If you passed Network+ five years ago, you could lean on memorization: port numbers, cable standards, OSI-layer definitions. The current exam, N10-009, still tests that foundation — but the questions that decide whether you pass are the ones that hand you a broken network and ask what you do next. CompTIA rebuilt the exam around the job as it actually exists in 2026: less trivia, more judgment.
That shift is good news for working techs and bad news for flashcard-only studiers. Here is how N10-009 is structured, where the points actually live, and how to prepare for the exam CompTIA really gives you.
What Changed From N10-008 to N10-009
N10-009 replaced N10-008 as the current Network+ exam, and the update is more than a version bump. CompTIA reorganized the objectives to reflect how networks are actually run today: more cloud, more virtualization, more zero-trust thinking, and more emphasis on diagnosing problems rather than reciting definitions.
The exam still covers five domains, but the weight has shifted toward applied skills:
- Networking Fundamentals (24%) — concepts, topologies, ports and protocols, addressing and subnetting
- Network Implementations (19%) — routing, switching, wireless, cabling, and configuration
- Network Operations (16%) — monitoring, policies, documentation, and lifecycle management
- Network Security (16%) — hardening, access control, VPNs, and common attack types
- Network Troubleshooting (25%) — the single largest domain, and the one that decides most outcomes Read that last line again. A full quarter of the exam is troubleshooting. That is the clearest signal CompTIA has ever sent about what it values: not what you can recite, but what you can fix. ## The Troubleshooting Domain Is the Exam Most candidates treat troubleshooting as a topic to review last. On N10-009, it should be the center of your study plan, because troubleshooting questions pull from every other domain at once. A single scenario might require you to read a routing table, recognize a misconfigured VLAN, spot a DNS problem, and pick the right next step — in that order. ### Learn the Troubleshooting Methodology Cold CompTIA publishes a seven-step troubleshooting methodology, and the exam tests it directly:
- Identify the problem
- Establish a theory of probable cause
- Test the theory to determine the cause
- Establish a plan of action to resolve the problem and implement the solution
- Verify full system functionality and, if applicable, implement preventive measures
- Document findings, actions, outcomes, and lessons learned Memorizing the list is not enough. The exam asks which step comes next in a scenario, or which step a technician skipped. The classic trap: a tech who "fixes" the symptom and moves on without verifying full functionality or documenting the change. On the exam, that is always the wrong answer — and in real life, it is how the same outage comes back next month. ### Practice With Scenarios, Not Flashcards Flashcards will get you through the fundamentals domain. They will not get you through troubleshooting. For every concept you study, ask yourself the failure-mode question: what breaks when this is wrong, and what does the symptom look like?
- A wrong subnet mask: devices on the same physical network cannot reach each other, or a host thinks a remote address is local.
- A missing default gateway: local traffic works, everything beyond the subnet fails.
- A DNS failure: ping by IP works, ping by name fails — the single most testable symptom in all of networking.
- A duplex mismatch: the link stays up but crawls, with collisions and errors climbing.
- A VLAN misassignment: the port works, but the device lands on the wrong network and gets the wrong DHCP scope or no connectivity at all. If you can look at a symptom and narrow it to one or two probable causes, you are thinking the way the exam rewards. If you can only define the terms, you are not there yet. ## The Fundamentals Still Matter — Study Them as Tools None of this means fundamentals are optional. The 24% fundamentals domain is the vocabulary the troubleshooting questions are written in. The difference is how you study them. ### Subnetting: Fast and Practical Subnetting shows up constantly, but the exam rarely asks you to subnet in isolation. It asks you to look at an address and mask and decide whether two hosts are on the same network, whether a DHCP scope is sized correctly, or why a host with a given configuration cannot reach its gateway. Practice until you can answer those questions in under a minute. A reliable method beats a clever shortcut: pick one approach — binary, magic number, whatever clicks — and drill it until it is automatic. ### Ports and Protocols: Learn Them in Context You do need to know common ports: DNS (53), DHCP (67/68), HTTP (80), HTTPS (443), SSH (22), Telnet (23), SMTP (25), FTP (20/21), SNMP (161/162), LDAP (389), LDAPS (636), RDP (3389). But the exam tests them inside scenarios: a firewall rule blocking port 53 produces a specific symptom; an email client failing on port 25 points to a specific service. Study each port attached to a service and a failure, not as an isolated number. ### Wireless and Cabling: Know the Trade-offs Wireless questions on N10-009 focus on standards, frequencies, and real-world trade-offs: 2.4 GHz reaches farther and penetrates walls better; 5 GHz is faster but shorter-range; 6 GHz (Wi-Fi 6E) adds clean spectrum at the cost of range. Cabling questions test the same judgment: fiber for distance and bandwidth, copper for short runs and PoE, and the right connector and standard for each job. When the exam asks "which is best," it almost always means "best for these constraints," so read the scenario's constraints before the answer choices. ## Network Security: Think in Layers The security domain rewards the same layered thinking the rest of the exam does. No single control is the answer to anything; the exam wants you to combine them.
- Access control: 802.1X, MAC filtering, and port security each solve different problems. Know which one actually authenticates a device and which one merely inconveniences an attacker.
- VPNs: site-to-site versus client-to-site, and when each fits. A branch office needs site-to-site; a remote worker needs client-to-site.
- Zero trust: the principle that nothing is trusted by default, even inside the perimeter. Expect scenario questions where the "old" answer (trust the LAN) is wrong and the zero-trust answer (verify every user and device) is right.
- Common attacks: on-path (man-in-the-middle), DNS poisoning, VLAN hopping, evil twin access points, and rogue DHCP servers. For each, know the symptom and the countermeasure, not just the definition. ## A Four-Week Study Plan That Matches the Exam ### Week 1: Fundamentals Boot Camp Cover addressing, subnetting, ports and protocols, topologies, and the OSI and TCP/IP models. End the week able to subnet quickly and explain what happens at each OSI layer when a packet moves from one host to another. Build a small lab — even a single virtual machine and a packet-capture tool — and watch real traffic. ### Week 2: Implementations and Operations Routing, switching, VLANs, wireless, cabling, and the day-to-day work of running a network: monitoring, documentation, change management, and patching. This is the week to get hands-on. Configure a VLAN. Break it. Fix it. Set up a wireless network and test what happens when two access points share a channel. The exam rewards people who have seen these failures, not just read about them. ### Week 3: Security and Troubleshooting Drills Study the security domain, then spend most of the week on troubleshooting scenarios. Take every concept from weeks 1 and 2 and convert it into a broken-network question. Work through practice questions that give you a symptom and four possible causes, and force yourself to explain why each wrong answer is wrong before moving on. That explanation step is where the learning happens. ### Week 4: Full Practice and Weak-Spot Repair Take full-length timed practice tests under real exam conditions: no notes, no pauses, same question count and time pressure. Score yourself by domain, not just overall. If troubleshooting is below target, spend your remaining days on scenarios; if fundamentals are weak, drill those specifically. A realistic way to check your readiness is to work through free N10-009 practice questions styled like the live exam — see how you handle scenario questions under time pressure before you book the real thing: https://study4pass.com/study-material/comptia/n10-009 ## Exam-Day Tactics That Save Points
- Read the scenario, then the question. The exam buries the decisive detail mid-paragraph. Know what is being asked before you look at the choices.
- Eliminate aggressively. Most questions have two answers that are clearly wrong to anyone who understands the scenario. Cross them out and decide between the remaining two.
- Flag and move on. A hard question early can eat five minutes you need later. Answer your best guess, flag it, and return after you have banked the easier points.
- Trust the methodology. When a troubleshooting question feels ambiguous, the answer that follows CompTIA's step-by-step methodology is usually right.
- Watch for absolute words. Answers with "always" or "never" are usually wrong in networking, because nearly everything depends on context. ## The Bottom Line N10-009 is not a harder exam than N10-008 — it is a more honest one. It tests the skills a junior network administrator actually uses: understanding the fundamentals, implementing real configurations, securing them in layers, and troubleshooting methodically when things break. Study like a technician, not like a trivia contestant, and the exam starts to feel like a day at work rather than a memory test. The technicians who pass comfortably are the ones who practiced fixing networks, not just reading about them.
