Network Administrator exam: what is tested and how to prepare

Updated 15 September 2026 · 4 min read

Written tests for network posts reward people who can reason about a network, not people who have memorised a glossary. Expect scenarios: a user cannot reach a server, two VLANs cannot talk to each other, a new branch office needs addresses. This guide sets out what those questions draw on, how they are put together, and how to prepare so that the clock is not the thing that beats you.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

What the questions draw on

Most questions come from a small number of areas, and they overlap. A single scenario can test addressing, switching and a network service at the same time.

IP addressing and subnetting: masks, network and broadcast addresses, usable hosts, private ranges and default gateways.
Switching: VLANs, access and trunk ports, the MAC address table, and why spanning tree exists.
Routing: static and default routes, how a router chooses between routes, and the basics of OSPF.
Network services: DHCP, DNS and NAT, and what breaks when each one fails.
Wireless: SSIDs, channel choice, and the difference between WPA2 and WPA3.
Security: access control lists, port security, strong device passwords and least privilege.
Troubleshooting: working through a fault in a sensible order with ping, tracert or traceroute, ipconfig and switch or router show commands.

Where to spend your study time

The suggested emphasis reflects what this position works with day to day. It is a study guide, not a published exam blueprint.

Area	Suggested emphasis	Questions in the bank	Practise
Networking fundamentals	31%	2,636	Networking
Routing and switching	23%	247	Routing & Switching
Ports and protocols	15%	264	Networking
Cybersecurity	15%	541	Security
Hardware and operating systems	8%	961	Hardware & OS
Linux command line	8%	360	In the full bank

How a scenario question is built

A good scenario question gives you a symptom and one real clue, then offers four answers that all sound like something an administrator might do. Usually only one of them addresses the cause the clue points to.

Take a user whose laptop shows an address of 169.254.10.23. That address is link-local: the laptop asked for a DHCP lease and got no reply. Answers about DNS, the browser or the website are reasonable things to check on another day, but none of them explains that address. The clue decides the answer, so find it before you read the options.

Subnetting without running out of time

Subnetting appears in almost every networking test, and it is where slow methods cost the most. Writing every address out in binary works, but it is too slow to repeat many times against a clock.

Learn the block-size method instead. Find the octet where the mask stops being 255, subtract that mask value from 256, and count up in steps of the block size to find the network the address falls into. With practice, a /26 or /27 question takes well under a minute. Drill the prefixes from /20 to /30 until their masks are automatic, because those are the ones scenarios use most.

Reading "first", "best" and "most likely"

These words change the question. "What should you do first" is asking about order, and the expected order is usually the least disruptive, most basic check: is the cable connected, is the link light on, does the device have an address. "Best" asks you to weigh options that may all work. "Most likely" asks which cause fits the evidence, not which cause is merely possible.

Underline these words when you read the stem. Many wrong answers are correct actions offered in the wrong order.

Preparing in the weeks before

Work through questions every day rather than in long weekend sessions. Keep an error log: for every wrong answer, write the topic and one sentence on why you chose wrongly. After two weeks that log tells you exactly what to revise.

Build a small lab if you can. Cisco Packet Tracer runs on an ordinary laptop and lets you configure VLANs, trunks and routing, then watch them fail. Explaining out loud why a configuration works is slower than reading about it, and it sticks far better.

Sit at least two timed mock exams. The first shows your pace; the second shows whether you fixed it.

Try a few now

A user reports that they are unable to access the hospital management system due to a certificate expiration issue. What steps would you take to troubleshoot and resolve the issue while ensuring system availability?
1. Renew the expired certificate and update it on the system
2. Promise a solution without a timeline
3. Utilize a certificate revocation list (CRL) to block access from expired certificates
4. No correct answer
Show the answer
A. Renew the expired certificate and update it on the system
Renewing and installing the certificate restores trust and availability. A CRL blocks access rather than restoring it.
Real past-paper question; answer cross-checked against the original session. Open this question
What is the primary purpose of Safe Mode in Windows?
1. To install new software
2. To update drivers
3. To diagnose and fix problems
4. To delete files securely
Show the answer
C. To diagnose and fix problems
Safe Mode boots with a minimal set of drivers and services so a faulty driver or startup program can be isolated and removed.
Real past-paper question; answer cross-checked against the original session. Open this question
What protocol is used to send email?
1. SMTP
2. POP3
3. HTTP
4. IMAP
Show the answer
A. SMTP
SMTP sends mail. POP3 and IMAP retrieve it; HTTP serves web content.
Real past-paper question; answer cross-checked against the original session. Open this question
A switch receives a frame with a destination MAC address of FF:FF:FF:FF:FF:FF. Which OSI layer is responsible for flooding this frame out all ports?
1. Transport
2. Physical
3. Network
4. Data Link
Show the answer
D. Data Link
Objective 1.1: Switches operate primarily at the Data Link layer (Layer 2) to flood broadcast MAC addresses.
Original practice question, written against published exam objectives. Open this question

Common questions

Do I need to memorise port numbers?

Yes, for the common ones. Know SSH (22), DNS (53), DHCP (67 and 68), HTTP (80), HTTPS (443), SNMP (161), syslog (514) and RDP (3389) without thinking. Questions often hide a port number inside a firewall or access-list scenario.

Are the questions about Cisco commands?

Mostly they test concepts. Some scenarios show output from commands such as show ip interface brief or show vlan brief, because Cisco equipment is common and widely taught. If you understand what the output means, the exact vendor matters less.

How much time should I give each question?

Divide the time allowed by the number of questions to find your average, then aim to finish easy questions faster than that. Flag anything taking twice your average and come back once every other question has an answer.