N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  RADIUS with EAP-TLS

  Why it's wrong here

  RADIUS (Remote Authentication Dial-In User Service) is commonly used for network access control, authenticating users connecting to a network, often via 802.1X. While EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) provides strong, mutual authentication and encrypts the EAP conversation, RADIUS itself only encrypts the password within the authentication packet payload, leaving other attributes vulnerable. Crucially, RADIUS primarily focuses on network access authorization (granting or denying access) and does not offer the granular, per-command authorization or detailed accounting logs required for managing network device configurations.

  When this WOULD be correct

  A question that asks for a protocol that provides strong authentication encryption for wireless or remote access, where per-command authorization logging is not required, and the focus is on secure authentication using certificates.

• ✓

  TACACS+

  Why this is correct

  TACACS+ is the correct choice for network device administration because it encrypts the entire authentication, authorization, and accounting (AAA) packet, not just the password. This robust encryption protects sensitive administrative data during transit. Furthermore, TACACS+ uniquely provides granular, per-command authorization, allowing administrators to define precisely which commands a user can execute on a network device, and logs these actions for comprehensive auditing. Its separation of AAA functions makes it highly flexible and scalable for complex network environments.

• ✗

  LDAP over SSL

  Why it's wrong here

  LDAP (Lightweight Directory Access Protocol) over SSL is primarily a directory service protocol used for querying and modifying distributed directory information, such as user accounts and groups. While it can provide authentication by verifying user credentials against a directory, it lacks the inherent capabilities for robust network device authorization and accounting. Specifically, LDAP does not offer the granular per-command authorization required for managing network devices, nor does it provide the detailed accounting logs of user actions on those devices.

  When this WOULD be correct

  An organization needs to centralize user authentication and authorization for directory services (e.g., Active Directory) with encrypted transmission. The question would specify 'user authentication for accessing network resources' and 'directory service integration' without requiring command-level logging.

• ✗

  Kerberos

  Why it's wrong here

  Kerberos is a network authentication protocol that uses a ticket-granting system to provide strong authentication for client-server applications within a trusted domain, often used for single sign-on (SSO). While highly secure for authentication, Kerberos does not inherently provide the granular authorization controls necessary for managing network devices, such as restricting specific commands. It also lacks the comprehensive accounting capabilities to log all administrative actions performed on network infrastructure, making it unsuitable for a full AAA solution in this context.

  When this WOULD be correct

  An exam question that asks for a protocol providing mutual authentication and single sign-on in a Windows domain environment, without requiring per-command authorization logging.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”