Study Hub / CompTIA Network+ (N10-009) / Domain 4.0
CompTIA Network+ (N10-009) Domain 4.0: Network Security — Explained
Domain 4.0 applies security thinking to the network itself: the devices that filter traffic, the tunnels that protect it across untrusted networks, the controls on who gets on, and the wireless specifics that make Wi-Fi its own battleground.
4.1 — Firewalls and filtering
A firewall enforces policy on traffic: what may pass, in which direction, under what conditions.
- Stateless vs. stateful — stateless filters each packet alone against static rules; stateful tracks connections and knows that an inbound packet is the legitimate reply to an outbound request. Stateful is the modern default.
- NGFW (next-generation firewall) — adds application awareness, intrusion prevention, and threat intelligence to stateful filtering. It can block "Facebook chat" while allowing "facebook.com".
- ACLs — access control lists on routers/firewalls: ordered rules, first match wins, with an implicit deny at the end. Order matters — a permit buried below a matching deny never fires.
- DMZ — a demilitarized zone: a network segment for public-facing servers, isolated from both the internet and the internal LAN by firewall policy.
- NAT — network address translation lets many private IPs share one public IP. It conserves addresses and incidentally hides internal topology — but it is not a security control by itself.
4.2 — VPNs and remote access
A VPN creates a private, encrypted conversation across a public network.
- Site-to-site VPN — connects whole networks (branch office to HQ) over the internet. Always on; users never notice it.
- Client-to-site VPN — connects one device to the corporate network. The remote worker's laptop gets an internal IP and corporate policy applies.
- IPsec — the standard VPN protocol suite. Tunnel mode encrypts the entire original packet (site-to-site); transport mode encrypts only the payload (host-to-host).
- SSL/TLS VPN — runs over HTTPS in a browser or lightweight client. Easier through firewalls and for non-managed devices.
- Split tunnel vs. full tunnel — split sends only corporate traffic through the VPN (faster, less private); full tunnel sends everything through it (slower, fully inspected and protected).
4.3 — Access control and wireless security
Getting on the network is itself a security decision:
- 802.1X — port-based network access control. Before a device gets network access, it must authenticate — typically against a RADIUS server. No valid credentials, no network.
- RADIUS vs. TACACS+ — both centralize AAA. RADIUS (UDP, encrypts only the password) is the general standard; TACACS+ (TCP, encrypts the whole payload, separates each A) is Cisco's choice for device administration.
- Wireless: WPA2 vs. WPA3 — WPA2-Personal uses a shared passphrase (PSK) — everyone with the password is equal. WPA3 replaces the PSK handshake with SAE, defeating offline dictionary attacks, and WPA3-Enterprise keeps per-user credentials. WEP and WPA are broken and must never be deployed.
- Rogue access points — unauthorized APs (an employee's hotspot, an attacker's "Free_WiFi") that bypass every control. Wireless intrusion prevention watches for them.
- Physical security — locks, badges, cameras, and cable management. The fanciest firewall means nothing if someone can walk out with the server.
The must-memorize table: VPN types at a glance
Match the scenario to the VPN.
| Type | Connects | Typical use |
|---|---|---|
| Site-to-site (IPsec tunnel mode) | Network to network | Branch office to HQ, always on |
| Client-to-site (IPsec) | One device to network | Remote worker with managed laptop |
| Client-to-site (SSL/TLS) | Browser/device to network | Contractor, BYOD, through restrictive firewalls |
| Split tunnel | Device to network (partial) | Corporate traffic via VPN, YouTube direct |
| Full tunnel | Device to network (all traffic) | Maximum inspection and protection |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A firewall rule set has "permit web to server" as rule 10 and "deny all to server" as rule 5. Web traffic to the server is blocked. Why?
- A. A. The firewall is stateless and cannot track web sessions
- B. B. ACLs evaluate top-down; the deny at rule 5 matches before the permit at rule 10
- C. C. Web traffic requires an NGFW, not a standard firewall
- D. D. The implicit deny only applies to outbound traffic
Show answer & reasoning
B. ACLs are first-match-wins, evaluated top to bottom. Rule 5's deny matches the traffic before rule 10's permit is ever consulted — so the permit is dead text. The fix is reordering, not new hardware. (The implicit deny sits at the very bottom and isn't the culprit here.)
2. A company wants branch offices connected to HQ with no user action required, encrypting all inter-site traffic. Which solution fits?
- A. A. Client-to-site SSL VPN for each employee
- B. B. Site-to-site IPsec VPN in tunnel mode
- C. C. Split-tunnel VPN on every workstation
- D. D. A DMZ at each branch office
Show answer & reasoning
B. Site-to-site connects networks, always on, invisible to users — exactly the requirement. Tunnel mode encrypts the whole packet between sites. Client VPNs (A, C) are per-device and require user action; a DMZ (D) is a server segment, not a WAN link.
3. An office replaces its WPA2-Personal Wi-Fi with WPA3. What is the main security gain?
- A. A. Faster roaming between access points
- B. B. Longer passphrases are now required
- C. C. The SAE handshake resists offline dictionary attacks against the passphrase
- D. D. Guest users no longer need any credentials
Show answer & reasoning
C. WPA2-Personal's weakness is its 4-way handshake: capture it once, guess passwords offline forever. WPA3's SAE (Simultaneous Authentication of Equals) makes each guess require interacting with the AP, killing offline attacks. It's a protocol fix, not a password-length rule (B) or a roaming feature (A).
4. A switch port is configured for 802.1X. A device with no credentials is plugged in. What happens?
- A. A. It gets a guest VLAN with full internal access
- B. B. It receives an APIPA address and works normally
- C. C. It is denied network access until it authenticates successfully
- D. D. It can reach the internet but not internal servers
Show answer & reasoning
C. That's the entire point of 802.1X port-based access control: no authentication, no network. (A guest VLAN can be configured as a fallback, but the default and the exam's expected answer is denial.) The port stays unauthorized — the device is effectively unplugged.
This was one domain. The simulator drills all 5.
This free preview covered Network Security (Domain 4.0, 15%). Not covered here: Network Implementation (Domain 2.0, 20%); Network Troubleshooting (Domain 5.0, 24%). The hands-on domains — device configuration and scenario troubleshooting — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full Network+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy