N10-009 Network Security Practice Question
A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?
⚠ Common exam trap
CompTIA often tests the distinction between authentication (802.1X) and access control methods (MAC filtering), where candidates mistakenly choose MAC filtering because they think it 'authenticates' devices, but it only identifies by MAC address without verifying identity or credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X
802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to authenticate a device at the switch port before granting full network access. Only after successful authentication does the switch open the port, ensuring that unauthorized computers cannot connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
802.1X
Why this is correct
802.1X is a port-based Network Access Control (NAC) protocol that provides authentication for devices attempting to connect to a network, whether wired or wireless. It acts as a gatekeeper, requiring devices to successfully authenticate with an authentication server (like RADIUS) using credentials or certificates *before* granting any network access. This ensures only authorized employee computers can connect by validating their identity at the network edge.
- ✗
WPA2
Why it's wrong here
Wi-Fi Protected Access 2 (WPA2) is a security protocol specifically designed to secure wireless local area networks (WLANs) by providing strong encryption (AES) and authentication. It protects Wi-Fi communications from eavesdropping and unauthorized access. However, WPA2 is exclusively for wireless networks and has no mechanism or applicability for authenticating devices connecting via a wired Ethernet port.
When this WOULD be correct
A question asking 'Which technology provides encryption and authentication for wireless networks?' would make WPA2 the correct answer, as it secures Wi-Fi communications.
- ✗
MAC filtering
Why it's wrong here
MAC filtering attempts to control network access by maintaining a list of permitted or denied Media Access Control (MAC) addresses. While it can prevent unknown devices from easily connecting, it is a weak security measure because MAC addresses are easily discoverable and can be spoofed by unauthorized users. It also lacks robust user or device authentication, making it unsuitable for ensuring only *authorized employee computers* connect securely.
When this WOULD be correct
A question asking for a simple, low-security method to restrict network access to known devices based on hardware addresses, without requiring authentication credentials or a RADIUS server.
- ✗
VPN
Why it's wrong here
A Virtual Private Network (VPN) establishes an encrypted tunnel over an untrusted network, primarily for secure remote access to private resources. Its function is to protect data in transit and provide secure connectivity for users *outside* the local network perimeter. A VPN does not provide port-based authentication for devices physically connecting to a local area network switch port.
When this WOULD be correct
A question asks: 'Which technology allows remote employees to securely access the corporate network over the internet?' In that context, VPN is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1XCorrect answer▾
Why this is correct
802.1X is a port-based Network Access Control (NAC) protocol that provides authentication for devices attempting to connect to a network, whether wired or wireless. It acts as a gatekeeper, requiring devices to successfully authenticate with an authentication server (like RADIUS) using credentials or certificates *before* granting any network access. This ensures only authorized employee computers can connect by validating their identity at the network edge.
✗WPA2Wrong answer — click to see why▾
Why this is wrong here
WPA2 is a wireless security protocol for Wi-Fi networks, not for port-based authentication on wired networks. The question specifically asks about wired network access control.
★ When this WOULD be the correct answer
A question asking 'Which technology provides encryption and authentication for wireless networks?' would make WPA2 the correct answer, as it secures Wi-Fi communications.
Why candidates choose this
Candidates may confuse WPA2 with 802.1X because both involve authentication, but WPA2 is wireless-specific and does not perform port-based access control on wired switches.
✗MAC filteringWrong answer — click to see why▾
Why this is wrong here
MAC filtering authenticates based on MAC address, not user or device credentials, and does not provide port-based authentication as defined by 802.1X. It can be bypassed by MAC spoofing.
★ When this WOULD be the correct answer
A question asking for a simple, low-security method to restrict network access to known devices based on hardware addresses, without requiring authentication credentials or a RADIUS server.
Why candidates choose this
Candidates confuse MAC filtering with port security because both involve controlling access at the switch port level, but MAC filtering lacks the authentication mechanism required by the question.
✗VPNWrong answer — click to see why▾
Why this is wrong here
VPN provides encrypted remote access over an untrusted network, not port-based authentication for wired LAN access. It does not control access at the switch port level.
★ When this WOULD be the correct answer
A question asks: 'Which technology allows remote employees to securely access the corporate network over the internet?' In that context, VPN is the correct answer.
Why candidates choose this
Candidates may confuse network access control with remote access security, thinking VPN authenticates users before granting network access.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
NAC
Network Access Control (NAC) is a security technology that enforces policies to control which devices and users can connect to a network.
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.