CompTIA Network+ · Domain 4 · 14% of the examNetwork Security

Answer: C. TACACS+

TACACS+ separates authentication, authorization and accounting, supports per-command authorization, and encrypts the whole packet body, which makes it the usual choice for device administration. RADIUS encrypts only the password and combines authentication with authorization, so it suits network access better than per-command control.

Answer: A. Honeypot

A honeypot is a decoy with no legitimate users, so any connection to it is suspicious and worth investigating. A screened subnet is a network zone for public-facing services, not a decoy.

Answer: D. Place the devices in a separate VLAN or segment, with ACLs allowing only the traffic they need

Segmenting IoT devices and restricting their traffic with ACLs limits what an attacker can reach if one is compromised. Changing passwords helps with credential attacks but does nothing about the unpatched vulnerabilities in the devices.

Answer: B. ARP poisoning

ARP poisoning sends forged ARP replies so victims map other IPs (such as the gateway) to the attacker's MAC, putting the attacker on-path. MAC flooding targets the switch's MAC address table, not the ARP caches on hosts.

Answer: C. Evil twin

An evil twin imitates a legitimate SSID to lure users into connecting and handing over credentials or traffic. A rogue access point is an unauthorized AP plugged into the company's own network, which this device is not.

Answer: A. VLAN hopping by double tagging; set the native VLAN to an unused VLAN that no user ports belong to

Double tagging works only when the attacker's access VLAN matches the trunk's native VLAN, so moving the native VLAN to an unused VLAN (or tagging it) stops it. Port security limits MAC addresses on a port and does nothing about extra 802.1Q tags.

Answer: D. A rogue DHCP server

The home router's DHCP server is answering clients faster than the real server and handing out its own range and gateway. If the real scope were exhausted, clients would get 169.254.x.x APIPA addresses instead of a different private range.

Answer: B. Change the default admin credentials, shut down unused ports, and disable unneeded services such as Telnet

Device hardening means removing defaults attackers know (credentials, community strings), shutting unused ports, and turning off insecure or unneeded services. Leaving ports enabled in the default VLAN gives anyone who plugs in instant network access.

Answer: A. Port security limiting the number of MAC addresses each port can learn

Port security caps how many MAC addresses a port can learn and can shut the port down on a violation, which defeats MAC flooding. A longer aging time actually keeps the fake entries in the table longer, making the problem worse.

Answer: C. 802.1X port-based network access control

802.1X keeps a switch port in an unauthorized state until the supplicant authenticates through the switch to a RADIUS server. MAC filtering checks only the hardware address, which is easy to spoof, and it never authenticates the user.

Answer: D. In a screened subnet

A screened subnet (DMZ) sits between firewall zones, so internet users can reach the server while firewall rules tightly limit what the server can reach internally. Putting it on the trusted LAN would give an attacker who compromises it direct access to internal systems.

Answer: B. The traffic is denied by the implicit deny at the end of the ACL

The only entry matches the source but permits destination port 443 alone, so SSH on port 22 falls through to the implicit deny any at the end of every ACL. Matching the source address isn't enough; every condition in an entry must match for that entry to apply.