21 Network Security Practice Questions & Answers

1. 1. A network team publishes a cryptographic hash value for every firmware image so that anyone downloading it can verify the file was not altered. Which property of the CIA triad does this control primarily protect?

   • A.Integrity✓ Answer
   • B.Accounting
   • C.Confidentiality
   • D.Availability

   A hash is a one-way digest: changing even a single bit of the file produces a completely different value, so comparing hashes detects unauthorized modification. That is the definition of integrity. Confidentiality is provided by encryption and access control, and availability by redundancy, backups and denial-of-service mitigation; accounting is not part of the CIA triad at all.

   Source: CompTIA Network+ — Network Security domain (CIA triad)Report a problem with this question

2. 2. A router is running firmware that contains an unpatched flaw in its web management interface. Using standard security terminology, what does the unpatched flaw itself represent?

   • A.The threat
   • B.The exploit
   • C.The risk
   • D.The vulnerability✓ Answer

   A vulnerability is the weakness or flaw itself. A threat is the actor or event that could take advantage of it, an exploit is the specific technique or code that uses the weakness, and risk is the combination of how likely a threat is to exploit the vulnerability and how much impact that would cause. Keeping these four apart is a recurring vocabulary item.

   Source: CompTIA Network+ — Network Security domain (security terminology)Report a problem with this question

3. 3. Which statement best describes zero trust architecture compared with a traditional perimeter model?

   • A.Every request is authenticated, authorized and held to least privilege, regardless of whether it originates inside or outside the network✓ Answer
   • B.Once a device has passed the perimeter firewall, it is treated as trusted for internal resources
   • C.Trust is granted automatically to any host that holds an RFC 1918 private address
   • D.Only inbound traffic from the internet is inspected, while traffic between internal segments is exempt

   Zero trust removes implicit trust based on network location: 'never trust, always verify' means identity, device posture and policy are checked on every request, and access is granted at least privilege and re-verified continuously. The perimeter model does the opposite by treating everything inside the firewall as trusted, which lets an attacker who gets one foothold move laterally.

   Source: CompTIA Network+ — Networking Concepts domain (zero trust architecture)Report a problem with this question

4. 4. A centralized server records which technician logged in to a switch, at what time, and which configuration commands were entered. Which element of AAA does this record represent?

   • A.Accounting✓ Answer
   • B.Authentication
   • C.Authorization
   • D.Identification

   Accounting is the record of what an authenticated user actually did — session start and stop, resources used, commands issued — and it is what makes activity traceable after the fact. Authentication proves who the user is, authorization decides what that user is allowed to do, and identification is only the claim of an identity before it is proven.

   Source: CompTIA Network+ — Network Security domain (authentication, authorization and accounting)Report a problem with this question

5. 5. On a wired network using IEEE 802.1X, the access-layer switch port blocks all data traffic from a newly connected laptop until the laptop's credentials have been validated by a central server. Which 802.1X role does the switch port perform?

   • A.Supplicant
   • B.Authentication server
   • C.Certificate authority
   • D.Authenticator✓ Answer

   802.1X defines three roles: the supplicant is the client requesting access, the authenticator is the switch port or access point that acts as gatekeeper, and the authentication server (typically RADIUS) makes the decision. The authenticator keeps the port in an uncontrolled state that passes only EAP over LAN (EAPOL) authentication traffic, relays those EAP messages to the server, and opens the controlled state for data only after a success result.

   Source: IEEE 802.1X port-based network access control standardReport a problem with this question

6. 6. Which statement correctly distinguishes TACACS+ from RADIUS?

   • A.RADIUS separates authorization from authentication, whereas TACACS+ combines them into a single exchange
   • B.RADIUS encrypts the whole packet, whereas TACACS+ protects only the password field
   • C.TACACS+ is an open standard, whereas RADIUS is a single-vendor proprietary protocol
   • D.TACACS+ encrypts the entire packet body and separates authentication, authorization and accounting, which makes per-command control of device administration possible✓ Answer

   TACACS+ encrypts the whole payload and treats authentication, authorization and accounting as independent functions, so an administrator can be authenticated once and then authorized command by command — which is why it is favoured for device administration. RADIUS is the open standard, rides on UDP, protects only the password field, and merges authentication with authorization, which suits network access decisions such as wireless, VPN and 802.1X.

   Source: CompTIA Network+ — Network Security domain (identity and access management)Report a problem with this question

7. 7. A web portal asks the user for a password and then for the answer to a personal security question. Why does this NOT qualify as multifactor authentication?

   • A.Multifactor authentication requires at least three separate credentials
   • B.The second prompt is not protected by encryption in transit
   • C.Security questions cannot be validated by an authentication server
   • D.Both a password and a security-question answer are 'something you know', so only one factor category is used✓ Answer

   Multifactor authentication requires credentials from different factor categories — something you know, something you have, something you are, plus supporting attributes such as somewhere you are or a time window. Two knowledge items are still one category, so a single act of shoulder surfing, phishing or a password-database leak can compromise both. Adding a token code, a push approval or a biometric would introduce a genuine second category.

   Source: CompTIA Network+ — Network Security domain (multifactor authentication)Report a problem with this question

8. 8. An organization wants permissions to follow job function, so that a new hire placed in the 'help desk' group automatically receives exactly the rights that job needs. Which access control approach does this describe?

   • A.Creating an individual permission entry for every user on every resource
   • B.Granting all new hires administrator rights and reviewing the logs afterwards
   • C.Role-based access control, where permissions are attached to roles and users inherit them by job function✓ Answer
   • D.Filtering access by MAC address at the switch port

   Role-based access control attaches rights to a role or group rather than to individuals, so provisioning and de-provisioning become a matter of role membership and the same rules apply consistently to everyone doing that job. It also enforces least privilege at scale, because the role is scoped to the minimum the job requires; per-user entries on every resource are unmanageable and drift, and MAC filtering controls which device connects, not what a person may do.

   Source: CompTIA Network+ — Network Security domain (authorization and least privilege)Report a problem with this question

9. 9. An ACL is applied inbound on a router interface with its statements in this order: (1) deny tcp any 10.10.0.0/16; (2) permit tcp any host 10.10.5.20 eq 443. Users report they cannot reach the HTTPS server at 10.10.5.20. What explains this?

   • A.ACLs are evaluated top down and the first match wins, so the broad deny matches the traffic first and the specific permit is never reached✓ Answer
   • B.An ACL has no effect until it is also applied to a VLAN interface
   • C.An implicit permit at the end of the list overrides both configured statements
   • D.HTTPS runs over UDP, so a TCP permit statement can never match it

   An ACL is processed from the top down and stops at the first matching entry, so a broad deny placed above a specific permit silently blocks the traffic the permit was meant to allow; the fix is to order the specific permit before the broader deny. The list also ends with an implicit deny-all, never an implicit permit, so anything that must pass needs an explicit permit statement.

   Source: CompTIA Network+ — Network Security domain (access control lists)Report a problem with this question

10. 10. A company must host a public web server and an externally reachable DNS server. Following standard zone design, where should these systems be placed?

    • A.On the guest wireless VLAN, so that visitors can reach them without a VPN
    • B.On the internal user VLAN, with the firewall forwarding the necessary ports to them
    • C.In a screened subnet, separated by firewall policy from both the internet and the internal LAN, with no sessions initiated from that segment into the internal LAN✓ Answer
    • D.Directly on the internet edge with no filtering, since public servers are meant to be reachable

    A screened subnet is a separate segment for internet-facing services, positioned so that untrusted clients can reach the published services but the segment itself cannot open connections into the trusted internal network. That containment is the point: if the public web server is compromised, the attacker lands in an isolated zone rather than on the LAN with the file servers and workstations.

    Source: CompTIA Network+ — Network Security domain (trusted and untrusted zones, screened subnet)Report a problem with this question

11. 11. A security team wants to watch for suspicious traffic patterns on a production link, with an absolute requirement that the monitoring system can never delay or drop legitimate traffic. Which deployment meets that requirement?

    • A.An IDS deployed out of band, fed by a mirrored (SPAN) port, which alerts but cannot drop traffic✓ Answer
    • B.A web application firewall placed in front of every internal client
    • C.An inline IPS at the internet edge operating in blocking mode
    • D.A proxy that terminates and rewrites every client session

    An IDS sits out of band and inspects a copy of the traffic delivered by a mirrored port, so it can only detect and alert; production packets never pass through it and a false positive costs an analyst's time rather than an outage. An IPS is inline, which is exactly what gives it the ability to block in real time and also the ability to add latency or drop legitimate sessions when a signature misfires.

    Source: CompTIA Network+ — Networking Concepts domain (IDS and IPS appliances)Report a problem with this question

12. 12. A manufacturing plant runs legacy SCADA and industrial control devices that the vendor no longer patches and that cannot support current authentication or encryption. What is the most appropriate network control?

    • A.Move the controllers onto the same VLAN as the engineering workstations to simplify monitoring
    • B.Isolate the controllers in their own VLAN or zone, with tightly filtered traffic to and from every other segment✓ Answer
    • C.Install endpoint antivirus agents on each controller
    • D.Publish the controllers to the internet through port forwarding so the vendor can support them remotely

    When a device cannot be hardened or patched, the compensating control is to shrink what can reach it and what it can reach: a dedicated segment with filtered traffic limits lateral movement and reduces the blast radius if anything on the network is compromised. Antivirus agents generally cannot be installed on embedded controllers, and merging them with general-purpose workstations or exposing them to the internet enlarges the attack surface instead.

    Source: CompTIA Network+ — Network Security domain (network segmentation enforcement)Report a problem with this question

13. 13. A technician is deploying a new switch and a new wireless access point taken straight out of their boxes. Which hardening step addresses the weakness most commonly exploited on freshly installed network devices?

    • A.Hide the wireless SSID so the network cannot be discovered
    • B.Change the default administrative credentials, and disable the ports and services that are not in use✓ Answer
    • C.Leave every switchport enabled so that new equipment can be connected without a change request
    • D.Enable Telnet so the devices can be managed before any certificates are installed

    Default vendor usernames and passwords are published in manuals and in public lists, so changing them is the first action on any new switch, access point, router or camera; disabling unused ports and services removes the rest of the unnecessary attack surface. The same hardening pass replaces cleartext management with encrypted equivalents — SSH instead of Telnet, HTTPS instead of HTTP, SNMPv3 instead of community strings — and hiding an SSID only omits it from beacons, which any wireless analyzer defeats.

    Source: CompTIA Network+ — Network Security domain (device hardening)Report a problem with this question

14. 14. Visitors in a company lobby connect to a wireless network broadcasting the exact corporate SSID with an unusually strong signal, and are then shown a login page that harvests their corporate credentials. Which attack does this describe?

    • A.Evil twin✓ Answer
    • B.Rogue access point
    • C.Deauthentication attack
    • D.MAC flooding

    The defining feature of an evil twin is impersonation: the attacker's access point clones a known SSID (often the BSSID too) and out-signals the real one so clients associate to it, putting the attacker on path and enabling a fake captive portal. A rogue access point is merely an unauthorized AP attached to the network, such as an employee's consumer unit, and does not necessarily pretend to be the corporate network; that impersonation detail is the discriminator.

    Source: CompTIA Network+ — Network Security domain (wireless attacks)Report a problem with this question

15. 15. On several workstations, the output of arp -a shows the default gateway's IP address and a second host's IP address both mapped to the same MAC address, and traffic to the gateway is being intercepted. Which attack is occurring?

    • A.DNS poisoning
    • B.A rogue DHCP server
    • C.ARP spoofing (ARP poisoning)✓ Answer
    • D.VLAN hopping by double tagging

    ARP carries no authentication, so an attacker can send unsolicited or gratuitous ARP replies that bind their own MAC address to the gateway's IP, poisoning the ARP caches of every host that hears them. Two IP addresses resolving to one MAC address is the classic symptom, and the result is an on-path position that allows sniffing, modification or denial of service.

    Source: IETF RFC 826 (Address Resolution Protocol); CompTIA Network+ — Network Security domainReport a problem with this question

16. 16. Employees type the correct internal payroll hostname into the browser and land on a convincing but fraudulent login page. The hostname in the address bar is correct, and the resolver's cached record for that name points to an unfamiliar external IP address. Which attack best fits?

    • A.Shoulder surfing
    • B.DNS poisoning✓ Answer
    • C.Typosquatting
    • D.Phishing

    DNS poisoning corrupts the cached record held by a resolver (or a hosts file) so a legitimate, correctly spelled name resolves to an attacker-controlled address — which is why the URL looks right while the destination is not. Typosquatting depends on the user mistyping the name, and phishing depends on the user following a supplied link. DNSSEC counters this by signing records to give origin authentication and integrity, though it does not encrypt DNS; DoH and DoT provide the encryption.

    Source: IETF RFC 1035 (Domain Names — Implementation and Specification); CompTIA Network+ — Network Security domainReport a problem with this question

17. 17. Which switch configuration change most directly mitigates VLAN hopping performed by double tagging?

    • A.Enable dynamic trunking negotiation on all access ports
    • B.Raise the MTU on trunk links so that double-tagged frames are dropped
    • C.Place every host in the default VLAN so that no tagging is required
    • D.Set the trunk native VLAN to a dedicated, unused VLAN that carries no host traffic, and stop access ports from negotiating trunking✓ Answer

    In double tagging the attacker sends a frame with two 802.1Q tags; the first switch strips the outer tag because it matches the native VLAN, which is carried untagged, and forwards the frame with the inner tag toward the victim VLAN. Assigning the native VLAN to an unused VLAN with no hosts removes the vehicle for that outer tag, and disabling trunk negotiation on access ports closes the other VLAN-hopping method, switch spoofing.

    Source: IEEE 802.1Q VLAN tagging standard; CompTIA Network+ — Network Security domainReport a problem with this question

18. 18. A switch suddenly begins forwarding unicast frames out of every port, and a laptop attached to an access port can capture conversations between other hosts. What happened, and which feature prevents it?

    • A.The CAM table was overflowed with forged source MAC addresses; port security, which limits the MAC addresses learned per port, prevents it✓ Answer
    • B.A routing loop produced a broadcast storm; enabling NAT prevents it
    • C.The ARP caches expired network-wide; shortening the DHCP lease prevents it
    • D.The switch lost its default gateway; adding a static route prevents it

    MAC flooding sends a torrent of frames with bogus source addresses until the switch's CAM table is full; with nowhere to record new entries the switch fails open and floods unicast frames out all ports, which lets the attacker sniff traffic that should have been switched only to its destination port. Port security caps the number of MAC addresses learned on a port and can shut down, restrict or protect the port when the limit is violated.

    Source: CompTIA Network+ — Network Security domain (port security and Layer 2 attacks)Report a problem with this question

19. 19. An attacker sends small, spoofed UDP queries to many open internet services, placing the victim's IP address in the source field, so each service returns a much larger response to the victim and saturates its link. How is this attack best described?

    • A.An ARP poisoning attack against integrity
    • B.An on-path attack against confidentiality
    • C.A credential-stuffing attack against authentication
    • D.A reflected, amplified distributed denial-of-service attack against availability✓ Answer

    Source-address spoofing makes third-party services reflect their replies to the victim, and because the reply is far larger than the query the traffic is amplified — a small amount of attacker bandwidth becomes a flood. The target property is availability: nothing is read or altered, the link and the service are simply exhausted, which is what separates denial of service from confidentiality or integrity attacks.

    Source: CompTIA Network+ — Network Security domain (DoS and DDoS attacks)Report a problem with this question

20. 20. Which statement describes a structural difference between personal (pre-shared key) mode and enterprise (802.1X) mode on a wireless LAN?

    • A.MAC filtering in pre-shared key mode authenticates individual users as strongly as enterprise mode does
    • B.Pre-shared key mode authenticates knowledge of one shared passphrase rather than an individual, so the passphrase must be changed for everyone when one person leaves, whereas enterprise mode uses 802.1X to authenticate each user separately✓ Answer
    • C.Hiding the SSID in pre-shared key mode gives the same per-user identity that enterprise mode provides
    • D.Pre-shared key mode leaves wireless frames unencrypted, while enterprise mode encrypts them

    Both modes encrypt the air link; the durable difference is what is being authenticated. A pre-shared key authenticates the network to anyone holding the shared passphrase, so there is no per-user accountability, no individual revocation, and a departure forces a re-key of every device. Enterprise mode inserts 802.1X with an authentication server, giving each user distinct credentials that can be logged and revoked one at a time. SSID hiding and MAC filtering are not authentication at all — beacons and MAC addresses are trivially observed and spoofed.

    Source: IEEE 802.11 wireless security amendments; IEEE 802.1X port-based network access control standardReport a problem with this question

21. 21. A badged employee opens the door to the wiring closet corridor and an unfamiliar person without a badge walks in behind them. Which attack is this, and which control is designed to stop it?

    • A.Dumpster diving, countered by shredding discarded documents
    • B.Shoulder surfing, countered by privacy screens
    • C.Tailgating, countered by an access control vestibule together with security awareness training✓ Answer
    • D.Pretexting, countered by email content filtering

    Tailgating (piggybacking) is following an authorized person through a controlled door so the intruder never presents credentials — a direct route to unlocked IDFs, patch panels and switch consoles. An access control vestibule admits one person at a time and will not open the inner door until the outer one has closed and the individual has authenticated, and awareness training teaches staff not to hold the door. The other options pair real techniques with their own, different countermeasures.

    Source: CompTIA Network+ — Network Security domain (physical security and social engineering)Report a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →