N10-009 network operations explained
Network operations is worth 19% of CompTIA Network+ N10-009 — around 17 of the 90 questions. It covers running a network once it exists: watching it, documenting it, keeping it available, and changing it safely.
It is the least glamorous domain and one of the easiest to score in, because the expected answers follow consistent patterns.
Monitoring
- SNMP — how devices report status, and the distinction between polling and traps, where the device reports an event rather than waiting to be asked.
- Syslog — centralised logging, and severity levels.
- Baselines. The idea that underpins the domain: you cannot say performance has degraded without a record of normal. Any question about detecting a gradual change wants a baseline.
- NetFlow and traffic analysis for understanding what is consuming bandwidth.
- Alerting on conditions that require action rather than on everything.
Documentation
Frequently underestimated, reliably examined:
- Physical and logical diagrams, and the difference: physical shows cabling and locations, logical shows addressing, VLANs and routing.
- IP address management — knowing what is assigned where.
- Labelling of cables, ports and racks.
- Asset inventory and configuration records.
- Rack diagrams and floor plans.
The recurring principle: documentation that is not maintained is worse than none, because people trust it.
Availability and redundancy
- High availability concepts, and eliminating single points of failure.
- Redundancy at each layer: power (UPS, dual feeds), links, devices, paths.
- Load balancing for both capacity and resilience.
- RTO and RPO — how quickly you must recover, and how much data you can afford to lose. These two are commonly confused and commonly tested.
- Backups: types, scheduling, off-site storage, and — the part organisations forget — testing restores.
- Disaster recovery sites: hot, warm and cold, and the cost-versus-recovery-speed trade-off.
Change management
- Why network changes need a process: one misapplied change can take down everything.
- Request, review, approval, implementation, and a rollback plan.
- Maintenance windows.
- Updating documentation after the change, not before the next incident.
Sample questions
Question 1. Users report the network 'feels slower than it used to'. The team wants to determine objectively whether performance has degraded. What was needed?
- A. Additional bandwidth on the internet circuit
- B. A longer DHCP lease duration
- C. A performance baseline recorded when the network was known to be healthy
- D. More wireless access points
Show answer
Answer: C
A performance baseline captured when the network was healthy provides the comparison needed to establish whether current performance has actually degraded. More bandwidth is a response rather than a measurement, a longer DHCP lease is unrelated, and additional access points address wireless coverage.
Question 2. An organisation can tolerate losing at most 15 minutes of data, and must restore service within 4 hours. Which values describe these two requirements?
- A. RTO 15 minutes, RPO 4 hours
- B. RPO 15 minutes, RTO 4 hours
- C. MTBF 15 minutes, MTTR 4 hours
- D. SLA 15 minutes, RPO 4 hours
Show answer
Answer: B
The recovery point objective is the maximum tolerable data loss, here 15 minutes, and the recovery time objective is the maximum tolerable time to restore service, here 4 hours. The other options reverse the two or misname them entirely.
Question 3. A network engineer plans a routing change on a core device during business hours, with no documented way to reverse it. Which element of change management is missing?
- A. An updated asset inventory
- B. A physical network diagram
- C. An SNMP trap on the core device
- D. A rollback plan, and an approved maintenance window
Show answer
Answer: D
A rollback plan defines how to reverse a change if it causes problems and is a required element of network change management, particularly on a core device. Asset inventory, a physical diagram and an SNMP trap serve other purposes and none of them provides a way back.
What to practise
Write the RTO and RPO definitions on a card and keep them straight — they are confused more often than any other pair in this domain.
Then take a network you know and ask three questions: where is the single point of failure, when was the last restore actually tested, and is the diagram current? Those three questions are most of what this domain examines.