N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VPN

  Why it's wrong here

  A Virtual Private Network (VPN) establishes a secure, encrypted tunnel over an untrusted network, primarily to provide confidential and integrity-protected remote access to private network resources. Its core function is to secure the communication channel itself, ensuring data privacy and authenticity during transit. However, a VPN typically does not inherently assess the security compliance or health of the connecting client device *before* establishing the secure tunnel, assuming the device is already trusted or relying on separate authentication mechanisms.

  When this WOULD be correct

  A company needs to allow remote employees to securely access internal resources over the internet. VPN would be correct when the requirement is encrypted remote connectivity, not device compliance enforcement.

• ✓

  Network Access Control (NAC)

  Why this is correct

  Network Access Control (NAC) is specifically designed to ensure that only authorized and compliant devices can connect to a network. It performs pre-admission checks, assessing an endpoint's security posture—such as antivirus status, patch levels, and presence of specific software—before granting access. Non-compliant devices can be quarantined, remediated, or denied access entirely, making it ideal for enforcing security policies at the point of connection.

• ✗

  Access control list (ACL)

  Why it's wrong here

  An Access Control List (ACL) is a set of rules configured on network devices like routers and firewalls to filter traffic based on specific packet header information, such as source/destination IP addresses, ports, and protocols. While ACLs can restrict network access, they are stateless and cannot dynamically evaluate a device's security posture, operating system health, or user identity beyond basic network parameters. They lack the intelligence to enforce pre-admission compliance policies based on endpoint characteristics.

  When this WOULD be correct

  An ACL would be correct if the requirement were to restrict traffic between specific network segments (e.g., block all traffic from the guest VLAN to the internal server subnet) based on IP addresses or protocols.

• ✗

  Intrusion prevention system (IPS)

  Why it's wrong here

  An Intrusion Prevention System (IPS) operates by continuously monitoring network traffic for known malicious signatures or anomalous behavior patterns. Its primary function is to detect and actively block threats *after* they have entered the network perimeter or are attempting to exploit vulnerabilities. However, an IPS does not perform endpoint health checks or compliance assessments *before* a device is granted initial network access, focusing instead on traffic content rather than device posture.

  When this WOULD be correct

  A company needs to monitor network traffic in real-time and automatically block malicious activities, such as exploit attempts or malware propagation, without requiring endpoint compliance checks.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question