21 Network Security Practice Questions & Answers

1. 1. A network team publishes a cryptographic hash value for every firmware image so that anyone downloading it can verify the file was not altered. Which property of the CIA triad does this control primarily protect?

   • A.Integrity✓ Answer
   • B.Accounting
   • C.Confidentiality
   • D.Availability

   A hash is a one-way digest: changing even a single bit of the file produces a completely different value, so comparing hashes detects unauthorized modification. That is the definition of integrity. Confidentiality is provided by encryption and access control, and availability by redundancy, backups and denial-of-service mitigation; accounting is not part of the CIA triad at all.

   Source: CompTIA Network+ — Network Security domain (CIA triad)Report a problem with this question

2. 2. A router is running firmware that contains an unpatched flaw in its web management interface. Using standard security terminology, what does the unpatched flaw itself represent?

   • A.The threat actor
   • B.The exploit payload
   • C.The risk exposure
   • D.The vulnerability✓ Answer

   A vulnerability is the weakness or flaw itself. A threat is the actor or event that could take advantage of it, an exploit is the specific technique or code that uses the weakness, and risk is the combination of how likely a threat is to exploit the vulnerability and how much impact that would cause. Keeping these four apart is a recurring vocabulary item.

   Source: CompTIA Network+ — Network Security domain (security terminology)Report a problem with this question

3. 3. Which statement best describes zero trust architecture compared with a traditional perimeter model?

   • A.Every request is authenticated and authorized, inside or outside the network✓ Answer
   • B.A device that clears the perimeter firewall is trusted on the inside
   • C.Any host with an RFC 1918 private address is trusted automatically
   • D.Only inbound traffic from the internet is inspected; internal traffic is exempt

   Zero trust removes implicit trust based on network location: 'never trust, always verify' means identity, device posture and policy are checked on every request, and access is granted at least privilege and re-verified continuously. The perimeter model does the opposite by treating everything inside the firewall as trusted, which lets an attacker who gets one foothold move laterally.

   Source: CompTIA Network+ — Networking Concepts domain (zero trust architecture)Report a problem with this question

4. 4. A centralized server records which technician logged in to a switch, at what time, and which configuration commands were entered. Which element of AAA does this record represent?

   • A.Accounting✓ Answer
   • B.Authentication
   • C.Authorization
   • D.Identification

   Accounting is the record of what an authenticated user actually did — session start and stop, resources used, commands issued — and it is what makes activity traceable after the fact. Authentication proves who the user is, authorization decides what that user is allowed to do, and identification is only the claim of an identity before it is proven.

   Source: CompTIA Network+ — Network Security domain (authentication, authorization and accounting)Report a problem with this question

5. 5. On a wired network using IEEE 802.1X, the access-layer switch port blocks all data traffic from a newly connected laptop until the laptop's credentials have been validated by a central server. Which 802.1X role does the switch port perform?

   • A.Supplicant
   • B.Authentication server
   • C.Certificate authority
   • D.Authenticator✓ Answer

   802.1X defines three roles: the supplicant is the client requesting access, the authenticator is the switch port or access point that acts as gatekeeper, and the authentication server (typically RADIUS) makes the decision. The authenticator keeps the port in an uncontrolled state that passes only EAP over LAN (EAPOL) authentication traffic, relays those EAP messages to the server, and opens the controlled state for data only after a success result.

   Source: IEEE 802.1X port-based network access control standardReport a problem with this question

6. 6. Which statement correctly distinguishes TACACS+ from RADIUS?

   • A.RADIUS separates authorization from authentication; TACACS+ combines them
   • B.RADIUS encrypts the whole packet; TACACS+ protects only the password
   • C.TACACS+ is an open standard; RADIUS is a single-vendor protocol
   • D.TACACS+ encrypts the whole packet and separates the AAA functions✓ Answer

   TACACS+ encrypts the whole payload and treats authentication, authorization and accounting as independent functions, so an administrator can be authenticated once and then authorized command by command — which is why it is favoured for device administration. RADIUS is the open standard, rides on UDP, protects only the password field, and merges authentication with authorization, which suits network access decisions such as wireless, VPN and 802.1X.

   Source: CompTIA Network+ — Network Security domain (identity and access management)Report a problem with this question

7. 7. A web portal asks the user for a password and then for the answer to a personal security question. Why does this NOT qualify as multifactor authentication?

   • A.Multifactor authentication requires at least three credentials
   • B.The second prompt is not protected by encryption in transit
   • C.Security questions cannot be validated by a RADIUS server
   • D.Both prompts ask for 'something you know', so it is one factor✓ Answer

   Multifactor authentication requires credentials from different factor categories — something you know, something you have, something you are, plus supporting attributes such as somewhere you are or a time window. Two knowledge items are still one category, so a single act of shoulder surfing, phishing or a password-database leak can compromise both. Adding a token code, a push approval or a biometric would introduce a genuine second category.

   Source: CompTIA Network+ — Network Security domain (multifactor authentication)Report a problem with this question

8. 8. An organization wants permissions to follow job function, so that a new hire placed in the 'help desk' group automatically receives exactly the rights that job needs. Which access control approach does this describe?

   • A.Mandatory access control
   • B.Discretionary access control
   • C.Role-based access control✓ Answer
   • D.Rule-based access control

   Role-based access control attaches rights to a role or group rather than to individuals, so provisioning and de-provisioning become a matter of role membership, the same rules apply to everyone doing that job, and least privilege is enforced at scale because the role is scoped to the minimum the job requires. The other three models key on something else entirely: mandatory access control assigns access from system-enforced security labels and clearances, discretionary access control lets the owner of each resource decide who may use it, and rule-based access control applies conditions such as time of day or source address to everyone alike.

   Source: CompTIA Network+ — Network Security domain (authorization and least privilege)Report a problem with this question

9. 9. An ACL is applied inbound on a router interface with its statements in this order: (1) deny tcp any 10.10.0.0/16; (2) permit tcp any host 10.10.5.20 eq 443. Users report they cannot reach the HTTPS server at 10.10.5.20. What explains this?

   • A.ACLs match top down and stop at the first hit, so the deny wins first✓ Answer
   • B.An ACL has no effect until it is also applied to a VLAN interface
   • C.An implicit permit at the end of the list overrides both statements
   • D.HTTPS runs over UDP, so a TCP permit statement can never match it

   An ACL is processed from the top down and stops at the first matching entry, so a broad deny placed above a specific permit silently blocks the traffic the permit was meant to allow; the fix is to order the specific permit before the broader deny. The list also ends with an implicit deny-all, never an implicit permit, so anything that must pass needs an explicit permit statement.

   Source: CompTIA Network+ — Network Security domain (access control lists)Report a problem with this question

10. 10. A company must host a public web server and an externally reachable DNS server. Following standard zone design, where should these systems be placed?

    • A.On the guest wireless VLAN, so visitors can reach them without a VPN
    • B.On the internal user VLAN, with the firewall forwarding the ports
    • C.In a screened subnet, filtered from both the internet and the LAN✓ Answer
    • D.Directly on the internet edge, with no filtering in front of them

    A screened subnet is a separate segment for internet-facing services, positioned so that untrusted clients can reach the published services but the segment itself cannot open connections into the trusted internal network. That containment is the point: if the public web server is compromised, the attacker lands in an isolated zone rather than on the LAN with the file servers and workstations.

    Source: CompTIA Network+ — Network Security domain (trusted and untrusted zones, screened subnet)Report a problem with this question

11. 11. A security team wants to watch for suspicious traffic patterns on a production link, with an absolute requirement that the monitoring system can never delay or drop legitimate traffic. Which deployment meets that requirement?

    • A.An IDS deployed out of band, fed by a mirrored (SPAN) port✓ Answer
    • B.A web application firewall in front of every client
    • C.An inline IPS at the internet edge in blocking mode
    • D.A proxy that terminates and rewrites every session

    An IDS sits out of band and inspects a copy of the traffic delivered by a mirrored port, so it can only detect and alert; production packets never pass through it and a false positive costs an analyst's time rather than an outage. An IPS is inline, which is exactly what gives it the ability to block in real time and also the ability to add latency or drop legitimate sessions when a signature misfires.

    Source: CompTIA Network+ — Networking Concepts domain (IDS and IPS appliances)Report a problem with this question

12. 12. A manufacturing plant runs legacy SCADA and industrial control devices that the vendor no longer patches and that cannot support current authentication or encryption. What is the most appropriate network control?

    • A.Move the controllers onto the engineering workstation VLAN
    • B.Isolate the controllers in their own tightly filtered VLAN✓ Answer
    • C.Install endpoint antivirus agents on every legacy controller
    • D.Publish the controllers to the internet by port forwarding

    When a device cannot be hardened or patched, the compensating control is to shrink what can reach it and what it can reach: a dedicated segment with filtered traffic limits lateral movement and reduces the blast radius if anything on the network is compromised. Antivirus agents generally cannot be installed on embedded controllers, and merging them with general-purpose workstations or exposing them to the internet enlarges the attack surface instead.

    Source: CompTIA Network+ — Network Security domain (network segmentation enforcement)Report a problem with this question

13. 13. A technician is deploying a new switch and a new wireless access point taken straight out of their boxes. Which hardening step addresses the weakness most commonly exploited on freshly installed network devices?

    • A.Hide the wireless SSID so the network cannot be discovered
    • B.Change the default administrative credentials on both new devices✓ Answer
    • C.Leave every switchport enabled so new equipment can be connected
    • D.Enable Telnet so the devices can be managed from the start

    Default vendor usernames and passwords are published in manuals and in public lists, so changing them is the first action on any new switch, access point, router or camera; disabling unused ports and services removes the rest of the unnecessary attack surface. The same hardening pass replaces cleartext management with encrypted equivalents — SSH instead of Telnet, HTTPS instead of HTTP, SNMPv3 instead of community strings — and hiding an SSID only omits it from beacons, which any wireless analyzer defeats.

    Source: CompTIA Network+ — Network Security domain (device hardening)Report a problem with this question

14. 14. Visitors in a company lobby connect to a wireless network broadcasting the exact corporate SSID with an unusually strong signal, and are then shown a login page that harvests their corporate credentials. Which attack does this describe?

    • A.Evil twin✓ Answer
    • B.Rogue AP
    • C.Deauth attack
    • D.MAC flooding

    The defining feature of an evil twin is impersonation: the attacker's access point clones a known SSID (often the BSSID too) and out-signals the real one so clients associate to it, putting the attacker on path and enabling a fake captive portal. A rogue access point is merely an unauthorized AP attached to the network, such as an employee's consumer unit, and does not necessarily pretend to be the corporate network; that impersonation detail is the discriminator.

    Source: CompTIA Network+ — Network Security domain (wireless attacks)Report a problem with this question

15. 15. On several workstations, the output of arp -a shows the default gateway's IP address and a second host's IP address both mapped to the same MAC address, and traffic to the gateway is being intercepted. Which attack is occurring?

    • A.DNS poisoning
    • B.DHCP spoofing
    • C.ARP poisoning✓ Answer
    • D.VLAN hopping

    ARP carries no authentication, so an attacker can send unsolicited or gratuitous ARP replies that bind their own MAC address to the gateway's IP, poisoning the ARP caches of every host that hears them. Two IP addresses resolving to one MAC address is the classic symptom, and the result is an on-path position that allows sniffing, modification or denial of service.

    Source: IETF RFC 826 (Address Resolution Protocol); CompTIA Network+ — Network Security domainReport a problem with this question

16. 16. Employees type the correct internal payroll hostname into the browser and land on a convincing but fraudulent login page. The hostname in the address bar is correct, and the resolver's cached record for that name points to an unfamiliar external IP address. Which attack best fits?

    • A.ARP poisoning
    • B.DNS poisoning✓ Answer
    • C.Typosquatting
    • D.Spear phishing

    DNS poisoning corrupts the cached record held by a resolver (or a hosts file) so a legitimate, correctly spelled name resolves to an attacker-controlled address — which is why the URL looks right while the destination is not. Typosquatting depends on the user mistyping the name, spear phishing depends on the user following a link that was sent to them, and ARP poisoning works at Layer 2 on the local segment and would not change what a resolver has cached for a name. DNSSEC counters this by signing records to give origin authentication and integrity, though it does not encrypt DNS; DoH and DoT provide the encryption.

    Source: IETF RFC 1035 (Domain Names — Implementation and Specification); CompTIA Network+ — Network Security domainReport a problem with this question

17. 17. Which switch configuration change most directly mitigates VLAN hopping performed by double tagging?

    • A.Enable dynamic trunking negotiation on all access ports
    • B.Raise the MTU on trunk links so double-tagged frames drop
    • C.Place every host in the default VLAN so no tagging is needed
    • D.Set the trunk native VLAN to a dedicated, unused VLAN✓ Answer

    In double tagging the attacker sends a frame with two 802.1Q tags; the first switch strips the outer tag because it matches the native VLAN, which is carried untagged, and forwards the frame with the inner tag toward the victim VLAN. Assigning the native VLAN to an unused VLAN with no hosts removes the vehicle for that outer tag, and disabling trunk negotiation on access ports closes the other VLAN-hopping method, switch spoofing.

    Source: IEEE 802.1Q VLAN tagging standard; CompTIA Network+ — Network Security domainReport a problem with this question

18. 18. A switch suddenly begins forwarding unicast frames out of every port, and a laptop attached to an access port can capture conversations between other hosts. What happened, and which feature prevents it?

    • A.The CAM table filled with forged MAC addresses; port security prevents it✓ Answer
    • B.A routing loop caused a broadcast storm; enabling NAT prevents it
    • C.The ARP caches expired across the network; a shorter DHCP lease prevents it
    • D.The switch lost its default gateway; adding a static route prevents it

    MAC flooding sends a torrent of frames with bogus source addresses until the switch's CAM table is full; with nowhere to record new entries the switch fails open and floods unicast frames out all ports, which lets the attacker sniff traffic that should have been switched only to its destination port. Port security caps the number of MAC addresses learned on a port and can shut down, restrict or protect the port when the limit is violated.

    Source: CompTIA Network+ — Network Security domain (port security and Layer 2 attacks)Report a problem with this question

19. 19. An attacker sends small, spoofed UDP queries to many open internet services, placing the victim's IP address in the source field, so each service returns a much larger response to the victim and saturates its link. How is this attack best described?

    • A.A DNS cache poisoning attack
    • B.An on-path interception attack
    • C.A credential-stuffing attack
    • D.A reflective amplification DDoS attack✓ Answer

    Source-address spoofing makes third-party services reflect their replies to the victim, and because the reply is far larger than the query the traffic is amplified — a small amount of attacker bandwidth becomes a flood. The target property is availability: nothing is read or altered, the link and the service are simply exhausted, which is what separates denial of service from confidentiality or integrity attacks.

    Source: CompTIA Network+ — Network Security domain (DoS and DDoS attacks)Report a problem with this question

20. 20. Which statement describes a structural difference between personal (pre-shared key) mode and enterprise (802.1X) mode on a wireless LAN?

    • A.MAC filtering in PSK mode identifies users as strongly as 802.1X
    • B.PSK mode authenticates a shared passphrase, not an individual user✓ Answer
    • C.Hiding the SSID in PSK mode gives the per-user identity 802.1X gives
    • D.PSK mode leaves frames unencrypted, while enterprise mode encrypts them

    Both modes encrypt the air link; the durable difference is what is being authenticated. A pre-shared key authenticates the network to anyone holding the shared passphrase, so there is no per-user accountability, no individual revocation, and a departure forces a re-key of every device. Enterprise mode inserts 802.1X with an authentication server, giving each user distinct credentials that can be logged and revoked one at a time. SSID hiding and MAC filtering are not authentication at all — beacons and MAC addresses are trivially observed and spoofed.

    Source: IEEE 802.11 wireless security amendments; IEEE 802.1X port-based network access control standardReport a problem with this question

21. 21. A badged employee opens the door to the wiring closet corridor and an unfamiliar person without a badge walks in behind them. Which attack is this, and which control is designed to stop it?

    • A.Dumpster diving, countered by shredding documents
    • B.Shoulder surfing, countered by privacy screens
    • C.Tailgating, countered by an access control vestibule✓ Answer
    • D.Pretexting, countered by email content filtering

    Tailgating (piggybacking) is following an authorized person through a controlled door so the intruder never presents credentials — a direct route to unlocked IDFs, patch panels and switch consoles. An access control vestibule admits one person at a time and will not open the inner door until the outer one has closed and the individual has authenticated, and awareness training teaches staff not to hold the door. The other options pair real techniques with their own, different countermeasures.

    Source: CompTIA Network+ — Network Security domain (physical security and social engineering)Report a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →