N10-009 network security explained
Network security is worth 14% of CompTIA Network+ N10-009 — around 13 of the 90 questions and the smallest domain. It is deliberately foundational: depth belongs to Security+.
Cover it properly, but proportionately. Thirteen questions does not justify three weeks.
Common attacks
Recognise them by their network signature:
| Attack | What you would see |
|---|---|
| DoS / DDoS | Service unavailable under overwhelming traffic |
| ARP spoofing / poisoning | Traffic redirected; duplicate MAC associations |
| DNS poisoning | Correct name resolving to the wrong address |
| On-path (man in the middle) | Traffic intercepted between two parties |
| VLAN hopping | Traffic reaching a VLAN it should not |
| Rogue access point / evil twin | An unauthorised wireless network users connect to |
| Social engineering / phishing | The human is the vector |
The exam gives a symptom and asks for the attack, so learn the signature rather than the definition.
Hardening
- Change default credentials. The most common correct answer in the domain.
- Disable unused ports and services.
- Keep firmware current.
- Secure protocols over insecure ones: SSH not Telnet, HTTPS not HTTP, SFTP not FTP, SNMPv3 not earlier versions.
- Port security on switches, limiting which devices may connect.
That secure-alternative pairing links directly back to the concepts domain, where the ports and protocols live.
Segmentation and access control
- VLANs for logical separation — the same mechanism as in implementation, here framed as a security control.
- DMZ / screened subnet for services reachable from outside.
- Firewalls and access control lists, and the principle of least privilege applied to network access.
- NAC — checking a device’s posture before allowing it on.
- Guest networks isolated from internal resources.
Authentication and remote access
- AAA: authentication, authorisation and accounting.
- Multifactor authentication.
- VPNs: site-to-site versus remote access, and that the point is an encrypted tunnel over an untrusted network.
- Wireless authentication: pre-shared key versus enterprise with a RADIUS server.
Physical security
Easy marks: locks, badge access, cameras, secured wiring closets, and the reminder that physical access usually defeats logical controls.
Sample questions
Question 1. Users report being redirected to a fraudulent site when typing the company's correct web address. Name resolution is returning an incorrect IP address. Which attack does this describe?
- A. ARP spoofing
- B. DNS poisoning
- C. Distributed denial of service
- D. VLAN hopping
Show answer
Answer: B
A correct name resolving to a wrong address is DNS poisoning, where resolution records have been corrupted. ARP spoofing operates at layer 2 within a subnet on MAC associations, a denial of service removes availability rather than redirecting, and VLAN hopping concerns traffic crossing VLAN boundaries.
Question 2. A newly installed network switch is reachable over Telnet using the manufacturer's default credentials. Which hardening step is most urgent?
- A. Change the default credentials and disable Telnet in favour of SSH
- B. Increase the DHCP lease duration
- C. Create additional VLANs on the switch
- D. Upgrade the uplink to a faster port
Show answer
Answer: A
Default credentials on a reachable management interface are the most immediate exposure, and replacing them along with switching to SSH removes both the weak credential and the unencrypted protocol. A longer DHCP lease, additional VLANs and a faster uplink do nothing about administrative access.
Question 3. An organisation hosts a public web server that must be reachable from the internet while keeping the internal network protected. What should be implemented?
- A. Place the web server on the internal user VLAN
- B. Place the web server on the guest wireless network
- C. Place the web server in a screened subnet (DMZ)
- D. Require a VPN for all public visitors
Show answer
Answer: C
A screened subnet, or DMZ, places internet-facing services in a separate segment so a compromise there does not give direct access to the internal network. Putting the server on the internal VLAN removes that protection, a guest wireless network serves a different purpose, and a VPN provides private access rather than public hosting.
What to practise
Write the attack-to-signature table from memory. Then list every insecure protocol from the concepts domain with its secure replacement — that single list answers a surprising number of questions across both domains.
Then stop. This domain is 14%, and the time you save belongs in troubleshooting, which is worth nearly double.