N10-009 - Network Security (14% of the exam) - Section 4.1

Explain the importance of basic network security concepts, including the CIA triad, defence in depth, zero trust, and authentication factors.

Explain the foundational security concepts that shape network defence: the CIA triad (confidentiality, integrity, availability), defence in depth, least privilege, and zero trust. Distinguish the AAA components (authentication, authorisation, accounting) and the multifactor authentication factor categories, and recognise the role of encryption and certificates in protecting data in transit.

CIA triadZero trustDefence in depthAAA and MFA

Practice question for this objective

Free sampleNetwork Securitymedium

In a zero trust model, why is a user re-authenticated and re-authorised for each resource request instead of being granted broad access after one successful login?

ABecause re-authentication is mandated by the DHCP lease renewal process whenever a host changes subnet.
BBecause zero trust issues one single sign-on token at the perimeter that stays valid and does not expire.
CBecause zero trust assumes any session or credential could be compromised, so it applies continuous verification with least-privilege access. Correct
DBecause the CIA triad requires availability to be prioritised above confidentiality on every single request.

Zero trust assumes breach and enforces least privilege, so it continuously re-verifies each request instead of granting lasting trust after a single login. Because any credential or session may already be compromised, zero trust re-evaluates identity, device posture, and context for every resource request and grants only the least privilege required.

Why A is wrong: DHCP lease renewal is an addressing function unrelated to authorisation, so it does not drive the per-resource access decisions that zero trust makes.

Why B is wrong: A non-expiring perimeter token is the opposite of zero trust, because continuous re-verification exists so a stale or stolen token cannot grant lasting access.

Why C is correct: Zero trust assumes breach and grants the minimum access needed, so it re-verifies identity, device, and context on each request rather than trusting one login.

Why D is wrong: This misapplies the CIA triad, because availability and confidentiality are goals rather than the reason for per-request checks, which stem from assuming compromise.

See more N10-009 practice questions, answers explained.

Exam traps in Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

Identity is irrelevant because access is decided from the source IP address and VLAN membership on the network.
Why it is wrong: Deciding access purely by IP and VLAN is location-based trust, which zero trust rejects, so identity and context are central rather than irrelevant.
Configure a nightly backup of the database to a second server so that a current copy always exists.
Why it is wrong: Nightly backups ensure a copy survives if the laptop is lost, which supports availability and recovery, but they do nothing to stop a thief reading the data already on the device.
Port mirroring, which copies traffic from one switch port to a monitor port for passive analysis.
Why it is wrong: Port mirroring is a monitoring feature that copies traffic for analysis, so it is tempting as a security tool but does not isolate workloads or stop lateral movement.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.