N10-009 Network Security Practice Question
A company wants to ensure that only users who have successfully authenticated Active Directory credentials can access the wired network. The network switches support IEEE 802.1X. Which additional component must be deployed to complete the solution?
⚠ Common exam trap
The N10-009 exam often tests the distinction between RADIUS (for network access) and TACACS+ (for device administration), leading candidates to mistakenly choose TACACS+ because it is associated with authentication, even though 802.1X specifically requires RADIUS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A RADIUS server
IEEE 802.1X port-based authentication requires a RADIUS server to act as the authentication server. The switch (authenticator) forwards the user's credentials to the RADIUS server, which validates them against Active Directory and returns an accept or reject decision. Without a RADIUS server, the switch has no way to verify the user's credentials against the central identity store.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A RADIUS server
Why this is correct
A RADIUS server is the foundational component for 802.1X port-based authentication, acting as the central Authentication, Authorization, and Accounting (AAA) server. It receives authentication requests from network devices (authenticators) and validates user credentials against an identity store, such as Active Directory or an internal database. Upon successful authentication, the RADIUS server authorizes network access, ensuring only legitimate users gain entry to the network and enforcing specific access policies.
- ✗
A DHCP server
Why it's wrong here
A DHCP server's sole function is to dynamically assign IP addresses and other network configuration parameters to client devices. It operates *after* a client has successfully authenticated and gained network access, providing the necessary addressing for communication. DHCP has no inherent authentication capabilities and cannot determine whether a user or device is authorized to connect to the network; it merely facilitates network communication post-access.
When this WOULD be correct
A DHCP server would be the correct answer if the question asked for a component that dynamically assigns IP addresses to devices after they have been authenticated and granted network access via 802.1X.
- ✗
A certificate authority
Why it's wrong here
A Certificate Authority (CA) is responsible for issuing and managing digital certificates, which are used to establish trust and verify identities in Public Key Infrastructure (PKI). While certificates are crucial for secure authentication methods like EAP-TLS within an 802.1X framework, the CA itself does not perform the real-time authentication decision or enforce access policies. The RADIUS server still acts as the central authentication server, often leveraging certificates issued by a CA for stronger identity verification, but the CA is not the primary authentication engine.
When this WOULD be correct
A certificate authority would be correct if the question specified deploying 802.1X with EAP-TLS (certificate-based authentication) to ensure only devices with valid certificates can access the network.
- ✗
A TACACS+ server
Why it's wrong here
A TACACS+ server is primarily designed for centralized administrative access control to network devices like routers, switches, and firewalls, not for authenticating end-user client devices. While it also provides AAA services, its robust command authorization capabilities and separate handling of authentication, authorization, and accounting make it better suited for securing management plane access. It is not typically employed for authenticating users connecting to the network via 802.1X.
When this WOULD be correct
A question asking which protocol is best for managing administrative access to network devices (e.g., switches, routers) where you need to control commands and log all actions, with the requirement of encrypting the entire packet payload.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A RADIUS serverCorrect answer▾
Why this is correct
A RADIUS server is the foundational component for 802.1X port-based authentication, acting as the central Authentication, Authorization, and Accounting (AAA) server. It receives authentication requests from network devices (authenticators) and validates user credentials against an identity store, such as Active Directory or an internal database. Upon successful authentication, the RADIUS server authorizes network access, ensuring only legitimate users gain entry to the network and enforcing specific access policies.
✗A DHCP serverWrong answer — click to see why▾
Why this is wrong here
A DHCP server assigns IP addresses but does not authenticate users against Active Directory or enforce network access control, which is required for 802.1X authentication.
★ When this WOULD be the correct answer
A DHCP server would be the correct answer if the question asked for a component that dynamically assigns IP addresses to devices after they have been authenticated and granted network access via 802.1X.
Why candidates choose this
Candidates may confuse the need for IP address assignment with the authentication process, thinking that DHCP is involved in granting network access.
✗A certificate authorityWrong answer — click to see why▾
Why this is wrong here
802.1X authentication uses RADIUS to verify credentials against Active Directory; a certificate authority is not required unless EAP-TLS is used, but the question does not specify certificate-based authentication.
★ When this WOULD be the correct answer
A certificate authority would be correct if the question specified deploying 802.1X with EAP-TLS (certificate-based authentication) to ensure only devices with valid certificates can access the network.
Why candidates choose this
Candidates may associate certificates with authentication security and assume 802.1X always requires a PKI, overlooking that many deployments use password-based EAP methods with RADIUS.
✗A TACACS+ serverWrong answer — click to see why▾
Why this is wrong here
TACACS+ is used for device administration (e.g., switch/router login) and separates authentication, authorization, and accounting, but it is not the standard RADIUS protocol required for IEEE 802.1X port-based network access control.
★ When this WOULD be the correct answer
A question asking which protocol is best for managing administrative access to network devices (e.g., switches, routers) where you need to control commands and log all actions, with the requirement of encrypting the entire packet payload.
Why candidates choose this
Candidates confuse TACACS+ with RADIUS because both are AAA protocols, and they may think TACACS+ can also handle network access authentication, but 802.1X specifically requires RADIUS.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.