N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  RADIUS

  Why this is correct

  WPA3-Enterprise leverages the 802.1X standard for robust authentication, which mandates the use of an external authentication server. RADIUS (Remote Authentication Dial-In User Service) is the industry-standard protocol for this purpose, providing centralized Authentication, Authorization, and Accounting (AAA) services. It acts as an intermediary between the wireless access point (authenticator) and the user database, verifying user credentials and assigning network access policies.

• ✗

  LDAP

  Why it's wrong here

  LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information services, commonly used to store user accounts, groups, and other network resources. While an LDAP directory can serve as the backend database for user credentials, it does not perform the actual 802.1X authentication process itself. A RADIUS server is still necessary to handle the EAP (Extensible Authentication Protocol) negotiation and communicate with the LDAP directory to verify user identities for WPA3-Enterprise.

  When this WOULD be correct

  LDAP would be correct in a question asking: 'Which protocol is used to query and modify directory services (e.g., Active Directory) for user account information?' or 'Which protocol is commonly used for centralized authentication in a non-802.1X environment?'

• ✗

  TACACS+

  Why it's wrong here

  TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-proprietary AAA protocol primarily used for authenticating and authorizing administrators accessing network devices like routers and switches. Unlike RADIUS, which combines authentication and authorization into a single packet, TACACS+ separates these functions, offering more granular control over command authorization. However, it is not the standard or preferred protocol for authenticating end-user devices connecting to 802.1X-secured wireless networks such as WPA3-Enterprise.

  When this WOULD be correct

  TACACS+ would be correct in a question about authenticating network device administrators (e.g., router or switch login) where the protocol provides separate authentication, authorization, and accounting for management access.

• ✗

  Kerberos

  Why it's wrong here

  Kerberos is a network authentication protocol primarily designed for client-server applications within a Windows Active Directory domain, providing strong authentication through secret-key cryptography. While it secures access to many network services, Kerberos does not directly integrate as the authentication backend for 802.1X-based wireless networks like WPA3-Enterprise. Instead, a RADIUS server is required to handle the 802.1X authentication process, even if that RADIUS server might, in turn, query an Active Directory for user credentials.

  When this WOULD be correct

  Kerberos would be the correct answer if the question asked about the authentication protocol used by Active Directory for domain logon or for securing network services like NFS or SMB, not for wireless enterprise authentication.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question