N10-009 Network Security Practice Question
An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?
⚠ Common exam trap
Candidates often confuse 'two-factor authentication' with simply using a certificate (Option A) or a preshared key (Option B), failing to recognize that posture assessment is a separate, critical requirement that RADIUS combined with a NAC or posture system uniquely fulfills.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPN with RADIUS authentication and posture assessment
RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL VPN with client certificate authentication
Why it's wrong here
Client certificate authentication supplies only one factor — something the user has — so it cannot satisfy the two-factor requirement, and it performs no patch-level posture check. It is tempting because certificate-based SSL VPNs are strong for device authentication, but the scenario demands a second factor plus compliance verification.
When this WOULD be correct
A question that asks for a remote access VPN solution providing strong authentication without requiring endpoint compliance checks, such as 'Which VPN technology uses client certificates for authentication and operates at the transport layer?'
- ✗
IPsec VPN using preshared keys
Why it's wrong here
IPsec preshared keys authenticate the tunnel itself, providing neither per-user two-factor authentication nor endpoint patch compliance checks. It is tempting because IPsec is a legitimate remote-access VPN, but it would fit a site-to-site tunnel where device identity, not user MFA and posture, is the requirement.
When this WOULD be correct
This option would be correct for a question asking for a simple, low-overhead VPN setup for site-to-site connections where strong authentication is not required and no client compliance checks are needed.
- ✗
NAC integrated with a reverse proxy
Why it's wrong here
NAC enforces endpoint posture, but pairing it with a reverse proxy provides no VPN tunnel and no two-factor authentication mechanism for remote users. It is tempting because NAC genuinely delivers patch-compliance checking, yet the reverse proxy cannot terminate remote-access VPN sessions or verify a second factor.
- ✓
VPN with RADIUS authentication and posture assessment
Why this is correct
RADIUS supplies the centralised authentication service that enforces two-factor credentials for VPN users, while posture assessment checks each client's patch level before granting access. This combination satisfies both the 2FA and patch-compliance constraints in the security policy.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓VPN with RADIUS authentication and posture assessmentCorrect answer▾
Why this is correct
RADIUS supplies the centralised authentication service that enforces two-factor credentials for VPN users, while posture assessment checks each client's patch level before granting access. This combination satisfies both the 2FA and patch-compliance constraints in the security policy.
✗SSL VPN with client certificate authenticationWrong answer — click to see why▾
Why this is wrong here
SSL VPN with client certificate authentication provides two-factor authentication (certificate + something else) but does not include posture assessment to verify patch compliance before granting network access.
★ When this WOULD be the correct answer
A question that asks for a remote access VPN solution providing strong authentication without requiring endpoint compliance checks, such as 'Which VPN technology uses client certificates for authentication and operates at the transport layer?'
Why candidates choose this
Candidates may associate SSL VPNs with secure remote access and client certificates with two-factor authentication, overlooking the additional requirement for posture assessment.
✗IPsec VPN using preshared keysWrong answer — click to see why▾
Why this is wrong here
IPsec VPN using preshared keys provides only single-factor authentication (the preshared key) and does not include any mechanism for posture assessment to verify client patch compliance.
★ When this WOULD be the correct answer
This option would be correct for a question asking for a simple, low-overhead VPN setup for site-to-site connections where strong authentication is not required and no client compliance checks are needed.
Why candidates choose this
Candidates may think preshared keys are sufficient for authentication and overlook the two-factor and posture assessment requirements, or they may confuse IPsec with more advanced authentication methods.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
VPNs and Remote Access
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
This N10-009 question is part of Courseiva's 472-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.