Network+ Network Security: 227 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

Network+ Network Security: 227 practice questions

Network+ 227 questions 12 shown free

12 of the 227 Network Security questions in the Certsqill Network+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Network+? Take the free 5-min readiness check →

1. TLS for browser traffic: Which feature directly satisfies the requirement?

Medium
A food distributor sends order data through a browser-based warehouse application across untrusted networks. The design must protect the browser application session without requiring a network tunnel. Which feature directly satisfies the requirement?
  1. WPA3 wireless access
    WPA3 protects a wireless local-area connection, not the browser session across untrusted networks.
  2. TLS for browser traffic ✓
    TLS protects the browser application session with confidentiality and integrity across untrusted networks.
  3. Full-disk encryption
    Full-disk encryption protects stored data on devices, not data while it traverses networks.
  4. IPsec tunnel across untrusted networks
    IPsec can protect network-layer traffic, but the requirement specifically calls for securing the browser application session without a network tunnel.
The trap
Confuses local wireless protection with application-session protection. Confuses encryption at rest with encryption in transit. Chooses a valid network mechanism that does not match the stated application-session constraint.

TLS directly protects the browser application session while it crosses untrusted networks.

2. Full-disk encryption: Which feature directly satisfies the requirement?

Medium
An insurance office must protect data stored on employee laptops if a device is lost. The requirement applies to the operating system, user files, and temporary local data when the laptop is powered off. Which feature directly satisfies the requirement?
  1. File hashing
    Hashing can detect changes, but it does not make stored laptop contents confidential after loss.
  2. TLS
    TLS protects network sessions, but it does not protect files stored locally while the laptop is powered off.
  3. Data loss prevention
    Data loss prevention can control handling or transmission, but it does not inherently encrypt every local disk sector.
  4. Full-disk encryption ✓
    Full-disk encryption protects the operating system, files, and local temporary data when the device is not unlocked.
The trap
Confuses protection during transmission with protection of stored information. Confuses integrity verification with confidentiality. Assumes policy enforcement automatically provides comprehensive storage encryption.

Full-disk encryption protects comprehensive laptop storage when the device is powered off or locked.

3. PKI: Which feature directly satisfies the requirement?

Medium
A logistics depot publishes a secure web service. Clients must verify the service identity through a trusted certification hierarchy without manually trusting each individual server certificate. Which feature directly satisfies the requirement?
  1. VLAN
    VLAN segmentation separates local broadcast domains, but it does not authenticate server certificates.
  2. MFA
    MFA strengthens user authentication, but it does not establish a web server’s certificate trust chain.
  3. PKI ✓
    PKI provides certificate issuance, chain validation, and trusted certification authorities for scalable service identity verification.
  4. NAT
    NAT changes address translation behavior, but it provides no certificate identity or trust validation.
The trap
Confuses user authentication factors with machine identity validation. Treats network address handling as an identity control. Confuses network segmentation with cryptographic identity trust.

PKI scales certificate trust through certification authorities and validated identity chains.

4. Hardware token: Which feature directly satisfies the additional-factor requirement?

Medium
A sports venue requires staff to sign in with a password and one additional factor that is different from a knowledge factor. Which feature directly satisfies the additional-factor requirement?
  1. Hardware token ✓
    A hardware token supplies a possession factor, which differs from the password’s knowledge factor.
  2. Single sign-on
    Single sign-on changes application authentication flow, but it does not inherently add a different authentication factor.
  3. Username
    A username identifies an account but is not an authentication factor providing independent proof of identity.
  4. Security question
    A security question is another knowledge factor, so it does not provide factor diversity with a password.
The trap
Mistakes two knowledge items for multifactor authentication. Assumes SSO automatically provides multifactor authentication. Confuses identification with authentication.

A hardware token provides a possession factor alongside the password’s knowledge factor.

5. RADIUS: Which feature directly satisfies the requirement?

Medium
A community college wants centralized authentication and authorization for users joining its wireless network. The network team needs a protocol commonly used by access points to consult a central AAA service. Which feature directly satisfies the requirement?
  1. LDAP
    LDAP provides directory access, but wireless access points commonly use another protocol for centralized AAA exchanges.
  2. SAML
    SAML carries federated identity assertions, but it is not the common access-point AAA protocol described.
  3. TACACS+
    TACACS+ is commonly associated with device administration rather than routine wireless network access AAA.
  4. RADIUS ✓
    RADIUS commonly provides centralized authentication, authorization, and accounting for network access devices.
The trap
Confuses directory lookup with network access AAA. Selects an AAA protocol whose common role differs from the stated access use. Confuses web federation with network access authentication.

RADIUS is commonly used by network access devices for centralized authentication, authorization, and accounting.

6. LDAP directory service: Which feature directly meets the requirement?

Hard
A logistics depot needs one central service that stores user identities, groups, and attributes for several internal applications. Federation is not required. Which feature directly meets the requirement?
  1. SAML assertion
    SAML carries federated authentication claims, but it is not the directory database or lookup protocol requested.
  2. RADIUS authentication
    RADIUS commonly supports network access AAA, but it does not provide the requested general-purpose identity directory.
  3. TACACS+ administration
    TACACS+ commonly supports device-administration AAA, but it is not an application identity directory.
  4. LDAP directory service ✓
    LDAP provides a directory protocol for centrally storing and querying identities, groups, and attributes used by applications.
The trap
Confusing a federation token format with a directory service. Assuming a network authentication protocol replaces centralized directory storage. Confusing device administrator authorization with directory-based identity management.

LDAP directly supplies centralized directory storage and lookup for identities, groups, and application attributes.

7. SAML assertion exchange: Which feature meets this requirement?

Medium
A sports venue lets employees sign in to multiple partner web applications using the venue identity provider. The applications must receive signed login claims without sharing passwords. Which feature meets this requirement?
  1. SAML assertion exchange ✓
    SAML assertions let an identity provider send signed authentication claims to relying web applications without sharing passwords.
  2. TACACS+ authorization reply
    TACACS+ authorization supports device administration, but it does not federate browser authentication with partner applications.
  3. LDAP bind request
    An LDAP bind authenticates to a directory, but it does not provide signed web federation claims between organizations.
  4. RADIUS Access-Accept
    A RADIUS response supports network access decisions, not browser-based federated identity claims for partner applications.
The trap
Treating directory authentication as a web federation mechanism. Assuming network AAA responses function as web single sign-on assertions. Confusing device-management AAA with federated web application authentication.

SAML provides signed federation assertions from the venue identity provider to partner web applications.

8. Least-privilege RBAC role: Which feature most directly enforces this limited job-based access?

Medium
A community college wants instructors to upload course materials but not change grades, manage accounts, or alter security settings. Which feature most directly enforces this limited job-based access?
  1. Least-privilege RBAC role ✓
    A narrowly defined role grants only required permissions, limiting instructors to approved course-material operations.
  2. Single sign-on
    SSO reduces repeated logins, but it does not restrict the permissions granted after authentication.
  3. Multifactor authentication
    MFA strengthens identity verification, but it does not define which actions an authenticated instructor may perform.
  4. Accounting records
    Accounting records document activity, but they do not prevent instructors from receiving excessive permissions.
The trap
Confusing stronger authentication with authorization scope. Assuming convenient authentication automatically limits authorized actions. Mistaking monitoring and accountability for preventive authorization control.

A least-privilege RBAC role grants only the instructor permissions required for course-material uploads.

9. Geofencing policy: Which feature directly enforces that location restriction?

Medium
An airport office issues a mobile application that must function only while the device is within a defined operational geographic boundary. Which feature directly enforces that location restriction?
  1. Geofencing policy ✓
    Geofencing evaluates device location against a defined boundary and can restrict application use outside that area.
  2. Device allowlisting
    Allowlisting restricts approved devices or identities, but it does not enforce where those devices may operate.
  3. Device posture assessment
    Posture checks evaluate device health or configuration, not the device's geographic position.
  4. Time-based access
    Time-based access limits hours of use, but it cannot determine whether a device is inside the boundary.
The trap
Confusing device identity restrictions with geographic restrictions. Assuming scheduled access controls represent physical location. Treating security state measurements as location validation.

Geofencing uses device location to enforce an application boundary around the airport operating area.

10. Surveillance camera: Which physical security feature most directly provides that evidence?

Easy
A hospital IT team needs evidence showing who entered a restricted equipment room after an unauthorized entry occurred. Which physical security feature most directly provides that evidence?
  1. Electronic door lock
    A lock controls access but does not by itself provide visual evidence of who entered.
  2. Motion detector
    A motion detector signals movement but generally cannot identify the person involved.
  3. Badge reader
    A badge reader records credential use, but it may not prove which person physically entered using that credential.
  4. Surveillance camera ✓
    A camera records visual evidence that can help investigators identify the entrant.
The trap
Confusing access prevention with post-event visual investigation. Assuming credential records always establish physical identity. Mistaking movement detection for identity evidence.

A surveillance camera provides visual evidence for identifying the entrant.

11. Isolated honeypot segment: Which feature is required?

Medium
A retail branch deploys a honeypot to attract suspicious activity. The security lead confirmed the decoy must not reach production servers, and the change authority approved a separate network segment. Which feature is required?
  1. Guest wireless SSID
    A guest SSID may separate wireless clients, but it does not inherently isolate a wired or routed honeypot.
  2. Isolated honeypot segment ✓
    A separate isolated segment limits the decoy's connectivity and helps prevent compromise from reaching production systems.
  3. Port mirroring session
    Port mirroring copies traffic for observation, but it does not restrict the honeypot's network reachability.
  4. Production VLAN membership
    Placing the honeypot with production systems increases possible attack paths instead of containing the decoy.
The trap
Assuming shared segmentation is acceptable for a deliberately exposed system. Treating an SSID name as equivalent to enforced network isolation. Confusing monitoring visibility with containment.

An isolated honeypot segment contains the intentionally exposed system away from production resources.

12. Availability: Which CIA security property is the primary requirement?

Easy
A museum's digital exhibit must remain usable during a single server failure. Management accepts limited temporary disclosure of exhibit metadata. Which CIA security property is the primary requirement?
  1. Availability ✓
    Availability requires systems and services to remain accessible when users need them, including during a component failure.
  2. Confidentiality
    Confidentiality protects information from unauthorized disclosure, but the stated priority is continued service access.
  3. Nonrepudiation
    Nonrepudiation supports proof of an action or origin, not continued availability during infrastructure failure.
  4. Integrity
    Integrity protects information from unauthorized alteration, but it does not primarily address service continuity.
The trap
Selecting secrecy when uninterrupted service is the explicit concern. Confusing accurate data with resilient service operation. Applying transaction accountability to a resilience requirement.

Availability is the CIA property concerned with keeping the exhibit accessible during a server failure.

215 more Network Security questions

The remaining 215 questions in this domain are part of the full Network+ bank — 1678 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Network+ readiness — free

Other Network+ domains

Part of the Certsqill Network+ question bank · Network Security · Every answer, right and wrong, comes with its own explanation.