is the only permitted SSH source
2. B) Use Telnet instead of SSH
3. C) Add every workstation to the server VLAN
4. D) Open SSH to the servers from the internet
Answer: A — Connect through a jump box (bastion host) that is the only permitted SSH source
A jump box is a hardened host that administrators connect to first and then hop from into the restricted segment, giving a single auditable, controllable entry point. Telnet is unencrypted, flattening the VLANs removes the segmentation, and exposing SSH to the internet is the opposite of restriction. (Objective 3.5)

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Network+ N10-009 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.

Network+ N10-009 Domain 3: Network Operations — 9 practice questions with answers

Objectives in this domain

What to focus on

Practice questions and explanations

1. A network engineer needs a document showing how switches, routers and firewalls are interconnected, including which ports connect to which, without showing IP addressing. Which document is this?

2. Before deploying a configuration change to a core switch, a team records the current performance values for CPU, memory and interface utilisation. What is this record called?

3. A monitoring server polls routers for interface counters and receives unsolicited alerts from them when an interface goes down. Which protocol is being used?

4. Management wants to know which applications are consuming most of the WAN bandwidth, with source and destination details. Which monitoring data provides this?

5. A company requires that, after a disaster, its network must be restored within four hours and lose no more than fifteen minutes of data. Which two metrics do these requirements define?

6. A disaster recovery site has power, cooling and network connectivity but no servers or data installed. Which type of site is this?

7. Clients on VLAN 30 cannot obtain IP addresses, while the DHCP server sits on VLAN 10. Which router configuration allows the DHCP broadcasts to reach the server?

8. Which DNS record type maps a hostname to an IPv6 address?

9. Administrators must manage servers in a restricted data-centre segment, but direct SSH from user workstations to those servers is prohibited by policy. Which approach satisfies the policy?