CompTIA Network+ Study Guide 2026: N10-009 Exam Prep

Network+ is the certification that bridges the gap between IT support knowledge (A+) and specialist networking roles. When we built Dragonfly's Network+ practice set, we focused heavily on the troubleshooting and security domains — not because the other domains are unimportant, but because our analysis of the N10-009 blueprint showed that candidates who score well in troubleshooting and security pass consistently, while those who neglect these domains often fall just below the pass mark.

N10-009 domain breakdown

CompTIA Network+ N10-009 covers five domains: Networking Fundamentals (23%) — OSI model, network types, topologies, ports and protocols, IP addressing; Network Implementation (19%) — routing protocols, switching concepts, wireless standards, virtualisation; Network Operations (17%) — monitoring tools, network documentation, policies, disaster recovery; Network Security (20%) — common threats, security concepts, network hardening, remote access; Network Troubleshooting (21%) — troubleshooting methodology, wired and wireless issues, common problems and solutions.

The two highest-weighted domains — Networking Fundamentals (23%) and Network Troubleshooting (21%) — together account for 44% of the exam. Master subnetting (which appears across both domains), the OSI model and its layer functions, and CompTIA's systematic troubleshooting methodology, and you have covered the most exam-critical material.

Subnetting: the skill you must master

Subnetting is the most important technical skill tested across the entire Network+ exam. It appears in the Networking Fundamentals domain, the Network Implementation domain, and throughout troubleshooting scenarios. You must be able to: convert between decimal and binary IP addresses, calculate the network address, broadcast address, first usable host, last usable host, and number of hosts from any CIDR notation (/prefix), and determine which subnet a given IP address belongs to.

The binary method is the most reliable under exam pressure. Memorise the binary bit values for an octet: 128, 64, 32, 16, 8, 4, 2, 1. A /26 prefix means the first 26 bits are the network portion — the subnet mask is 255.255.255.192 (11111111.11111111.11111111.11000000 in binary). The block size is 256 minus the last octet of the subnet mask: 256 - 192 = 64. Subnets start at 0, 64, 128, 192. Practice this until it takes less than 60 seconds per problem.

OSI model: layer by layer

The OSI (Open Systems Interconnection) model is the foundational framework for understanding how network communication works. The seven layers from top to bottom: Application (7) — user-facing protocols: HTTP, HTTPS, FTP, SMTP, DNS, DHCP; Presentation (6) — data formatting, encryption, compression; Session (5) — session establishment and management; Transport (4) — end-to-end communication, TCP vs UDP, port numbers; Network (3) — IP addressing, routing, logical addressing; Data Link (2) — MAC addressing, switches, frames, error detection; Physical (1) — cables, signals, bits, NICs, hubs.

Network+ questions frequently reference specific layers. 'Layer 3 switch' means a switch that can perform routing functions. 'Layer 2 issue' means a problem with MAC addresses or switching. 'Transport layer protocol' means TCP or UDP. A mnemonic for the layers from top to bottom: All People Seem To Need Data Processing. From bottom to top: Please Do Not Throw Sausage Pizza Away.

Key protocols and port numbers

Network+ tests whether you know the standard port numbers for common protocols. The most important to memorise: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53), DHCP (67/68), HTTP (80), POP3 (110), IMAP (143), HTTPS (443), SMB (445), RDP (3389), and MySQL (3306). Questions often ask which port a described service uses, or which protocol uses a given port number.

TCP vs UDP: TCP (Transmission Control Protocol) is connection-oriented — it establishes a connection before data transfer (3-way handshake: SYN, SYN-ACK, ACK), provides error checking, guarantees delivery and ordering. UDP (User Datagram Protocol) is connectionless — faster, lower overhead, no guaranteed delivery. Used for DNS queries, streaming, VoIP, and online gaming where speed matters more than perfect reliability.

Network security for Network+

The security domain (20%) covers: common network attacks (DoS and DDoS, man-in-the-middle, spoofing, ARP poisoning, VLAN hopping, social engineering), network hardening techniques (changing default credentials, disabling unused ports and services, implementing VLANs for segmentation, using SSH instead of Telnet, 802.1X port-based authentication), wireless security (WPA2 vs WPA3, enterprise vs personal mode, common wireless attacks including evil twin and deauthentication attacks), and remote access security (VPN types — SSL/TLS VPN, IPsec VPN, site-to-site vs client VPN).

For each attack type, know: what the attack does, what it targets (specific layer or protocol), how to detect it, and how to mitigate it. This pattern — what/where/detect/mitigate — structures your knowledge for both multiple-choice questions and troubleshooting scenarios where you must identify what type of attack has occurred based on symptoms.