- A
A DNS server
Why wrong: DNS resolves domain names to IP addresses but does not authenticate users or devices. It is not part of the 802.1X process.
- B
A DHCP server
Why wrong: DHCP assigns IP addresses to clients, but it does not perform authentication. 802.1X typically works before DHCP to ensure only authenticated devices get network access.
- C
A RADIUS server
RADIUS is the standard protocol for 802.1X authentication. The switch acts as a RADIUS client, sending authentication requests to the RADIUS server, which validates credentials against an identity store (e.g., Active Directory).
- D
A Kerberos server
Why wrong: Kerberos is used for authentication in Windows domains but operates at the application layer. 802.1X uses EAP (Extensible Authentication Protocol) over RADIUS, not directly Kerberos. While Active Directory uses Kerberos for domain authentication, the network-level 802.1X authentication is mediated by RADIUS.
Quick Answer
The answer is a RADIUS server. In an 802.1X deployment, the switch acts as the authenticator, relaying Extensible Authentication Protocol (EAP) frames from the client supplicant to the RADIUS server, which then validates credentials against the identity store, such as Active Directory. The RADIUS server is the central policy decision point that instructs the switch to open or block the port. On the CompTIA Network+ N10-009 exam, this question tests your understanding of the AAA framework—Authentication, Authorization, and Accounting—and the specific role of RADIUS in port-based access control. A common trap is confusing the authenticator (the switch) with the authentication server; remember, the switch enforces the decision but does not verify credentials itself. A helpful memory tip: RADIUS is the “gatekeeper” that checks the ID, while the switch is just the “bouncer” at the door.
N10-009 Network Security Practice Question
This N10-009 practice question tests your understanding of network security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: rADIUS is a client-server protocol for AAA services.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is implementing 802.1X port-based authentication on its wired network to control access. The network uses Active Directory for user accounts. Which type of server must be deployed to authenticate clients connecting to the switch ports?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
A RADIUS server
802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.
Key principle: RADIUS is a client-server protocol for AAA services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A DNS server
- ✗
A DHCP server
- ✓
A RADIUS server
- ✗
A Kerberos server
Why it's wrong here
Kerberos is used for authentication in Windows domains but operates at the application layer. 802.1X uses EAP (Extensible Authentication Protocol) over RADIUS, not directly Kerberos. While Active Directory uses Kerberos for domain authentication, the network-level 802.1X authentication is mediated by RADIUS.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that because Active Directory uses Kerberos, a Kerberos server can directly authenticate switch ports, but 802.1X mandates a RADIUS server as the intermediary that translates EAP frames into authentication requests the switch can process.
Detailed technical explanation
How to think about this question
In an 802.1X deployment, the switch acts as the authenticator and uses the RADIUS protocol (RFC 2865) to communicate with the RADIUS server. The RADIUS server can be configured to proxy authentication to Active Directory via LDAP or Kerberos, but the switch itself only understands RADIUS. A common real-world scenario is using Microsoft NPS (Network Policy Server) as the RADIUS server, which integrates with AD to enforce policies like VLAN assignment or ACLs based on user or machine credentials.
KKey Concepts to Remember
- RADIUS is a client-server protocol for AAA services.
- In 802.1X, the switch acts as a RADIUS client.
- RADIUS servers validate credentials against an identity store like Active Directory.
- EAP messages are encapsulated within RADIUS packets for 802.1X authentication.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
RADIUS is a client-server protocol for AAA services.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Review rADIUS is a client-server protocol for AAA services., then practise related N10-009 questions on the same topic to reinforce the concept.
- →
Network Security — study guide chapter
Learn the concepts, then practise the questions
- →
Network Security practice questions
Targeted practice on this topic area only
- →
All N10-009 questions
520 questions across all exam domains
- →
CompTIA Network+ N10-009 study guide
Full concept coverage aligned to exam objectives
- →
N10-009 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related N10-009 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Networking Concepts practice questions
Practise N10-009 questions linked to Networking Concepts.
Network Implementation practice questions
Practise N10-009 questions linked to Network Implementation.
Network Operations practice questions
Practise N10-009 questions linked to Network Operations.
Network Security practice questions
Practise N10-009 questions linked to Network Security.
Network Troubleshooting practice questions
Practise N10-009 questions linked to Network Troubleshooting.
Network+ network fundamentals practice questions
Practise N10-009 questions linked to Network+ network fundamentals.
Practice this exam
Start a free N10-009 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this N10-009 question test?
Network Security — This question tests Network Security — RADIUS is a client-server protocol for AAA services..
What is the correct answer to this question?
The correct answer is: A RADIUS server — 802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.
What should I do if I get this N10-009 question wrong?
Review rADIUS is a client-server protocol for AAA services., then practise related N10-009 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
RADIUS is a client-server protocol for AAA services.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?
medium- ✓ A.A) RADIUS server
- B.B) Syslog server
- C.C) TACACS+ server
- D.D) NTP server
Why A: 802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.
Keep practising
More N10-009 practice questions
- Which layer of the OSI model is responsible for logical addressing and routing of packets between networks?
- Users in VLAN 10 cannot obtain IP addresses from a DHCP server located in VLAN 20. The router has an ip helper-address c…
- Which of the following is a characteristic of a Layer 2 network switch?
- Which of the following network devices operates primarily at Layer 2 of the OSI model and uses MAC addresses to forward…
- Which of the following is a characteristic of UDP when compared to TCP?
- Which of the following IPv6 addresses is a valid link-local address?
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.