CompTIA Network+

• Switching, VLANs, trunks and inter-VLAN implementation

  ≈ 4%2 h 15 min

  This topic covers how Ethernet switching is implemented with VLAN segmentation, trunking, and inter-VLAN communication on modern enterprise networks. On the exam, candidates are typically asked to choose, apply, or validate the correct switch configuration approach for access ports, trunk ports, native VLANs, voice VLANs, and Layer 3 switching or router-on-a-stick designs.

  • Explain how a managed switch learns and forwards frames using the MAC address table, including unicast, broadcast, unknown unicast, and multicast behaviour within a VLAN.
  • Apply VLAN concepts to segment a network, including default VLANs, data VLANs, voice VLANs, management VLANs, and the operational purpose of separating broadcast domains.
  • Configure and verify switchport modes and trunk links, including access ports, 802.1Q trunking, allowed VLAN lists, and native VLAN handling.
  • Implement inter-VLAN routing by selecting the appropriate method, including switched virtual interfaces (SVIs) on a multilayer switch and router-on-a-stick using subinterfaces.
  • Interpret switch interface status and common implementation outputs to confirm VLAN membership, trunk operation, duplex and speed settings, and administrative state.
  • Evaluate when to use features such as port security and MAC filtering at the switchport as part of a basic implementation scenario without confusing them with broader security-policy troubleshooting tasks.

• Spanning tree, link aggregation and switch resiliency

  ≈ 2.5%1 h 45 min

  This topic covers the Layer 2 resiliency mechanisms that prevent loops and preserve availability in switched networks. The exam tests recognition and implementation of spanning tree operation, redundant links, and aggregated links that increase bandwidth while maintaining stability.

  • Explain the purpose of spanning tree in preventing Layer 2 switching loops and broadcast storms in redundant Ethernet topologies.
  • Interpret core spanning tree concepts, including root bridge election, root port, designated port, blocked or discarding states, and path cost.
  • Compare common spanning tree variants at a high level, including STP, RSTP, and MSTP, and identify the implementation outcome expected in a scenario.
  • Apply edge-port and loop-prevention features appropriately, including concepts such as PortFast, BPDU Guard, and related protections where a scenario calls for safe endpoint attachment.
  • Explain link aggregation and implement an EtherChannel or port-channel concept using the correct member-link requirements and benefits.

• Routing technologies, path selection and gateway redundancy

  ≈ 4%2 h 15 min

  This topic covers how routers and Layer 3 devices select paths, exchange routes, and provide resilient default gateway services. The exam commonly tests route interpretation, longest-prefix matching, dynamic versus static route choice, and first-hop redundancy in small and enterprise networks.

  • Explain how a router builds and uses a routing table, including directly connected networks, static routes, default routes, and dynamically learned routes.
  • Apply path-selection logic to a scenario using longest prefix match, administrative distance, and metric to determine which route a device will prefer.
  • Compare distance-vector and link-state routing concepts and identify the role of common protocols such as RIP, OSPF, EIGRP, and BGP at the level expected by Network+.
  • Implement static routing concepts, including default routes and floating static routes, when a simple or backup path is required.
  • Interpret route summarization and route advertisement concepts and evaluate when summarization reduces routing-table size and improves efficiency.

• Wireless LAN implementation, authentication and optimization

  ≈ 4%2 h 15 min

  This topic covers practical WLAN deployment, including SSID design, AP placement, controller or standalone operation, wireless authentication choices, and RF optimization. On the exam, candidates are expected to select and apply the correct wireless implementation parameters for coverage, capacity, roaming, and secure client access.

  • Compare wireless deployment models, including standalone access points, controller-based APs, lightweight APs, mesh, and point-to-point or point-to-multipoint wireless links, and choose the appropriate design for a scenario.
  • Configure core WLAN settings, including SSIDs, VLAN mapping, channels, channel width, transmit power, security mode, and guest-network separation.
  • Explain wireless authentication and access methods, including open, captive portal, PSK, WPA2, WPA3, 802.1X, and RADIUS-backed enterprise authentication.
  • Apply RF optimization principles, including 2.4 GHz, 5 GHz, and 6 GHz band characteristics, channel reuse, interference avoidance, coverage planning, and client-density considerations.
  • Evaluate roaming and mobility requirements, including AP overlap, signal thresholds, and design choices that improve handoff for voice and mobile clients.

• Cabling installation, racks, power and environmental controls

  ≈ 2.5%1 h 30 min

  This topic covers the physical implementation work needed to install network infrastructure safely and correctly, including structured cabling practice, rack layout, power design, and environmental controls. The exam tests whether candidates can select the right installation approach, physical components, and site protections for real deployment scenarios.

  • Apply structured cabling practices, including cable management, bend radius awareness, separation from electromagnetic interference sources, proper labeling, and standards-based termination choices.
  • Select and place physical infrastructure components correctly, including racks, cabinets, patch panels, horizontal and vertical cable managers, ladder racks, and demarcation-related equipment where applicable.
  • Differentiate common power solutions, including AC and DC considerations, power distribution units, uninterruptible power supplies, surge suppression, generators, and Power over Ethernet deployment requirements.
  • Explain grounding and bonding concepts and evaluate their role in protecting personnel, equipment, and cabling installations.
  • Interpret environmental requirements for network spaces, including temperature, humidity, airflow, hot aisle/cold aisle concepts, fire suppression considerations, and protection from dust or water hazards.

• Implementing network appliances, services, virtual devices and diagrams

  ≈ 2%1 h 30 min

  This topic covers how supporting network appliances, services, and virtualized network functions are deployed and represented in documentation. The exam usually tests whether candidates can identify the correct implementation of common infrastructure services and appliances, then interpret or create accurate logical and physical diagrams.

  • Identify the implementation role of common network appliances, including firewalls, IDS/IPS, load balancers, proxies, content filters, VPN concentrators, wireless controllers, and WAN edge devices.
  • Implement foundational network services in a scenario, including DHCP, DNS, NTP, AAA, directory services, syslog, and SNMP, with the correct purpose and placement in the network.
  • Explain how virtual networking components are deployed, including virtual switches, virtual routers, virtual firewalls, virtual NICs, and hypervisor-based networking constructs.
  • Compare appliance deployment models such as dedicated hardware, virtual appliance, and cloud-hosted service, and choose the most suitable option for a business requirement.
  • Interpret and create network diagrams that distinguish logical and physical views, show device roles and interconnections accurately, and reflect segmentation, routing boundaries, and service placement.

About 11 h 30 min of study, lessons and core practice

• Network documentation, inventory, baselines and operational procedures

  ≈ 3%1 h 30 min

  Covers the operational records and reference information used to run a network, including diagrams, inventories, configurations, baselines and standard procedures. The exam tests recognition of correct documentation artifacts, interpretation of baseline information and selection of the right operational procedure for a scenario.

  • Identify the purpose and contents of common network documentation, including physical and logical diagrams, rack diagrams, cable maps, port maps, IP address management records, VLAN and subnet documentation, wireless surveys and topology documentation.
  • Maintain network inventory and asset records for hardware, software, licensing, support contracts, configurations and lifecycle status.
  • Establish and interpret performance baselines for network devices, links and services so that normal operation can be distinguished from abnormal behavior.
  • Explain the role of standard operating procedures, runbooks and playbooks in routine administration, incident response, escalation and communication.
  • Apply labeling, naming and documentation conventions to interfaces, cables, devices, circuits and sites to support accurate operations and troubleshooting.
  • Differentiate operational records such as configuration archives, network maps, inventory databases and procedural documentation, and choose the correct source for a given task.

• Monitoring, telemetry, logs and performance metrics

  ≈ 4%2 h

  Focuses on how administrators observe network health through monitoring systems, logs, flow records, packet analysis and performance data. The exam tests the ability to choose appropriate monitoring methods, interpret telemetry and metrics, and relate alerts or trends to network conditions.

  • Explain the use of monitoring and telemetry sources, including SNMP, syslog, flow data, packet captures, traps, sensors and dashboards, for visibility into network operations.
  • Interpret logs, alerts and event records from network devices, servers and security appliances to identify faults, performance issues and operational trends.
  • Evaluate common performance metrics, including bandwidth utilization, throughput, latency, jitter, packet loss, errors, CPU, memory and interface statistics.
  • Differentiate active monitoring from passive monitoring, and select the appropriate approach for availability testing, performance analysis or protocol troubleshooting.
  • Use baseline data, thresholds and trend analysis to determine whether observed metrics represent normal variation, degradation or a probable incident.

• Management access, administrative tools and maintenance practices

  ≈ 3%1 h 30 min

  Covers secure management access methods, administrative utilities and routine maintenance practices used to operate network infrastructure. The exam tests tool selection, safe management access choices and the application of ongoing maintenance activities in operational scenarios.

  • Differentiate in-band and out-of-band management access and select appropriate management methods such as console, SSH, web management and management VLANs for a given scenario.
  • Use common administrative tools and utilities to manage and verify network operation, including terminal access, configuration interfaces, IP utilities, packet capture tools and vendor management platforms.
  • Explain the purpose of AAA for administrative access and apply least-privilege, credential management and secure remote administration practices.
  • Perform routine maintenance tasks such as configuration backup, image verification, certificate review, account review, interface checks and scheduled service validation.
  • Apply maintenance-window, communication and rollback considerations when planning operational work on production network devices.

• High availability, redundancy, disaster recovery and business continuity

  ≈ 3%1 h 45 min

  Addresses operational resilience measures that keep networks available during faults, outages and site-level disruptions. The exam tests recognition of redundancy and failover designs, and the ability to distinguish high availability from disaster recovery and business continuity planning.

  • Explain high-availability concepts and redundancy methods for devices, links, power, WAN connectivity, storage and services in enterprise networks.
  • Differentiate fault tolerance, high availability, load sharing, failover and resilience, and apply the correct term to a network design scenario.
  • Explain disaster recovery and business continuity concepts, including backup sites, recovery procedures, communication planning and restoration priorities for network services.
  • Interpret recovery objectives such as RTO and RPO and relate them to backup, replication and service-restoration strategies.
  • Identify environmental and facility considerations that support continuity, including redundant power, UPS, generators, HVAC, geographic diversity and carrier diversity.

• Change control, patching, backups and decommissioning

  ≈ 3%1 h 15 min

  Covers the controlled processes used to modify, maintain and retire network systems throughout their lifecycle. The exam tests sequencing and justification of change management steps, patching and backup practices, and safe decommissioning actions for operational and security compliance.

  • Explain the purpose and stages of change control, including request, impact assessment, approval, maintenance scheduling, implementation, validation, documentation and rollback.
  • Apply patch and firmware management practices for network devices, including testing, compatibility checking, staged deployment, verification and risk reduction.
  • Differentiate backup types and targets relevant to network operations, including configuration backups, system images and data backups, and select an appropriate protection method for a scenario.
  • Verify backup integrity and restoration readiness through validation, retention practices and periodic recovery testing.
  • Perform secure decommissioning tasks for network hardware and virtual resources, including data sanitization, certificate and key removal, license recovery, asset updates and disposal according to policy.

About 8 h of study, lessons and core practice

• Core security concepts, zero trust and secure network design

  ≈ 3.5%1 h 45 min

  This topic covers foundational network-security principles, including confidentiality, integrity and availability, defense-in-depth, segmentation and zero trust. On the exam, candidates must interpret secure design scenarios, choose the best control for a stated risk and distinguish sound security architecture from weak or overly permissive designs.

  • Explain core security concepts, including confidentiality, integrity, availability, non-repudiation and least privilege, in network-design and operations scenarios.
  • Apply secure network design principles such as defense in depth, segmentation, microsegmentation, air gaps and isolation to reduce attack surface and limit lateral movement.
  • Explain zero trust concepts, including explicit verification, continuous validation, least-privilege access and the assumption of breach, and evaluate where they fit in enterprise networks.
  • Evaluate secure placement of resources by using zones and trust boundaries such as inside, outside, DMZ, screened subnet and management networks.
  • Compare logical security approaches that support secure design, including out-of-band management, jump boxes, bastion hosts and dedicated management interfaces.
  • Interpret security requirements and recommend appropriate architectural controls for on-premises, hybrid and cloud-connected network environments.

• Common network threats, attacks and vulnerabilities

  ≈ 4.5%2 h 15 min

  This topic covers the major network threats, attack methods and vulnerability types that affect modern enterprise networks. The exam tests recognition of attack indicators, matching attacks to impacted layers or services and selecting the most appropriate mitigation or preventive control.

  • Identify common threat actors, attack surfaces and vulnerability sources affecting wired, wireless, remote-access and internet-facing networks.
  • Differentiate common attack types, including malware, ransomware, social engineering, phishing, spoofing, on-path attacks, replay attacks, brute-force attacks, password attacks and denial-of-service or distributed denial-of-service attacks.
  • Explain network-specific attacks such as ARP spoofing, MAC flooding, VLAN hopping, rogue DHCP, DNS poisoning, route manipulation and session hijacking.
  • Interpret reconnaissance and exploitation activity, including port scanning, banner grabbing, vulnerability scanning and enumeration, and distinguish these from normal administrative traffic.
  • Evaluate risks created by unpatched systems, default configurations, weak encryption, exposed services, misconfigurations and unsupported devices.

• Firewalls, IDS/IPS, proxies and protective security services

  ≈ 4%2 h

  This topic covers the operation and use of preventive and detective network-security technologies, including filtering, inspection, detection and protective service layers. On the exam, candidates must choose the correct security appliance or service, interpret how traffic is handled and place controls appropriately in the network.

  • Compare firewall technologies and rule-processing concepts, including packet filtering, stateful inspection, application-aware filtering, next-generation firewalls and unified threat management features.
  • Explain the purpose and deployment of IDS and IPS technologies, including network-based and host-based approaches, signature-based detection and anomaly- or behavior-based detection.
  • Differentiate proxy types and functions, including forward proxy, reverse proxy and content-filtering use cases, and evaluate when each should be deployed.
  • Explain protective network services such as URL filtering, DNS filtering, secure web gateways, email security gateways, sandboxing and web application firewalls.
  • Apply access-control logic to security policies by evaluating permit, deny, implicit deny, rule order, source and destination criteria, protocol and port matching, and logging.

• Authentication, authorization, certificates and access control protocols

  ≈ 3%2 h

  This topic covers identity and access controls used to authenticate users and devices, authorize access and support secure communications. The exam tests protocol recognition, certificate use, AAA design choices and selecting the best access-control method for wired, wireless and remote-access scenarios.

  • Explain authentication, authorization and accounting (AAA) concepts and compare centralized access-control systems such as RADIUS and TACACS+.
  • Differentiate authentication factors and methods, including single-factor authentication, multifactor authentication, single sign-on and certificate-based authentication.
  • Explain directory and identity services used in networked environments, including LDAP and related integration with centralized authentication workflows.
  • Interpret digital certificate concepts, including public key infrastructure, certificate authorities, certificate signing requests, certificate chains, revocation and common certificate uses on network devices and services.
  • Compare network access-control and authentication protocols such as 802.1X, EAP methods and captive portal access, and determine where each is appropriate.

• Device hardening and Layer 2 security controls

  ≈ 2.5%1 h 45 min

  This topic covers the secure configuration of network devices and the Layer 2 protections used to defend local switching environments. On the exam, candidates must identify insecure defaults, recommend hardening actions and match switch-security controls to attacks such as spoofing, flooding and unauthorized access.

  • Apply device-hardening practices such as changing default credentials, enforcing strong password policies, restricting administrative access, disabling unused services and interfaces and keeping device software current.
  • Explain secure management settings for network devices, including SSH, HTTPS, SNMP security options, management ACLs and dedicated management-plane protections.
  • Differentiate Layer 2 security threats and controls, including port security, MAC address limiting, sticky MAC, BPDU guard, root guard, DHCP snooping, dynamic ARP inspection and IP source guard.
  • Evaluate switchport and VLAN hardening measures such as disabling unused ports, moving unused ports to an unused VLAN, controlling trunking and preventing unauthorized VLAN participation.
  • Explain endpoint- and device-admission controls at the access layer, including 802.1X-based port access and posture-oriented access decisions where applicable.

• Wireless, remote access and VPN security

  ≈ 1.5%1 h 15 min

  This topic covers securing wireless networks, remote administrative access and encrypted tunnels across untrusted networks. The exam tests the ability to choose suitable wireless protections, recognize secure remote-access practices and identify the correct VPN technology or configuration for a scenario.

  • Compare wireless security methods, including WPA2, WPA3, personal and enterprise modes, and identify secure uses of 802.1X and RADIUS in WLAN authentication.
  • Recognize wireless risks such as evil twin, rogue access point, deauthentication activity and weak pre-shared keys, and recommend appropriate mitigations.
  • Explain secure remote-access practices for administrative and user access, including encrypted management protocols, jump hosts and least-privilege remote connectivity.
  • Differentiate VPN concepts and technologies, including site-to-site and client-to-site VPNs, IPsec and SSL/TLS VPN approaches, and determine when each is appropriate.
  • Interpret core VPN components and settings such as tunnel establishment, authentication, encryption and encapsulation in business remote-access scenarios.

About 11 h of study, lessons and core practice

• Troubleshooting methodology, escalation and performance-based workflow

  ≈ 3%1 h 15 min

  Covers the CompTIA Network+ troubleshooting methodology and how to apply it in multiple-choice and performance-based scenarios, including establishing a theory, testing, planning, implementing, verifying and documenting while using escalation appropriately. The exam tests whether candidates can follow a disciplined workflow, choose the next best action, and preserve service and evidence during live troubleshooting.

  • Apply the standard troubleshooting methodology to a network incident: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action, implement the solution or escalate as necessary, verify full system functionality, and document findings, actions and outcomes.
  • Differentiate probable causes from symptoms by interpreting user reports, baselines, logs, alerts, topology information and recent changes before selecting a troubleshooting path.
  • Evaluate when to use a top-down, bottom-up, divide-and-conquer, follow-the-path or substitution approach based on the scope and evidence available.
  • Determine when and how to escalate an issue according to operational procedures, severity, impact, access limitations, change-control requirements and organizational roles.
  • Perform a structured troubleshooting workflow in a performance-based task by selecting tools, sequencing actions safely, preserving business continuity and validating the final fix against the original problem statement.
  • Document root cause, remediation, preventive recommendations and lessons learned using accurate technical terminology and ticket or runbook procedures.

• Physical connectivity, interface and cable faults

  ≈ 4%2 h

  Focuses on diagnosing Layer 1 and interface-level faults involving links, cabling, optics, transceivers, ports and physical installation issues. The exam tests recognition of symptoms, correct tool choice and the ability to isolate failures such as bad cables, duplex mismatches, damaged media, signal loss and environmental causes.

  • Troubleshoot physical connectivity issues by inspecting link lights, interface state, transceiver status, cable seating, patching paths and hardware power state.
  • Diagnose copper, fiber and transceiver faults, including damaged or incorrect cable types, attenuation, polarity problems, dirty fiber ends, bad SFP or GBIC modules and unsupported or mismatched optics.
  • Interpret interface statistics and symptoms to identify Layer 1 and interface problems such as CRC errors, runts, giants, late collisions, input errors, output drops, speed mismatches and duplex mismatches.
  • Use appropriate troubleshooting tools to validate physical media and signal integrity, including cable testers, tone generators and probes, loopback plugs, optical power meters and time domain reflectometers where applicable.
  • Evaluate environmental and installation causes of physical faults, including electromagnetic interference, improper bend radius, distance limitations, poor labeling, faulty patch panels, inadequate power and damaged ports.

• Switching, VLAN and spanning tree troubleshooting

  ≈ 3.5%2 h

  Covers troubleshooting switched-network problems involving MAC learning, VLAN membership, trunking, native VLAN mismatches, inter-switch connectivity and spanning tree behavior. The exam tests whether candidates can identify symptoms such as loops, blocked paths, missing VLAN access and intermittent connectivity, then select the correct corrective action.

  • Troubleshoot switch forwarding issues by interpreting MAC address table behavior, interface status, port roles and symptoms such as unknown destination flooding, intermittent loss and one-way communication.
  • Diagnose VLAN configuration problems, including incorrect access VLAN assignment, missing VLANs, disabled VLANs, voice VLAN issues and failed inter-VLAN communication when the fault lies in switching configuration.
  • Identify and correct trunking problems involving encapsulation expectations where relevant, allowed VLAN lists, native VLAN mismatches, tagging errors and administrative shutdown on uplinks.
  • Interpret spanning tree states, roles and topology changes to isolate loops, unexpected blocking, root bridge misselection, slow convergence symptoms and broadcast storms.
  • Differentiate switching issues from routing or host issues by validating local segment behavior, ARP or neighbor discovery outcomes and same-VLAN versus different-VLAN reachability.

• Routing, addressing, NAT and WAN troubleshooting

  ≈ 4.5%2 h 15 min

  Covers Layer 3 troubleshooting for IP addressing, subnetting, default gateways, route selection, NAT operation and WAN connectivity. The exam tests whether candidates can isolate failures such as bad masks, duplicate IPs, missing routes, asymmetric paths, NAT translation issues and WAN circuit or protocol faults using route and interface evidence.

  • Troubleshoot IPv4 and IPv6 addressing issues, including incorrect address assignment, subnet mask or prefix length errors, duplicate addresses, invalid default gateways, APIPA addressing and misconfigured static settings.
  • Interpret routing tables, administrative distance, metrics and path selection behavior to identify missing routes, incorrect next hops, black holes, routing loops and asymmetric routing symptoms.
  • Diagnose default gateway and inter-network reachability issues by testing local subnet communication, first-hop connectivity, end-to-end path visibility and route advertisement or static route configuration.
  • Troubleshoot NAT and PAT problems by validating inside and outside roles, translation rules, address pool availability, overload behavior and application symptoms caused by failed or incomplete translations.

• Wireless connectivity, roaming and RF troubleshooting

  ≈ 3%1 h 45 min

  Focuses on diagnosing wireless client and WLAN problems related to association, authentication, signal quality, channel use, roaming and RF interference. The exam tests practical recognition of symptoms such as low throughput, weak coverage, sticky clients, co-channel interference and incompatible security settings, then choosing the best remediation.

  • Troubleshoot wireless client connectivity by evaluating SSID visibility, association state, authentication success, DHCP acquisition, IP configuration and captive portal or policy effects where applicable.
  • Diagnose RF and coverage issues using signal strength, signal-to-noise ratio, channel utilization and interference symptoms to distinguish weak signal, attenuation, non-Wi-Fi interference, co-channel interference and adjacent-channel interference.
  • Identify configuration mismatches that prevent WLAN access, including incorrect security mode, passphrase or key, authentication method, band mismatch, channel width, SSID settings and unsupported client capabilities.
  • Troubleshoot roaming behavior by evaluating AP placement, power levels, overlapping coverage, roaming thresholds, sticky-client symptoms and inconsistent security or mobility settings between access points.

• Network services, name resolution and application-connectivity troubleshooting

  ≈ 2.5%1 h 30 min

  Covers troubleshooting of shared network services and application reachability, especially DNS, DHCP, NTP and service-port availability. The exam tests whether candidates can distinguish between transport, name-resolution and application-layer failures, validate service operation and identify the point where connectivity breaks down.

  • Troubleshoot DNS issues by validating name resolution, record accuracy, query path, cache effects, suffix search behavior and the difference between successful IP reachability and failed hostname resolution.
  • Diagnose DHCP problems, including scope exhaustion, unreachable server or relay, incorrect options, lease failures and clients falling back to self-assigned addressing.
  • Identify application-connectivity problems by testing service availability on the correct port and protocol, distinguishing between host reachability, transport-layer failure and application-layer rejection or timeout.
  • Interpret symptoms of network service misconfiguration involving NTP and other supporting services when they affect authentication, logging, policy enforcement or application behavior.

• Security policy, authentication and filtering troubleshooting

  ≈ 2.5%1 h 30 min

  Covers troubleshooting when connectivity is impacted by security controls such as ACLs, firewalls, NAC, 802.1X, VPN policy and content filtering. The exam tests whether candidates can recognize when a security mechanism is the cause, interpret deny behavior or authentication failure symptoms, and restore authorized access without weakening policy unnecessarily.

  • Troubleshoot access control issues caused by ACLs, security groups, firewall rules, implicit denies, rule order, object definitions and zone or interface assignment.
  • Diagnose authentication and authorization failures affecting wired, wireless or remote access, including bad credentials, certificate issues, AAA server reachability, 802.1X supplicant problems and policy mismatch.
  • Identify symptoms of port security, MAC filtering, NAC posture checks, segmentation policy or microsegmentation controls that block otherwise valid traffic or endpoint access.
  • Troubleshoot VPN and secure remote-access failures when the root cause is policy, authentication, encryption parameter mismatch, expired credentials or blocked negotiation traffic.
  • Differentiate intended security enforcement from misconfiguration by interpreting logs, deny counters, session state and user impact, then select the least disruptive corrective action consistent with policy.

About 12 h 15 min of study, lessons and core practice