Free CompTIA Network+ Exam Flashcards

The Open Systems Interconnection model is a seven-layer conceptual framework describing how data moves through a network. From bottom to top: Physical (bits), Data Link (frames), Network (packets), Transport (segments), Session, Presentation, and Application. Understanding the OSI model helps troubleshoot network issues by isolating problems to specific layers.

A four-layer protocol suite that powers the internet: Network Interface (combines OSI Physical and Data Link), Internet (Network layer with IP), Transport (TCP/UDP), and Application (combines Session, Presentation, Application). TCP/IP is the practical implementation of networking, while OSI is the theoretical reference model.

TCP (Transmission Control Protocol) is connection-oriented, providing reliable, ordered delivery with error checking and flow control through a three-way handshake (SYN, SYN-ACK, ACK). UDP (User Datagram Protocol) is connectionless, faster but unreliable, used for real-time applications like VoIP, streaming, and DNS queries where speed matters more than guaranteed delivery.

A 32-bit address written in dotted decimal notation (e.g., 192.168.1.1) providing approximately 4.3 billion unique addresses. Divided into network and host portions based on subnet mask. Classes include A (1-126), B (128-191), C (192-223), D (multicast), and E (experimental). Private ranges are 10.x.x.x, 172.16-31.x.x, and 192.168.x.x.

A 128-bit address providing virtually unlimited addresses, written in hexadecimal with colons (e.g., 2001:0db8:85a3::8a2e:0370:7334). Features include autoconfiguration (SLAAC), built-in IPsec support, and simplified header format. IPv6 eliminates NAT requirements and broadcasts, using multicast and anycast instead. Double colons (::) represent consecutive zeros.

Subnetting divides a network into smaller logical segments for better management and security. CIDR (Classless Inter-Domain Routing) notation uses a slash followed by the number of network bits (e.g., /24 = 255.255.255.0). VLSM (Variable Length Subnet Masking) allows different subnet sizes within the same network, optimizing IP address allocation.

A 48-bit physical address burned into network interface cards, written in hexadecimal (e.g., 00:1A:2B:3C:4D:5E). The first 24 bits identify the manufacturer (OUI), while the last 24 bits are unique to the device. MAC addresses operate at Layer 2 and are used for local network communication, while IP addresses handle routing across networks.

Essential ports include: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53), DHCP (67/68), HTTP (80), HTTPS (443), POP3 (110), IMAP (143), SNMP (161/162), LDAP (389), RDP (3389), and NTP (123). Well-known ports range from 0-1023, registered ports 1024-49151, and dynamic/ephemeral ports 49152-65535.

A hierarchical distributed database that translates domain names to IP addresses. Uses port 53 (UDP for queries, TCP for zone transfers). The resolution process involves recursive and iterative queries through root servers, TLD servers, and authoritative name servers. Record types include A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), PTR (reverse), and TXT.

Automatically assigns IP addresses and network configuration to devices. Uses the DORA process: Discover (client broadcasts), Offer (server responds), Request (client requests), Acknowledge (server confirms). Uses UDP ports 67 (server) and 68 (client). DHCP relay agents forward requests across subnets. Lease times determine how long addresses remain assigned.

Layer 2 devices that forward frames based on MAC addresses using a CAM (Content Addressable Memory) table. Features include full-duplex communication, microsegmentation, and VLAN support. Managed switches offer CLI/GUI configuration, while unmanaged switches are plug-and-play. Layer 3 switches can perform routing functions, combining switch speed with router capabilities.

Layer 3 devices that forward packets between different networks based on IP addresses using routing tables. Support static routes (manually configured) and dynamic routing protocols (RIP, OSPF, EIGRP, BGP). Perform NAT, access control lists, and connect different network segments. Make forwarding decisions based on destination IP and longest prefix match.

Logical network segmentation at Layer 2 that separates broadcast domains without physical separation. Benefits include improved security, reduced broadcast traffic, and flexible network design. VLAN tagging (802.1Q) adds a 4-byte header to frames. Trunk ports carry multiple VLANs, while access ports connect end devices to a single VLAN.

IEEE 802.1D protocol preventing Layer 2 loops in switched networks by blocking redundant paths. Elects a root bridge based on lowest bridge ID, then calculates shortest paths. Port states include Blocking, Listening, Learning, Forwarding, and Disabled. RSTP (802.1w) provides faster convergence, while MSTP (802.1s) supports multiple spanning tree instances.

Dynamic routing protocols share network topology information. Distance vector protocols (RIP, EIGRP) use hop count and direction. Link-state protocols (OSPF, IS-IS) maintain complete network topology maps. BGP is a path vector protocol for internet routing between autonomous systems. Administrative distance determines protocol preference when multiple routes exist.

Translates private IP addresses to public addresses for internet access. Static NAT maps one private to one public address. Dynamic NAT uses a pool of public addresses. PAT (Port Address Translation) or NAT overload maps multiple private addresses to one public address using different ports, conserving IPv4 addresses.

IEEE wireless standards include: 802.11a (5GHz, 54Mbps), 802.11b (2.4GHz, 11Mbps), 802.11g (2.4GHz, 54Mbps), 802.11n/Wi-Fi 4 (dual-band, 600Mbps, MIMO), 802.11ac/Wi-Fi 5 (5GHz, 6.9Gbps, MU-MIMO), and 802.11ax/Wi-Fi 6 (dual-band, 9.6Gbps, OFDMA). Wi-Fi 6E extends to 6GHz band.

WEP (deprecated, easily cracked), WPA (TKIP encryption, vulnerable), WPA2 (AES-CCMP, current standard), and WPA3 (SAE handshake, enhanced security). Enterprise mode uses 802.1X/RADIUS authentication, while Personal mode uses pre-shared keys (PSK). Always use WPA2 or WPA3 with strong passwords for secure wireless networks.

Twisted pair categories: Cat5e (1Gbps, 100m), Cat6 (10Gbps at 55m), Cat6a (10Gbps at 100m), Cat7 (10Gbps, shielded), Cat8 (25-40Gbps, data centers). T568A and T568B are wiring standards. Straight-through cables connect different devices, crossover cables connect similar devices (though Auto-MDI-X eliminates this need). Fiber optic offers longer distances and immunity to EMI.

Architecture separating the control plane from the data plane, centralizing network intelligence in software controllers. The application layer communicates via northbound APIs, while southbound APIs (like OpenFlow) control network devices. Benefits include programmability, automation, and dynamic traffic management. SD-WAN extends SDN concepts to wide area networks.

Simple Network Management Protocol enables centralized monitoring and management of network devices. Uses UDP ports 161 (queries) and 162 (traps). Components include managers, agents, and MIBs (Management Information Bases). SNMPv3 provides authentication and encryption, while v1/v2c use community strings. Traps provide asynchronous notifications of events.

Standard protocol for sending log messages to a centralized server on UDP port 514 (or TCP 514/TLS 6514 for reliability). Severity levels range from 0 (Emergency) to 7 (Debug). Facilities identify message sources (kernel, mail, auth). Centralized logging aids troubleshooting, security analysis, and compliance. Rsyslog and syslog-ng are common implementations.

Essential documentation includes network diagrams (physical and logical topologies), IP address management (IPAM), baseline configurations, change management records, and standard operating procedures. Proper documentation accelerates troubleshooting, ensures consistency, supports disaster recovery, and maintains compliance. Update documentation with every change.

Backup types include full (complete copy), incremental (changes since last backup), and differential (changes since last full backup). The 3-2-1 rule recommends three copies on two different media with one offsite. RTO (Recovery Time Objective) defines acceptable downtime, while RPO (Recovery Point Objective) defines acceptable data loss.

Techniques ensuring continuous operation include NIC teaming/bonding, link aggregation (LACP/802.3ad), redundant power supplies, hot standby routers (HSRP, VRRP, GLBP), and clustering. Calculate availability using nines (99.9% = 8.76 hours downtime/year, 99.99% = 52.6 minutes). MTBF (Mean Time Between Failures) and MTTR (Mean Time To Repair) measure reliability.

Prioritizes network traffic to ensure critical applications receive adequate bandwidth and low latency. Methods include classification/marking (DSCP, 802.1p), queuing (priority, weighted fair), traffic shaping, and policing. Essential for VoIP (requires <150ms latency, <30ms jitter, <1% packet loss), video conferencing, and real-time applications.

Connect to cloud providers via public internet (VPN), dedicated connections (AWS Direct Connect, Azure ExpressRoute), or hybrid architectures. IaaS provides virtual infrastructure, PaaS provides platforms for development, SaaS delivers applications. Consider latency, bandwidth, security, and compliance when designing cloud connectivity.

Key metrics include bandwidth (maximum data rate), throughput (actual data transferred), latency (delay between send and receive), jitter (latency variation), and packet loss (percentage of lost packets). Tools like iPerf measure throughput, while ping measures latency and packet loss. Establish baselines for comparison during troubleshooting.

Formal process for implementing network changes including request submission, impact assessment, approval, implementation planning, testing, rollback procedures, and documentation. Reduces risk of outages from unplanned changes. Change advisory boards (CAB) review significant changes. Maintenance windows minimize business impact.

Managing and provisioning network infrastructure through machine-readable configuration files rather than manual processes. Tools include Ansible, Terraform, and Puppet. Benefits include version control, consistency, rapid deployment, and reduced human error. IaC enables automation, repeatability, and integration with CI/CD pipelines for network operations.

Security devices controlling traffic based on rules. Types include packet filtering (examines headers), stateful inspection (tracks connections), application layer/proxy (inspects content), and next-generation (NGFW, combines multiple functions). Rules typically specify source/destination IP, ports, protocols, and actions (allow/deny). Implicit deny blocks unmatched traffic.

Ordered lists of rules filtering traffic on routers and switches. Standard ACLs filter by source IP only, while extended ACLs filter by source/destination IP, ports, and protocols. Applied inbound or outbound on interfaces. Rules are processed top-down until a match; implicit deny at the end blocks remaining traffic. Numbered or named for identification.

Intrusion Detection Systems (IDS) monitor and alert on suspicious activity, while Intrusion Prevention Systems (IPS) actively block threats inline. Signature-based detection identifies known attacks, behavior-based/anomaly detection identifies deviations from baselines. NIDS/NIPS protect network segments, while HIDS/HIPS protect individual hosts.

Virtual Private Networks create encrypted tunnels over public networks. IPsec operates at Layer 3, providing authentication (AH) and encryption (ESP). SSL/TLS VPNs use HTTPS (port 443) for clientless browser access. Site-to-site VPNs connect networks, while remote access VPNs connect individual users. Split tunneling routes only specific traffic through VPN.

802.1X is port-based network access control requiring authentication before granting network access. Components include supplicant (client), authenticator (switch/AP), and authentication server (RADIUS). EAP (Extensible Authentication Protocol) provides the framework for various authentication methods (EAP-TLS, PEAP, EAP-FAST). RADIUS uses UDP ports 1812/1813.

DDoS floods targets with traffic, Man-in-the-Middle intercepts communications, ARP spoofing poisons ARP caches for traffic interception, DNS poisoning redirects users to malicious sites, VLAN hopping accesses unauthorized VLANs, and MAC flooding overwhelms switch CAM tables. Phishing, social engineering, and ransomware target users rather than infrastructure.

Security model assuming no implicit trust regardless of network location. Core principles: verify explicitly (always authenticate), use least privilege access, and assume breach. Implements microsegmentation, continuous verification, and strong identity management. Replaces traditional perimeter-based security where internal networks were trusted by default.

Dividing networks into isolated segments to contain threats and limit lateral movement. Methods include VLANs, firewalls, and microsegmentation. DMZ (demilitarized zone) places public-facing servers between external and internal networks. Air gaps physically isolate critical systems. Segmentation supports defense in depth and compliance requirements.

SSH (port 22) provides secure remote access replacing Telnet. HTTPS (port 443) encrypts web traffic with TLS. SFTP/SCP secure file transfers. SNMPv3 adds authentication and encryption. DNSSEC validates DNS responses. TLS 1.3 is the current standard for transport security, deprecating SSL and older TLS versions due to vulnerabilities.

Protecting network infrastructure from physical threats. Controls include locked cabinets/closets, badge access systems, security cameras, biometrics, and visitor logs. Environmental protections address fire suppression, HVAC, and UPS/generators. Port security disables unused switch ports. Hardware security modules (HSMs) protect cryptographic keys.

Systematic approach: 1) Identify the problem (gather information, question users, identify symptoms), 2) Establish a theory of probable cause, 3) Test the theory, 4) Establish a plan of action, 5) Implement the solution, 6) Verify full functionality, 7) Document findings and lessons learned. This structured approach ensures efficient problem resolution.

Ping uses ICMP echo requests to test connectivity and measure round-trip time. Traceroute (tracert on Windows) maps the path packets take, showing each hop's latency. Both help identify where connectivity fails. Traceroute uses incrementing TTL values, receiving ICMP Time Exceeded messages from each router along the path.

ipconfig (Windows) and ifconfig/ip (Linux) display network interface configuration including IP address, subnet mask, gateway, and DNS servers. nslookup and dig query DNS servers to troubleshoot name resolution. Use ipconfig /release and /renew to reset DHCP leases. ifconfig is deprecated in favor of the ip command on modern Linux.

netstat displays network connections, routing tables, interface statistics, and listening ports. Key options: -a (all connections), -n (numeric addresses), -r (routing table), -s (statistics). ss (socket statistics) is the modern replacement on Linux, offering faster performance. Both identify active connections and potential security issues.

Tools like Wireshark capture and analyze network traffic at the packet level. Features include filtering, protocol decoding, flow analysis, and statistics. Place capture points strategically using SPAN/mirror ports or network taps. Essential for troubleshooting application issues, security incidents, and protocol problems that other tools cannot detect.

Cable testers verify continuity, proper wiring (T568A/B), and identify opens, shorts, and crossed pairs. Time Domain Reflectometers (TDRs) locate cable faults by measuring signal reflection. Certification testers verify cables meet category specifications. Tone generators and probes trace cables through walls and ceilings.

STP problems cause loops (broadcast storms) or blocked legitimate paths. VLAN misconfigurations prevent communication between devices. Duplex mismatches cause collisions and poor performance. MAC table overflow from attacks causes flooding. Speed mismatches and native VLAN mismatches between trunk ports cause connectivity issues. Check port status and error counters.

Missing or incorrect routes cause unreachable destinations. Routing loops create circular paths. Asymmetric routing causes issues with stateful firewalls. Default gateway misconfiguration prevents internet access. MTU mismatches cause fragmentation or black holes. Use show ip route (Cisco) and traceroute to identify routing problems.

Common issues include interference (overlapping channels, other 2.4GHz devices), insufficient coverage (dead zones), wrong security settings, and channel congestion. Wi-Fi analyzers identify channel utilization and interference. Check SSID broadcasting, encryption settings, and driver updates. For 2.4GHz, use non-overlapping channels 1, 6, or 11.

DHCP problems: address exhaustion, rogue servers, scope misconfiguration. DNS issues: incorrect records, cache poisoning, server unreachable. NTP sync failures cause authentication and logging problems. Check service status, logs, and configuration files. Verify network connectivity to service servers and proper firewall rules allowing required ports.