N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  TACACS+

  Why this is correct

  TACACS+ (Terminal Access Controller Access Control System Plus) is the correct protocol for this scenario because it provides robust Authentication, Authorization, and Accounting (AAA) services specifically designed for network device administration. It encrypts the entire communication session, not just the password, and offers granular command authorization, allowing administrators to define precisely which commands a user or group can execute on a network device. This level of control is essential for security and compliance in managing critical infrastructure.

• ✗

  RADIUS

  Why it's wrong here

  RADIUS (Remote Authentication Dial-In User Service) is a widely used AAA protocol, but its primary strength lies in network access control, such as authenticating users for Wi-Fi (802.1X), VPNs, or dial-up connections. While it provides authentication and some authorization, its authorization capabilities are typically limited to network access parameters (e.g., VLAN assignment, access duration) rather than granular command-level control for device administration. Additionally, RADIUS encrypts only the password in the access-request packet, not the entire session, and uses UDP, making it less robust for command-level authorization compared to TACACS+.

  When this WOULD be correct

  When the requirement is to authenticate users for network access (e.g., VPN or 802.1X) and optionally authorize network services, but does not require per-command authorization or full-session encryption.

• ✗

  LDAP

  Why it's wrong here

  LDAP (Lightweight Directory Access Protocol) is primarily used for querying and modifying directory services, such as Microsoft Active Directory or OpenLDAP, to retrieve user attributes or authenticate users against a directory. While it can be used for authentication by binding to a directory, it does not inherently provide the granular command-level authorization capabilities required to control which specific commands a network administrator can execute on a network device. It lacks the built-in AAA framework for device management.

• ✗

  Kerberos

  Why it's wrong here

  Kerberos is a network authentication protocol that provides strong authentication for client-server applications by using secret-key cryptography. It issues 'tickets' to users, allowing them to access various services without re-authenticating repeatedly (single sign-on). However, Kerberos primarily focuses on authentication and does not natively offer the fine-grained, per-command authorization capabilities necessary to control specific administrative actions on network devices. It authenticates access to a service, but not the specific commands within that service.

  When this WOULD be correct

  An organization needs to implement single sign-on for users accessing multiple services within a Windows domain, with mutual authentication and ticket-based access control.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question