N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Web application firewall (WAF)

  Why it's wrong here

  A Web Application Firewall (WAF) specifically protects web applications from common application-layer attacks such as SQL injection, cross-site scripting (XSS), and broken authentication. It operates by filtering, monitoring, and blocking malicious HTTP traffic directed *at* web servers, rather than securing *outbound* web browsing for internal users. While cloud-based WAFs exist, their focus is on protecting an organization's *own* web applications, not providing a general cloud-based web security solution for client-side browsing.

  When this WOULD be correct

  A question asking for a solution that protects a specific web application from application-layer attacks (e.g., SQL injection, XSS) by inspecting HTTP/HTTPS requests and responses, typically deployed in front of web servers.

• ✓

  Secure web gateway (SWG)

  Why this is correct

  A Secure Web Gateway (SWG) is precisely designed to filter and secure web traffic, often delivered as a cloud-based service. It acts as an intermediary proxy, inspecting all outbound and inbound web requests to block malware, enforce acceptable use policies, and prevent data loss. This cloud-native approach provides consistent security for users regardless of their location, making it ideal for distributed workforces and aligning perfectly with the need for a cloud-based security solution.

• ✗

  Intrusion detection system (IDS)

  Why it's wrong here

  An Intrusion Detection System (IDS) passively monitors network traffic for suspicious activities or known attack signatures, generating alerts when potential threats are identified. While it helps detect malicious patterns, an IDS does not actively block or filter web content in real-time as a proxy would, nor is its primary purpose to provide a cloud-based service for proactive web traffic security and policy enforcement. Its role is detection and alerting, not inline prevention of web-borne threats.

  When this WOULD be correct

  A question asking for a solution that monitors network traffic for signs of malicious activity and generates alerts without actively blocking traffic, such as 'An organization wants to detect potential intrusions on its internal network without affecting performance.'

• ✗

  VPN concentrator

  Why it's wrong here

  A VPN concentrator establishes and manages encrypted virtual private network tunnels, primarily for secure remote access to an organization's internal network. Its core function is authentication and encryption of network traffic between remote clients and the corporate network, not to actively inspect, filter, or secure general web browsing content for an entire organization via a cloud service. It facilitates secure *access*, rather than *filtering* web content.

  When this WOULD be correct

  An organization needs to provide secure remote access for employees connecting from external networks, requiring encrypted tunnels and authentication. The correct answer would be a VPN concentrator.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”