N10-009 - Network Security (14% of the exam) - Section 4.3

Apply network security features, defence techniques, and solutions, including ACLs, segmentation, port security, NAC, and VPNs.

Apply the controls that harden a network: access control lists (ACLs) to filter traffic, network segmentation and screened subnets to contain breaches, and port security with 802.1X network access control (NAC) to block unauthorised devices. Select the appropriate remote-access protection - IPsec or SSL/TLS VPNs - and apply device hardening such as disabling unused services and changing default credentials.

Access control listsNetwork segmentation802.1X NACVPN (IPsec/SSL)Device hardening

Practice question for this objective

Free sampleNetwork Securitymedium

A security architect argues that placing cardholder-data systems on their own isolated network segment is worthwhile beyond any performance gain. Which statement best describes a security benefit of network segmentation?

  • AIt encrypts traffic between segments automatically, so a separate VPN or TLS session on the wire is no longer needed.
  • BIt replaces access control lists, because hosts placed in different segments are then unable to exchange traffic of any kind.
  • CIt limits an attacker's lateral movement, so a compromise in one segment cannot reach hosts in another without crossing a controlled boundary. Correct
  • DIt stops malware from executing on hosts inside a segment, because the segment boundary inspects the contents of transferred files.
Network segmentation limits lateral movement by forcing inter-segment traffic through a controlled security boundary. Segmentation forces traffic between zones through a controlled boundary such as a firewall or ACL, which contains a breach to its origin segment and stops an attacker moving laterally to other hosts.

Why A is wrong: Segmentation does add security, but it separates traffic rather than encrypting it, so VPN or TLS is still required to protect confidentiality on the wire.

Why B is wrong: Segmentation controls inter-segment traffic rather than forbidding it, and ACLs or firewall rules are how that permitted traffic is defined, so they remain necessary.

Why C is correct: By forcing inter-segment traffic through a controlled boundary, segmentation contains a breach to its origin segment and blocks free lateral movement, a core security benefit.

Why D is wrong: Segmentation restricts network reachability; it does not scan file contents or halt code on a host, so it cannot prevent malware from running.

See more N10-009 practice questions, answers explained.

Exam traps in Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

  • Zero trust eliminates the need for authentication because every device is fully inspected at the network firewall.

    Why it is wrong: Zero trust actually increases authentication rather than removing it, because verifying identity and device state is central to every access decision it makes.

  • Replace the edge firewall with a higher-throughput model from the same vendor so the single filtering point can inspect more traffic at once.

    Why it is wrong: A faster firewall improves the capacity of the existing single layer but adds no new independent control, so a threat that evades that one device still faces nothing behind it.

  • Deploy a second, higher-capacity firewall at the internet edge to strengthen inspection of traffic entering the network from outside.

    Why it is wrong: A stronger edge firewall reinforces a layer that already exists at the perimeter, so it does nothing about an attacker who is already inside the flat internal network, which is the identified gap.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.