Sample CompTIA Network+ N10-009 — 4.0 Network Security questions with explanations
Use these examples to check how the topics are tested. Read the explanation for every option you were unsure about, then start a scored practice set above.
Question 1
2.0 Network Implementation / 4.0 Network Security
Which segmentation method demilitarized zone for public-facing servers?
-
✓ DMZ
-
○ Microsegmentation
-
○ Subnetting
-
○ VLAN
Answer:
A. DMZ
DMZ: Demilitarized zone for public-facing servers.
Question 2
4.0 Network Security
Which wireless security is weakest?
-
✓ WEP
-
○ WPA3
-
○ WPA
-
○ WPA2
Answer:
A. WEP
WEP (Wired Equivalent Privacy) is correct.. It is a fundamental networking protocol/technology tested on the exam. Understanding its purpose and proper configuration is essential for troubleshooting.
Question 3
2.0 Network Implementation / 4.0 Network Security
Which segmentation method ip-based segmentation at layer 3?
-
○ Microsegmentation
-
○ DMZ
-
○ VLAN
-
✓ Subnetting
Answer:
D. Subnetting
Subnetting: IP-based segmentation at Layer 3.
Question 4
4.0 Network Security
Which security device operates at Layer 7 and protects web applications?
-
○ IDS
-
○ Firewall
-
○ UTM
-
✓ WAF
Answer:
D. WAF
WAF: Layer 7, Protects web applications.
Question 5
2.0 Network Implementation / 4.0 Network Security
Which segmentation method granular per-workload security?
-
○ VLAN
-
✓ Microsegmentation
-
○ DMZ
-
○ Subnetting
Answer:
B. Microsegmentation
Microsegmentation: Granular per-workload security.
Question 6
4.0 Network Security
Which policy is for acceptable use?
-
○ Remote access
-
○ Incident response
-
✓ AUP
-
○ Password
Answer:
C. AUP
AUP is correct. This concept is important for the certification exam and appears in scenario-based questions testing your understanding of when and how to apply it.
Question 7
2.0 Network Implementation / 4.0 Network Security
Which segmentation method logical segmentation at layer 2?
-
○ Subnetting
-
✓ VLAN
-
○ Microsegmentation
-
○ DMZ
Answer:
B. VLAN
VLAN: Logical segmentation at Layer 2.
Question 8
4.0 Network Security
Which security device is web app firewall?
-
✓ WAF
-
○ IPS
-
○ IDS
-
○ Firewall
Answer:
A. WAF
WAF is correct. This concept is important for the certification exam and appears in scenario-based questions testing your understanding of when and how to apply it.
Question 9
4.0 Network Security
Which wireless security mechanism centralized authentication for wireless?
-
✓ RADIUS
-
○ MAC filtering
-
○ SSID broadcast
-
○ Captive portal
Answer:
A. RADIUS
RADIUS: Centralized authentication for wireless.
Question 10
4.0 Network Security
Which security device controls access?
-
○ Firewall
-
✓ NAC
-
○ IDS
-
○ IPS
Answer:
B. NAC
NAC is correct. This concept is important for the certification exam and appears in scenario-based questions testing your understanding of when and how to apply it.
Question 11
4.0 Network Security
A security team has deployed an intrusion detection system that uses a baseline of normal network behavior. The system alerts when it detects significant deviations from this baseline, such as a server suddenly initiating connections to many external IP addresses on an unusual port. What type of detection method is primarily being used?
-
○ Signature-based detection
-
○ Heuristic-based detection
-
✓ Anomaly-based detection
-
○ Policy-based detection
Answer:
C. Anomaly-based detection
Anomaly-based detection establishes a baseline of normal network or system activity (e.g., typical traffic patterns, connection rates) and then monitors for significant deviations from that baseline. The scenario describes detecting a deviation (a server making many external connections on an unusual port), which is characteristic of anomaly-based detection. Option A, signature-based detection, relies on a database of known attack patterns (signatures) and matches traffic against them; it would not use a learned baseline of normal behavior. Option B, heuristic-based detection, uses rules or algorithms to identify suspicious behavior that may indicate new or unknown attacks, but it is more closely associated with analyzing code or behavior for malicious intent rather than statistical deviations from a baseline. Option D, policy-based detection, alerts when activity violates a pre-defined security policy, not a learned baseline.
Question 12
4.0 Network Security
Which security device blocks intrusions?
-
✓ IPS
-
○ WAF
-
○ IDS
-
○ Firewall
Answer:
A. IPS
IPS is correct. This concept is important for the certification exam and appears in scenario-based questions testing your understanding of when and how to apply it.
Question 13
4.0 Network Security
Which policy rules for vpn and remote connections?
-
✓ Remote Access Policy
-
○ Acceptable Use Policy
-
○ Password Policy
-
○ Incident Response Policy
Answer:
A. Remote Access Policy
Remote Access Policy: Rules for VPN and remote connections.
Question 14
4.0 Network Security
A network administrator is configuring a VPN for remote employees. The requirement is that users can access internal corporate resources securely while also being able to browse the internet directly without sending internet traffic through the corporate network. Which VPN configuration should the administrator choose?
-
○ Full tunnel
-
✓ Split tunnel
-
○ SSL VPN
-
○ IPsec transport mode
Answer:
B. Split tunnel
Split tunneling allows VPN traffic destined for the corporate network to be encrypted and sent through the VPN tunnel, while non-corporate internet traffic goes directly to the internet without being routed through the VPN. This meets the requirement of both internal resource access and direct internet browsing. Full tunnel would route all traffic (including internet) through the VPN, potentially causing bandwidth issues and latency. SSL VPN is a type of VPN that uses SSL/TLS for encryption, but it can operate in either split-tunnel or full-tunnel mode; the configuration choice is what matters. IPsec transport mode encrypts only the payload and is used for end-to-end communications, not for typical remote access VPNs; it does not inherently control split vs. full tunneling.
Question 15
4.0 Network Security
Which attack is fake access point?
-
○ Jamming
-
○ Rogue AP
-
○ War driving
-
✓ Evil twin
Answer:
D. Evil twin
Evil twin is correct.
Open the full CompTIA Network+ N10-009 — 4.0 Network Security question-and-answer guide
