N10-009 Network Security Practice Question
An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?
⚠ Common exam trap
Candidates often confuse 'two-factor authentication' with simply using a certificate (Option A) or a preshared key (Option B), failing to recognize that posture assessment is a separate, critical requirement that RADIUS combined with a NAC or posture system uniquely fulfills.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPN with RADIUS authentication and posture assessment
RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL VPN with client certificate authentication
Why it's wrong here
Client certificates provide strong authentication but do not enforce patch-level compliance or two-factor authentication inherently.
When this WOULD be correct
A question that asks for a remote access VPN solution providing strong authentication without requiring endpoint compliance checks, such as 'Which VPN technology uses client certificates for authentication and operates at the transport layer?'
- ✗
IPsec VPN using preshared keys
Why it's wrong here
Preshared keys are a single-factor authentication method and do not support compliance checks. This does not meet policy requirements.
When this WOULD be correct
This option would be correct for a question asking for a simple, low-overhead VPN setup for site-to-site connections where strong authentication is not required and no client compliance checks are needed.
- ✗
NAC integrated with a reverse proxy
Why it's wrong here
NAC can enforce compliance, but a reverse proxy is specific to web applications, not general VPN remote access.
- ✓
VPN with RADIUS authentication and posture assessment
Why this is correct
RADIUS can enforce two-factor authentication (e.g., via OTP) and work with a NAC (posture) server to check client health (patch levels) before allowing full VPN access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓VPN with RADIUS authentication and posture assessmentCorrect answer▾
Why this is correct
RADIUS can enforce two-factor authentication (e.g., via OTP) and work with a NAC (posture) server to check client health (patch levels) before allowing full VPN access.
✗SSL VPN with client certificate authenticationWrong answer — click to see why▾
Why this is wrong here
SSL VPN with client certificate authentication provides two-factor authentication (certificate + something else) but does not include posture assessment to verify patch compliance before granting network access.
★ When this WOULD be the correct answer
A question that asks for a remote access VPN solution providing strong authentication without requiring endpoint compliance checks, such as 'Which VPN technology uses client certificates for authentication and operates at the transport layer?'
Why candidates choose this
Candidates may associate SSL VPNs with secure remote access and client certificates with two-factor authentication, overlooking the additional requirement for posture assessment.
✗IPsec VPN using preshared keysWrong answer — click to see why▾
Why this is wrong here
IPsec VPN using preshared keys provides only single-factor authentication (the preshared key) and does not include any mechanism for posture assessment to verify client patch compliance.
★ When this WOULD be the correct answer
This option would be correct for a question asking for a simple, low-overhead VPN setup for site-to-site connections where strong authentication is not required and no client compliance checks are needed.
Why candidates choose this
Candidates may think preshared keys are sufficient for authentication and overlook the two-factor and posture assessment requirements, or they may confuse IPsec with more advanced authentication methods.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.