N10-009 deep review — September 29, 2026

Same-context AI review; independent human review pending. Study guide.

Scope, lifecycle and accepted metadata

The canonical Network+ page retains V9/N10-009, June 20, 2024 launch, weights 23/20/19/14/24, maximum 90 questions, 90 minutes, 720/900 and the five listed languages. Retirement remains estimated 2027 with no exact date. Experience is a recommendation, not an invented mandatory prerequisite.

Read all numbered objectives and detailed bullets in the public document version 6.0 PDF: 19 pages, 25 objectives in groups of 8/4/5/3/5. Page 11 layout confirms 3.3 disaster recovery, 3.4 services and 3.5 management; plain extraction order differs. The main page has 34 summary rows. Original objective paraphrases with published IDs are mapped in the receipt; the PDF is not redistributed.

The monitor diff adds only Duration: 90 minutes, already taught in the guide. No topic, weight or retirement wording changed. Explicitly accepted the reviewed metadata, archived byte-identical prior objective bytes, retained prior status and before/after reports, and preserved historical review/audit hashes, dates and conclusions. Document version 6.0 is distinct from exam V9. The public resource collection also contains other assets; their existence is not treated as an announced replacement exam or scheduling date.

Teaching changes and contradictions

Objective 1.8 explicitly includes SDN/SD-WAN, VXLAN, zero trust, SASE/SSE, IaC and IPv6 transitions; the guide now teaches their boundaries rather than leaving them as unconfirmed provider claims. Network+ 5.1 explicitly includes methodology, unlike the A+ V15 scope note. Expanded the complete port list, cloud/forwarding functions, wireless identities, power budget, monitoring levels, DNS records/results/privacy, time and management paths, tool selection and original lab acceptance evidence. Strengthened 44 answered checks and all eight proposed labs.

Cisco route selection distinguishes route-source/path selection for installation from longest-prefix forwarding. Added a worked default/aggregate/specific/host-route model; no generic comparison of unrelated protocol metrics is taught. DHCP renewal rules support separating new allocation from extension of an existing lease; pool exhaustion does not by itself make every renewal fail. IPv4 link-local evidence is qualified, not treated as a complete diagnosis.

The PDF labels port 587 “SMTPS.” RFC 8314 distinguishes submission with STARTTLS on 587 from implicit TLS on 465. The guide retains exam recognition while requiring actual negotiation and identity evidence. Read 66 selected rows from the IANA CSV; registry entries do not establish actual traffic identity or make every registered transport a common deployment.

DNSSEC data authenticity and encrypted client-resolver transport are separate controls. Added DoT/DoH, authoritative/recursive/primary/secondary distinctions and NOERROR-without-type versus NXDOMAIN, REFUSED and timeout. The limited example does not implement DNSSEC, encrypted transport, caching or upstream recursion. NTS key establishment and authenticated client/server NTP are likewise distinguished from a precision guarantee. Current SNMPv3 configuration must select the intended security level; an old RFC’s algorithm examples are not current algorithm recommendations.

IPv6 routers do not fragment forwarded traffic. Path MTU Discovery can fail when Packet Too Big feedback is blocked. Added a clearly scoped VXLAN encapsulation calculation: underlay IP MTU 1500 minus outer IP/UDP/VXLAN and inner Ethernet headers leaves inner IP space 1450 with a 20-byte IPv4 header or 1430 with a 40-byte IPv6 header. Tags/options/extensions/encryption may change the budget. No MTU, tunnel or interface configuration was executed.

Executed original examples

Both public Python examples ran on Python 3.13.14. A separate harness passed 72 checks. The planning example allocates four LANs for 90/50/20/10 total hosts, tests boundary counts, rejects oversized/invalid requests, handles /31 point-to-point and /32 host cases, verifies overlap/capacity, and models longest-match lookup. It deliberately rejects ambiguous equal-prefix alternatives rather than pretending to implement ECMP or a router control plane. Additional MTU, PoE and transfer-rate checks are arithmetic/models.

The DNS example uses dnslib 0.9.26 and dnspython 2.8.0 in an isolated virtual environment, with listeners bound only to 127.0.0.1 on separately selected UDP/TCP ports. The harness made 14 real wire exchanges; the public example made ten more, 24 total. Cases cover A, AAAA, CNAME plus target, existing-name missing type, NXDOMAIN, refusal, case-insensitive names, TTL/authority/recursion flags and negative SOA. No upstream request is possible in the example. Listeners stopped and sockets were released; the harness checks TCP closure and UDP port reuse.

No host DNS/hosts file, interface, routing, firewall/NAT, DHCP service, TLS, DNSSEC, cache, capture, scan, wireless, switch/router, remote resolver or full failure/recovery lab was changed or tested. The tiny zone is a selected-behavior demonstration, not a complete production DNS implementation. All eight full network labs remain proposed. The local HTTP fetch of the dnslib PyPI page was a challenge shell; separate web package/release retrieval and installed upstream API inspection supplied content evidence.

Catalog and blog

Current public metadata: Pluralsight 12 courses/14 hours; LinkedIn 18h51, April 25, 2025 release; Messer 87 videos/12h55. Pluralsight’s general path text mentions labs but supplies no verified lab count. MeasureUp’s product-specific 219 questions/June 2024 listing overrides generic FAQ language about 150 questions; no questions were reproduced. Both O’Reilly pages and Udemy blocked automated rechecking, so prior book page counts/runtimes are marked unverified. Paid interiors and complete lesson coverage were not reviewed.

CompTIA’s Perform option was added with official-page time estimates: Perform 30–60h, Learn 25–40h, Practice 10–20h, Labs 15–25h. These overlap and are not a mandatory combined workload. Additional practice times are planning estimates. Places to learn is final.

Peter Wu’s October 29, 2019 Cloudflare article supports the resolver-trust/transport distinction and split-DNS tradeoffs. Historical product defaults, commands, deployment statistics and draft status are not adopted as current guidance. No resolver policy or product setting was changed.

Repository validation, 176 unit tests, strict site build, generated-site validation, learning catalog consistency and diff checks are recorded in the operational receipt after execution.