CompTIA Network+ common mistakes
CompTIA Network+ · Understand the traps and how to avoid them.
Memorizes port numbers only in the number→protocol direction ("3389 = RDP") and then freezes when a scenario describes the service first ("a technician must reach a Windows host's graphical console remotely - which port must be allowed?"), or swaps near-identical pairs such as 389/636, 143/993, 80/8080, and 161/162.
Ports are usually drilled from a single flat list in one direction, so recognition works but recall does not, and paired secure/insecure services blur together because they were never studied as pairs.
What to do instead
Rebuild the deck bidirectionally (service→port and port→service) and study paired entries side by side (389 LDAP / 636 LDAPS, 143 IMAP / 993 IMAPS, 161 SNMP query / 162 SNMP trap, 20-21 FTP control+data / 22 SFTP). Add one scenario sentence to each card describing a real use case so the port is attached to a situation, not just a number.
Answers "which OSI layer" questions from the name of a device or protocol rather than from the fault symptom - for example choosing Layer 3 for a duplex mismatch or VLAN misconfiguration, Layer 7 for a TLS certificate error, or Layer 2 for a routing loop.
Candidates memorize layer names and one example device per layer, but exam items usually present a symptom (cable unplugged, bad transceiver, wrong default gateway, application timeout) and expect the layer where that symptom originates.
What to do instead
Build a two-column table of symptom→layer and practice classifying 20–30 symptoms rather than devices: physical damage/no link = 1, MAC/VLAN/duplex = 2, IP/addressing/routing = 3, port/firewall/segment = 4, session teardown = 5, encoding/encryption/format = 6, application behavior = 7. Note that TLS encryption is commonly attributed to Layer 6 while TLS-based protocols like HTTPS are Layer 7.
Computes subnet size or range incorrectly - counting the network and broadcast addresses as usable hosts (calling /26 "64 hosts" instead of 62), or failing to determine whether two given IP/mask pairs sit on the same subnet when the item asks whether traffic is routed or switched.
The 2^h formula is memorized without the "minus 2" for traditional IPv4 subnets, and same-subnet questions are answered by eyeballing the first three octets instead of ANDing against the mask.
What to do instead
Drill until the mask table is automatic ( /25=128, /26=64, /27=32, /28=16, /29=8, /30=4 blocks; usable = block minus 2), then practice the AND operation explicitly on pairs like 192.168.1.70/26 vs 192.168.1.130/26. For /31 and /32, remember the usable-host rule differs.
Confuses virtualization, cloud, and software-defined networking models - labeling a provider-managed virtual machine as PaaS, calling SaaS "infrastructure," or stating that SDN moves the forwarding function into the control plane (the reverse is true: forwarding stays in the data plane while the control plane is centralized).
The service models are learned as three words rather than as a responsibility split, and SDN is learned as a slogan rather than as a plane diagram, so plausible-sounding reversals look correct under time pressure.
What to do instead
Anchor each model to who manages what: IaaS = you manage the OS and up; PaaS = you manage only the app/code; SaaS = you manage only your data and access. Draw the SDN split once by hand - control plane decides, data plane forwards - and note that NFV virtualizes network functions while SDN centralizes control; they are complementary, not the same thing.
Picks the wrong wireless tradeoff - choosing 5 GHz as the band with the longest range and best wall penetration, assuming 2.4 GHz is faster because it is "more crowded," or matching a standard to the wrong band/throughput (e.g., attributing 802.11ac features to 2.4 GHz).
Band characteristics are memorized as adjectives rather than as a physical tradeoff, and standards are learned as a list of speeds without attaching each to its frequency, channel width, and MIMO characteristics.
What to do instead
Learn one sentence per band: lower frequency = longer range and better penetration but fewer non-overlapping channels (2.4 GHz: 1/6/11); higher frequency = more bandwidth and less interference but shorter range (5 GHz, 6 GHz). Then build a standards grid with columns for band, max channel width, and typical marketing speed, and fill it from memory weekly.
Selects cable media by category name alone and ignores the distance constraint in the question - recommending Cat 6 for 10 Gbps at 100 m, Cat 5e for 2.5/5 Gbps at full length, or single-mode fiber for a short intra-building run where multimode is the expected choice.
Candidates memorize "Cat 6a = 10G" as a slogan and drop the length qualifier, and fiber types are learned as connector shapes rather than as distance/optics tradeoffs.
What to do instead
Attach a distance to every copper standard you memorize (Cat 5e = 1 Gbps/100 m, Cat 6 = 10 Gbps to ~55 m, Cat 6a = 10 Gbps/100 m) and every fiber type (multimode for short-to-moderate runs inside a campus, single-mode for long-haul). Before answering, underline the distance in the stem and eliminate any option that cannot meet it.
Swaps RTO and RPO - stating that RPO is the time to restore service after an outage, or that RTO is how much data loss is tolerable - and then picking a backup-frequency answer for a question that actually asked about acceptable downtime.
Both are expressed in time units and both appear in the same disaster-recovery paragraph, so they are stored as one undifferentiated "recovery time" concept.
What to do instead
Fix the mnemonic to the object each one protects: RTO protects service availability (how long until we are back up), RPO protects data (how far back the last good copy may be, which sets backup frequency). When a stem says "the business can tolerate four hours of downtime," that is RTO; "no more than 15 minutes of transactions may be lost" is RPO.
Mixes up 802.1X and AAA roles - naming the switch or access point as the authentication server, or treating authentication, authorization, and accounting as interchangeable when a scenario distinguishes them.
802.1X is learned as "port security with a login," so the three-party exchange collapses into two parties, and AAA is learned as a single acronym rather than as three sequential functions.
What to do instead
Draw the 802.1X triangle once and label it precisely: supplicant (client) → authenticator (switch/AP, which only relays) → authentication server (RADIUS/TACACS+). Then write one line per A: authentication = who you are, authorization = what you may do, accounting = what you did and when. Check any answer that names the switch as the decision-maker.
Conflates attack types that share a symptom - answering "evil twin" for a rogue DHCP server, "phishing" for a targeted executive email (whaling/spear phishing), "DoS" for a botnet-driven flood (DDoS), or "on-path attack" for ARP spoofing that the question is testing as ARP poisoning.
These attacks are studied as a vocabulary list of names rather than as distinct mechanisms, so any answer containing a familiar security word looks right.
What to do instead
For each attack, memorize the mechanism in one clause (evil twin = fake AP broadcasting a real SSID; rogue DHCP = unauthorized server handing out leases/gateway; on-path = attacker relays traffic between two hosts; DDoS = many distributed sources). Group the phishing family by target: broad = phishing, specific individual = spear phishing, executive = whaling, voice channel = vishing, SMS = smishing.
Skips or reorders the CompTIA troubleshooting methodology - selecting "document findings" or "implement the solution" as an early step, or jumping straight to a fix without establishing and testing a theory - and answers the "next step" item with the technically effective action rather than the methodologically correct one.
Experienced candidates troubleshoot intuitively and answer with what they would actually do first on the job, which is often out of order relative to the seven-step model the exam is measuring.
What to do instead
Memorize the sequence verbatim: identify the problem (gather information, question the obvious, duplicate the problem if possible) → establish a theory of probable cause (question the obvious) → test the theory to determine cause → establish a plan of action and implement the solution → verify full system functionality and implement preventive measures → document findings, actions, and outcomes. For any "next step" item, locate where the scenario currently sits in the sequence before reading the options.