Your FREE CompTIA Network+ Flashcards 2026 – 250+ Cards

A seven-layer framework for network communication: Physical, Data Link, Network, Transport, Session, Presentation, Application (L1→L7).

Physical — bits on the medium: cables, connectors, radio, voltage, hubs, NICs, repeaters.

Data Link — local (MAC) addressing and framing on the link. Switches, bridges, 802.3, 802.11. PDU: frame.

Network — logical addressing and routing between networks. IP, ICMP, routers. PDU: packet.

Transport — end-to-end delivery, segmentation, and ports. TCP and UDP. PDU: segment/datagram.

Session — establishes, manages, and terminates sessions between applications (RPC, NetBIOS).

Presentation — translation, encryption/decryption, and compression (TLS, ASCII, JPEG).

Application — user-facing network services and protocols (HTTP, FTP, DNS, SMTP).

All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data Link, Physical).

Adding each layer's header to data as it moves down the stack: data → segment → packet → frame → bits.

The data unit at each OSI layer: bits (L1), frame (L2), packet (L3), segment/datagram (L4).

Transmission Control Protocol — connection-oriented, reliable Layer 4 protocol using a three-way handshake, sequencing, acknowledgments, and retransmission.

User Datagram Protocol — connectionless, best-effort Layer 4 protocol with low overhead; no handshake or acknowledgments.

SYN → SYN-ACK → ACK. Establishes a reliable TCP connection before data flows.

TCP is reliable and connection-oriented (web, email, SSH); UDP is fast and connectionless (DNS, DHCP, VoIP, streaming).

A 32-bit logical address written as four dotted-decimal octets (e.g., 192.168.1.10), split into network and host portions.

A 128-bit address written in eight groups of hexadecimal (e.g., 2001:db8::1); vastly larger space, no NAT needed.

Marks which bits of an IP address are the network portion (1s) and which are the host portion (0s).

Classless Inter-Domain Routing — a slash and number (e.g., /24) showing how many leading bits are the network portion.

Usable hosts = 2 raised to the number of host bits − 2 (subtract the network and broadcast addresses).

Mask 255.255.255.0; 8 host bits; 254 usable hosts.

Mask 255.255.255.252; 2 host bits; 2 usable hosts — common for point-to-point links.

The router IP a host sends traffic to when the destination is on a different subnet.

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — internal use only, not internet-routable.

Automatic Private IP Addressing (169.254.0.0/16); self-assigned when no DHCP server responds — a DHCP-failure clue.

127.0.0.1 (127.0.0.0/8) — tests the local TCP/IP stack on the host itself.

The last address in a subnet (all host bits = 1); reaches every host on that subnet.

The first address in a subnet (all host bits = 0); identifies the subnet itself, not a host.

File Transfer Protocol — 20 is data, 21 is control. TCP. Unencrypted.

Secure Shell / SFTP / SCP — encrypted remote access and file transfer. TCP.

Remote terminal access, unencrypted — avoid; use SSH instead. TCP.

Simple Mail Transfer Protocol — sending email. TCP.

Domain Name System — name resolution. UDP (TCP for zone transfers / large responses).

Dynamic Host Configuration Protocol — 67 server, 68 client. UDP.

Trivial File Transfer Protocol — simple, no authentication. UDP.

Hypertext Transfer Protocol — unencrypted web. TCP.

Network Time Protocol — clock synchronization. UDP.

Simple Network Management Protocol — 161 polling, 162 traps. UDP.

Lightweight Directory Access Protocol — directory services. TCP/UDP.

HTTP over TLS — encrypted web traffic. TCP.

Server Message Block — Windows file and printer sharing. TCP.

Syslog — centralized event logging. UDP.

LDAP over TLS — secure directory services. TCP.

Remote Desktop Protocol — Windows remote graphical access. TCP.

Internet Control Message Protocol — Layer 3 messaging used by ping and traceroute for errors and diagnostics.

Cat 5e/6/6a/8 cabling; cheap and common, limited to about 100 m per run.

Fiber with a tiny core and a laser source; carries signals over very long distances.

Fiber with a larger core and LED/VCSEL source; high speed over shorter distances.

The 8-pin connector used to terminate twisted-pair copper Ethernet cable.

Hot-swappable transceiver modules that connect a device to fiber or copper at various speeds.

All nodes connect to a central switch; simple, but the central device is a single point of failure.

Many or all nodes interconnect; maximum redundancy but expensive and complex.

A data-center fabric where each leaf switch connects to every spine switch; predictable low latency.

Core (fast backbone), distribution (policy/routing), and access (end-device connection) layers.

A design that merges the core and distribution layers into one for smaller networks.

Traffic between clients and servers, in and out of the data center (client ↔ server).

Traffic between servers within the data center (server ↔ server).

Software-Defined Networking — separates the control plane (decisions) from the data plane (forwarding), managed centrally in software.

Software-Defined WAN — uses software to manage and optimize traffic across multiple WAN links (broadband, MPLS, LTE).

Secure Access Service Edge — converges networking (SD-WAN) and security services in the cloud.

Cloud service models: Infrastructure, Platform, and Software as a Service — increasing levels of provider management.

Deployment models: shared provider, dedicated/internal, or a mix of both.

Managing and provisioning network/device configuration through version-controlled code instead of manual setup.

Virtual Private Cloud — an isolated, logically segmented network within a public cloud provider.

Maximum Transmission Unit — the largest frame size that can be sent without fragmentation (typically 1500 bytes for Ethernet).

Four layers: Link (Network Access), Internet, Transport, Application — maps onto the seven OSI layers.

One-to-one communication: a packet sent to a single destination host.

One-to-all communication within a subnet (all hosts receive it). IPv4 only; IPv6 uses multicast instead.

One-to-many communication to a group of subscribed hosts (e.g., streaming, routing updates).

One-to-nearest communication: the same address is advertised from multiple locations; traffic goes to the closest.

1.0.0.0–126.0.0.0, default mask /8; huge networks.

128.0.0.0–191.255.0.0, default mask /16; medium networks.

192.0.0.0–223.255.255.0, default mask /24; small networks.

Variable Length Subnet Masking — using different mask lengths to size subnets efficiently.

Mask 255.255.255.128; 7 host bits; 126 usable hosts; block size 128.

Mask 255.255.255.192; 6 host bits; 62 usable hosts; block size 64.

Mask 255.255.255.224; 5 host bits; 30 usable hosts; block size 32.

Mask 255.255.255.240; 4 host bits; 14 usable hosts; block size 16.

Block size = 256 − the mask's interesting octet; subnets increment by the block size.

fe80::/10 — an automatically configured address used only on the local link.

fc00::/7 (commonly fd00::/8) — the IPv6 equivalent of RFC 1918 private addresses.

Stateless Address Autoconfiguration — how IPv6 hosts self-assign an address using router advertisements.

Running IPv4 and IPv6 simultaneously on the same devices during migration.

Fully Qualified Domain Name — the complete name of a host including its domain (e.g., host.example.com).

HTTP (port 80) is unencrypted; HTTPS (port 443) wraps HTTP in TLS for confidentiality and integrity.

Email retrieval protocols — POP3 (110) downloads and often removes mail; IMAP (143) syncs mail on the server.

An intermediary that forwards client requests, providing caching, filtering, and anonymity.

Distributes incoming traffic across multiple servers for performance and availability.

Content Delivery Network — geographically distributed servers that cache content near users.

An IDS detects and alerts on suspicious traffic; an IPS sits inline and can actively block it.

NAS provides file-level storage over the LAN; a SAN provides block-level storage over a dedicated high-speed network.

A Layer 3 device that forwards packets between different networks using IP addresses and a routing table.

A Layer 2 device that forwards frames within a network using MAC addresses and a MAC address table.

A switch that also performs routing in hardware, including inter-VLAN routing.

An obsolete Layer 1 device that repeats incoming bits to every port, creating one collision domain.

A 48-bit hardware address burned into a NIC, used for Layer 2 delivery on the local link.

Address Resolution Protocol — maps a known IPv4 address to its MAC address on the local network.

Manually configured routes; predictable and low-overhead, but no automatic adaptation to changes.

Routes learned automatically via protocols (OSPF, EIGRP, BGP, RIP) that adapt to topology changes.

Open Shortest Path First — a fast link-state interior gateway protocol using cost (bandwidth) as its metric.

Border Gateway Protocol — the path-vector exterior gateway protocol that routes between autonomous systems on the internet.

Enhanced Interior Gateway Routing Protocol — Cisco's advanced distance-vector IGP using a composite metric.

Routing Information Protocol — a simple distance-vector IGP using hop count (max 15); rarely used today.

A router's trust ranking of routing sources; lower is preferred when multiple protocols offer a route.

Network Address Translation — maps private IP addresses to public ones at the network edge.

Port Address Translation (NAT overload) — lets many private hosts share one public IP using unique port numbers.

First Hop Redundancy Protocols — provide a redundant default gateway so the network survives a router failure.

Virtual LAN — a logical Layer 2 segment that splits one switch into multiple broadcast domains.

The IEEE standard that tags Ethernet frames with a VLAN ID so VLANs span trunk links between switches.

A switch port that carries traffic for multiple VLANs (tagged with 802.1Q) between switches.

A switch port that belongs to a single VLAN and connects to an end device.

The VLAN whose traffic is sent untagged across a trunk link.

Routing between VLANs using a router-on-a-stick (subinterfaces) or a Layer 3 switch (SVIs).

Spanning Tree Protocol — prevents Layer 2 loops by electing a root bridge and blocking redundant paths.

Rapid Spanning Tree Protocol — a faster-converging version of STP.

The switch with the lowest bridge ID; the reference point STP uses to build a loop-free topology.

Bundling multiple physical links into one logical link for more bandwidth and redundancy (IEEE 802.3ad).

Copies traffic from one or more ports to a monitoring port for analysis.

Power over Ethernet — delivers electrical power and data over a single cable to APs, phones, and cameras.

Ethernet frames larger than the standard 1500-byte MTU (up to ~9000 bytes); improve throughput for storage networks.

The IEEE wireless LAN family: a/b/g/n (Wi-Fi 4)/ac (Wi-Fi 5)/ax (Wi-Fi 6/6E).

The current mainstream Wi-Fi standard; works on 2.4/5 GHz (and 6 GHz as 6E) with higher efficiency in dense areas.

Longer range and better penetration but slower; only channels 1, 6, 11 are non-overlapping — congested.

Faster with many non-overlapping channels but shorter range than 2.4 GHz.

Carrier-Sense Multiple Access with Collision Avoidance — the wireless access method (collisions can't be detected on air).

Service Set Identifier — the human-readable name of a wireless network.

Wi-Fi Protected Access 2 — uses AES (CCMP); the older secure standard, vulnerable to offline PSK guessing.

The current Wi-Fi security standard; uses SAE to resist offline guessing and adds forward secrecy.

Wired Equivalent Privacy — an obsolete, easily cracked wireless encryption; never use it.

Intermediate and Main Distribution Frames — wiring closets where cabling and equipment are terminated.

Uninterruptible Power Supply — battery backup that keeps equipment running through power interruptions.

Inter-VLAN routing using one physical router interface divided into VLAN subinterfaces.

Switched Virtual Interface — a virtual Layer 3 interface on a switch used for inter-VLAN routing.

Disables a port that receives a BPDU, protecting the STP topology at the edge.

Lets an edge access port skip STP listening/learning and go straight to forwarding.

Automatically detects and corrects cable type (straight-through vs crossover) on a port.

Both ends can transmit and receive simultaneously; no collisions on a switched link.

Only one end transmits at a time; used by hubs and shared media, prone to collisions.

Provided by FHRPs like VRRP and HSRP via a shared virtual IP.

The MAC address of a wireless access point's radio, identifying a basic service set.

The SSID shared by multiple APs forming one extended wireless network.

Combining adjacent Wi-Fi channels for more bandwidth (wider channels = higher throughput).

Radiates signal evenly in all directions; good general coverage.

Focuses signal in one direction for longer-range, point-to-point links.

WPA3 mode using 802.1X/RADIUS for individual authentication, with up to 192-bit security.

A web page that requires sign-in or acceptance before granting wireless network access.

Measuring signal, interference, and coverage to plan AP placement and channels.

Dynamic Trunking Protocol — auto-negotiates trunks; disable it to prevent VLAN hopping.

STP picks the switch with the lowest bridge priority (then lowest MAC) as the root bridge.

Dynamic Host Configuration Protocol — automatically assigns IP, mask, gateway, and DNS to clients.

The DHCP exchange: Discover, Offer, Request, Acknowledge.

Forwards DHCP requests across subnets to a centralized DHCP server.

Domain Name System — resolves human-readable names to IP addresses using a hierarchy of servers.

Maps a hostname to an IPv4 address.

Maps a hostname to an IPv6 address.

An alias that points one name to another canonical name.

Specifies the mail server(s) for a domain.

Maps an IP address back to a hostname (reverse DNS).

Identifies the authoritative name servers for a domain.

Simple Network Management Protocol — monitors and manages devices; manager polls UDP 161, agents send traps on UDP 162.

The secure version of SNMP, adding authentication and encryption; prefer it over v1/v2c.

A standard for centralized event/error logging from network devices (UDP 514).

Records traffic flows so you can analyze who is sending how much data and to where.

Security Information and Event Management — aggregates and correlates logs/alerts across the network.

A reference of normal performance/behavior used to detect anomalies later.

Shows IP addressing, VLANs, routing, and data flow — the network's logical structure.

Shows actual devices, ports, and cabling — racks, runs, and connections.

IP Address Management — tools/processes for tracking and assigning IP address space.

Service Level Agreement — a contract defining expected uptime, performance, and support response.

Designing systems with redundancy so a single failure does not cause an outage.

A redundancy model where multiple nodes share the load simultaneously.

A redundancy model where a standby node takes over only when the active node fails.

Recovery Time Objective — the maximum acceptable time to restore service after an outage.

Recovery Point Objective — the maximum acceptable amount of data loss (how far back you recover).

Mean Time To Repair — the average time to fix a failed component.

Mean Time Between Failures — the average operating time between failures (a reliability measure).

Network Access Control — enforces policy (posture, identity) before a device is allowed onto the network.

Port-based network access control that authenticates a device before granting network access (often via RADIUS).

A switch feature limiting which/how many MAC addresses may use a port, defending against MAC flooding.

End of Life / End of Support — lifecycle milestones after which a product no longer receives updates.

Prioritizing certain traffic (e.g., VoIP) to guarantee performance under congestion.

Delaying lower-priority packets to smooth bandwidth use and meet QoS targets.

Controlling how much capacity applications or users may consume.

Tracking and controlling device configurations and changes (often version-controlled).

A formal process for reviewing and approving network changes to reduce risk.

A fully equipped, ready-to-run backup site for fast disaster recovery.

A backup site with space and power but no preinstalled equipment; slow to bring online.

A backup site partially equipped; a middle ground between hot and cold.

A complete copy of all selected data.

Backs up only data changed since the last backup of any type; fast backup, slower restore.

Backs up data changed since the last full backup; slower backup, faster restore than incremental.

A fixed IP a DHCP server always assigns to a specific MAC address.

The time period a client may use an assigned DHCP address before renewing.

Acceptable Use Policy and related rules governing how the network may be used.

Monitor temperature, humidity, and power in equipment rooms to prevent failures.

Confidentiality, Integrity, and Availability — the three core goals of information security.

Ensuring information is accessible only to authorized parties (e.g., via encryption).

Ensuring data is not altered without authorization (e.g., via hashing).

Ensuring systems and data are accessible when needed (e.g., via redundancy).

Authentication, Authorization, and Accounting — who you are, what you can do, and logging it.

Remote Authentication Dial-In User Service — a common AAA protocol; often used with 802.1X.

A Cisco AAA protocol that separates authentication, authorization, and accounting and encrypts the full payload.

A model that trusts no user or device by default and verifies every access request (NIST SP 800-207).

Granting users and systems only the access they actually need.

Layering multiple security controls so no single failure exposes the network.

Multi-Factor Authentication — requiring two or more factors (something you know/have/are).

A device or software that permits or blocks traffic based on rules.

Tracks the state of active connections and allows return traffic for established sessions.

Filters each packet independently against rules, without tracking connection state.

Access Control List — an ordered set of permit/deny rules filtering traffic by address, port, or protocol.

Virtual Private Network — an encrypted tunnel carrying private traffic across a public network.

A suite securing IP traffic with authentication (AH) and encryption (ESP); common for site-to-site VPNs.

A persistent encrypted tunnel connecting two networks (e.g., two offices).

An encrypted tunnel from an individual device into the corporate network.

A buffer network exposing public-facing servers while isolating them from the internal LAN.

Dividing a network into zones so a breach in one area cannot spread freely.

Denial of Service — overwhelming a target so legitimate users cannot access it.

Distributed Denial of Service — many compromised hosts flood a target simultaneously.

Formerly man-in-the-middle — an attacker intercepts or alters traffic between two parties.

Sending forged ARP replies to associate the attacker's MAC with another host's IP, enabling on-path attacks.

Corrupting DNS data so name lookups resolve to a malicious server.

Overwhelming a switch's MAC table so it floods traffic, letting an attacker capture it. Countered by port security.

Gaining access to traffic on other VLANs (via double-tagging or switch spoofing). Counter with a unique native VLAN and disabling DTP.

An unauthorized access point connected to the network, creating a security hole.

A malicious access point impersonating a legitimate SSID to capture credentials and traffic.

A switch feature that validates ARP packets to stop ARP spoofing.

A switch feature that blocks rogue DHCP servers by trusting only designated ports.

A social-engineering attack tricking users into revealing credentials or clicking malicious links.

DNS Security Extensions — adds cryptographic signatures to DNS data to prevent poisoning.

Preventive, detective, and corrective controls; also physical, technical, and administrative.

One-way function producing a fixed-size digest to verify integrity (e.g., SHA-256).

Uses one shared key to encrypt and decrypt; fast (e.g., AES).

Uses a public/private key pair; the basis of TLS and digital signatures (e.g., RSA).

Restricting access based on a device's physical location.

A decoy system that lures attackers to study them and divert them from real assets.

Isolates internet-facing servers so a compromise there can't directly reach the internal LAN.

802.1X authenticates the device/user; MAC filtering allows/denies by hardware address (weak, spoofable).

Manipulating people into breaking security (phishing, pretexting, tailgating).

Following an authorized person through a secure door without credentials.

Trying many passwords/keys until one works; countered by lockouts and strong passwords/MFA.

Forcing wireless clients off an AP, often to set up an evil twin or capture handshakes.

Faking a source identity (IP, MAC, ARP, or DNS) to bypass controls or intercept traffic.

Checking a device's security state (patches, AV) before NAC grants access.

CompTIA's 7 steps: identify the problem; theorize a cause; test it; plan; implement or escalate; verify; document.

Gather information, question users, identify symptoms, and determine if anything recently changed.

Question the obvious; consider multiple causes (top-down, bottom-up, or divide and conquer the OSI stack).

Confirm the cause; if not confirmed, form a new theory or escalate.

Establish a plan to resolve the problem and identify the potential effects of the fix.

Apply the solution, or escalate to someone with more access or expertise.

Confirm the fix works and, if applicable, implement preventive measures.

Record the findings, actions, and outcomes — always the last step.

Loss of signal strength over distance; a Layer 1 cabling problem.

Interference between adjacent wire pairs in a cable, degrading the signal.

Electromagnetic Interference — outside electrical noise that corrupts a copper signal; reroute away from sources.

When the two ends of a link disagree on half/full duplex, causing collisions, errors, and poor throughput.

When link ends negotiate different speeds, causing the link to fail or perform poorly.

Transmit and receive pairs are swapped, preventing the link from coming up (fixed by a crossover or auto-MDIX).

A tool that verifies continuity and wiring of a copper cable to find opens, shorts, and miswires.

A 'toner' used to trace and identify a specific cable run among many.

Optical Time-Domain Reflectometer — locates breaks and measures loss on fiber runs.

The delay for data to travel from source to destination (round-trip time).

Variation in packet delay over time — especially disruptive to VoIP and video.

Packets that fail to reach the destination, caused by congestion, errors, or faulty hardware.

When a link is fully utilized, causing queuing, latency, and loss.

Cyclic Redundancy Check failures indicating corrupted frames — often from a bad cable, EMI, or duplex mismatch.

Uses ICMP echo request/reply to test reachability and round-trip time to a host.

Maps the per-hop path to a destination to find where traffic stops.

Query DNS to diagnose name-resolution problems.

Show and manage a host's IP address, mask, gateway, and DNS (spot an APIPA address).

Displays the local IP-to-MAC address mapping table.

Shows active network connections, listening ports, and protocol statistics.

Capture and inspect actual packets to diagnose hard problems at the protocol level.

A scanner that discovers hosts, open ports, and services on a network.

A tool that measures achievable bandwidth/throughput between two endpoints.

A classic symptom of a DNS problem (Layers 1-3 work; name resolution fails).

Indicates the client could not reach a DHCP server.

A misconfigured gateway lets local communication work but blocks access to other networks/the internet.

An unauthorized DHCP server handing out bad addresses; causes intermittent connectivity. Counter with DHCP snooping.

When all addresses in a DHCP pool are leased, new clients can't get an IP.

Troubleshooting approaches that work the OSI model from L7 down or L1 up to localize a fault.

CLI output revealing errors (CRC, runts, giants), drops, and utilization on a port.

Frames smaller than the minimum or larger than the maximum size — signs of errors or duplex/MTU issues.

Measures optical power to confirm a fiber link's signal strength is within tolerance.

Measures voltage, current, and resistance; used to check cabling and power.

A connector that loops a port's transmit to its receive to test the port itself.

A faulty optic causing a down or error-prone link; swap to isolate.

Traffic taking different paths each direction, which can break stateful firewalls.

A firewall rule or ACL silently dropping traffic, mimicking a connectivity outage.

A wrong mask makes a host miscalculate local vs remote, breaking some communication.

Overlapping channels, microwaves, or Bluetooth degrading 2.4 GHz Wi-Fi; fix with channel planning and 5 GHz.

Often a DNS or HTTPS-redirect issue on a guest network.

Displays or sets the device's network name.

Displays the routing table to verify how a device reaches destinations.