N10-009 Network Security Practice Question
A network administrator wants to ensure that only a specific laptop can connect to a particular switch port. The laptop's MAC address is known. Which security feature should be configured?
⚠ Common exam trap
The N10-009 exam often tests the distinction between port security (which controls MAC-level access on a single port) and 802.1X (which controls network access via authentication), leading candidates to mistakenly choose 802.1X because they associate it with 'security' and 'laptop access' without understanding the specific requirement of a static MAC binding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security is the correct feature because it allows the administrator to statically configure the allowed MAC address on a specific switch port. Once configured, the switch will only forward traffic from that MAC address, dropping frames from any other source MAC. This directly fulfills the requirement to restrict access to a single known laptop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
802.1X
Why it's wrong here
IEEE 802.1X is a port-based network access control protocol that requires users or devices to authenticate before gaining access to the network, typically using a RADIUS server. It provides robust authentication by verifying credentials (e.g., username/password, certificates) against a central authority. While 802.1X effectively restricts unauthorized access, its primary mechanism is authentication, not the static assignment of a specific MAC address to a particular switch port, which is a simpler, more direct method for the scenario described.
When this WOULD be correct
802.1X would be correct in a scenario where the network administrator needs to authenticate users or devices before granting network access, typically using credentials or certificates, and the goal is to control access at the network edge based on identity rather than a static MAC address. For example: 'A company wants to require all employees to authenticate with their domain credentials before accessing the wired network.'
- ✓
Port security
Why this is correct
Port security is a Layer 2 control mechanism implemented on network switches. It enables an administrator to statically configure or dynamically learn specific MAC addresses that are permitted to transmit traffic on a given switch port. By limiting the number of allowed MAC addresses, or by specifying a single static MAC address, port security ensures that only the intended device, such as a particular laptop, can connect and communicate through that port, effectively preventing unauthorized devices from gaining network access.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a security feature designed to prevent unauthorized DHCP servers from operating on the network and to mitigate various DHCP-related attacks. It inspects DHCP messages passing through the switch, building and maintaining a database of valid IP-to-MAC address bindings. While it enhances network security by ensuring IP address integrity, it does not directly control or restrict which specific end device, identified by its MAC address, is allowed to physically connect to a switch port.
- ✗
BPDU guard
Why it's wrong here
BPDU guard is a Spanning Tree Protocol (STP) feature that protects the integrity of the STP topology by immediately disabling a port if it receives a Bridge Protocol Data Unit (BPDU). This mechanism is primarily used on edge ports where end devices are connected, preventing accidental or malicious introduction of switching devices that could create network loops. However, BPDU guard's function is solely to maintain STP stability and does not provide a mechanism to restrict specific end devices, like a particular laptop, from connecting based on their identity.
When this WOULD be correct
A network administrator wants to prevent unauthorized switches from being connected to access ports, ensuring STP stability. BPDU guard would be configured to disable a port if it receives a BPDU.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security is a Layer 2 control mechanism implemented on network switches. It enables an administrator to statically configure or dynamically learn specific MAC addresses that are permitted to transmit traffic on a given switch port. By limiting the number of allowed MAC addresses, or by specifying a single static MAC address, port security ensures that only the intended device, such as a particular laptop, can connect and communicate through that port, effectively preventing unauthorized devices from gaining network access.
✗802.1XWrong answer — click to see why▾
Why this is wrong here
802.1X is a network access control method that authenticates users or devices via an authentication server (e.g., RADIUS), but it does not restrict a specific switch port to a single known MAC address without additional configuration. The question explicitly asks for a feature that ensures only a specific laptop (by MAC address) can connect to a particular port, which is the function of port security, not 802.1X.
★ When this WOULD be the correct answer
802.1X would be correct in a scenario where the network administrator needs to authenticate users or devices before granting network access, typically using credentials or certificates, and the goal is to control access at the network edge based on identity rather than a static MAC address. For example: 'A company wants to require all employees to authenticate with their domain credentials before accessing the wired network.'
Why candidates choose this
Candidates may confuse 802.1X with MAC-based authentication, as 802.1X can use MAC addresses as a form of identity (MAC authentication bypass), but it is not the simplest or most direct method for restricting a port to a single known MAC address. Port security is the straightforward answer for MAC address filtering on a switch port.
✗BPDU guardWrong answer — click to see why▾
Why this is wrong here
BPDU guard is used to protect against bridge loops by disabling ports that receive BPDUs, not to restrict access based on MAC address.
★ When this WOULD be the correct answer
A network administrator wants to prevent unauthorized switches from being connected to access ports, ensuring STP stability. BPDU guard would be configured to disable a port if it receives a BPDU.
Why candidates choose this
Candidates may confuse BPDU guard with port security because both involve protecting switch ports, but BPDU guard addresses loop prevention, not MAC-based access control.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.