N10-009 Network Security Practice Question
A company wants to prevent unauthorized users from plugging into network jacks and gaining access to the wired network. Which of the following security mechanisms should be implemented at the switch level?
⚠ Common exam trap
Test-takers frequently confuse port security (which only limits MAC addresses) with 802.1X (which provides actual authentication), leading them to pick port security because it sounds like it 'secures the port' at the switch level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X
802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that authenticates devices before granting full network access. When a device plugs into a switch port, the switch (as the authenticator) blocks all traffic except EAPoL (Extensible Authentication Protocol over LAN) frames until the device successfully authenticates via a RADIUS server. This prevents unauthorized users from gaining network access simply by connecting to a live jack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MAC address filtering
Why it's wrong here
MAC address filtering involves configuring network devices, such as switches or wireless access points, to permit or deny network access based on a list of approved or blocked Media Access Control (MAC) addresses. Although it attempts to restrict access, MAC addresses are easily discoverable and can be spoofed by an attacker. This vulnerability means an unauthorized user can simply change their device's MAC address to one that is permitted, thereby bypassing this security control and gaining network access without true authentication.
When this WOULD be correct
A company wants to allow only specific devices (e.g., known printers or servers) to connect to certain switch ports, and the network is small with static MAC assignments. The question would specify that MAC spoofing is not a concern and that dynamic authentication is not required.
- ✗
Port security
Why it's wrong here
Port security is a Layer 2 control that restricts network access based on MAC addresses learned or configured on a switch port. While it can limit the number of devices connected to a port and prevent unknown MAC addresses from communicating, it does not perform user or device authentication. An unauthorized user could still plug in and potentially spoof an authorized MAC address, or if the port is configured to allow a certain number of MACs, they might be able to connect if the limit hasn't been reached.
When this WOULD be correct
A question asks: 'Which switch feature prevents MAC flooding attacks by limiting the number of MAC addresses learned on a port?' or 'Which security mechanism blocks traffic from unknown MAC addresses on a port?'
- ✓
802.1X
Why this is correct
802.1X is a port-based network access control protocol. It prevents unauthorized access by requiring authentication (typically using EAP over LAN, EAPOL) from a connecting device or user before the switch port is fully activated and allowed to pass traffic. This authentication is validated against an external authentication server, like RADIUS, ensuring only authorized entities gain network access. If authentication fails, the port remains in an unauthorized state, effectively blocking network connectivity.
- ✗
Dynamic ARP Inspection
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature designed to prevent Address Resolution Protocol (ARP) spoofing and man-in-the-middle attacks by validating ARP packets against a trusted database, often derived from DHCP snooping. While crucial for maintaining the integrity of the ARP cache and preventing specific types of attacks, DAI operates *after* a device has already gained some level of network access. It does not provide a mechanism to authenticate or block an unauthorized user from initially plugging into a network jack and attempting to connect.
When this WOULD be correct
A company wants to prevent ARP spoofing attacks on its network where an attacker sends fake ARP messages to intercept traffic. Implementing Dynamic ARP Inspection on switches would validate ARP packets and drop invalid ones, mitigating the attack.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1XCorrect answer▾
Why this is correct
802.1X is a port-based network access control protocol. It prevents unauthorized access by requiring authentication (typically using EAP over LAN, EAPOL) from a connecting device or user before the switch port is fully activated and allowed to pass traffic. This authentication is validated against an external authentication server, like RADIUS, ensuring only authorized entities gain network access. If authentication fails, the port remains in an unauthorized state, effectively blocking network connectivity.
✗MAC address filteringWrong answer — click to see why▾
Why this is wrong here
MAC address filtering only restricts traffic based on MAC addresses, but it does not authenticate users or prevent unauthorized devices from connecting if the MAC address is spoofed or allowed. It also does not enforce per-user authentication at the switch port level.
★ When this WOULD be the correct answer
A company wants to allow only specific devices (e.g., known printers or servers) to connect to certain switch ports, and the network is small with static MAC assignments. The question would specify that MAC spoofing is not a concern and that dynamic authentication is not required.
Why candidates choose this
Candidates often confuse MAC address filtering with port security, thinking that filtering MACs is sufficient to prevent unauthorized access, but they overlook that 802.1X provides stronger, user-based authentication.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits the number of MAC addresses per port but does not authenticate users; it can be bypassed by spoofing allowed MAC addresses, so it does not prevent unauthorized users from plugging in.
★ When this WOULD be the correct answer
A question asks: 'Which switch feature prevents MAC flooding attacks by limiting the number of MAC addresses learned on a port?' or 'Which security mechanism blocks traffic from unknown MAC addresses on a port?'
Why candidates choose this
Candidates confuse port security with user authentication, thinking that restricting MAC addresses is sufficient to prevent unauthorized access, but it lacks per-user authentication and can be easily spoofed.
✗Dynamic ARP InspectionWrong answer — click to see why▾
Why this is wrong here
Dynamic ARP Inspection (DAI) is used to prevent ARP spoofing attacks by validating ARP packets against a trusted database, not to control physical access to network jacks. It does not authenticate users or devices attempting to connect to the switch.
★ When this WOULD be the correct answer
A company wants to prevent ARP spoofing attacks on its network where an attacker sends fake ARP messages to intercept traffic. Implementing Dynamic ARP Inspection on switches would validate ARP packets and drop invalid ones, mitigating the attack.
Why candidates choose this
Candidates may confuse DAI with a security mechanism that controls network access because it involves inspecting packets at the switch level, but it specifically addresses ARP-related threats, not physical port access.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.