Network+ Network Security: 294 practice questions

12 of the 294 Network Security questions in the Certsqill Network+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Network+? Take the free 5-min readiness check →

1. TLS for browser traffic: Which feature directly satisfies the requirement?

1. WPA3 wireless access

   WPA3 protects a wireless local-area connection, not the browser session across untrusted networks.
2. TLS for browser traffic ✓

   TLS protects the browser application session with confidentiality and integrity across untrusted networks.
3. Full-disk encryption

   Full-disk encryption protects stored data on devices, not data while it traverses networks.
4. IPsec tunnel across untrusted networks

   IPsec can protect network-layer traffic, but the requirement specifically calls for securing the browser application session without a network tunnel.

TLS directly protects the browser application session while it crosses untrusted networks.

2. Full-disk encryption: Which feature directly satisfies the requirement?

1. File hashing

   Hashing can detect changes, but it does not make stored laptop contents confidential after loss.
2. TLS

   TLS protects network sessions, but it does not protect files stored locally while the laptop is powered off.
3. Data loss prevention

   Data loss prevention can control handling or transmission, but it does not inherently encrypt every local disk sector.
4. Full-disk encryption ✓

   Full-disk encryption protects the operating system, files, and local temporary data when the device is not unlocked.

Full-disk encryption protects comprehensive laptop storage when the device is powered off or locked.

3. PKI: Which feature directly satisfies the requirement?

1. VLAN

   VLAN segmentation separates local broadcast domains, but it does not authenticate server certificates.
2. MFA

   MFA strengthens user authentication, but it does not establish a web server’s certificate trust chain.
3. PKI ✓

   PKI provides certificate issuance, chain validation, and trusted certification authorities for scalable service identity verification.
4. NAT

   NAT changes address translation behavior, but it provides no certificate identity or trust validation.

PKI scales certificate trust through certification authorities and validated identity chains.

4. Pin the expected certificate or public key on managed: Select TWO controls that directly establish this trust.

Select two. More than one option is correct — every correct one is ticked below.

1. Pin the expected certificate or public key on managed clients ✓

   Certificate or public-key pinning restricts acceptance to the explicitly expected self-signed identity.
2. Replace the certificate with a publicly trusted CA certificate

   A public CA certificate could establish broad trust, but it does not directly configure acceptance of the existing self-signed certificate.
3. Place the service in a separate VLAN

   A VLAN can segment traffic, but segmentation does not create cryptographic trust for the certificate.
4. Install the certificate in the managed clients’ trusted stores ✓

   Adding the self-signed certificate to managed trust stores explicitly establishes trust for those clients.
5. Enable multifactor authentication for administrators

   MFA protects administrator identities, but it does not make clients trust a self-signed server certificate.

Managed trust stores and certificate pinning explicitly identify the permitted self-signed certificate.

5. Hardware token: Which feature directly satisfies the additional-factor requirement?

1. Hardware token ✓

   A hardware token supplies a possession factor, which differs from the password’s knowledge factor.
2. Single sign-on

   Single sign-on changes application authentication flow, but it does not inherently add a different authentication factor.
3. Username

   A username identifies an account but is not an authentication factor providing independent proof of identity.
4. Security question

   A security question is another knowledge factor, so it does not provide factor diversity with a password.

A hardware token provides a possession factor alongside the password’s knowledge factor.

6. Each service provider trusts the identity provider’s: Select TWO features that directly support this design.

Select two. More than one option is correct — every correct one is ticked below.

1. The venue enables a shared password for every application

   Shared passwords avoid federation and create one reusable secret rather than delegated identity assertions.
2. Each service provider trusts the identity provider’s federation metadata ✓

   Service-provider trust configuration enables applications to validate assertions issued by the selected identity provider.
3. The directory stores users in LDAP

   LDAP can provide directory services, but it is not itself the federation assertion or trust mechanism.
4. The identity provider issues signed SAML assertions ✓

   Signed SAML assertions communicate authenticated identity claims from the identity provider to participating applications.
5. The venue assigns separate local accounts to every application

   Separate local accounts require independent credentials and do not provide federated single sign-on.

SAML assertions and configured identity-provider trust enable password-free federated access across applications.

7. RADIUS: Which feature directly satisfies the requirement?

1. LDAP

   LDAP provides directory access, but wireless access points commonly use another protocol for centralized AAA exchanges.
2. SAML

   SAML carries federated identity assertions, but it is not the common access-point AAA protocol described.
3. TACACS+

   TACACS+ is commonly associated with device administration rather than routine wireless network access AAA.
4. RADIUS ✓

   RADIUS commonly provides centralized authentication, authorization, and accounting for network access devices.

RADIUS is commonly used by network access devices for centralized authentication, authorization, and accounting.

8. TACACS+ for device AAA: Select TWO features that directly support the requirement.

Select two. More than one option is correct — every correct one is ticked below.

1. TACACS+ for device AAA ✓

   TACACS+ commonly supports centralized authentication and authorization for network-device administrators.
2. Per-command authorization ✓

   Per-command authorization restricts which administrative commands an authenticated user may execute.
3. RADIUS for wireless AAA

   RADIUS is commonly used for network-access AAA, but this option does not directly provide the stated device-command control.
4. LDAP directory lookup service

   LDAP can provide directory information, but it does not alone provide device command authorization.
5. SSH transport encryption service

   SSH protects the management connection in transit but does not by itself centralize authorization or restrict commands.

TACACS+ supports device AAA, and per-command authorization restricts administrative actions.

9. LDAP directory service: Which feature directly meets the requirement?

1. SAML assertion

   SAML carries federated authentication claims, but it is not the directory database or lookup protocol requested.
2. RADIUS authentication

   RADIUS commonly supports network access AAA, but it does not provide the requested general-purpose identity directory.
3. TACACS+ administration

   TACACS+ commonly supports device-administration AAA, but it is not an application identity directory.
4. LDAP directory service ✓

   LDAP provides a directory protocol for centrally storing and querying identities, groups, and attributes used by applications.

LDAP directly supplies centralized directory storage and lookup for identities, groups, and application attributes.

10. SAML assertion exchange: Which feature meets this requirement?

1. SAML assertion exchange ✓

   SAML assertions let an identity provider send signed authentication claims to relying web applications without sharing passwords.
2. TACACS+ authorization reply

   TACACS+ authorization supports device administration, but it does not federate browser authentication with partner applications.
3. LDAP bind request

   An LDAP bind authenticates to a directory, but it does not provide signed web federation claims between organizations.
4. RADIUS Access-Accept

   A RADIUS response supports network access decisions, not browser-based federated identity claims for partner applications.

SAML provides signed federation assertions from the venue identity provider to partner web applications.

11. Least-privilege RBAC role: Which feature most directly enforces this limited job-based access?

1. Least-privilege RBAC role ✓

   A narrowly defined role grants only required permissions, limiting instructors to approved course-material operations.
2. Single sign-on

   SSO reduces repeated logins, but it does not restrict the permissions granted after authentication.
3. Multifactor authentication

   MFA strengthens identity verification, but it does not define which actions an authenticated instructor may perform.
4. Accounting records

   Accounting records document activity, but they do not prevent instructors from receiving excessive permissions.

A least-privilege RBAC role grants only the instructor permissions required for course-material uploads.

12. Geofencing policy: Which feature directly enforces that location restriction?

1. Geofencing policy ✓

   Geofencing evaluates device location against a defined boundary and can restrict application use outside that area.
2. Device allowlisting

   Allowlisting restricts approved devices or identities, but it does not enforce where those devices may operate.
3. Device posture assessment

   Posture checks evaluate device health or configuration, not the device's geographic position.
4. Time-based access

   Time-based access limits hours of use, but it cannot determine whether a device is inside the boundary.

Geofencing uses device location to enforce an application boundary around the airport operating area.

Other Network+ domains

• Network Troubleshooting — 502 questions →
• Networking Concepts — 483 questions →
• Network Implementation — 420 questions →
• Network Operations — 399 questions →
• All 2098 Network+ questions →
• Network+ certification: requirements, cost and exam format →