Overview
Networking Concepts is the conceptual foundation of Network+ and, at 23%, nearly a quarter of the exam. It has eight objectives. The OSI reference model covers the seven layers and encapsulation. Networking appliances covers devices, applications and functions such as routers, switches, firewalls, load balancers and proxies, physical and virtual. Cloud concepts cover service and deployment models, network function virtualization, VPCs and cloud connectivity. Ports and protocols covers common ports, protocols, services and traffic types. Transmission media covers copper and fiber cabling and transceivers. Topologies covers network topologies, architectures and types. IPv4 addressing covers subnetting and address types. IPv6 covers addressing concepts.
This domain underpins every other, since troubleshooting, implementation, operations and security all assume this foundation. The exam rewards fluency with the OSI model, ports and protocols, cabling, and especially IPv4 subnetting, which is a core, heavily tested skill.
How it's tested
Network+ questions are scenario-based and vendor-neutral, testing applied understanding of networking fundamentals. In this domain they describe a situation and ask which OSI layer, device, protocol, port, cable or address applies, or require a subnetting calculation. Read the scenario for the layer, protocol or address it points to.
-
OSI layer or device
A function or device is described, and you identify the OSI layer or the appliance.
-
Port, protocol or media
A service or connection need is described, and you choose the port, protocol or cable.
-
Addressing and subnetting
An addressing need is described, and you calculate the subnet, range or address type.
A device must be given a usable host address within a subnet, and you are told the network uses a /26 mask. A /26 leaves 6 host bits, giving 64 addresses per subnet, of which 62 are usable hosts after removing the network and broadcast addresses. Calculating the subnet's range and identifying a usable host address is the IPv4 subnetting skill the exam expects, applied directly from the mask.
Domains 8
Official domains from the CompTIA outline, in outline order.
1.1 Explain concepts related to the OSI reference modelThe seven layers and encapsulation.
- What it means
- This covers the seven layers of the OSI model, physical, data link, network, transport, session, presentation and application, what operates at each, and how data is encapsulated as it moves down the layers and decapsulated as it moves up.
- What to understand
- Each OSI layer has a role: physical moves bits, data link handles frames and MAC addresses, network handles IP routing, transport handles TCP and UDP, and the upper layers handle sessions, formatting and applications. The model is a troubleshooting and design framework, and knowing which devices and protocols operate at each layer is essential.
- How it shows up
- A function, device or protocol is described, and you must identify its OSI layer.
- Common confusion
- Confusing the data link and network layers, or which devices operate where; switches are layer 2, routers are layer 3.
1.2 Compare and contrast networking appliances, applications, and functionsRouters, switches, firewalls, load balancers, proxies and more.
- What it means
- This covers networking devices and functions, physical and virtual, including routers, switches, firewalls, load balancers, proxies, IDS and IPS, VPN concentrators, network-attached storage, storage area networks and content delivery networks, and what each does.
- What to understand
- Each appliance has a distinct function: switches connect devices in a LAN, routers connect networks, firewalls filter traffic, load balancers distribute it, and proxies mediate requests. Devices can be physical or virtual. Knowing each device's purpose and layer is foundational for design and troubleshooting.
- How it shows up
- A function need is described, and you must choose the appliance.
- Common confusion
- Confusing a switch with a router, or an IDS with an IPS; an IDS detects while an IPS detects and blocks.
1.3 Summarize cloud concepts and connectivity optionsService and deployment models, NFV, VPCs and cloud connectivity.
- What it means
- This covers cloud service models (IaaS, PaaS, SaaS) and deployment models, network function virtualization, virtual private clouds, network security groups and lists, cloud gateways, and cloud connectivity options such as VPNs and direct connections.
- What to understand
- Cloud networking applies familiar concepts in a provider's environment: VPCs isolate resources, security groups and lists filter traffic, and gateways connect networks. Network function virtualization runs network functions as software. Connectivity options link on-premises networks to the cloud. These concepts bridge traditional and cloud networking.
- How it shows up
- A cloud networking need is described, and you must choose the model, construct or connectivity option.
- Common confusion
- Confusing a network security group with a network security list, or a deployment model with a service model.
1.4 Explain common networking ports, protocols, services, and traffic typesWell-known ports, protocols and traffic types.
- What it means
- This covers common ports and the protocols and services that use them, such as DNS on 53, HTTP on 80, HTTPS on 443, SSH on 22 and many others, plus traffic types such as unicast, multicast, broadcast and anycast.
- What to understand
- Memorizing the well-known ports and their protocols is a core, heavily tested requirement, since questions ask which port a service uses or which service a port implies. Knowing secure versus insecure protocol pairs, and the traffic types, is also expected. This is rote knowledge the exam assumes.
- How it shows up
- A service or port is described, and you must identify the matching port, protocol or traffic type.
- Common confusion
- Confusing the ports of similar protocols, such as the secure and insecure versions of a service.
1.5 Compare and contrast transmission media and transceiversCopper and fiber cabling and transceivers.
- What it means
- This covers transmission media, copper cabling categories and their speeds and distances, fiber (single-mode and multimode), connectors, and transceivers such as SFP modules, and comparing their characteristics.
- What to understand
- Copper cabling categories support different speeds and maximum distances, and fiber supports longer distances and higher speeds, with single-mode for long range and multimode for shorter. Connectors and transceivers must match the media and equipment. Choosing the right media for a speed and distance requirement is the key skill.
- How it shows up
- A speed, distance or connector need is described, and you must choose the media or transceiver.
- Common confusion
- Confusing single-mode and multimode fiber, or the capabilities of different copper categories.
1.6 Compare and contrast network topologies, architectures, and typesTopologies, hierarchical models, and network types.
- What it means
- This covers physical and logical topologies, network architectures such as the three-tier hierarchical model and collapsed core, software-defined networking and SD-WAN, and network types such as LAN, WAN, MAN, PAN, SAN and newer concepts like VXLAN and SASE.
- What to understand
- Topologies describe how devices connect, architectures describe how networks are structured for scale and resilience, and network types describe geographic and functional scope. Modern concepts such as software-defined networking, SD-WAN, VXLAN, zero trust and SASE are newly emphasized. Knowing each concept's purpose is expected.
- How it shows up
- A structure or scope need is described, and you must identify the topology, architecture or network type.
- Common confusion
- Confusing network types such as LAN, WAN and MAN, or physical with logical topologies.
1.7 Use appropriate IPv4 network addressingSubnetting, address classes, CIDR and address types.
- What it means
- This covers IPv4 addressing: address classes, private versus public addresses, Classless Inter-Domain Routing, subnetting and calculating subnets, hosts, ranges, network and broadcast addresses, and special addresses such as APIPA and loopback.
- What to understand
- Subnetting is the most practical and heavily tested skill in this domain: given an address and mask, you calculate the number of subnets and hosts, the usable range, and the network and broadcast addresses. CIDR notation expresses masks concisely. Private address ranges and special addresses must be known. Fluent subnetting is essential.
- How it shows up
- An addressing scenario is described, and you must subnet or identify the address type.
- Common confusion
- Miscalculating subnets and hosts from a mask, or confusing the network, broadcast and usable addresses.
1.8 Summarize IPv6 addressing conceptsIPv6 address types, notation and concepts.
- What it means
- This covers IPv6 addressing concepts: the 128-bit address format and notation, address types such as unicast, multicast and anycast, link-local addresses, and the reasons for and transition mechanisms toward IPv6.
- What to understand
- IPv6 uses 128-bit addresses written in hexadecimal with abbreviation rules, and includes link-local addresses that are automatically configured. It was created to address IPv4 exhaustion. Understanding the address types, notation and why IPv6 exists, rather than detailed subnetting, is what the exam expects.
- How it shows up
- An IPv6 situation is described, and you must identify the address type, notation or concept.
- Common confusion
- Confusing IPv6 address types, or the abbreviation rules for compressing an address.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
OSI seven layers
Physical to application, each with a role.
- Remember
- Know what operates at each layer.
- Tested as
- Foundational and troubleshooting questions.
- Trap
- Confusing adjacent layers.
-
Layer 2 vs. layer 3 devices
Switches at layer 2, routers at layer 3.
- Remember
- Switches use MAC, routers use IP.
- Tested as
- Device questions.
- Trap
- Confusing switches and routers.
-
IDS vs. IPS
Detects versus detects and blocks.
- Remember
- An IPS can stop traffic.
- Tested as
- Appliance questions.
- Trap
- Confusing the two.
-
Well-known ports
DNS 53, HTTP 80, HTTPS 443, SSH 22 and more.
- Remember
- Memorize the common ports.
- Tested as
- Heavily tested port questions.
- Trap
- Confusing similar protocols' ports.
-
Copper vs. fiber media
Copper categories versus single-mode and multimode fiber.
- Remember
- Fiber goes farther and faster.
- Tested as
- Media questions.
- Trap
- Confusing single-mode and multimode.
-
IPv4 subnetting
Calculating subnets, hosts and ranges from a mask.
- Remember
- Know hosts and ranges per mask.
- Tested as
- Heavily tested calculation questions.
- Trap
- Miscounting hosts or ranges.
-
CIDR notation
A mask written as a prefix length such as /26.
- Remember
- Prefix length sets subnet and host bits.
- Tested as
- Addressing questions.
- Trap
- Misreading the prefix length.
-
Private vs. public IPv4
Reserved private ranges versus routable public addresses.
- Remember
- Know the private ranges.
- Tested as
- Addressing questions.
- Trap
- Confusing private and public ranges.
-
IPv6 address types
Unicast, multicast, anycast and link-local.
- Remember
- Link-local is auto-configured.
- Tested as
- IPv6 questions.
- Trap
- Confusing the types.
-
Network types
LAN, WAN, MAN, PAN, SAN and more.
- Remember
- Defined by scope and function.
- Tested as
- Topology questions.
- Trap
- Confusing LAN, WAN and MAN.
-
Modern architectures
SDN, SD-WAN, VXLAN, zero trust, SASE.
- Remember
- Newly emphasized in N10-009.
- Tested as
- Architecture questions.
- Trap
- Overlooking the new concepts.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Switch vs. router vs. firewall
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Switch | Connects devices in a LAN | Layer 2, uses MAC | Confusing with a router |
| Router | Connects networks | Layer 3, uses IP | Confusing with a switch |
| Firewall | Filters traffic by rules | Security enforcement | Confusing with a router |
Single-mode vs. multimode fiber
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Single-mode | Narrow core, laser | Longer distances | Confusing with multimode |
| Multimode | Wider core, LED | Shorter distances, cheaper | Using for long runs |
IPv4 vs. IPv6
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IPv4 | 32-bit, dotted decimal | Limited address space | Miscalculating subnets |
| IPv6 | 128-bit, hexadecimal | Vast address space | Mishandling abbreviation |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Wrong OSI layer
- What candidates pick
- Place a routing function at the data link layer.
- Why it looks right
- The layers feel similar.
- Why it's wrong
- Routing by IP is a layer 3 (network) function; layer 2 handles frames and MAC addresses.
Clue to watch for The function involves IP routing versus MAC-based switching.
-
Switch for connecting networks
- What candidates pick
- Use a switch to connect two different IP networks.
- Why it looks right
- Switches connect devices.
- Why it's wrong
- A router connects different networks at layer 3; a switch connects devices within a network at layer 2.
Clue to watch for Different IP networks must communicate.
-
IDS blocks traffic
- What candidates pick
- Expect an IDS to automatically block an attack.
- Why it looks right
- Both are detection systems.
- Why it's wrong
- An IDS only detects and alerts; an IPS detects and actively blocks.
Clue to watch for The requirement is to stop, not just detect, malicious traffic.
-
Subnet miscount
- What candidates pick
- Count all addresses in a subnet as usable hosts.
- Why it looks right
- It seems straightforward.
- Why it's wrong
- The network and broadcast addresses are not usable hosts, so usable hosts are two fewer than total addresses.
Clue to watch for The question asks for usable host addresses.
-
Multimode for long distance
- What candidates pick
- Use multimode fiber for a long-distance run.
- Why it looks right
- Multimode is cheaper.
- Why it's wrong
- Single-mode fiber supports much longer distances; multimode is for shorter runs.
Clue to watch for The distance exceeds multimode's range.
-
Insecure port for secure service
- What candidates pick
- Use the insecure protocol's port when a secure service is required.
- Why it looks right
- The ports are similar.
- Why it's wrong
- Secure services use their own ports, such as HTTPS on 443 rather than HTTP on 80.
Clue to watch for The requirement specifies a secure, encrypted service.
Answer framework
For any Domain 1 concept scenario, use these steps to find the answer Network+ expects.
- Identify whether the question is about the OSI model, a device, cloud, ports and protocols, media, topology or addressing.
- For functions and devices, map them to the correct OSI layer and appliance, keeping layer 2 switches distinct from layer 3 routers.
- For services, recall the correct well-known port and protocol, choosing the secure version where required.
- For media, match copper category or fiber type and transceiver to the speed and distance requirement.
- For addressing, subnet IPv4 carefully, computing hosts, ranges and network and broadcast addresses, and identify IPv6 address types. Where two options seem to fit, pick the one that most precisely matches the scenario's symptom or requirement.
Practice question
Want more like this? The Network+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as the foundation the whole exam rests on, and give it heavy, early attention. Start with the OSI model until you can place any device, protocol or function at its layer, since this underpins troubleshooting. Then memorize the common ports and protocols cold, because port questions are frequent and purely recall.
Give the most practice to IPv4 subnetting, the single most important and most underestimated skill: drill calculating subnets, usable hosts, ranges, and network and broadcast addresses from any mask until it is fast and automatic, ideally without a calculator. Learn the copper categories and single-mode versus multimode fiber, and the newer architecture concepts such as SDN, SD-WAN, VXLAN, zero trust and SASE that N10-009 added.
Because this domain is foundational, hands-on practice with a subnet calculator and simple topologies cements it. Afterwards, move to Domain 2, Network Implementation. Because Network+ rewards hands-on familiarity, practice configuring and troubleshooting on real or simulated devices rather than only reading, and review missed practice questions by domain to find weak spots.
FAQ
How much of Network+ is Domain 1?
Networking Concepts is 23% of the exam, one of the two largest domains, and it is the foundation that every other domain assumes.
Why is the OSI model so important?
It is the common framework for describing where devices, protocols and functions operate, and it structures troubleshooting. Knowing which layer something belongs to is tested directly and underpins the whole exam.
Do I really need to memorize ports?
Yes. Common ports and their protocols, such as DNS on 53, HTTP on 80, HTTPS on 443 and SSH on 22, are heavily and directly tested, and there is no shortcut other than memorization.
How important is subnetting?
Very. IPv4 subnetting is the most practical and heavily tested skill in this domain and a common reason candidates fail. You must be able to calculate subnets, usable hosts and ranges from a mask quickly.
What is the difference between an IDS and an IPS?
An intrusion detection system detects and alerts on suspicious activity. An intrusion prevention system detects and actively blocks it, so an IPS can stop an attack while an IDS only reports it.
What is new in the N10-009 Networking Concepts domain?
N10-009 added modern concepts such as zero trust, SASE, VXLAN, SD-WAN and infrastructure as code, reflecting how modern networks operate, so study materials predating mid-2024 may miss these.
How does Domain 1 connect to the rest of the exam?
These foundations underpin the implementation, operations, security and troubleshooting domains, which all assume you know the OSI model, addressing, ports and media.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have covered the OSI model, appliances, cloud, ports, media, topologies and addressing. Test whether you can apply these foundations, including subnetting, under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Network+ AI tutor Get any concept explained your way