Courseiva
Network SecurityhardMultiple ChoiceObjective-mapped

N10-009 Network Security Practice Question

A company wants to ensure that only users who have successfully authenticated Active Directory credentials can access the wired network. The network switches support IEEE 802.1X. Which additional component must be deployed to complete the solution?

⚠ Common exam trap

The N10-009 exam often tests the distinction between RADIUS (for network access) and TACACS+ (for device administration), leading candidates to mistakenly choose TACACS+ because it is associated with authentication, even though 802.1X specifically requires RADIUS.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

A RADIUS server

IEEE 802.1X port-based authentication requires a RADIUS server to act as the authentication server. The switch (authenticator) forwards the user's credentials to the RADIUS server, which validates them against Active Directory and returns an accept or reject decision. Without a RADIUS server, the switch has no way to verify the user's credentials against the central identity store.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • A RADIUS server

    Why this is correct

    A RADIUS server is the foundational component for 802.1X port-based authentication, acting as the central Authentication, Authorization, and Accounting (AAA) server. It receives authentication requests from network devices (authenticators) and validates user credentials against an identity store, such as Active Directory or an internal database. Upon successful authentication, the RADIUS server authorizes network access, ensuring only legitimate users gain entry to the network and enforcing specific access policies.

  • A DHCP server

    Why it's wrong here

    A DHCP server's sole function is to dynamically assign IP addresses and other network configuration parameters to client devices. It operates *after* a client has successfully authenticated and gained network access, providing the necessary addressing for communication. DHCP has no inherent authentication capabilities and cannot determine whether a user or device is authorized to connect to the network; it merely facilitates network communication post-access.

    When this WOULD be correct

    A DHCP server would be the correct answer if the question asked for a component that dynamically assigns IP addresses to devices after they have been authenticated and granted network access via 802.1X.

  • A certificate authority

    Why it's wrong here

    A Certificate Authority (CA) is responsible for issuing and managing digital certificates, which are used to establish trust and verify identities in Public Key Infrastructure (PKI). While certificates are crucial for secure authentication methods like EAP-TLS within an 802.1X framework, the CA itself does not perform the real-time authentication decision or enforce access policies. The RADIUS server still acts as the central authentication server, often leveraging certificates issued by a CA for stronger identity verification, but the CA is not the primary authentication engine.

    When this WOULD be correct

    A certificate authority would be correct if the question specified deploying 802.1X with EAP-TLS (certificate-based authentication) to ensure only devices with valid certificates can access the network.

  • A TACACS+ server

    Why it's wrong here

    A TACACS+ server is primarily designed for centralized administrative access control to network devices like routers, switches, and firewalls, not for authenticating end-user client devices. While it also provides AAA services, its robust command authorization capabilities and separate handling of authentication, authorization, and accounting make it better suited for securing management plane access. It is not typically employed for authenticating users connecting to the network via 802.1X.

    When this WOULD be correct

    A question asking which protocol is best for managing administrative access to network devices (e.g., switches, routers) where you need to control commands and log all actions, with the requirement of encrypting the entire packet payload.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

A RADIUS serverCorrect answer

Why this is correct

A RADIUS server is the foundational component for 802.1X port-based authentication, acting as the central Authentication, Authorization, and Accounting (AAA) server. It receives authentication requests from network devices (authenticators) and validates user credentials against an identity store, such as Active Directory or an internal database. Upon successful authentication, the RADIUS server authorizes network access, ensuring only legitimate users gain entry to the network and enforcing specific access policies.

A DHCP serverWrong answer — click to see why

Why this is wrong here

A DHCP server assigns IP addresses but does not authenticate users against Active Directory or enforce network access control, which is required for 802.1X authentication.

★ When this WOULD be the correct answer

A DHCP server would be the correct answer if the question asked for a component that dynamically assigns IP addresses to devices after they have been authenticated and granted network access via 802.1X.

Why candidates choose this

Candidates may confuse the need for IP address assignment with the authentication process, thinking that DHCP is involved in granting network access.

A certificate authorityWrong answer — click to see why

Why this is wrong here

802.1X authentication uses RADIUS to verify credentials against Active Directory; a certificate authority is not required unless EAP-TLS is used, but the question does not specify certificate-based authentication.

★ When this WOULD be the correct answer

A certificate authority would be correct if the question specified deploying 802.1X with EAP-TLS (certificate-based authentication) to ensure only devices with valid certificates can access the network.

Why candidates choose this

Candidates may associate certificates with authentication security and assume 802.1X always requires a PKI, overlooking that many deployments use password-based EAP methods with RADIUS.

A TACACS+ serverWrong answer — click to see why

Why this is wrong here

TACACS+ is used for device administration (e.g., switch/router login) and separates authentication, authorization, and accounting, but it is not the standard RADIUS protocol required for IEEE 802.1X port-based network access control.

★ When this WOULD be the correct answer

A question asking which protocol is best for managing administrative access to network devices (e.g., switches, routers) where you need to control commands and log all actions, with the requirement of encrypting the entire packet payload.

Why candidates choose this

Candidates confuse TACACS+ with RADIUS because both are AAA protocols, and they may think TACACS+ can also handle network access authentication, but 802.1X specifically requires RADIUS.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Quick reference

AAA Protocol Comparison

ProtocolPort(s)EncryptionTransportPrimary Use
RADIUS1812 / 1813Password onlyUDPNetwork access control
TACACS+49Full packetTCPDevice administration
Diameter3868Full sessionTCP / SCTPCarrier / mobile networks
802.1XEAP-basedLayer 2Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

Go deeper

Related to this question

About these practice questions

One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.