Network Security — CompTIA Network+ practice questions

An architecture review concludes that a device on the internal LAN should get no implicit trust and must be evaluated on every request. Which principle is being applied?

1. Defence in depth, layering independent controls along the path
2. Zero trust, verifying identity and posture per request regardless of location
3. Separation of duties, splitting privileged tasks among staff
4. Implicit deny, blocking traffic that no rule explicitly permits

Answer: B — Zero trust, verifying identity and posture per request regardless of location

B) Correct — zero trust removes location-based trust and applies policy-based authentication and authorization to each access request. A) Defence in depth describes stacking controls generally and does not by itself remove trust based on network position. C) Separation of duties governs how human responsibilities are divided, not per-request device access. D) Implicit deny is a rule-processing default within a firewall or ACL, narrower than the architectural principle described.

Which is the difference between a stateful firewall and a stateless ACL?

1. Both maintain a connection table for the established sessions
2. Both inspect the application payload to identify the protocol
3. The stateless ACL tracks sessions; the stateful firewall does not
4. Stateful tracks session state and permits matching return traffic

Answer: D — Stateful tracks session state and permits matching return traffic

Stateful firewalls maintain a connection/session table; stateless ACLs evaluate each packet alone. Direction reversal (C) is the classic trap. App-awareness is NGFW, not basic stateful.

A company must authenticate corporate laptops to the wired network without users typing credentials, and must reject any unmanaged device. Which approach BEST meets this?

1. MAC address filtering maintained from an asset inventory list
2. A pre-shared key distributed through the mobile device management platform
3. 802.1X with certificate-based EAP validated against a RADIUS server
4. A web portal prompting for domain credentials on first connection

Answer: C — 802.1X with certificate-based EAP validated against a RADIUS server

C) Correct — certificate-based EAP under 802.1X authenticates the machine itself through a RADIUS server, so no user interaction occurs and devices without an issued certificate cannot join. A) MAC filtering is easily spoofed and becomes an unmanageable list at scale. B) A shared key authenticates knowledge of a secret rather than a specific device, and the secret leaks with any one machine. D) A portal requires the user to type credentials, which the requirement explicitly excludes.

Which feature limits the number of MAC addresses learned on a switch port to prevent CAM-table attacks?

1. BPDU Guard
2. Root Guard
3. Port Security
4. DHCP Snooping

Answer: C — Port Security

Port Security limits/permits specific MACs per port. BPDU Guard shuts ports receiving BPDUs (PortFast edges). Root Guard prevents inferior roots. DHCP Snooping blocks rogue DHCP. Adjacent-feature confusion is common.

An organization wants malicious traffic blocked in real time rather than merely recorded. Which deployment characteristic is required?

1. The sensor is fed by a mirrored port copying traffic for analysis
2. The sensor sits inline in the forwarding path so it can drop packets
3. The sensor collects flow records exported by the core routers
4. The sensor receives syslog messages forwarded from edge devices

Answer: B — The sensor sits inline in the forwarding path so it can drop packets

B) Correct — prevention requires the sensor to be inline, because only a device in the forwarding path can discard a packet before it reaches the target. A) A mirrored feed gives a copy after the fact, which supports detection and alerting but not blocking. C) Flow records summarize conversations for analysis and arrive far too late to stop anything. D) Syslog reports what devices already did and is a logging input, not an enforcement point.

Which authentication protocol is a Cisco-proprietary AAA that separates Authentication, Authorization, and Accounting and encrypts the entire payload?

1. TACACS+
2. RADIUS
3. Diameter
4. Kerberos

Answer: A — TACACS+

TACACS+ (Cisco) separates AAA and encrypts the full payload; RADIUS encrypts only the password and combines AuthN/AuthZ. Diameter is RADIUS' successor. Kerberos is ticket-based SSO.

Which is the BEST mitigation for password attacks against management interfaces?

1. Permit Telnet access only from the management VLAN subnet
2. Use one shared administrator password across all devices
3. Disable authentication logging to reduce collector volume
4. Use SSH key-based auth with MFA and login rate limiting

Answer: D — Use SSH key-based auth with MFA and login rate limiting

Strong auth (SSH keys + MFA), rate-limiting, and lockout protect management planes. Telnet, no logging, and shared passwords are anti-patterns.

Which control BEST mitigates ARP spoofing on a switched network?

1. Port Security limiting learned MAC addresses per access port
2. Dynamic ARP Inspection checked against DHCP snooping bindings
3. BPDU Guard shutting ports that receive spanning tree BPDUs
4. Storm Control capping broadcast and unknown unicast rates

Answer: B — Dynamic ARP Inspection checked against DHCP snooping bindings

DAI validates ARP packets against DHCP Snooping bindings, blocking spoofed gratuitous ARPs. Port Security limits MACs. BPDU Guard protects STP. Storm Control limits broadcast/multicast/unknown unicast.

Which protocol provides 802.1X authentication transport between supplicant and authenticator?

1. RADIUS
2. TACACS+
3. EAP
4. Kerberos

Answer: C — EAP

EAP is the authentication framework used by 802.1X supplicants. RADIUS carries EAP between authenticator and server. TACACS+ is admin AAA. Kerberos is host/user ticketing. Adjacent-protocol trap.

VPN technologies provide:

1. Encrypted tunnels carrying remote-access or site-to-site traffic
2. Faster internet by compressing traffic before it leaves the LAN
3. Free public Wi-Fi access at partner hotspots and coffee shops
4. IP address blocking that filters hosts by reputation lists only

Answer: A — Encrypted tunnels carrying remote-access or site-to-site traffic

A is right: a VPN supplies authentication, confidentiality, and integrity over an untrusted network, typically with IPsec for site-to-site and TLS-based clients for remote access. B is a common marketing myth, since encryption adds overhead. C confuses a VPN with hotspot access. D describes filtering, which a firewall performs.

What is a next-gen firewall (NGFW)?

Adds app-aware filtering, IPS, TLS inspection, user identity, and threat intel to a stateful firewall. Examples: Palo Alto, Fortinet, Check Point.

What is DHCP snooping?

Switch security feature dropping DHCP server replies from untrusted ports — prevents rogue DHCP servers and feeds Dynamic ARP Inspection.

What is 802.1X?

Port-based network access control. Supplicant ↔ authenticator (switch/AP) ↔ authentication server (RADIUS). Uses EAP. Required for enterprise wireless and wired NAC.