N10-009 Network Security Practice Question
Which of the following security mechanisms requires a user to authenticate before gaining access to the wired network at a switch port?
⚠ Common exam trap
The N10-009 exam often tests the distinction between 802.1X (user authentication) and port security (MAC address filtering), leading candidates to confuse MAC-based restrictions with true authentication mechanisms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
802.1X
802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that requires a user or device to authenticate via an authentication server (e.g., RADIUS) before the switch port transitions from an unauthorized to an authorized state, allowing full network access. It uses Extensible Authentication Protocol (EAP) over LAN (EAPoL) to carry authentication messages between the supplicant (client), authenticator (switch), and authentication server. This ensures that only authenticated users can access the wired network at the switch port level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
802.1X
Why this is correct
802.1X is an IEEE standard for Port-based Network Access Control (PNAC) that operates at Layer 2 (Data Link Layer). It functions as a gatekeeper, blocking all network traffic from a device connected to a switch port until that device successfully authenticates with an authentication server, typically RADIUS. This mechanism ensures that only authorized users or devices can gain any network access, making it a robust solution for initial access control by preventing unauthorized devices from even sending basic network requests before authentication.
- ✗
Port security
Why it's wrong here
Port security is a Layer 2 switch feature designed to limit the number of valid MAC addresses allowed on a specific port or to restrict access to only specific, pre-configured MAC addresses. While it can prevent unauthorized devices from connecting by blocking unknown MACs, it does not involve a user authentication process. Instead, it relies on MAC address learning or static configuration, which can be bypassed through MAC address spoofing, and it doesn't verify user identity before network access.
When this WOULD be correct
A question asking 'Which feature prevents unauthorized devices from connecting by limiting the number of MAC addresses per port?' would make port security the correct answer.
- ✗
ACL
Why it's wrong here
Access Control Lists (ACLs) are rule sets applied to network devices, such as routers or firewalls, to filter traffic based on criteria like source/destination IP addresses, port numbers, or protocols. ACLs operate *after* a device has already gained network access and is attempting to send or receive traffic. They are a filtering mechanism for *what* traffic is allowed to pass, not an authentication mechanism to determine *who* or *what* is allowed to connect to the network in the first place.
When this WOULD be correct
A question asking 'Which security mechanism is used to permit or deny traffic based on source IP addresses on a router interface?' would have ACL as the correct answer.
- ✗
MAC authentication
Why it's wrong here
MAC authentication, often referred to as MAC-based authentication or MAC Address Bypass (MAB), involves authenticating a device solely based on its unique MAC address against a list of allowed MACs, typically stored on a RADIUS server. While it does provide a form of access control, it does not require a user to provide credentials. Since MAC addresses can be easily spoofed, this method is significantly less secure than protocols like 802.1X, which demand explicit user or device credential verification before granting network access.
When this WOULD be correct
A question that asks: 'Which security mechanism allows a device to connect to a switch port based solely on its MAC address without user credentials?' would make MAC authentication the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓802.1XCorrect answer▾
Why this is correct
802.1X is an IEEE standard for Port-based Network Access Control (PNAC) that operates at Layer 2 (Data Link Layer). It functions as a gatekeeper, blocking all network traffic from a device connected to a switch port until that device successfully authenticates with an authentication server, typically RADIUS. This mechanism ensures that only authorized users or devices can gain any network access, making it a robust solution for initial access control by preventing unauthorized devices from even sending basic network requests before authentication.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security restricts access based on MAC addresses but does not require user authentication; it controls which devices can connect, not who uses them.
★ When this WOULD be the correct answer
A question asking 'Which feature prevents unauthorized devices from connecting by limiting the number of MAC addresses per port?' would make port security the correct answer.
Why candidates choose this
Candidates confuse port security with authentication because both control network access, but port security lacks user-level authentication.
✗ACLWrong answer — click to see why▾
Why this is wrong here
ACLs (Access Control Lists) filter traffic based on IP addresses, protocols, or ports, but they do not require user authentication before granting network access at a switch port.
★ When this WOULD be the correct answer
A question asking 'Which security mechanism is used to permit or deny traffic based on source IP addresses on a router interface?' would have ACL as the correct answer.
Why candidates choose this
Candidates may confuse ACLs with authentication mechanisms because both are security features, but ACLs control access based on rules, not user identity.
✗MAC authenticationWrong answer — click to see why▾
Why this is wrong here
MAC authentication (typically MAC address bypass or MAC authentication bypass) allows devices to authenticate based on their MAC address, but it does not require user authentication; it is often used as a fallback when 802.1X is not supported. The question specifically requires user authentication, which 802.1X provides via EAP.
★ When this WOULD be the correct answer
A question that asks: 'Which security mechanism allows a device to connect to a switch port based solely on its MAC address without user credentials?' would make MAC authentication the correct answer.
Why candidates choose this
Candidates may confuse MAC authentication with 802.1X because both involve authentication at the switch port, but MAC authentication is simpler and does not require user credentials, making it seem like a valid answer when user authentication is specified.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.