N10-009 Network Security Practice Question
A company wants to prevent unauthorized devices from connecting to the wired network by authenticating users or devices before granting network access. Which of the following technologies should be implemented on the switch ports to achieve this?
⚠ Common exam trap
CompTIA often tests the misconception that port security with sticky MAC addresses provides authentication, but it only restricts MAC addresses and does not verify user identity or credentials, making it a layer-2 control, not an authentication mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A: 802.1X
802.1X is an IEEE standard (802.1X-2020) for port-based Network Access Control (NAC). It authenticates users or devices via EAP (Extensible Authentication Protocol) before the switch port transitions from the unauthorized (blocking) state to the authorized (forwarding) state, effectively preventing unauthorized devices from accessing the wired network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A: 802.1X
Why this is correct
802.1X is a port-based network access control protocol that authenticates devices before granting them access to the network. It leverages an authenticator (e.g., a switch port), a supplicant (the client device), and an authentication server (e.g., RADIUS) to verify user or device credentials. Until successful authentication, the port remains in an unauthorized state, preventing any unauthorized device from sending or receiving traffic beyond the authentication exchange. This effectively blocks unauthorized devices from connecting.
- ✗
B: Port security with MAC address sticky
Why it's wrong here
Port security, especially with MAC address sticky, restricts network access by limiting the number of MAC addresses allowed on a specific switch port. It can "stick" to the first learned MAC address, effectively binding a port to a particular device. However, this mechanism does not perform user or device authentication; it merely enforces a MAC address limit or association. An unauthorized device with a spoofed MAC address or one that is simply the first to connect could still gain access without credential verification, making it less robust for preventing unauthorized devices based on identity.
When this WOULD be correct
This option would be correct for a question asking: 'Which feature prevents unauthorized devices by limiting the number of MAC addresses on a switch port and dynamically learning allowed MACs?'
- ✗
C: Access control lists (ACLs)
Why it's wrong here
Access Control Lists (ACLs) are primarily used for filtering network traffic based on criteria such as source/destination IP addresses, port numbers, or protocols. While ACLs can restrict what an already connected device can do or access, they operate at Layer 3/4 and do not provide a mechanism to authenticate a device before it gains initial network access. Therefore, ACLs cannot prevent an unauthorized device from physically connecting and obtaining an IP address, only limit its subsequent communication.
When this WOULD be correct
A company needs to restrict traffic between VLANs on a switch, allowing only specific IP ranges to access a sensitive server. Implementing ACLs on the switch ports or VLAN interfaces would be the correct answer.
- ✗
D: DHCP snooping
Why it's wrong here
DHCP snooping is a security feature designed to prevent rogue DHCP servers from distributing IP addresses and to mitigate DHCP starvation attacks. It works by classifying switch ports as trusted (for legitimate DHCP servers) or untrusted (for client devices), and it inspects DHCP messages to ensure validity. While crucial for network integrity by preventing malicious DHCP activity, DHCP snooping does not authenticate individual client devices attempting to connect to the network; it only validates the legitimacy of DHCP communications, not the device's authorization to be on the network.
When this WOULD be correct
A question asking: 'Which technology helps prevent rogue DHCP server attacks on a switched network?' would make DHCP snooping the correct answer, as it validates DHCP messages on untrusted ports.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A: 802.1XCorrect answer▾
Why this is correct
802.1X is a port-based network access control protocol that authenticates devices before granting them access to the network. It leverages an authenticator (e.g., a switch port), a supplicant (the client device), and an authentication server (e.g., RADIUS) to verify user or device credentials. Until successful authentication, the port remains in an unauthorized state, preventing any unauthorized device from sending or receiving traffic beyond the authentication exchange. This effectively blocks unauthorized devices from connecting.
✗B: Port security with MAC address stickyWrong answer — click to see why▾
Why this is wrong here
Port security with MAC address sticky only allows specific MAC addresses to connect, but it does not authenticate users or devices before granting network access; it simply filters based on MAC addresses, which can be spoofed.
★ When this WOULD be the correct answer
This option would be correct for a question asking: 'Which feature prevents unauthorized devices by limiting the number of MAC addresses on a switch port and dynamically learning allowed MACs?'
Why candidates choose this
Candidates may confuse MAC address filtering with authentication, thinking that restricting MAC addresses provides similar security to 802.1X, but it lacks the authentication and authorization framework.
✗C: Access control lists (ACLs)Wrong answer — click to see why▾
Why this is wrong here
ACLs filter traffic based on IP addresses or protocols but do not authenticate users or devices before granting network access; they control traffic after access is already granted.
★ When this WOULD be the correct answer
A company needs to restrict traffic between VLANs on a switch, allowing only specific IP ranges to access a sensitive server. Implementing ACLs on the switch ports or VLAN interfaces would be the correct answer.
Why candidates choose this
Candidates may confuse ACLs with network access control because both involve 'access control' in their names, but ACLs lack authentication and are applied post-connection.
✗D: DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature that filters untrusted DHCP messages to prevent rogue DHCP servers, but it does not authenticate users or devices before granting network access. The question specifically requires authentication before access, which DHCP snooping does not provide.
★ When this WOULD be the correct answer
A question asking: 'Which technology helps prevent rogue DHCP server attacks on a switched network?' would make DHCP snooping the correct answer, as it validates DHCP messages on untrusted ports.
Why candidates choose this
Candidates may confuse DHCP snooping with network access control because both involve switch port security, but DHCP snooping focuses on DHCP integrity, not user/device authentication.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
NAC
Network Access Control (NAC) is a security technology that enforces policies to control which devices and users can connect to a network.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.