CompTIA Network+ N10-009: Networking Concepts

Introduction

Imagine an employee opening a cloud application from a laptop connected to office Wi-Fi. The laptop sends wireless frames to an access point, forwards traffic through switches and routers, resolves the application name using DNS, and builds an encrypted connection to a server that may be thousands of miles away. Every step depends on a distinct networking concept.

Domain 1 gives you the vocabulary and mental model to explain that entire journey. It covers eight official N10-009 objectives: the OSI model; network devices and functions; cloud connections; ports and protocols; media and connectors; network architectures; IPv4 addressing; and modern approaches such as software-defined networking and IPv6.

The important exam skill is distinguishing what each component does and recognizing where a problem belongs. Memorizing that DNS uses port 53 is useful. Understanding that DNS translates names and does not itself establish application connectivity is more useful.

1.1 — The seven-layer OSI model

The Open Systems Interconnection (OSI) model is a way to separate networking responsibilities. It is a reasoning framework, not a claim that every real protocol fits neatly into exactly one layer.

Layers 1 and 2 are not the same. A broken cable is a physical-layer problem. A frame arriving on the wrong VLAN is a data-link configuration problem. A host with the wrong default gateway has a network-layer problem even when its cable and Ethernet link are fine.

Layers 3 and 4 are not the same. IP addresses identify endpoints and support packet forwarding across networks. TCP and UDP identify application conversations using ports and provide different transport behaviors. A packet reaching the correct server IP does not guarantee that a service is listening on the intended TCP port.

Application-layer communication is not equivalent to an application working. DNS resolution might succeed, a TCP connection might succeed, and an HTTP application could still return an error.

Encapsulation: what travels through the layers?

For a typical Ethernet/IP/TCP exchange, application data becomes a TCP segment, is carried inside an IP packet, and is transmitted inside an Ethernet frame. The sender adds the headers needed at each stage. A receiver removes those headers in reverse order. Ethernet forwarding relies primarily on MAC addresses within a local network; routers use destination IP networks to choose a next hop.

In the common teaching model, Layer 4 data is called a segment for TCP (or datagram for UDP), Layer 3 data is a packet, Layer 2 data is a frame, and Layer 1 transmits bits/signals. These labels help you read diagrams and packet captures.

Scenario: what layer should you inspect?

A laptop detects an Ethernet link but cannot contact any device outside its subnet. The illuminated link is useful evidence about the physical connection; it says nothing conclusive about the correct default gateway or routing policy. Start with local IP settings and relevant forwarding state, not a replacement cable chosen at random.

1.2 — Network appliances, applications, and functions

Networking equipment can be physical, virtual, or delivered as a managed cloud service. The essential question is what function it performs.

A content delivery network (CDN) places or caches content closer to users and distributes demand among locations. It can lower origin load and improve response time, but it cannot make every dynamic request local or eliminate the need for healthy origin systems.

Three functions sometimes appear alongside appliances:

• A VPN protects or isolates communication across another network using a tunnel and relevant security controls. A VPN does not by itself guarantee that a remote user is authorized for every internal resource.
• Quality of service (QoS) classifies and prioritizes traffic when resources are constrained. It may improve voice under congestion, but cannot create bandwidth that a link does not have.
• The IP time to live (TTL) value (called a hop limit in IPv6) is reduced as packets cross routers so a routing loop cannot circulate a packet forever. It is unrelated to DNS-record cache TTL even though both use the same abbreviation.

Compare: proxy, firewall, and load balancer

A reverse proxy often receives an application request on behalf of a server. A firewall decides whether traffic is allowed according to policy. A load balancer chooses among available backends. Products can combine these functions; the functions remain conceptually distinct.

1.3 — Cloud networks and connectivity

Cloud networking uses many of the same IP concepts as an on-premises environment, but the network components are often virtualized, programmable, and managed through an API.

Network functions virtualization (NFV) implements functions such as firewalls or routing in software rather than requiring a dedicated appliance for each one. A virtual private cloud (VPC) is a logically isolated cloud networking environment with addresses, subnets, route controls, and security boundaries.

Cloud security controls may be associated with instances or interfaces (often called security groups) or with subnets and network segments (often called network security lists). Their stateful/stateless behaviors and default rules are provider-specific; never assume every cloud implements them identically.

An internet gateway provides an internet-facing route for appropriately configured public resources. A NAT gateway enables outbound connections for certain privately addressed resources without assigning each one a public address. NAT is not a substitute for access-control policy.

Cloud connection choices

Public, private, and hybrid deployment models describe who operates infrastructure and how environments are combined. SaaS, PaaS, and IaaS describe service responsibility, not whether an application is publicly accessible.

• SaaS: consumers use an application operated by a provider.
• PaaS: developers deploy applications on a provider-managed platform.
• IaaS: customers manage guest systems and applications on supplied compute, storage, and networking resources.

Scalability is an ability to handle more demand by adding or improving capacity. Elasticity means adjusting capacity up and down with changing demand. Multitenancy allows multiple customers to share underlying infrastructure while maintaining required separation. These ideas are related but not interchangeable.

1.4 — Ports, protocols, and traffic types

An IP address identifies a host or interface. For TCP and UDP, a port helps identify the service or process that receives traffic. A protocol's customary port is a clue, not a guarantee that a system is listening there.

Common ports in the N10-009 blueprint

The exam may ask you to select a likely service from its port, but you must also understand what a service does. DNS resolves names; DHCP assigns network configuration; NTP synchronizes clocks; SNMP reads management information; syslog transports logs. A successful DNS lookup does not prove a web service is healthy.

TCP offers connection-oriented, ordered, reliable byte-stream delivery with retransmission and congestion control. UDP is connectionless and preserves message boundaries without providing TCP's delivery guarantees. Applications may build reliability over UDP when needed.

ICMP carries network control and diagnostic messages; it has no TCP or UDP service port. GRE encapsulates packets inside other IP packets, typically without encryption by itself. IPsec protects IP communications through components such as AH (authentication/integrity), ESP (confidentiality and/or integrity), and IKE (security-association negotiation).

One-to-one, one-to-many, and nearest-destination delivery

Broadcast is an IPv4/Ethernet concept rather than a normal IPv6 address type. IPv6 relies on multicast for several discovery functions.

1.5 — Transmission media, transceivers, and connectors

Media selection is about more than speed: distance, interference, power, installation environment, and compatibility matter.

Copper Ethernet commonly uses twisted-pair cable with RJ45-style connectors. Categories and the applicable Ethernet standard determine supported rates and distances. Shielded twisted pair (STP) may be appropriate in high-interference environments when installed correctly; unshielded twisted pair (UTP) is common in offices. Coaxial cable remains relevant in cable broadband and specialized systems.

Fiber optic cable transmits light and avoids electromagnetic interference. Single-mode fiber is designed for longer distances with a small optical core and appropriate optics. Multimode fiber typically serves shorter data-center or campus links with different optical requirements. Fiber types, wavelengths, optics, and connectors must match. A transceiver that physically fits a slot is not necessarily compatible with the fiber or the device.

Direct-attach copper (DAC) uses integrated transceiver ends on a short copper twinax assembly, frequently for nearby rack connections. It is often economical for short distances but is not a substitute for long-reach fiber.

Plenum-rated cable meets requirements for certain air-handling spaces; it does not mean the cable is automatically faster. Local building and fire rules determine what cable jacket is appropriate.

SFP and QSFP describe pluggable transceiver form-factor families, not a single network speed or optical range. Fibre Channel and Ethernet are different protocols and may use related-looking transceiver form factors. Read the transceiver's actual specification.

Wireless media includes IEEE 802.11 Wi-Fi, cellular networks, and satellite links. These differ in spectrum, range, latency, infrastructure, mobility, capacity, and licensing requirements. For example, a satellite connection may be appropriate where terrestrial coverage is unavailable, while a wired fiber connection usually offers different capacity and latency characteristics.

Scenario: a cross-building link

Two buildings need a reliable network connection across a long outdoor route. A short copper patch cable is not appropriate simply because both switches have RJ45 ports. Distance, pathway, lightning exposure, fiber type, optics, and required throughput must be evaluated together.

1.6 — Network topologies and architectures

A topology describes how components and links connect. An architecture describes how network roles and traffic paths are organized.

• Star / hub-and-spoke: endpoints or branches connect to a central node or location; simple to understand but the center needs resilience.
• Mesh: multiple interconnected paths provide alternative routes; improves redundancy at added complexity and cost.
• Point-to-point: a dedicated logical or physical connection joins two endpoints.
• Hybrid: combines more than one topology to fit the environment.
• Spine-and-leaf: each leaf switch typically connects to multiple spine switches; supports predictable east-west paths in data centers.

The traditional enterprise three-tier hierarchy separates access, distribution, and core functions. A collapsed core combines core and distribution functions, often suitable for smaller designs. Neither model alone establishes whether a network is secure or highly available.

North-south traffic crosses a network or data-center boundary, such as a client reaching a public application. East-west traffic moves laterally among systems within an environment, such as an application server calling a database. These are traffic-direction concepts, not compass directions.

Scenario: A data center hosts thousands of application-to-application connections. A spine-and-leaf topology may provide more consistent east-west connectivity than a design optimized only for traffic entering and leaving the site. The choice still depends on scale, resiliency, and cost.

1.7 — IPv4 addressing and subnetting

IPv4 addresses are 32 bits long. A prefix such as /24 specifies how many leading bits identify the network. The remaining bits identify addresses within it. A subnet mask such as 255.255.255.0 is another way to express /24.

Recognize important address ranges

Private addresses are not routed on the public internet as ordinary globally reachable source or destination addresses. NAT often allows privately addressed clients to initiate connections through a public address. APIPA/link-local addresses are not a substitute for a correctly routed enterprise subnet; in an environment expecting DHCP, a newly assigned 169.254 address is a diagnostic clue. Loopback addresses represent the local host.

Work a subnet, not just the prefix

Take 192.168.10.130/26. A /26 uses 26 bits for the network and leaves 6 host bits, giving 2^6 = 64 total addresses per subnet. The block size in the last octet is 64: 0, 64, 128, and 192.

The address 192.168.10.130 lies in the block starting at 128.

The usual subtraction of two addresses applies to conventional IPv4 subnet designs with separate network and broadcast addresses; special cases such as /31 point-to-point links have different rules.

CIDR describes classless prefixes such as /26 and makes route aggregation possible. VLSM assigns different subnet sizes according to need: a 50-host segment might use /26 while a 12-host segment could use /28. Use non-overlapping ranges.

CompTIA also references historical Class A, B, C, D, and E addressing. A, B, and C describe older unicast class boundaries; D identifies multicast addresses; E is reserved/experimental. Modern routing and subnetting use classless prefixes rather than inferring a mask from an address's first octet.

Scenario: the wrong gateway

A host has 10.10.20.25/24 and gateway 10.10.21.1. In a conventional Ethernet network the configured next hop falls outside the local 10.10.20.0/24 subnet. Even if the gateway is a real router elsewhere, this mismatch is a likely configuration problem. The correct gateway address must be confirmed from the actual segment design.

1.8 — Modern network environments

Software-defined networking (SDN) separates or centralizes aspects of network control so policies and forwarding behavior can be managed programmatically. Software-defined WAN (SD-WAN) uses software-based policies to select and manage wide-area paths across different transports. Application awareness, central policy, transport independence, and zero-touch provisioning can simplify operations, but the physical links and security controls still matter.

VXLAN uses encapsulation to extend Layer 2 segments over a Layer 3 underlay. It is useful in data centers and interconnect designs, but adds overlay/underlay dependencies that operators must understand.

Zero Trust architecture (ZTA) makes access decisions using verified identities, device or session context, explicit authorization, and least privilege. It does not mean “trust no packets” or remove all internal networking. SASE combines networking and security service delivery in a distributed model; SSE focuses on security service capabilities without necessarily including the WAN component.

Infrastructure as code (IaC) treats desired infrastructure configurations as reviewable definitions. Templates, playbooks, reusable tasks, dynamic inventory, controlled upgrades, and drift detection help maintain consistency. Source control provides history, branching, change comparison, and conflict handling. Automation does not remove the need for testing and rollback.

IPv6 and transition

IPv6 has a 128-bit address space and different address configuration mechanisms. It reduces reliance on the address-conservation role of IPv4 NAT, but does not make security controls unnecessary.

IPv6 is not simply IPv4 with longer numbers. Neighbor discovery, address representation, multicast, and subnet planning differ. Learn the purpose of each transition strategy and the limitations of what it connects.

Review: one network, several possible explanations

An organization reports the following:

1. Wireless clients have healthy Wi-Fi signal but no internet access.
2. The DHCP service recently changed.
3. Clients on one VLAN receive expected addresses; clients on another receive 169.254 addresses.
4. The WAN router and web service remain healthy.

The strongest first hypothesis is not “the internet is down.” The contrast between VLANs suggests that the failing segment's DHCP delivery path, relay, switch configuration, or policy deserves examination. Healthy radio signal only addresses part of the path; it does not prove that IP configuration succeeded.

This is the central skill of Domain 1: use the model to choose the next meaningful distinction.

Original practice questions

1. A computer reaches a service by IP address, but the hostname fails. Which function should be checked first?
Answer: DNS. The IP path has some evidence of working, while name resolution is unproven. A DNS issue is more likely than a disconnected cable on these facts.

2. Which technology forwards packets between two separate IP networks?
Answer: A router or Layer 3 forwarding function. A basic Layer 2 switch forwards within a broadcast domain; VLAN separation alone does not route between subnets.

3. Why is a CDN not the same as a load balancer?
Answer: A CDN distributes content geographically and often caches it near consumers. A load balancer distributes requests among targets. Products may combine capabilities, but their primary purposes differ.

4. A 172.20.5.10 address appears on a client. Is it within an RFC 1918 private range?
Answer: Yes. The private 172.16.0.0/12 block spans 172.16.0.0 through 172.31.255.255, not all of 172/8.

5. What is the network address of 192.168.10.130/26?
Answer: 192.168.10.128. The /26 block boundaries increase by 64 in the last octet. 130 falls within 128–191.

6. A network requires protected remote connectivity over existing internet links. Which connectivity model fits?
Answer: A VPN. Dedicated connectivity may be appropriate for other requirements, but the scenario specifies protected communication over the existing internet path.

7. Which metric best describes variation in packet arrival time for a VoIP application?
Answer: Jitter. Latency measures delay; jitter measures variation in that delay. High jitter can produce choppy audio even when average bandwidth looks sufficient.

8. Why is a successful Ethernet link light insufficient proof of an application path?
Answer: It indicates some physical/link-layer status but does not validate IP addressing, routing, DNS, transport reachability, access policy, or application health.

Domain 1 readiness check

Before proceeding, make sure you can:

• Explain each OSI layer and distinguish link, network, transport, and application failures.
• Compare all major networking appliances, CDN, VPN, QoS, and TTL.
• Explain cloud gateways, connectivity, service/deployment models, scaling, and multitenancy.
• Associate the official services with their common ports and explain TCP, UDP, ICMP, GRE, and IPsec.
• Choose among copper, fiber, DAC, wireless, optics, and connectors using relevant constraints.
• Compare star, mesh, point-to-point, three-tier, collapsed-core, and spine-and-leaf architectures.
• Calculate IPv4 subnet boundaries, recognize special-use ranges, and explain CIDR and VLSM.
• Describe SDN, SD-WAN, VXLAN, ZTA, SASE/SSE, IaC, IPv6, and common transition strategies.

Official source

CompTIA Network+ N10-009 Exam Objectives, version 4.0 (PDF), Domain 1.0, objectives 1.1–1.8. This article explains the subjects independently; it does not reproduce actual exam items or the complete copyrighted objective document.

Tech Little Brawta is an independent educational publisher and is not affiliated with or endorsed by CompTIA. Last verified November 1, 2026.