DEV Community: Leon Odor

6 Network+ Exam Traps: OSI Layers, Broadcasts, Protocols, and Subnetting

Leon Odor — Tue, 07 Jul 2026 20:21:13 +0000

Network+ questions often hinge on one deciding fact. If you can pin that fact before reading the answers, the distractors get much less convincing.

This guide covers the traps that show up around OSI layers, hub vs switch, switch vs router, collision domains, broadcast domains, Telnet vs SSH, IMAP vs POP3, /26 subnetting, and DHCP relay.

Network+ exam traps summary table

Trap	Pinning fact	What follows
Hub vs switch vs router	Hub repeats bits at Layer 1; switch forwards frames by MAC at Layer 2; router forwards packets by IP at Layer 3.	Hubs share collision space, switches forward inside a VLAN, and routers move traffic between networks.
Collision vs broadcast domain	Collision is about simultaneous Ethernet transmission. Broadcast is about who receives L2 broadcasts.	Each switch port is a separate collision domain for exam purposes; one VLAN is one broadcast domain.
Telnet vs SSH	Telnet is plaintext remote terminal. SSH is encrypted remote access.	SSH uses TCP 22, encrypts client-to-server traffic, and supports public-key authentication.
IMAP vs POP3	IMAP syncs mailbox state; POP3 downloads messages.	POP3 may delete server copies, but that depends on client configuration.
/26 subnetting	/26 means 26 network bits, 6 host bits.	64 addresses per subnet, 62 usable hosts, mask 255.255.255.192.
DHCP relay	DHCP Discover is local broadcast; routers do not forward broadcasts by default.	A relay receives the broadcast, identifies the client subnet, and forwards DHCP information toward the server, generally by unicast.

Hub vs switch: Layer 1 repeating vs Layer 2 forwarding

The trap: both boxes connect Ethernet devices, so the answers blur into "it sends traffic where it needs to go."

The pinning fact: a hub does not make forwarding decisions. It is a Layer 1 repeater. A switch reads Layer 2 MAC addresses and forwards frames.

From that fact, the rest follows. A hub repeats incoming bits out the other ports, so connected devices share the same collision domain. A switch learns which MAC addresses live behind which ports, so it can forward known unicast frames only where they need to go.

Exam wording to watch for: "repeats signal," "no MAC table," or "all devices share bandwidth" points to a hub. "MAC address table," "forwards frames," or "separate collision domain per port" points to a switch.

Switch vs router: local frames vs routed packets

The trap: both switches and routers forward traffic, and a Layer 3 switch is a real device, so learners overgeneralize the exception.

The pinning fact: a standard switch operates at Layer 2 using MAC addresses. A router operates at Layer 3 using IP addresses.

A switch keeps traffic moving inside a Layer 2 segment, usually a VLAN. A router moves traffic between IP networks. That is why the default Network+ answer for breaking up broadcast domains is router, while a switch is the default answer for breaking up collision domains.

VLANs are the nuance: VLANs create separate Layer 2 broadcast domains on switches. Routing is needed only when devices in different VLANs need to communicate with each other.

Exam wording to watch for: "primarily breaks broadcast domains" usually wants router. "Inter-VLAN routing at wire speed" points to a Layer 3 switch. "WAN edge," "NAT," or "full routing features" points back to router.

Collision domain vs broadcast domain: two different boundaries

The trap: "domain" sounds like one category, so the switch rule gets copied from collisions to broadcasts.

The pinning fact: collision domains are about Ethernet transmit contention. Broadcast domains are about how far a Layer 2 broadcast frame travels.

For Network+ exam purposes, each switch port is a separate collision domain. In modern full-duplex Ethernet, collisions are effectively eliminated, but the exam still uses the one-port-one-collision-domain model to distinguish switches from hubs.

A broadcast is different. A switch floods a broadcast out every other applicable port in the same VLAN, not literally every physical port on the device. Different VLANs are different broadcast domains.

Exam wording to watch for: "How many collision domains on a 24-port switch?" usually means 24. "How many broadcast domains without VLANs?" usually means 1. "With four VLANs?" usually means 4.

Telnet vs SSH: plaintext remote access vs encrypted remote access

The trap: both give command-line remote access, so the question gets treated like a port-number flashcard.

The pinning fact: Telnet sends traffic in plaintext. SSH encrypts the connection between the SSH client and SSH server.

Once encryption is the deciding fact, SSH is the secure replacement for Telnet. SSH also supports public-key authentication, which is why key-based Linux administration shows up in hardening questions.

Ports still matter: SSH is TCP 22, Telnet is TCP 23.

Exam wording to watch for: "encrypted remote CLI," "secure shell," "key-based authentication," or "replace Telnet" points to SSH. "Plaintext terminal" points to Telnet.

IMAP vs POP3: sync the mailbox vs download the messages

The trap: both are incoming mail protocols, so people reduce the difference to "old vs new" or memorize only the ports.

The pinning fact: IMAP keeps mailbox state on the server and syncs across clients. POP3 downloads messages to the client.

That means IMAP fits multi-device mail: folders, read/unread state, and server-side mailbox state stay consistent. POP3 fits simple single-device retrieval. POP3 is often configured to remove messages from the server after download, but it does not always delete them; client settings control that behavior.

Ports: IMAP is TCP 143, IMAPS is 993, POP3 is TCP 110, and POP3S is 995.

Exam wording to watch for: "multiple devices," "sync folders," or "leave mail on server" points to IMAP. "Download to local client" points to POP3. "Send mail" is SMTP, not either one.

/26 subnetting: 64 addresses, 62 usable hosts

The trap: subnetting panic makes people jump straight to a memorized mask instead of counting the host bits.

The pinning fact: IPv4 has 32 bits. A /26 uses 26 bits for the network, leaving 6 host bits.

Six host bits gives 2^6 = 64 total addresses per subnet. Subtract the network address and broadcast address, and you get 62 usable host addresses. In the last octet, /26 is 11000000, so the mask is 255.255.255.192 and the block size is 64.

The subnet starts at multiples of 64 in the interesting octet: .0, .64, .128, .192.

Exam wording to watch for: "How many usable hosts?" asks for 62. "What subnet mask?" asks for 255.255.255.192. "Which subnet contains .130/26?" asks for the .128 block.

DHCP relay: forwarding a local broadcast toward a remote server

The trap: DHCP starts with a broadcast, and routers do not forward broadcasts, so the remote DHCP server seems impossible unless it is on every subnet.

The pinning fact: a DHCP relay agent receives the local client broadcast and forwards DHCP information toward a DHCP server on another subnet, generally using unicast, while identifying the client subnet.

The relay is often configured on a router or Layer 3 interface. It listens for DHCP Discover messages from local clients, forwards the request to the configured DHCP server, and includes information that lets the server choose the right address scope for the client subnet.

Exam wording to watch for: "DHCP server on a different subnet," "forward DHCP broadcasts," "ip helper," or "relay agent" all point to DHCP relay.

Closing pattern: identify the pinning fact first

The fastest way through these Network+ traps is not to memorize longer definitions. It is to ask, "What one fact decides this question?"

Layer question? Identify the address or unit: bits, frames, packets, ports, or application data.
Domain question? Decide whether the boundary is collision, broadcast, VLAN, or routed network.
Protocol question? Decide whether the job is secure remote access, incoming mail sync, incoming mail download, or mail sending.
Subnet question? Count host bits before choosing the mask.

The canonical version of this article is on Patternize: https://patternize.app/learn/network-plus/common-exam-traps/

The CompTIA concepts people keep confusing (and how to actually tell them apart)

Leon Odor — Sun, 28 Jun 2026 01:50:21 +0000

Most wrong answers on Security+ and Network+ aren't knowledge gaps. You read the objective, you watched the video, you could explain the term to a coworker. Then the exam hands you a scenario, two of the five answers look correct, and you pick the wrong one. That's not "I didn't study." That's "I couldn't tell which of these two similar things the question is describing."

Those are different skills. Knowing what tokenization is and being able to separate it from masking under time pressure are not the same muscle. The exam is built almost entirely on the second one. It rarely asks "define X." It asks "a company needs Y — which control fits," and the trap is a near-neighbor concept that's correct in isolation but wrong for the scenario.

This is why re-reading notes and grinding more questions past a certain point stops helping. Both reinforce recall. Neither trains discrimination — the ability to name the one feature that splits two look-alikes. Below are the pairs that trip people up the most, with the splitting feature for each. Once you can name the discriminator, the question gets easy.

WPA2 vs WPA3

Everyone knows WPA3 is newer and "more secure." The exam doesn't care that you know it's newer. It asks what WPA3 actually added, and that's where people stall.

Three concrete additions:

SAE (Simultaneous Authentication of Equals) replaces WPA2's pre-shared key 4-way handshake. The WPA2 handshake can be captured and brute-forced offline. SAE is resistant to that offline dictionary attack and gives forward secrecy.
OWE (Opportunistic Wireless Encryption) encrypts traffic on open networks — coffee-shop wifi with no password now has per-client encryption instead of plaintext.
192-bit security suite for WPA3-Enterprise, aimed at high-assurance environments.

Discriminator: if the scenario says "captured the handshake and cracked it offline," that's the WPA2 weakness SAE fixes. If it says "open network but still want encryption," that's OWE.

Wildcard vs SAN vs Single certificates

This one is entirely about scope, and people miss it because they reach for "wildcard = covers everything." It does not.

Single certificate covers one fully qualified domain name. www.example.com and nothing else.
Wildcard (*.example.com) covers one level of subdomains: mail.example.com, shop.example.com. It does not cover the bare example.com, and it does not cover api.v2.example.com — that's a second level down.
SAN (Subject Alternative Name) certificate covers an explicit list of names you specify: example.com, www.example.com, mail.otherdomain.com. Different domains, multiple specific hosts, whatever you list.

Discriminator: count the names and their shape. One host, single. One level of subdomains under a single domain, wildcard. An explicit mixed list, SAN.

DV vs OV vs EV certificates

The trap here is assuming these are encryption tiers. They are not. A DV cert and an EV cert give you the exact same TLS encryption. The difference is who the certificate authority verified before issuing.

DV (Domain Validation) — the CA confirmed you control the domain. A DNS record or a file on the server. Fast, automatable, no human checks who you are.
OV (Organization Validation) — the CA confirmed an actual organization exists and is tied to the domain. Some manual vetting.
EV (Extended Validation) — the CA vetted the legal entity through a stricter, standardized process.

Discriminator: the question is always who got verified, never how strong is the crypto. If an answer implies EV is "more encrypted," it's wrong.

Tokenization vs Masking vs Encryption

Three ways to protect a data field, and the exam loves to swap them. Split them on two questions: is it reversible, and where does the original live.

Encryption — reversible with a key. The original is mathematically present in the ciphertext; the key unlocks it. Lose control of the key, lose the data.
Tokenization — the value is swapped for a meaningless token. There's no algorithm that turns the token back into the original; the real value sits in a separate vault, and the token is just a lookup reference. Steal the token database without the vault and you have nothing useful.
Masking — the value is permanently obscured for display: ***-**-1234. There is no key, no vault, no way back. It's for showing data to people who don't need the full value.

Discriminator: reversible with a key → encryption. Reversible only via a separate vault lookup → tokenization. Not reversible at all → masking.

MFA vs SSO vs Federation

These get blended because they all sit around "logging in," but they answer different questions. MFA is about how many proofs. SSO and federation are about how many systems and across what boundary.

MFA (Multi-Factor Authentication) — one login that requires two or more different factor types: something you know, have, are. A password plus a TOTP code. Two passwords is not MFA — same factor type.
SSO (Single Sign-On) — one login grants access to many applications within the same organization. Authenticate once to the company IdP, reach email, the wiki, and the ticketing system without re-entering credentials.
Federation — SSO that crosses an organizational boundary via an established trust relationship, usually SAML or OIDC. Logging into a third-party SaaS vendor using your company identity is federation, because two separate trust domains agreed to honor each other's assertions.

Discriminator: count factor types for MFA. Count organizational boundaries for the other two — zero boundaries crossed is SSO, one boundary crossed is federation.

Two more that cause the same trouble

NAT vs PAT. NAT maps private addresses to public ones. Plain NAT can be a one-to-one mapping. PAT (Port Address Translation) — what most home routers actually do — maps many private addresses to a single public IP by tracking port numbers, also called NAT overload. Discriminator: many-to-one using ports is always PAT.

IDS vs IPS. Both detect. Only one acts. An IDS sits out of band, watches a copy of the traffic, and alerts — it cannot stop anything. An IPS sits inline, in the traffic path, and can drop or block in real time. Discriminator: if the device can stop the packet, it's inline, and inline means IPS. "Out of band / monitor / SPAN port / alerts only" is IDS.

Why this keeps happening

Notice the shape of every section above. The hard part was never the definition. It was a single splitting feature — reversibility, scope, who-got-verified, how-many-boundaries — that the scenario hides and the wrong answer is built to obscure. Standard studying optimizes recall: flashcards, re-reading, watching the term explained again. None of that trains you to produce the discriminator on demand, which is the exact thing the exam tests.

The fix is to study the pairs as pairs. Don't ask "what is tokenization." Ask "what one fact separates tokenization from masking, and which way does this scenario point." When you can state the discriminator in a sentence, the near-neighbor trap stops working on you.

Closing

If a question feels like a coin flip between two answers, that's the signal — you know both terms and you're missing the line between them. Find the line, write it down, and that whole class of question collapses.

I built a small free tool that drills these specific confusion pairs the way I described above — the most-confused concepts list — but the distinctions in this article stand on their own. The point isn't the tool. It's that "I keep getting these two mixed up" is a fixable, specific problem, and the fix is naming the discriminator rather than studying harder.