N10-009 Network Security Practice Question
A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Which security feature should be configured?
⚠ Common exam trap
The N10-009 exam often tests the distinction between port security (MAC address limiting) and 802.1X (authentication), leading candidates to mistakenly choose 802.1X when the question explicitly asks about limiting the number of MAC addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port security
Port security is the correct feature because it directly restricts the number of unique MAC addresses that can be learned on a switch port, preventing unauthorized devices from connecting. When the configured limit is exceeded, the switch can take actions such as shutdown, restrict, or protect, effectively blocking the unauthorized device. This is a Layer 2 access control mechanism that operates on the switch port itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
802.1X
Why it's wrong here
IEEE 802.1X provides port-based network access control by requiring authentication before a device or user is granted access to the network. It acts as an authenticator between the client (supplicant) and an authentication server (e.g., RADIUS), ensuring only authenticated entities can communicate. While it prevents unauthorized users or devices from gaining network access, its primary function is authentication, not to limit the number of MAC addresses that can be learned or connected to a single physical port.
When this WOULD be correct
A network administrator wants to enforce authentication for all devices before granting network access, using credentials or certificates. In that scenario, 802.1X would be the correct answer.
- ✓
Port security
Why this is correct
Port security is a Layer 2 control plane feature that restricts the number of MAC addresses allowed to communicate through a specific switch port. Network administrators can configure a maximum limit of MAC addresses per port, or even statically assign specific MAC addresses. If an unauthorized device attempts to connect and exceeds this configured limit, the switch can be configured to take actions such as shutting down the port, restricting traffic, or sending an SNMP trap, effectively preventing unauthorized access.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a Layer 2 security feature that protects against rogue DHCP servers and ensures the integrity of the DHCP process. It classifies switch ports as either trusted (where legitimate DHCP servers reside) or untrusted, filtering out unauthorized DHCP server messages from untrusted ports. Additionally, it builds and maintains a DHCP snooping binding table of valid IP-MAC-port-VLAN associations, which can be used by other security features like DAI. Its purpose is not to restrict the number of MAC addresses on a port.
When this WOULD be correct
A network administrator wants to prevent rogue DHCP servers from assigning incorrect IP addresses to clients. Which security feature should be configured?
- ✗
Dynamic ARP inspection
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature designed to prevent ARP spoofing and ARP poisoning attacks by validating ARP packets. It inspects ARP requests and replies on untrusted ports, comparing them against a trusted DHCP snooping binding database or static ARP entries. DAI ensures that only valid IP-to-MAC address bindings are propagated, thereby protecting the integrity of the network's data plane and preventing man-in-the-middle attacks, rather than directly limiting device connections.
When this WOULD be correct
A network administrator wants to prevent ARP spoofing attacks by ensuring that only valid ARP requests and replies are forwarded. Which security feature should be configured?
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Port securityCorrect answer▾
Why this is correct
Port security is a Layer 2 control plane feature that restricts the number of MAC addresses allowed to communicate through a specific switch port. Network administrators can configure a maximum limit of MAC addresses per port, or even statically assign specific MAC addresses. If an unauthorized device attempts to connect and exceeds this configured limit, the switch can be configured to take actions such as shutting down the port, restricting traffic, or sending an SNMP trap, effectively preventing unauthorized access.
✗802.1XWrong answer — click to see why▾
Why this is wrong here
802.1X is an authentication protocol that controls network access based on user or device credentials, not by limiting the number of MAC addresses on a port. The question specifically asks for limiting MAC addresses, which is a function of port security.
★ When this WOULD be the correct answer
A network administrator wants to enforce authentication for all devices before granting network access, using credentials or certificates. In that scenario, 802.1X would be the correct answer.
Why candidates choose this
Candidates may confuse 802.1X with port security because both control access to switch ports, but they operate differently: 802.1X authenticates, while port security limits MAC addresses.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is used to filter untrusted DHCP messages and prevent rogue DHCP servers, not to limit the number of MAC addresses on a switch port.
★ When this WOULD be the correct answer
A network administrator wants to prevent rogue DHCP servers from assigning incorrect IP addresses to clients. Which security feature should be configured?
Why candidates choose this
Candidates may confuse DHCP snooping with port security because both involve MAC address filtering, but DHCP snooping focuses on DHCP message validation, not port-level MAC limits.
✗Dynamic ARP inspectionWrong answer — click to see why▾
Why this is wrong here
Dynamic ARP inspection validates ARP packets to prevent man-in-the-middle attacks, but it does not limit the number of MAC addresses on a switch port.
★ When this WOULD be the correct answer
A network administrator wants to prevent ARP spoofing attacks by ensuring that only valid ARP requests and replies are forwarded. Which security feature should be configured?
Why candidates choose this
Candidates may confuse MAC address filtering with ARP inspection, thinking both control MAC addresses, but DAI focuses on ARP packet validation, not port-level MAC limits.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.