N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  RADIUS

  Why it's wrong here

  RADIUS is a widely used AAA protocol, primarily for network access authentication. However, its security model only encrypts the password field within the authentication packet using a shared secret, leaving other critical information like the username, IP address, and service type in cleartext. This selective encryption means that while the password itself is protected, an attacker could still glean significant details about the user and their access request by sniffing the network traffic, compromising overall confidentiality.

  When this WOULD be correct

  When the question asks for a protocol that encrypts only the password and is widely used for network access (e.g., 802.1X) or when the requirement is for a protocol that uses UDP for transport and combines authentication and authorization.

• ✓

  TACACS+

  Why this is correct

  TACACS+ is a robust AAA protocol that significantly enhances security by encrypting the entire payload of the authentication packet. Unlike other protocols that might only encrypt specific fields, TACACS+ ensures that all authentication-related data, including usernames, command parameters, and other attributes, remains confidential during transit. This comprehensive encryption provides superior protection against eavesdropping and unauthorized access to sensitive network administration information, making it ideal for securing device management.

• ✗

  LDAP

  Why it's wrong here

  LDAP (Lightweight Directory Access Protocol) is fundamentally a protocol for accessing and maintaining distributed directory information services, not an authentication protocol with inherent encryption. While it is commonly used as a backend for authentication by querying user credentials stored in a directory, LDAP itself transmits data, including usernames and passwords, in cleartext by default. To secure LDAP communications and encrypt the entire packet, it must be encapsulated within a secure tunnel using protocols like TLS (Transport Layer Security) or SSL (Secure Sockets Layer), typically referred to as LDAPS.

  When this WOULD be correct

  A question asking which protocol is used for querying and modifying directory services (e.g., Active Directory) to authenticate users or retrieve user attributes, especially when integration with AAA is not the primary focus.

• ✗

  Kerberos

  Why it's wrong here

  Kerberos is a network authentication protocol that works on the basis of 'tickets' to allow nodes to prove their identity to one another securely over a non-secure network. While it uses strong symmetric key cryptography to protect these tickets and subsequent communication, it does not encrypt the entire initial authentication packet itself. Instead, it focuses on establishing a secure, mutually authenticated session, where the integrity and confidentiality of subsequent communications are ensured through encrypted service tickets, rather than encrypting the initial credential exchange in its entirety.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”