Network+ N10-009 Domain 2: Network Implementation

Domain 2 accounts for 20% of N10-009. The objective wording often uses explain, configure, or select, which means recognition is not enough. You need to connect a requirement to the route, switchport, wireless setting, or physical design that makes the requirement work.

A branch office may need a backup WAN route that remains inactive until the primary dynamic route disappears. A voice phone may need tagged voice traffic while the attached workstation remains in an untagged data VLAN. A new access point may have strong signal but poor performance because neighboring radios overlap on wide channels. Each scenario asks you to preserve a traffic path while changing one part of the implementation.

Use this guide to practice those decisions. Start with the required outcome, identify which device or interface controls it, then check the dependencies on both sides. Many implementation errors are mismatches: one trunk uses a different native VLAN, one aggregated link has a different speed, one fiber optic does not match the other end, or one wireless radio uses a channel plan that ignores nearby cells.

Implementation rule: A configuration is not correct merely because one device accepts it. The neighboring interface, route source, wireless client, power system, and physical path must support the same design.

Domain 2 objective map

Objective	Main topic	Decision to make
2.1	Routing technologies	Which route should exist, which route should win, and how should addresses or gateways behave?
2.2	Switching technologies and features	Which VLAN, trunk, logical interface, loop-prevention feature, or link setting carries the traffic correctly?
2.3	Wireless devices and technologies	Which band, channel, width, antenna, security mode, and access-point design fits the environment?
2.4	Physical installations	Where should equipment live, how should it be mounted and patched, and what power and environmental protections are required?

The objectives are separate on paper, but implementations cross boundaries. A wireless SSID may map to a VLAN. That VLAN may travel across an 802.1Q trunk. An SVI or router subinterface may provide the default gateway. A dynamic route may then carry the traffic toward another site. Trace the complete path when a scenario includes several technologies.

Use a repeatable implementation workflow

Before choosing a command or feature, turn the scenario into a small design statement:

Define the required traffic. Identify the source, destination, service, direction, and expected path.
Identify the control point. Decide whether routing, switching, wireless, or physical infrastructure owns the change.
List dependencies. Note the peer interface, VLAN, gateway, route source, client capability, cable type, power budget, or environmental limit that must match.
Choose the smallest change. Preserve working behavior and avoid redesigning unrelated parts of the network.
Predict verification evidence. Decide which route table, MAC table, interface state, wireless measurement, or physical indicator should confirm success.
Plan reversal. Know how to restore the previous state if the implementation causes an outage.

Suppose a new VLAN needs connectivity between two switches and a router. The VLAN must exist where required, the access ports must assign endpoints correctly, the trunk must permit the VLAN, the native VLAN must match, and the Layer 3 gateway must have an address in the VLAN's subnet. Configuring only the endpoint port produces an isolated broadcast domain, not a complete routed service.

Separate configuration from verification

A configuration step changes intended behavior. A verification step checks observed behavior. Do not use the same assumption for both.

For a new static route, verify the route appears in the routing table and that traffic follows it. For a VLAN, verify access-port membership, trunk allowance, MAC learning, and gateway reachability. For wireless coverage, verify client signal, noise, channel use, roaming, and application performance rather than relying only on the access point's configuration page.

Routing technologies

Routers select a next hop or outgoing interface for a destination IP network. The route can be configured manually, learned from a dynamic protocol, created by a directly connected interface, or supplied as a default path.

Routing method	Best fit	Implementation concern
Connected route	A router interface has an active address in the destination network	The interface and line protocol must be operational, and the prefix must be correct
Static route	A predictable path, small network, stub destination, or controlled backup	Topology changes require manual maintenance unless tracking or another mechanism is added
Default route	Traffic without a more specific match should leave through one path	A default route does not replace routes that need different next hops
Dynamic route	Routers should exchange reachability and adapt to topology changes	Neighbors, advertisements, metrics, authentication, filtering, and convergence must be controlled
Floating static route	A static path should activate only after a preferred route disappears	Its administrative distance must be higher than the primary route's distance

Static and default routes

Static routing uses manually configured entries. A static route normally identifies a destination prefix and either a next-hop address or outgoing interface. A default IPv4 route uses 0.0.0.0/0; a default IPv6 route uses ::/0. The default matches every destination, but it loses to any more specific route.

Static routes are useful at a stub site with one upstream path, for a specific management network, or as a controlled backup. They can also create silent failures when the next hop remains reachable but the destination beyond it is not. Route tracking or a dynamic protocol can provide better failure awareness when the path has several dependencies.

Dynamic routing protocols

The exam expects the general role and behavior of BGP, EIGRP, and OSPF.

Protocol	Typical role	Decision clue
BGP	Policy-based routing between autonomous systems and selected large internal designs	Path attributes, routing policy, provider relationships, and control of advertised prefixes
EIGRP	Interior routing using a composite metric and rapid neighbor-based updates	Bandwidth and delay are prominent metric inputs; feasible successors support fast alternate paths
OSPF	Link-state interior routing organized into areas	Routers build a topology database and calculate paths using cost

BGP does not simply choose the path with the fewest router hops. Policy and path attributes influence selection. OSPF distributes link-state information so routers can calculate a shortest-path tree within the design. EIGRP exchanges reachability with neighbors and uses a composite metric. The best answer depends on the administrative setting described, not on which protocol sounds more advanced.

Scenario clue: “Between autonomous systems” points strongly toward BGP. “Link-state areas and cost” points toward OSPF. “Composite metric using bandwidth and delay” points toward EIGRP.

Route selection

Several routes may appear to reach the same destination. Evaluate them in the correct order. When a route boundary is not obvious, use the IPv4 Subnetting Reference to rebuild the prefix or check it with the IPv4 Subnet Calculator.

1. Longest prefix match

The route with the most specific matching prefix wins first. A route to 10.20.30.0/24 is preferred over 10.20.0.0/16 for a packet addressed to 10.20.30.45, regardless of which routing source has a lower administrative distance.

The default route is the least specific possible match. It is used only when no more specific entry applies.

2. Administrative distance

When routes to the same prefix come from different sources, administrative distance expresses the router's preference for the source. Lower is preferred. Exact values vary by platform, so focus on the relationship supplied in the scenario.

A backup static route should have a higher administrative distance than the preferred dynamic route. That makes it float outside the active table until the preferred route is withdrawn.

3. Metric

When the same routing protocol supplies multiple routes to the same prefix, the protocol's metric distinguishes them. OSPF uses cost. EIGRP uses a composite metric. BGP evaluates a sequence of attributes and policy decisions rather than one universal distance value.

Some devices can install equal-cost paths and distribute traffic among them. Equal-cost multipath improves aggregate use and resilience, but a single flow is commonly kept on one path to avoid reordering.

Question	Comparison	Winning route
Which entry matches the destination most specifically?	`/24` versus `/16`	The `/24` route
Which source is preferred for the same prefix?	Administrative distance 90 versus 110	The route with distance 90
Which path does the same protocol prefer?	Metric 20 versus 40	The route with metric 20
What happens when equal routes are supported?	Same prefix, source preference, and metric	Multiple paths may be installed

Read routing evidence carefully

A route table can show the destination prefix, route source, administrative distance, metric, next hop, age, and outgoing interface. A successful ping to the next hop proves local reachability to that neighbor. It does not prove that the neighbor has a return route or that the destination service is available.

When a new route does not appear, check:

Whether a more trusted source already supplies the same prefix.
Whether the outgoing interface is operational.
Whether the next hop is reachable through another route.
Whether the dynamic neighbor relationship formed.
Whether filtering, summarization, or redistribution changed the advertisement.
Whether the destination prefix was entered correctly.

Address translation, gateway redundancy, and subinterfaces

NAT and PAT

Network address translation changes IP addressing as traffic crosses a translation boundary. Port address translation also uses transport identifiers so many internal sessions can share one external address.

Method	Mapping	Typical clue
Static NAT	One inside address maps consistently to one outside address	A published internal service needs a stable translation
Dynamic NAT	Inside addresses borrow available addresses from a pool	A limited pool provides temporary one-to-one mappings
PAT	Many inside sessions share an outside address using distinct port mappings	Many clients access external services through one public IPv4 address

Translation state must support the return path. A packet can leave successfully and still fail if the reply does not match an active mapping, a firewall policy blocks it, or asymmetric routing sends the reply through a different device that lacks the state.

NAT conserves addresses and hides internal addressing from ordinary external routing, but it is not a replacement for firewall policy or authentication.

FHRP and virtual IP addresses

Endpoints usually have one configured default gateway address. A first-hop redundancy protocol lets multiple routers present a shared virtual IP address so the gateway can survive a router failure.

One router normally forwards for the virtual address while another is prepared to take over. Health tracking may reduce priority or trigger failover when an upstream dependency fails. Without tracking, the active router might retain the virtual IP even though its WAN path is unusable.

A virtual IP can also appear in load balancing and clustered services. Use the context. In an FHRP scenario, the VIP is the resilient default gateway. In a load-balancer scenario, the VIP represents a service distributed across backend systems.

Subinterfaces

A subinterface is a logical interface created beneath one physical router interface. Each subinterface can use its own Layer 3 address and, when carrying VLAN traffic, its own 802.1Q tag.

This supports router-on-a-stick designs: one physical router link acts as a trunk, and separate subinterfaces provide gateways for multiple VLANs. The switch trunk, allowed VLAN list, native VLAN behavior, subinterface tags, and IP subnets must all agree.

A multilayer switch can perform inter-VLAN routing through switch virtual interfaces instead. The choice depends on device capability, scale, throughput, resilience, and design requirements.

Switching technologies and features

A switch learns source MAC addresses and forwards frames according to the destination MAC address within the correct VLAN. Implementation questions usually add segmentation, redundancy, or interface behavior to that basic function. Use the VLANs, Trunks, STP, and Link Aggregation Quick Reference when those four jobs begin to blur together.

Follow a frame through the switch

When a frame arrives, the switch learns the source MAC address on the incoming port and VLAN. It then checks the destination:

A known unicast destination is forwarded toward the learned port.
An unknown unicast is flooded within the VLAN until the destination is learned.
A broadcast is flooded within the VLAN, except back through the incoming port.
A multicast may be flooded or selectively forwarded when multicast controls are in use.

The VLAN limits the Layer 2 broadcast domain. A host in another VLAN requires Layer 3 forwarding through an SVI, router subinterface, or another routed interface.

VLANs, access ports, trunks, and SVIs

VLAN database and access assignment

The VLAN must exist on the switch before ports and trunks can use it reliably. An access port normally carries endpoint traffic for one data VLAN. Frames from the endpoint are usually untagged, and the switch associates them with the configured access VLAN.

A voice-capable access port can support a data VLAN for the attached workstation and a separate voice VLAN for the phone. The phone tags voice traffic according to the learned or configured setting while the workstation continues to use the access VLAN.

802.1Q trunks

A trunk carries multiple VLANs across one link. 802.1Q inserts a tag that identifies the VLAN for most frames. The native VLAN is commonly sent untagged, so both ends must agree on which VLAN is native.

Setting	What it carries	Common failure
Access VLAN	Untagged endpoint traffic assigned to one VLAN	The endpoint is placed in the wrong broadcast domain
Voice VLAN	Tagged phone traffic alongside the access VLAN	The phone cannot reach call services or loses expected QoS treatment
Allowed VLAN list	Selected tagged VLANs permitted across the trunk	A VLAN exists but is pruned or omitted from the path
Native VLAN	Untagged traffic on an 802.1Q trunk	The two ends classify untagged frames into different VLANs

A native VLAN mismatch can create connectivity and security problems because each switch assigns untagged frames differently. Changing duplex, MTU, or spanning tree does not correct the classification mismatch.

Switch virtual interfaces

An SVI is a logical Layer 3 interface associated with a VLAN. It can provide switch management or act as the default gateway for hosts when the switch supports Layer 3 forwarding.

For an SVI to serve endpoints, the VLAN must be active, the SVI must have the correct address and prefix, routing must be enabled where required, and the switch must have a working Layer 2 path to hosts in that VLAN.

Scenario clue: A VLAN separates Layer 2 traffic. An SVI or router subinterface supplies Layer 3 reachability. Creating the VLAN alone does not create a gateway.

Link aggregation and spanning tree

Redundant Layer 2 links create two competing goals: use more than one physical connection, but prevent frames from circulating forever. Link aggregation and spanning tree solve different parts of that problem.

Link aggregation

Link aggregation combines compatible physical links into one logical connection. LACP negotiates and monitors members of the aggregate.

Benefits include:

More aggregate capacity across multiple flows.
Continued logical-link availability when one member fails.
One logical interface for spanning tree and VLAN configuration.

Member interfaces generally need compatible speed, duplex, VLAN mode, allowed VLANs, native VLAN, and other settings. A mismatch can prevent the link from joining or create inconsistent forwarding.

Aggregation does not guarantee that one flow receives the sum of all member speeds. A hashing method commonly keeps one flow on one member while distributing different flows across the bundle.

Spanning tree

Spanning tree prevents Layer 2 loops by selecting a loop-free forwarding topology. Switches exchange bridge protocol data units, elect a root bridge, calculate path cost, and place redundant ports into roles or states that prevent simultaneous forwarding loops.

Concept	Meaning	Implementation clue
Root bridge	Reference point for the Layer 2 tree	Place it deliberately near the desired traffic path instead of relying on an accidental election
Root port	Best path from a non-root switch toward the root	Each non-root switch selects one root port per spanning-tree instance
Designated port	Forwarding port selected for a network segment	Provides the preferred path from that segment toward the root
Alternate path	Redundant path held out of normal forwarding	Can transition when the active topology fails

A Layer 2 loop can create a broadcast storm, duplicate frames, unstable MAC-table entries, and severe resource use. Disabling spanning tree to make a blocked redundant link forward removes the protection and is usually the wrong fix. Aggregate intended parallel links, and let spanning tree manage independent redundant paths.

Rapid Spanning Tree Protocol improves convergence compared with older spanning-tree behavior, but topology design and correct edge-port settings still matter.

Speed, duplex, MTU, and jumbo frames

Speed and duplex

Modern Ethernet commonly uses auto-negotiation. Both ends should normally be configured consistently. A duplex mismatch can allow basic connectivity while causing poor throughput, late collisions or errors, retransmissions, and inconsistent performance under load.

If one side must be set manually, the peer should be configured to match. Replacing a cable may temporarily appear to help if the interface renegotiates, but the persistent configuration mismatch remains.

MTU

The maximum transmission unit defines the largest Layer 3 payload an interface can carry without fragmentation or another adaptation. A path with inconsistent MTU can pass small packets while larger transfers fail, stall, or require fragmentation.

Jumbo frames use an MTU larger than the common Ethernet default. They can reduce per-packet overhead for selected storage or data-center workloads, but every device along the path must support and be configured for the larger size. Enabling jumbo frames on only one switch does not create an end-to-end jumbo path.

Setting	Mismatch symptom	Verification
Speed	No link, unexpected lower rate, or member excluded from an aggregate	Interface operational speed and peer capability
Duplex	Poor performance, frame errors, or collisions on one side	Both ends report compatible duplex and clean counters
MTU	Small traffic works while larger packets fail or fragment	Path-wide MTU and appropriately sized test traffic
Jumbo frames	Storage or application sessions fail across one segment	Consistent support and configuration across every hop in the path

Wireless channels, bands, and network design

Wireless implementation balances coverage, capacity, interference, security, roaming, and client support. A strong signal does not guarantee a clean channel or enough airtime.

Frequency bands

Band	Common strength	Planning concern
2.4 GHz	Longer reach and better obstacle penetration	Less spectrum, fewer non-overlapping channels, and more interference from Wi-Fi and other devices
5 GHz	More channel choices and higher capacity in many deployments	Shorter reach through obstacles and regulatory behavior on selected channels
6 GHz	Large clean spectrum for compatible newer clients	Client support, shorter propagation, and deployment rules must be considered

Band steering encourages dual-band or tri-band clients toward a preferred band, often moving capable clients away from congested 2.4 GHz airtime. The client still participates in the final association decision, so steering is an influence rather than an absolute command.

Channels and width

Wider channels can provide more throughput to one client under clean conditions, but they consume more spectrum and increase overlap with neighboring cells. Dense environments often benefit from narrower channels and more careful reuse.

In the United States, a common 2.4 GHz plan using 20 MHz channels relies on channels 1, 6, and 11 to avoid overlap. Regulatory domains differ, so use the region and equipment settings supplied by the scenario.

802.11h supports behavior associated with regulatory requirements in selected 5 GHz spectrum, including dynamic frequency selection and transmit-power control. An access point may need to leave a channel when radar is detected.

A wireless survey or spectrum analysis should guide channel plans. Choosing the numerically least-used channel from one access point's dashboard may miss non-Wi-Fi interference, neighboring cells, and client experience.

SSID, BSSID, and extended coverage

The SSID is the human-facing wireless network name.
The BSSID identifies a specific basic service set, commonly tied to one access-point radio interface.
An extended service set identifier (ESSID) refers to the shared network identity used across multiple access points to provide broader coverage and roaming.

Multiple access points can advertise the same SSID while using different BSSIDs and channels. That is normal in an infrastructure deployment.

Wireless network types

Type	How systems connect	Best-fit clue
Infrastructure	Clients associate with access points connected to a distribution network	Normal enterprise, home, and campus Wi-Fi
Ad hoc	Devices communicate directly without a conventional access point	Small temporary peer connection
Point to point	Directional wireless bridge connects two locations	Building-to-building link with clear alignment and path
Mesh	Wireless nodes provide multiple paths and may relay traffic	Coverage where every node cannot receive a wired uplink

Wireless security, guest access, antennas, and AP operation

WPA2 and WPA3

WPA2 and WPA3 protect wireless access using stronger authentication and encryption than retired legacy methods. Choose the strongest mode supported by the security requirement and client population. A transition mode may improve compatibility during migration, but it can preserve weaker behavior for older clients.

PSK versus Enterprise authentication

A pre-shared key is simpler for a small trusted environment. Everyone who knows the shared credential can attempt access, and changing the key affects every client.

Enterprise authentication uses individual identity, commonly through 802.1X and a backend authentication service such as RADIUS. It supports per-user or per-device accountability, centralized credential policy, and revocation without changing one shared key for everyone.

Mode	Strength	Operational cost
PSK	Simple setup for a small controlled group	Shared secret is difficult to attribute and disruptive to rotate
Enterprise	Individual authentication and centralized access control	Requires identity infrastructure, certificates or credentials, and careful client configuration

Guest networks and captive portals

A guest network should separate visitor traffic from internal resources and apply appropriate internet-access policy. A captive portal presents an acceptance, sign-in, sponsorship, or payment page before allowing broader access.

The portal itself is not the network boundary. VLANs, routing, firewall rules, client isolation, DNS policy, and bandwidth controls determine what guests can actually reach.

Omnidirectional and directional antennas

An omnidirectional antenna spreads energy broadly around the antenna and fits general room or area coverage. A directional antenna focuses energy toward a target area or remote endpoint, improving reach and reducing wasted energy outside the intended direction.

Antenna gain changes the radiation pattern rather than creating free power. Placement, orientation, cable loss, regulatory limits, obstacles, and client transmit capability still affect the usable link.

Autonomous and lightweight access points

An autonomous AP performs its own management and control functions. It can fit smaller deployments but requires individual configuration or another management approach as the environment grows.

A lightweight AP relies on a controller or cloud management system for centralized policy, coordination, monitoring, and configuration. Centralization helps consistency, but controller reachability, licensing, redundancy, and supported operating modes remain design considerations.

Implementation clue: A controller can coordinate access points, but it cannot overcome poor placement, blocked radio paths, exhausted airtime, or an unsupported client band.

Physical installation factors

Logical design depends on a physical environment that can hold, power, cool, secure, and connect the equipment.

MDF and IDF placement

The main distribution frame is the central building or campus distribution point. Intermediate distribution frames serve local floors, areas, or sections and connect back toward the MDF.

Placement affects cable distance, pathway access, environmental control, physical security, maintenance, and resilience. An IDF should not be treated as spare storage if boxes block airflow, access, or fire-safety clearances.

Racks, airflow, and access

Rack equipment is measured in rack units. Confirm device depth, weight, rail compatibility, door clearance, cable-management space, power access, and future capacity rather than checking height alone.

Network and server equipment commonly moves air from one side to the other. Mixing port-side intake and port-side exhaust designs without planning can recirculate hot air. Hot-aisle and cold-aisle layouts separate equipment intake from exhaust where the room design supports it.

Lockable rooms and cabinets reduce unauthorized physical access. Locks should still allow emergency and maintenance access through controlled procedures.

Patch panels and fiber distribution panels

A copper patch panel terminates permanent horizontal cabling so short patch cords can connect building runs to switchports. This improves labeling, strain relief, testing, and change management compared with terminating every building cable directly on the switch.

A fiber distribution panel organizes fiber terminations, adapters, slack, and patching. Fiber needs bend-radius control, connector cleanliness, and protection from pulling or crushing. A link can fail even when the correct optic and fiber type are selected if connectors are dirty or polarity is wrong.

UPS and PDU roles

An uninterruptible power supply (UPS) provides temporary battery-backed power and may condition incoming power. A PDU distributes electrical power to devices. A passive PDU does not provide battery runtime.

Component or factor	Purpose	Planning question
UPS	Battery-backed runtime and controlled shutdown support	How much load and runtime must be supported?
PDU	Distributes available power to rack equipment	Does it support the voltage, plug type, current, monitoring, and redundancy design?
Power load	Total demand placed on the circuit, PDU, and UPS	Is sufficient capacity reserved for startup, growth, and failure conditions?
Voltage	Electrical supply required by equipment	Do the source, PDU, cable, and device input ratings agree?

Devices with dual power supplies can use separate A and B power paths. That improves resilience only when the feeds, PDUs, UPS systems, and upstream circuits are truly independent.

Environmental controls

Temperature and humidity outside supported ranges shorten equipment life and can cause immediate failures. Excess humidity can encourage condensation and corrosion. Very dry conditions increase electrostatic risk. Sensors should report conditions where equipment actually operates, including hot spots inside cabinets.

Fire suppression must protect people and comply with applicable building and safety requirements while limiting damage to equipment. Detection, alarm, shutdown, suppression agent, room integrity, and emergency procedures should be designed together by qualified professionals.

Plan the physical change

Before installing equipment:

Confirm rack location, rack units, depth, weight, rails, airflow direction, and service clearance.
Verify power source, voltage, PDU outlets, UPS capacity, and redundant-feed design.
Map copper and fiber paths, patch-panel positions, labels, connector types, transceivers, and distance limits.
Confirm grounding, bonding, environmental monitoring, and required building approvals.
Reserve space and capacity for growth without blocking airflow or access.
Record the finished rack, patching, power, and cable path in current documentation.

Work through implementation scenarios

Scenario 1: Backup route over a second WAN

A branch learns 10.50.0.0/16 through OSPF on the primary circuit. A second WAN should carry that traffic only after OSPF loses the route.

The focused solution is a static route to the same prefix with an administrative distance higher than the OSPF route. During normal operation, OSPF wins. After withdrawal, the floating static route can enter the routing table. Verify both failure and recovery so the primary route becomes preferred again.

A lower-distance static route would take over during normal operation, which violates the requirement.

Scenario 2: Data and voice on one access port

A phone connects to a switch, and a workstation connects through the phone. Voice traffic needs VLAN 30 and the workstation needs VLAN 20.

Configure the switchport with data access VLAN 20 and voice VLAN 30. Confirm the phone learns the voice setting, tags its voice frames, and passes workstation traffic according to the data VLAN behavior. The trunk and upstream gateway path must carry both VLANs.

Putting the entire port in VLAN 30 may make the phone work while placing the workstation in the wrong network.

Scenario 3: Parallel switch links

Two switches have four matching links. The requirement is more aggregate capacity and continued service when one cable fails, without spanning tree blocking three independent paths.

Use link aggregation with compatible member settings. Configure VLAN and trunk behavior on the logical aggregate according to the platform's method. Verify every member joins and that losing one member does not drop the logical link.

Disabling spanning tree would expose the network to a Layer 2 loop. Leaving the links independent would cause spanning tree to block redundant paths.

Scenario 4: Dense office Wi-Fi

A crowded office has many access points and client complaints despite strong signal. Radios use wide channels and overlap heavily.

Reduce unnecessary channel width, create a coordinated reuse plan, and verify spectrum and airtime conditions. Use 5 GHz or 6 GHz for capable clients where coverage supports it, while preserving appropriate 2.4 GHz service for clients that need it. More transmit power can worsen cell overlap and does not create more airtime.

Scenario 5: New access switch in an IDF

A new switch requires 48 powered access ports. The IDF has rack space but an aging UPS and limited cooling.

Calculate switch and PoE load, confirm circuit and PDU capacity, size UPS runtime for the supported load, verify airflow direction, check room temperature under expected demand, and document patch-panel and uplink assignments. Rack space alone does not make the installation ready.

Common exam traps

Comparing administrative distance before prefix length

Longest prefix match is evaluated first. A more specific route can win even when it comes from a source with a less-preferred administrative distance.

Giving the backup route a lower distance

A floating static route needs a higher administrative distance than the primary route. Lower makes it preferred immediately.

Treating PAT as a firewall

PAT creates address and port mappings. Security policy still decides which sessions are allowed.

Creating a VLAN without completing the path

Endpoint assignment, trunk allowance, native VLAN agreement, Layer 3 gateway, and routing may all be required. The VLAN database is one step.

Disabling spanning tree to use redundant links

Independent parallel Layer 2 links can loop. Use link aggregation for intended parallel members and retain loop prevention for the topology.

Assuming four 1 Gbps links make one flow run at 4 Gbps

Aggregation distributes multiple flows according to a hashing decision. One flow commonly remains on one member.

Increasing wireless channel width to fix congestion

Wider channels use more spectrum and can increase overlap. Dense deployments may perform better with narrower channels and better reuse.

Confusing SSID and BSSID

The SSID is the network name. The BSSID identifies a particular basic service set, commonly one radio interface.

Treating a captive portal as isolation

The portal controls the sign-in or acceptance experience. VLANs, routing, firewall rules, and client isolation control reachability.

Confusing a PDU with a UPS

A PDU distributes power. A UPS supplies temporary battery-backed runtime. Some products combine monitoring or switching features, but the roles remain distinct.

Checking rack units and ignoring depth, power, and airflow

A device can fit vertically and still be impossible to rail, cable, cool, or power safely.

Rapid review checklist

You are ready to move beyond Domain 2 review when you can:

Distinguish connected, static, default, dynamic, and floating static routes.
Explain the general roles of BGP, EIGRP, and OSPF.
Apply longest prefix match, administrative distance, and metric in the correct order.
Explain NAT, PAT, FHRP, virtual IP addresses, and subinterfaces from scenario clues.
Trace endpoint traffic through an access VLAN, trunk, SVI or router subinterface, and routed path.
Distinguish access, voice, native, and allowed VLAN behavior.
Explain how link aggregation differs from spanning tree.
Recognize common symptoms of speed, duplex, and MTU mismatches.
Explain why jumbo frames require end-to-end support.
Compare 2.4 GHz, 5 GHz, and 6 GHz implementation tradeoffs.
Choose channel width and reuse according to density and interference.
Distinguish SSID, BSSID, infrastructure, ad hoc, point-to-point, and mesh designs.
Compare WPA2 and WPA3, PSK and Enterprise authentication, and autonomous and lightweight APs.
Select omnidirectional or directional antennas according to the coverage requirement.
Explain the roles of an MDF, IDF, rack, patch panel, fiber distribution panel, UPS, and PDU.
Evaluate rack space, airflow, power load, voltage, temperature, humidity, fire suppression, and physical security as one installation plan.
Describe how you would verify and reverse a routing, switching, wireless, or physical change.

After reviewing, take a Network+ N10-009 practice test. For each missed implementation question, identify whether the error came from the desired outcome, the control point, a peer-side dependency, or the verification step. That classification turns a wrong answer into a specific lab or review task.