10.0.0.0/21 or 255.255.248.0
It's easy.
10.0.0.0 is a class A so the default mask is 255.0.0.0
So if you want to subnet you have to "borrow bits" from left to right without skipping.
You also have to start in the 2nd octet because the first one is already being used.
So...
12 bits = 4095 subnets
13 bits = 8191 subnets
12 isn't enough and 13 is way to damn many but there's nothing you can do about the wasted subnets. At least not on the CCNA level, but VLSM is a whole 'nother topic.
OK, so you have to borrow 13 bits starting at the first available bit after the subnet mask, which is the 2nd octet, and once you are done borrowing (start using zeros again) you use them till the end.
So it looks like this:
11111111 . 11111111 . 11111000 . 00000000
If you add ALL the ones, that's 21, which is where the /21 comes from.
Translate it back into decimal:
1st octet = 128+64+32+16+8+4+2+1 = 255
2nd octet = 128+64+32+16+8+4+2+1 = 255
3rd octet = 128+64+32+16+8+0+0+0 = 248
4th octet = 0+0+0+0+0+0+0+0 = 0
or... 255.255.248.0