N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure an ACL on the Layer 3 switch to permit specific traffic between VLANs

  Why this is correct

  Configuring an Access Control List (ACL) on the Layer 3 switch is the most effective and secure method to permit specific traffic between the HR and Finance VLANs. Since the Layer 3 switch performs inter-VLAN routing, it can inspect packets as they traverse between these segmented networks. An ACL can be precisely crafted to allow only the necessary printer-related protocols (e.g., TCP port 9100, SMB) from the HR VLAN to the printer's IP address in the Finance VLAN, while implicitly denying all other traffic.

• ✗

  Place the printer in the HR VLAN

  Why it's wrong here

  Placing the printer directly within the HR VLAN would indeed grant HR users full, unrestricted access to it, but this contradicts the implicit requirement that the printer resides in the Finance VLAN. Furthermore, this action would not address the fundamental challenge of securely controlling inter-VLAN communication. The printer would no longer be accessible to the Finance department without additional routing and ACLs from *their* VLAN to the HR VLAN, merely shifting the problem without solving the core security objective.

  When this WOULD be correct

  If the requirement were simply to give HR access to the printer without any need to block inter-VLAN traffic, and the printer only needed to be accessed by HR, moving it to the HR VLAN would be the simplest solution.

• ✗

  Create a separate VLAN for the printer

  Why it's wrong here

  Creating a separate VLAN for the printer would indeed isolate it, but this approach introduces unnecessary network segmentation complexity without directly solving the granular access control problem. Inter-VLAN routing would still be necessary for both HR and Finance to reach the printer, and an Access Control List (ACL) would still be required on the Layer 3 device to define precisely which traffic is permitted. This option does not simplify the core challenge of controlled inter-VLAN access.

  When this WOULD be correct

  When a printer needs to be accessible from multiple VLANs without routing between them, and the organization wants to isolate the printer's broadcast domain for security or performance reasons, creating a dedicated VLAN for the printer and using a Layer 3 switch with ACLs or a firewall to allow specific access would be appropriate.

• ✗

  Use a wireless access point to bridge the VLANs

  Why it's wrong here

  Using a wireless access point to bridge VLANs is a highly insecure and inappropriate solution for controlling access between sensitive departments like HR and Finance. A wireless bridge typically operates at Layer 2, simply extending the broadcast domain or forwarding frames without the capability for granular packet inspection or filtering based on IP addresses or port numbers. This would effectively merge the security boundaries of the VLANs, failing to meet any requirement for controlled, specific access.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question