N10-009 network troubleshooting explained
Network troubleshooting is worth 24% of CompTIA Network+ N10-009 — around 22 of the 90 questions and the largest domain. It is also where the performance-based questions concentrate.
That weighting is the most important thing to know about this exam. Network+ is not primarily a theory test; nearly a quarter of it asks what you would do when something is broken.
The methodology
CompTIA examines its troubleshooting methodology in order, and “what should you do next” questions are answered by knowing the sequence:
- Identify the problem — gather information, question users, determine what changed.
- Establish a theory of probable cause — question the obvious first.
- Test the theory to determine the cause.
- Establish a plan of action and identify potential effects.
- Implement the solution or escalate.
- Verify full system functionality and implement preventive measures.
- Document findings, actions and outcomes.
Two things candidates get wrong: jumping from a theory straight to implementing a fix without testing it, and forgetting that documentation is the final step rather than an optional extra.
“What changed?” is the highest-value question in step one, and scenarios often hide the answer in a detail about a recent change.
The tools
| Tool | Tells you |
|---|---|
ping | Basic reachability, and round-trip time |
traceroute / tracert | The path taken, and where it stops |
ipconfig / ifconfig / ip | Local addressing, gateway, DNS |
nslookup / dig | Name resolution behaviour |
netstat | Connections and listening ports |
arp | MAC-to-IP mappings |
| Cable tester / toner | Physical faults and cable tracing |
| Protocol analyser | What is actually on the wire |
Know which tool answers which question. A name resolution problem is nslookup, not ping. A “where does it stop” question is traceroute.
Working the layers
The most reliable diagnostic technique, and it links straight back to the concepts domain:
- No link light → layer 1. Cable, port, NIC.
- Link but no local communication → layer 2. VLAN, MAC, switch port.
- Local works, remote does not → layer 3. Gateway, subnet mask, routing.
- IP works, names do not → DNS.
- Some services work, others do not → layer 4. Firewall or port.
Most troubleshooting questions are solvable by asking which layer the symptom implicates.
Common faults by category
Connectivity: wrong subnet mask or gateway, duplicate IP, DHCP failure showing as an APIPA address, cable fault, wrong VLAN.
Name resolution: wrong DNS server, stale cache, incorrect record.
Performance: duplex mismatch (link up, poor throughput, rising errors), bandwidth saturation, latency, jitter, bottleneck at a single link.
Wireless: weak signal, channel overlap, interference, authentication failure, too many clients on one access point.
Scope is the strongest clue. One user means something local to that user. One subnet means something shared by that subnet. Everyone means something central.
Sample questions
Question 1. A technician has established a theory that a failing switch port is causing a user's intermittent connectivity. What should be done next?
- A. Replace the switch immediately
- B. Document the findings and close the ticket
- C. Test the theory, for example by moving the user to a known-good port
- D. Escalate to the network architecture team
Show answer
Answer: C
The methodology requires testing the theory to determine the cause before acting, for example by moving the user to a known-good port. Replacing the switch implements a fix before confirming the cause, documenting comes last, and escalation is premature when the theory is untested.
Question 2. Every user on one subnet has lost connectivity. Users on other subnets are unaffected. Where should the technician look first?
- A. The device or configuration shared by that subnet — its gateway, switch or VLAN
- B. Each affected workstation’s network adapter
- C. The organisation’s internet circuit
- D. One user’s patch cable
Show answer
Answer: A
A fault affecting one entire subnet but no others points to something shared by that subnet, such as its gateway, switch or VLAN configuration. Individual workstations would not all fail together, the internet circuit would affect everyone, and a single user’s cable cannot explain a subnet-wide outage.
Question 3. A technician needs to determine at which hop traffic to a remote site is being dropped. Which tool is most appropriate?
- A. ping
- B. nslookup
- C. netstat
- D. traceroute
Show answer
Answer: D
traceroute shows each hop along the path and where traffic stops, which is precisely what identifying the failing hop requires. ping confirms reachability without showing the path, nslookup tests name resolution, and netstat shows local connections.
What to practise
Memorise the seven methodology steps in order and drill “what comes next” until it is automatic. Those are free marks.
Then practise the scope habit: for every troubleshooting scenario you meet, before reading the options, ask how many people are affected? One user, one subnet, or everyone narrows the answer faster than any other single question — and it is exactly how the performance-based items are constructed.