Question 67 of 464
N10-009 Network Security Practice Question
An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?
⚠ Common exam trap
The N10-009 exam often tests the misconception that MAC filtering or VLAN segmentation alone can prevent unauthorized device access, when in fact 802.1X is the only option that provides per-port authentication and dynamic VLAN assignment based on credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X authentication
802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC filtering on the switch
Why it's wrong here
MAC filtering on a switch attempts to control access by allowing or denying network connectivity based on a device's unique Media Access Control (MAC) address. However, MAC addresses are easily spoofed, meaning an unauthorized user can configure their laptop to impersonate an authorized device's MAC address. This fundamental vulnerability makes MAC filtering an unreliable and weak security measure against determined unauthorized access.
When this WOULD be correct
MAC filtering would be correct in a scenario where the goal is to prevent unauthorized devices from connecting to a network by allowing only pre-approved MAC addresses, such as in a small office with a static device inventory and no need for user authentication.
- ✓
802.1X authentication
Why this is correct
802.1X authentication provides robust port-based network access control, requiring devices to successfully authenticate with an authentication server (typically RADIUS) before the switch port is activated and granted network access. This mechanism effectively prevents unauthorized personal laptops or other devices from gaining any network connectivity, even at the link layer, until proper credentials or certificates are presented and validated.
- ✗
VLAN segmentation
Why it's wrong here
VLAN segmentation logically separates network traffic into distinct broadcast domains, improving organization, security, and performance by limiting the scope of traffic and potential breaches. While VLANs can contain the impact of an unauthorized device once it's connected by isolating it to a specific segment, they do not inherently prevent the initial physical connection of an unauthorized laptop to a network jack. The device would still connect to a port, albeit potentially in a restricted VLAN.
When this WOULD be correct
A question asks which control limits broadcast traffic or isolates sensitive systems from general user traffic to reduce attack surface, e.g., 'Which security control separates guest Wi-Fi from corporate devices?'
- ✗
Access control lists on the router
Why it's wrong here
Access Control Lists (ACLs) on a router operate at Layer 3 and Layer 4, filtering network traffic based on source/destination IP addresses, ports, and protocols. While ACLs can restrict what an unauthorized device *does* once connected, they do not prevent the device from physically connecting to a switch port and establishing a link-layer connection to the network. Therefore, they cannot block the initial unauthorized access attempt itself.
When this WOULD be correct
An ACL on the router would be correct in a scenario where the question asks how to restrict traffic between different network segments (e.g., preventing a compromised device in the guest VLAN from accessing the corporate server subnet).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1X authenticationCorrect answer▾
Why this is correct
802.1X authentication provides robust port-based network access control, requiring devices to successfully authenticate with an authentication server (typically RADIUS) before the switch port is activated and granted network access. This mechanism effectively prevents unauthorized personal laptops or other devices from gaining any network connectivity, even at the link layer, until proper credentials or certificates are presented and validated.
✗MAC filtering on the switchWrong answer — click to see why▾
Why this is wrong here
MAC filtering only controls which devices can connect based on their MAC address, but it does not authenticate users or prevent an infected laptop from spreading malware once connected. It also does not enforce endpoint compliance.
★ When this WOULD be the correct answer
MAC filtering would be correct in a scenario where the goal is to prevent unauthorized devices from connecting to a network by allowing only pre-approved MAC addresses, such as in a small office with a static device inventory and no need for user authentication.
Why candidates choose this
Candidates may think MAC filtering provides strong access control because it restricts devices by hardware address, but they overlook that it can be bypassed via MAC spoofing and does not address malware propagation from an already connected device.
✗VLAN segmentationWrong answer — click to see why▾
Why this is wrong here
VLAN segmentation separates network traffic into logical groups but does not authenticate devices; it would not prevent an unauthenticated personal laptop from connecting to the network and spreading malware.
★ When this WOULD be the correct answer
A question asks which control limits broadcast traffic or isolates sensitive systems from general user traffic to reduce attack surface, e.g., 'Which security control separates guest Wi-Fi from corporate devices?'
Why candidates choose this
Candidates know VLANs improve security by isolating traffic, so they mistakenly believe VLANs can block unauthorized devices, confusing network segmentation with access control.
✗Access control lists on the routerWrong answer — click to see why▾
Why this is wrong here
Access control lists on the router control traffic between subnets but do not prevent an unauthorized device from connecting to the network jack in the first place. They cannot block the initial infection or lateral spread within the same VLAN.
★ When this WOULD be the correct answer
An ACL on the router would be correct in a scenario where the question asks how to restrict traffic between different network segments (e.g., preventing a compromised device in the guest VLAN from accessing the corporate server subnet).
Why candidates choose this
Candidates may think ACLs can block malicious traffic at the network perimeter, but they overlook that the malware spreads locally before reaching the router, and ACLs do not enforce device authentication at the access layer.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.