Network+ N10-009 Domain 4: Network Security — 7 practice questions with answers

Domain 4 is 14% of the CompTIA Network+ (N10-009) exam, which works out to roughly 13of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Network+ N10-009 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

4.1 Explain the importance of basic network security concepts
4.2 Summarize various types of attacks and their impact to the network
4.3 Given a scenario, apply network security features, defense techniques, and solutions

What to focus on

Network Security is the smallest domain, but its terms reappear in troubleshooting scenarios. Objective 4.1 covers the CIA triad, encryption in transit and at rest, PKI, identity and access management (MFA, SSO, RADIUS, TACACS+, LDAP, SAML), physical security, deception technologies such as honeypots, and the governance terms risk, vulnerability, exploit and threat.

Attacks (4.2) are best learned at the layer where they operate: ARP spoofing and MAC flooding on the LAN, VLAN hopping through double tagging or switch spoofing, rogue DHCP servers, evil twin and rogue access points on wireless, DNS poisoning and spoofing, on-path attacks, and DoS or DDoS against availability. Social-engineering attacks such as phishing, tailgating and shoulder surfing are included too.

Defences (4.3) map almost one-to-one onto those attacks. Dynamic ARP inspection stops ARP spoofing, DHCP snooping stops rogue DHCP, port security and 802.1X control who can plug in, disabling unused ports and changing the native VLAN reduces VLAN hopping, and ACLs, URL and content filtering, and screened subnets control traffic between zones. Pairing each attack with its specific countermeasure is the most efficient way to revise this domain.

Practice questions and explanations

1. Remote users authenticate to the VPN with a password and a code from an authenticator app. Which security concept is being applied?
1. A) Single sign-on
2. B) Multifactor authentication
3. C) Role-based access control
4. D) Least privilege
Answer: B — Multifactor authentication
A password (something you know) plus an app-generated code (something you have) are two different factor types, which is multifactor authentication. Single sign-on reuses one authentication across services, RBAC assigns permissions by role, and least privilege limits permissions to what a task needs. (Objective 4.1)
2. A company wants wireless clients to authenticate with their individual directory usernames and passwords rather than a shared passphrase. Which combination provides this?
1. A) WPA2-Personal with a long PSK
2. B) WPA3-Enterprise with 802.1X and a RADIUS server
3. C) WEP with MAC filtering
4. D) An open network with a captive portal
Answer: B — WPA3-Enterprise with 802.1X and a RADIUS server
Enterprise mode uses 802.1X to pass each user's credentials to a RADIUS server (often backed by Active Directory/LDAP), so every user authenticates individually. Personal mode uses one shared pre-shared key, WEP is broken, and a captive portal on an open network does not encrypt traffic. (Objective 4.1)
3. Which protocol does a Cisco-style network device typically use to send administrator logins to a central server that separately authorises each command?
1. A) TACACS+
2. B) SNMPv2c
3. C) Kerberos
4. D) SAML
Answer: A — TACACS+
TACACS+ separates authentication, authorisation and accounting and can authorise individual commands, which is why it is favoured for device administration. SNMP is for monitoring, Kerberos is a ticket-based authentication protocol used by Active Directory, and SAML is a web single sign-on standard. (Objective 4.1)
4. An attacker on the LAN sends forged ARP replies so that traffic destined for the default gateway is sent to the attacker's machine first. What is this attack called?
1. A) DNS poisoning
2. B) ARP spoofing (ARP poisoning)
3. C) VLAN hopping
4. D) Rogue DHCP
Answer: B — ARP spoofing (ARP poisoning)
ARP spoofing poisons hosts' ARP caches with a false MAC-to-IP mapping, enabling an on-path attack. DNS poisoning corrupts name resolution, VLAN hopping lets traffic cross VLAN boundaries via double tagging or switch spoofing, and a rogue DHCP server hands out malicious addressing. Dynamic ARP Inspection is the switch defence. (Objective 4.2)
5. Users report being connected to an access point with the company SSID that asks for their domain password on a web page, but the IT team never deployed it. What is this device?
1. A) A wireless repeater
2. B) An evil twin (rogue access point)
3. C) A wireless controller
4. D) A deauthentication jammer
Answer: B — An evil twin (rogue access point)
An evil twin is a rogue access point broadcasting a legitimate SSID to lure clients and harvest credentials or intercept traffic. A repeater extends a legitimate network, a controller manages corporate APs, and a deauthentication attack kicks clients off a network rather than impersonating it (though the two are often combined). (Objective 4.2)
6. A switch is configured so that each access port learns a maximum of two MAC addresses and shuts down if a third appears. Which feature is this?
1. A) Port security
2. B) DHCP snooping
3. C) 802.1Q tagging
4. D) Root guard
Answer: A — Port security
Port security limits the number (or specific values) of MAC addresses allowed on a port and takes a violation action such as err-disable, blocking MAC flooding and unauthorised hubs. DHCP snooping filters rogue DHCP offers, 802.1Q is VLAN tagging, and root guard protects the spanning-tree root. (Objective 4.3)
7. A company places its public web servers in a separate network segment between the internet-facing firewall and the internal network. What is this segment called?
1. A) A honeynet
2. B) A screened subnet (DMZ)
3. C) A management VLAN
4. D) An out-of-band network
Answer: B — A screened subnet (DMZ)
A screened subnet, traditionally called a DMZ, isolates public-facing services so that a compromised web server does not give direct access to internal systems. A honeynet is a decoy network, a management VLAN carries device administration traffic, and an out-of-band network provides management access independent of production links. (Objective 4.3)

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Network+ N10-009 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.

Network+ N10-009 Domain 4: Network Security — 7 practice questions with answers

Objectives in this domain

What to focus on

Practice questions and explanations

1. Remote users authenticate to the VPN with a password and a code from an authenticator app. Which security concept is being applied?

2. A company wants wireless clients to authenticate with their individual directory usernames and passwords rather than a shared passphrase. Which combination provides this?

3. Which protocol does a Cisco-style network device typically use to send administrator logins to a central server that separately authorises each command?

4. An attacker on the LAN sends forged ARP replies so that traffic destined for the default gateway is sent to the attacker's machine first. What is this attack called?

5. Users report being connected to an access point with the company SSID that asks for their domain password on a web page, but the IT team never deployed it. What is this device?

6. A switch is configured so that each access port learns a maximum of two MAC addresses and shuts down if a third appears. Which feature is this?

7. A company places its public web servers in a separate network segment between the internet-facing firewall and the internal network. What is this segment called?