CertificationsCompTIA Network+ N10-009Labs
CompTIA Network+ N10-009 hands-on labs
Cisco-style console work over a small topology: access ports, trunks, static routes, and the show output that proves the fix.
71 labs you run in the browser: 47 guided, 18 assisted, 5 challenge, 1 capstone. About 18 hours of authored lab time. 1 opens to any signed-in account without a lab grant.
71
labs
47
guided
steps in order
6
goal only
challenge and capstone
1
free tasters
signed-in, no grant
What you practise
Exam facts and study plan- Cisco-style device console and topology· you type57 labs
- Windows desktop· you click5 labs
- Firewall zone and rule table· you click3 labs
- Hardware bench and firmware panels· you click2 labs
- SIEM queue· you click2 labs
- Cloud panel with the matching CLI line· you click1 labs
- Linux bash console· you type1 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Lock down the comms room and keep the change
Free tasterGuided · Quick · 5 min · Cisco-style device console and topology
An insurance walk of the ground floor comms room found three patched jacks inside it, all live and all in the office segment…
device hardeningunused portsadministrative stateconfiguration management
Put the maintenance desk back and close the jack beside it
ProGuided · Quick · 5 min · Cisco-style device console and topology
A maintenance window closed two jacks on SW-MNT last Friday. The engineer closed Fa0/7 by mistake and that desk is in use again this morning, so the user has link lights but no address…
port statusadministratively downaccess portphysical interface issues
Retire the old analogue camera segment
ProGuided · Quick · 5 min · Cisco-style device console and topology
The old analogue recorder was replaced in March and its segment is still on the switch. VLAN 77 has two patched jacks in the recorder cupboard, both now empty…
VLAN databaseVLAN removalaccess portdefault VLAN
Shut down an unused wall jack
ProGuided · Quick · 5 min · Cisco-style device console and topology
A security walk found a live jack in the annex corridor. Nobody uses it, the room is unlocked, and a visitor with a patch cable would be on the staff segment in seconds…
administrative stateport securityunused ports
Give the store router a way out and the ward its own path
ProGuided · Quick · 6 min · Cisco-style device console and topology
R-PHARM was rebuilt after a power event and came back with an empty routing table. Staff cannot reach anything outside the store subnet…
static routedefault routeroute selectionprefix length
Make the basement switch match the rack diagram
ProGuided · Quick · 6 min · Cisco-style device console and topology
A new switch went into rack B2 last week and nobody finished the paperwork side of the install. The device still answers to the factory name, while the rack diagram…
configuration managementbaseline configurationdocumentationVLAN label
Open the warehouse uplink for four segments
ProGuided · Quick · 6 min · Cisco-style device console and topology
The warehouse switch SW-WH was fitted with three local segments last month and its link to the distribution switch is still a plain access port…
trunk802.1Q taggingallowed VLAN listaccess port
Relabel the radiology segment and move the viewer jack
ProGuided · Quick · 6 min · Cisco-style device console and topology
The imaging suite runs on VLAN 220. It was built in a hurry three years ago and the switch still shows the placeholder label the device invented on its own…
VLAN databaseVLAN labelaccess portbroadcast domain
Route the store to one backup appliance
ProGuided · Quick · 6 min · Cisco-style device console and topology
Nightly backups from the store router stopped this week. The provider moved the backup appliance behind their carrier network, so the store now needs a path to that one address…
static routenext hophost routeprefix length
Give a new team its own VLAN
ProGuided · Quick · 7 min · Cisco-style device console and topology
A six person team moves into suite 210 next week. Their switch stack is in place and port Fa0/12 on SW-A is patched to the new wall jacks…
vlanaccess portbroadcast domain
Route the store network to the stockroom subnet
ProGuided · Quick · 7 min · Cisco-style device console and topology
The stockroom moved into 172.21.40.0/22 last month. R-STORE already knows its own store LAN on Gi0/1 and the provider link on Gi0/0 is addressed as 198.51.100.14 with mask 255.255.255.252…
static routenext hoprouted interface
Add a static route to a branch subnet
ProGuided · Quick · 8 min · Cisco-style device console and topology
R-EDGE is the office router. Its LAN interface Gi0/1 is configured, the provider link on Gi0/0 has no address yet, and the branch summary 172.20.8.0/22 is unreachable…
static routenext hoprouted interface
Carry a stockroom VLAN past the store uplink
ProGuided · Quick · 8 min · Cisco-style device console and topology
Handheld stock units are arriving at the store next week and they need their own segment. Port Fa0/9 on SW-B is patched for the charging cradle…
VLANaccess porttrunkallowed VLAN list
Add the clinic portal DNS records
ProGuided · Quick · 12 min · Windows desktop
Ticket: Add portal.harborline.example as an A record for 10.20.5.20, then add patients.harborline.example as a CNAME alias to portal…
DNSA recordCNAMEnslookup
Block a scanning host above the web rule
ProGuided · Quick · 12 min · Firewall zone and rule table
Ticket: The IDS reports 198.51.100.77 sweeping ports on our web server 10.20.5.20 through the allowed HTTPS rule. Block that host completely without affecting other visitors.
rule orderfirst match winsblocking a hostport scan
Fix a CNAME that still points to the old server
ProGuided · Quick · 12 min · Windows desktop
The report server moved from the retired host to rpt02 last month, but reports.harborline.example still opens the old one. Repoint the alias to the server that took over…
DNSCNAME recordstale recordresolver cache
Give a Linux server a static address that survives a reboot
ProGuided · Quick · 12 min · Linux bash console
Server mon01 must keep 10.20.99.60/24, gateway 10.20.99.1 and DNS 10.20.99.53 after every reboot. It currently carries an address from an old lease and has no default route…
static addressingNetworkManager profiledefault gatewayDNS server
Allow Remote Desktop to a server only from the jump box
ProGuided · Quick · 14 min · Windows desktop
Turn on Remote Desktop with Network Level Authentication on SRV-APP-01 for the IT-Admins group, but only from the jump box at 10.20.99.40…
Remote DesktopNetwork Level Authenticationhost firewall rulesource scoping
Allow only HTTPS to the DMZ web server
ProGuided · Quick · 15 min · Firewall zone and rule table
Ticket: The new public web server 10.20.5.20 sits in the DMZ. Allow HTTPS from the internet to it and nothing else, and log the rule. The DMZ must not reach the LAN.
security zonefirst match winsleast privilegeDMZ
Bring the warehouse VPN up by matching both ends
ProGuided · Quick · 15 min · Firewall zone and rule table
Ticket: The site-to-site VPN to the warehouse shows phase 1 up and phase 2 down since the warehouse changed settings.
site-to-site VPNIPsec phase 1 and phase 2traffic selectorsstaged change
Create a guest WLAN with a captive portal
ProGuided · Quick · 15 min · Cisco-style device console and topology
Ticket NET-4821: Create `HL-Guest` on VLAN 30 for visitors at Harbor Clinic. Use the controller's web-auth policy, block peer-to-peer client traffic, and prefer the 5 GHz radio…
wireless LAN controllerguest WLANcaptive portalVLAN
Find ARP poisoning in a capture and name the culprit port
ProGuided · Quick · 15 min · SIEM queue
Ticket: Users on VLAN 10 report pages loading slowly and certificate warnings. The NOC captured 20 seconds of traffic on the floor uplink (cap-net-4502)…
ARPgratuitous ARPARP spoofingMAC address table
Make a cloud web subnet reachable from the internet
ProGuided · Quick · 15 min · Cloud panel with the matching CLI line
Ticket: The new web subnet subnet-0web in vpc-0clinic isn't reachable on HTTPS from the internet. The internet gateway igw-0clinic is attached. The web security group is sg-0web.
public subnetinternet gatewayroute tablesecurity group
Add IPv6 to the guest VLAN gateway
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Guest Wi-Fi is getting an IPv6 pilot. Give the guest gateway 2001:db8:20:30::1/64 and turn on IPv6 routing on the core. The test PC is set to 2001:db8:20:30::21.
IPv6 unicast routingIPv6 addressprefix lengthdual stack
Carry the new VLAN over the uplink trunk
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: VLAN 20 desks on the second floor get no address. The uplink Gi0/1 on SW-IDF2-01 to the core is still an access port in VLAN 10. Make it a trunk that carries only 10, 20 and 99…
trunk portnative VLANallowed VLAN list
Find and remove a service listening where it shouldn't
ProGuided · In-depth · 20 min · Windows desktop
Ticket: A routine check flagged PC HL-ADM-004 answering on TCP 21 (FTP, cleartext). Find what is listening, remove it, and prove the port is closed…
listening portFTPprocess IDuninstall
Find why the imaging link is slow and full of errors
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Image uploads to the archive crawl. The archive's switch port was "tuned" last week.
duplex mismatchlate collisionsautonegotiation
Fix a PC that reaches its floor but not the servers
ProGuided · In-depth · 20 min · Windows desktop
Ticket: Front desk PC HL-RCP-02 prints to the floor printer but can't open the imaging archive. Desks here use DHCP.
default gatewaytracertstatic versus DHCP addressing
Hand out guest addresses from the router
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Guest devices get no address. Serve 10.20.30.0/24 from the core: keep .1 to .20 for infrastructure, gateway .1, DNS 10.20.99.53, domain guest.harborline.example, 8-hour leases.
DHCP poolexcluded addresseslease timedefault router
Map an inherited closet with CDP and LLDP and label the uplinks
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: We inherited the second floor closet with no diagram. Find what Gi0/1 and Gi0/2 connect to and describe each port with the neighbor and its port, so the diagram can be updated.
CDPLLDPneighbor discoveryport description
Put two imaging desks on their own VLAN
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Imaging staff on the first floor (ports Fa0/5 and Fa0/6 on SW-IDF1-01) must be on VLAN 20 IMAGING, not the clinic VLAN. Their PCs are set for DHCP.
access VLANVLAN membershipDHCP relay
Relay DHCP to the server on another subnet
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Imaging PCs on VLAN 20 get APIPA addresses. The DHCP server 10.20.99.10 already has a scope for 10.20.20.0/24, but nothing forwards their requests to it.
DHCP relayhelper addressbroadcast domain
Send switch logs to the collector with the right time
ProGuided · In-depth · 20 min · Cisco-style device console and topology
Ticket: Security can't match switch events to server events. SW-IDF1-01 has no time source and its logs never reach the collector…
NTPsyslogtrap levellog timestamps
Bring back a desk port that security shut down
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Dr. Ade's new laptop has no network at desk 1.12. Her old laptop was returned to IT yesterday. The asset record says the new laptop's MAC is 0000.5e00.5312.
port securitysticky MACerr-disabledviolation mode
Bundle two uplinks with LACP
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: The first floor uplink is saturated during imaging uploads. A second cable is already in place, but STP blocks it. Bundle both links with LACP so both carry traffic…
EtherChannelLACPport-channeltrunk
Find where traffic to the warehouse stops
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Clinic staff can't reach the warehouse system 10.20.60.21 since the edge router was replaced last night. The internet works.
static routetraceroutereturn path
Find why a desk links at 100 Mb/s and move it to a good point
ProGuided · In-depth · 25 min · Hardware bench and firmware panels
Ticket: The editor at desk 2.20 says uploads are slow. The switch shows that port at 100 Mb/s. Desk 2.21 next to her is a spare point.
split paircable testerlink speedpatch panel
Find why new laptops get no address
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Laptops from the new nurse intake get APIPA addresses on VLAN 10. Existing desks work.
DHCP poolexcluded addressesaddress exhaustion
Fix slow paths caused by the wrong root bridge
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Since yesterday's maintenance, traffic between the floors goes through the first floor switch and is slow. The core should be the root for VLANs 10 and 20.
spanning treeroot bridgebridge priority
Give a switch a management address and SSH-only access
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: SW-IDF2-01 was racked with no management address. Give it 10.20.99.22/24 on VLAN 99 with gateway 10.20.99.2, and allow SSH only (no Telnet) with the local user netadmin…
management VLANSSHlocal userVTY lines
Harden the unused and desk ports on an access switch
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Audit finding on SW-IDF1-01. Unused ports Fa0/20 and Fa0/21 are live in the clinic VLAN, and desk ports negotiate trunks. Park the unused ports in VLAN 999 and shut them…
unused portsDTPPortFastBPDU guard
Let the clinic reach the internet through one address
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: The new edge router is up but no clinic PC reaches the internet. Translate all 10.20.0.0/16 traffic to the router's outside address (PAT). The default route to the ISP is already in.
PATNAT inside and outsideoverload
Patch, label and test a new desk's network point
ProGuided · In-depth · 25 min · Hardware bench and firmware panels
Ticket: Facilities installed a new desk in room 2.14. Its wall point is unlabelled. Find its panel port, label both ends, prove the run is good…
tone generatorpatch panelcable labelingcable tester
Prove from a capture whether a server answers
ProGuided · In-depth · 25 min · SIEM queue
Ticket: The app team says the network drops traffic to the new reporting server 10.20.50.21 on 8443. We captured on the server's switch port (SPAN)…
TCP handshakeRSTpacket capturedisplay filter
Publish the patient portal and keep staff browsing
ProGuided · In-depth · 25 min · Cisco-style device console and topology
Ticket: Publish the patient portal 10.20.5.20 on public address 203.0.113.10, and make sure staff can still browse through the router's own address.
static NATPATpublished server
Find and stop a rogue DHCP server
ProGuided · In-depth · 30 min · Cisco-style device console and topology
Ticket: Some first-floor PCs got 192.168.1.x addresses this morning and can't reach anything. Someone may have plugged in a home router.
rogue DHCP serverDHCP snoopingtrusted portMAC address table
Build an imaging segment and route to the scanner subnet
ProGuided · In-depth · 36 min · Cisco-style device console and topology
Two imaging rooms on the second floor go live next week. The jacks are patched into SW-F2, the wall plate in room two was replaced last month and the port was left shut…
VLANaccess porttrunkallowed VLAN list
Close the link to the floor that moved out
ProAssisted · Quick · 5 min · Cisco-style device console and topology
The fourth floor team moved to a managed office across the road and their switch left with them. On the distribution switch in the basement…
trunkadministrative stateuplinkport status
Turn the metrology bench link back into a host port
ProAssisted · Quick · 5 min · Cisco-style device console and topology
A calibration bench was set up in the quality room last quarter and the engineer who built it left the port at Gi0/4 on SW-QC as a trunk, because a temporary lab switch needed tags…
trunkaccess port802.1Q taggingport role
Add the scanner segment to a working uplink
ProAssisted · Quick · 6 min · Cisco-style device console and topology
Two handheld scanners arrived for the dock and were patched into Fa0/5 on SW-DOCK, which is still an office jack. The scanner management server sits in the head office…
allowed VLAN listtrunkaccess portisolation
Bring a disabled bench jack back into service
ProAssisted · Quick · 6 min · Cisco-style device console and topology
A tester moved onto the lab bench this morning and found the jack dead. Port Fa0/7 on SW-LAB1 was disabled when the bench was empty and it is still in the default segment…
administrative stateaccess portport status
Find the missing path to the delivery bay
ProAssisted · Quick · 6 min · Cisco-style device console and topology
The delivery bay was extended in spring and now uses 192.168.44.32 with a twenty nine bit mask. Barcode terminals there stopped reaching head office on Monday…
routing tablestatic routedefault routeprefix length
Give the office router a path to the internet
ProAssisted · Quick · 6 min · Cisco-style device console and topology
Staff at the office can reach the local print server on 10.88.0.0 and nothing else. R-OFFICE has its LAN on Gi0/1 and a provider link on Gi0/0 addressed as 203.0.113.34 with mask…
default routegateway of last resortstatic route
Move the mezzanine printer back to the print segment
ProAssisted · Quick · 6 min · Cisco-style device console and topology
During last weekend's patch panel tidy up, the mezzanine printer was landed in the wrong port group. It now shares VLAN 60 with nine workstations…
VLAN membershipaccess portbroadcast domainpatch panel mapping
Move the printer off the guest segment
ProAssisted · Quick · 6 min · Cisco-style device console and topology
The office printer was moved during the fit out and plugged into Fa0/24 on SW-OPS, which is a guest jack. Staff can see the printer but every job dies at the guest gateway…
incorrect VLAN assignmentaccess portbroadcast domainVLAN database
Narrow the event hall link to the three segments in the contract
ProAssisted · Quick · 6 min · Cisco-style device console and topology
SW-EVT serves a hall that is rented out at weekends. Its link back to the distribution switch, Gi0/3, was built with no permit list at all…
allowed VLAN listtrunk802.1Q taggingisolation
Cut the event hall uplink down to the segments it needs
ProAssisted · Quick · 7 min · Cisco-style device console and topology
The event hall is rented out at weekends and its switch shares a link back to our distribution switch, Gi0/1 on SW-HALL. That link currently permits every segment the hall has ever used…
allowed VLAN listtrunk802.1Q tagisolation
Restore a wall port after a desk move
ProAssisted · Quick · 7 min · Cisco-style device console and topology
The west pod moved desks last Friday. On Monday the jack at their new row is dead and the laptop gets no address. SW-B port Fa0/7 is patched to that jack…
disabled interfaceaccess portvlan membership
Turn the kiosk port back into a host port
ProAssisted · Quick · 7 min · Cisco-style device console and topology
A temporary training rig was plugged into the lobby switch last month and the installer turned Gi0/4 into a tagged link for it. The rig is gone…
trunkaccess port802.1Q tagVLAN membership
Settle the switching on a community radio refit
ProAssisted · In-depth · 32 min · Cisco-style device console and topology
A community radio station has moved into a converted chapel, and the switch in the vestry cabinet was set up over three weekends by whoever was free. The playout servers work…
VLANVLAN databaseaccess porttrunk
Move a trim cell onto new jacks and prune the retired tag
ProAssisted · In-depth · 34 min · Cisco-style device console and topology
The trim cell moved into the middle of the moulding hall over the weekend, and the three jacks at the new benches came with the building…
VLANaccess porttrunkallowed VLAN list
Move the stock floor onto a rebuilt switch
ProAssisted · In-depth · 34 min · Cisco-style device console and topology
A pipe burst over the weekend took out the stock floor switch, and the replacement SW-N3 arrived configured for the site it came from…
VLANVLAN databaseaccess porttrunk
Fit out the new dental suite network
ProAssisted · In-depth · 35 min · Cisco-style device console and topology
Ticket: The dental suite opens Monday on the second floor, desks on SW-IDF2-01 Fa0/7 and Fa0/8. Give it VLAN 25 DENTAL, 10.20.25.0/24 with gateway .1 on the core…
VLANtrunk allowed listDHCP relayport security
Route to the warehouse and give the clinic a backup gateway
ProAssisted · In-depth · 35 min · Cisco-style device console and topology
Ticket: Two jobs before the audit. First, the clinic must reach the warehouse network 10.20.60.0/24 both ways. Second, the server VLAN's gateway must survive a router failure…
static routeHSRPvirtual gatewaypreempt
The imaging floor lost its network
ProAssisted · In-depth · 35 min · Cisco-style device console and topology
Ticket: After last night's change window, imaging desks on the second floor have no network. Clinic desks on the same floor are fine. Restore imaging without breaking anything else…
troubleshooting methodtrunk allowed listSVI stateDHCP relay
Give the store switch a routed path to head office
ProChallenge · Quick · 8 min · Cisco-style device console and topology
The store switch runs the sales and click and collect segments and holds a single link to the store router on Gi0/1. Sites in this chain keep their segments on the router…
routed interfacestatic routenext hopprefix length
Open a guest lounge without handing over the office segment
ProChallenge · Quick · 8 min · Cisco-style device console and topology
The visitor lounge is being refitted and two wireless access points will be patched into Fa0/30 and Fa0/31 on SW-LOUNGE. Visitors must land on a guest segment with no path to office shares…
VLANaccess portbroadcast domaindevice hardening
Reach two remote offices through one neighbour
ProChallenge · Quick · 8 min · Cisco-style device console and topology
Two small offices opened this quarter and neither answers from head office. R-HQ has its own LAN on Gi0/0 and a wide area link on Gi0/1 addressed as 10.14.2.2 with mask 255.255.255.252…
static routenext hopprefix length
Separate the cafe jacks from the clinic network
ProChallenge · Quick · 8 min · Cisco-style device console and topology
Two jacks in the clinic waiting area are for visitors. Right now they sit in the default segment next to the clinical workstations, and a visitor with a patch cable can reach the printers…
VLANaccess portbroadcast domainsegmentation
Reopen two desks after the renovation
ProChallenge · Quick · 9 min · Cisco-style device console and topology
The south wing was painted last month and facilities shut a block of jacks so nothing got unplugged mid job. Three of them still sit disabled and in the default segment: Fa0/11…
administrative stateaccess portVLAN membershipport status
Restore the port roles on a leisure centre studio floor
ProCapstone · In-depth · 31 min · Cisco-style device console and topology
A leisure centre closed its studio floor for a two week refit and the switch came back with a set of problems that only show up when the building fills…
VLANaccess porttrunkallowed VLAN list
Where to go next
Every certification with labsN10-009 lab questions
There are 71 labs: 47 guided, 18 assisted, 5 challenge, 1 capstone. Together they carry about 18 hours of authored lab time, and 1 free taster lab.
Practise N10-009 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.