CompTIA Network+ — All Questions

Which access control method assigns permissions to users based on their job function within an organization?

• a.Discretionary access control
• b.Rule-based access control
• c.Role-based access control✓
• d.Mandatory access control

Role-based access control (RBAC) grants permissions according to a user's role or job function, simplifying administration at scale. Users inherit access by being placed into roles rather than being assigned rights individually. This supports least-privilege principles.

A firewall rule set should end with which type of rule to enforce a secure default posture?

• a.An implicit or explicit deny-all✓
• b.A permit-all to any destination
• c.A rule allowing all ICMP
• d.A rule opening all high ports

A secure firewall enforces a default-deny posture, so any traffic not explicitly permitted is blocked by an implicit or explicit deny-all rule. This follows the principle of least privilege for network access. Permit-all rules undermine the firewall's purpose.

Which attack floods a switch's MAC address table to force it to broadcast frames out all ports?

• a.MAC flooding✓
• b.DNS poisoning
• c.ARP spoofing
• d.Smurf attack

MAC flooding overwhelms a switch's MAC address table, causing it to fail open and flood frames out all ports so an attacker can capture traffic. Port security limiting MAC addresses per port mitigates this. It exploits the finite size of the CAM table.

Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a corporate network?

• a.VLAN
• b.VPN✓
• c.DMZ
• d.NAT

A VPN establishes an encrypted tunnel across untrusted networks, allowing remote users to securely access internal resources. IPsec and SSL/TLS are common VPN technologies. The encryption protects confidentiality and integrity in transit.

Which network segment is designed to host public-facing servers while isolating them from the internal LAN?

• a.Loopback interface
• b.Native VLAN
• c.Broadcast domain
• d.Screened subnet (DMZ)✓

A screened subnet, commonly called a DMZ, hosts public-facing services like web and mail servers in an isolated zone between the internet and the internal network. If a DMZ host is compromised, the internal LAN remains protected. Firewalls control traffic in and out of the DMZ.

Which authentication framework provides port-based network access control, often used with RADIUS for wired and wireless clients?

• a.802.3af
• b.802.1X✓
• c.802.1Q
• d.802.11ac

IEEE 802.1X provides port-based network access control, requiring clients to authenticate, often against a RADIUS server, before gaining network access. It is widely used for both wired ports and wireless networks. This prevents unauthorized devices from connecting.

An attacker sends forged ARP replies to associate their MAC with the default gateway's IP. What is this attack called?

• a.SYN flooding
• b.Session hijacking via cookies
• c.ARP poisoning✓
• d.Port scanning

ARP poisoning sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, enabling on-path interception. Dynamic ARP Inspection and static ARP entries mitigate it. It is a classic on-path (man-in-the-middle) technique.

Which principle dictates that users and processes should receive only the minimum access necessary to perform their tasks?

• a.Zero trust
• b.Separation of duties
• c.Least privilege✓
• d.Defense in depth

The principle of least privilege grants only the minimum access required, limiting the damage from compromised accounts or mistakes. It is a foundational security control. Regular access reviews help maintain it over time.

Which device inspects traffic and can actively block malicious activity inline, rather than only alerting on it?

• a.IDS
• b.IPS✓
• c.Proxy cache
• d.Syslog server

An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time. An IDS, by contrast, only detects and alerts without stopping the traffic. Inline placement is what enables prevention.

Which switch feature limits the number of MAC addresses learned on a port and can shut the port down if violated?

• a.Dynamic ARP inspection
• b.DHCP snooping
• c.BPDU guard
• d.Port security✓

Port security restricts how many MAC addresses a switch port learns and can take actions like shutting the port down on a violation. This mitigates MAC flooding and unauthorized device connections. Violation modes include protect, restrict, and shutdown.

Which authentication factor category does a hardware token or smartphone authenticator app represent?

• a.Something you have✓
• b.Something you know
• c.Something you are
• d.Somewhere you are

A hardware token or authenticator app is a 'something you have' factor, since it is a physical or possessed item. Passwords are 'something you know' and biometrics are 'something you are.' Combining factor categories creates multifactor authentication.

Which feature validates DHCP messages and blocks rogue DHCP servers on untrusted switch ports?

• a.Port mirroring
• b.MAC filtering
• c.DHCP snooping✓
• d.Link aggregation

DHCP snooping designates trusted and untrusted ports, dropping DHCP server responses on untrusted ports to block rogue DHCP servers. It also builds a binding table used by Dynamic ARP Inspection. This protects clients from receiving malicious configuration.

Which social engineering attack uses fraudulent emails that appear legitimate to trick users into revealing credentials?

• a.Dumpster diving
• b.Tailgating
• c.Phishing✓
• d.Shoulder surfing

Phishing uses deceptive emails impersonating trusted entities to lure users into disclosing credentials or clicking malicious links. Targeted variants include spear phishing and whaling. User awareness training is a primary defense.

Which security model assumes no implicit trust and verifies every request regardless of network location?

• a.Flat network model
• b.Zero trust✓
• c.Perimeter security
• d.Open access model

Zero trust assumes no user or device is inherently trusted, requiring continuous verification of every access request regardless of location. It shifts security away from a trusted internal perimeter. Microsegmentation and strong identity verification support the model.

Which trio of goals forms the foundational model for information security?

• a.Confidentiality, integrity, and availability✓
• b.People, process, and technology
• c.Authentication, authorization, and accounting
• d.Prevention, detection, and response

The CIA triad of confidentiality, integrity, and availability is the foundational model that security controls aim to uphold. Confidentiality protects secrecy, integrity protects accuracy, and availability keeps resources accessible. Most controls map to one or more of these goals.

A file's SHA-256 hash is compared before and after transfer to confirm it was not altered. Which security goal does this protect?

• a.Availability
• b.Non-repudiation
• c.Integrity✓
• d.Confidentiality

Comparing hashes verifies integrity, confirming that data has not been changed in transit. Confidentiality would involve encryption, and availability concerns uptime. A matching hash proves the file is identical to the original.

A successful DDoS attack that makes a website unreachable primarily violates which security goal?

• a.Availability✓
• b.Integrity
• c.Authentication
• d.Confidentiality

A DDoS attack targets availability by overwhelming a service so legitimate users cannot reach it. It does not necessarily expose or alter data. Availability is the CIA goal most directly harmed by denial-of-service attacks.

Which framework encompasses verifying identity, granting permissions, and logging user actions?

• a.Public key infrastructure
• b.AAA (authentication, authorization, and accounting)✓
• c.Spanning Tree Protocol
• d.The CIA triad

AAA stands for authentication (proving identity), authorization (granting appropriate access), and accounting (logging activity). Protocols like RADIUS and TACACS+ implement AAA. It provides a complete model for controlling and auditing access.

Layering firewalls, segmentation, endpoint protection, and access controls so no single failure is catastrophic describes which strategy?

• a.Security through obscurity
• b.Flat networking
• c.Single sign-on
• d.Defense in depth✓

Defense in depth layers multiple independent controls so that if one fails, others still protect the asset. It assumes no single safeguard is perfect. This layered approach is a core principle of resilient security architecture.

What distinguishes a distributed denial-of-service attack from a simple denial-of-service attack?

• a.It always uses encryption to hide
• b.It only targets DNS servers
• c.It floods the target from many compromised sources at once✓
• d.It exploits a single software bug

A DDoS attack uses many compromised systems, often a botnet, to flood the target simultaneously, making it far harder to block than a single-source DoS. The distributed nature overwhelms defenses and disguises the true origin. Mitigation typically requires upstream scrubbing or filtering services.

An attacker secretly relays and can alter traffic between two parties who believe they communicate directly. What is this called?

• a.A port scan
• b.A ransomware attack
• c.A brute-force attack
• d.An on-path (man-in-the-middle) attack✓

An on-path attack, historically called man-in-the-middle, positions the attacker between two parties to intercept and possibly modify traffic. Techniques include ARP poisoning and rogue access points. Strong encryption and mutual authentication defend against it.

Which attack abuses the native VLAN by adding two 802.1Q tags so a frame reaches a VLAN the attacker should not access?

• a.VLAN hopping via double tagging✓
• b.DHCP starvation
• c.ARP poisoning
• d.MAC flooding

Double-tagging VLAN hopping inserts two 802.1Q tags so the first is stripped by the native VLAN and the inner tag delivers the frame to a target VLAN. Setting the native VLAN to an unused ID and not using VLAN 1 mitigates it. Explicitly tagging the native VLAN also helps.

An attacker sets up an access point advertising the corporate SSID to lure clients into connecting. What is this called?

• a.A captive portal
• b.A jump box
• c.A honeypot
• d.An evil twin✓

An evil twin is a rogue access point impersonating a legitimate SSID to trick users into connecting so the attacker can intercept traffic or harvest credentials. It is a form of on-path attack. Client certificate validation and WPA3-Enterprise reduce the risk.

Which wireless attack sends spoofed management frames to force clients to disconnect from a legitimate access point?

• a.War driving
• b.Smurf attack
• c.Bluesnarfing
• d.Deauthentication attack✓

A deauthentication attack forges 802.11 management frames to kick clients off an AP, causing denial of service or pushing them toward an evil twin. Protected Management Frames (802.11w) defend against it. WPA3 mandates management frame protection.

An attacker inserts a forged record into a resolver's cache so users are sent to a malicious IP for a legitimate domain. What is this?

• a.Session hijacking
• b.ARP spoofing
• c.DNS cache poisoning✓
• d.SYN flood

DNS cache poisoning plants false records in a resolver so users of a legitimate domain are redirected to attacker-controlled addresses. DNSSEC, which cryptographically signs records, is the primary defense. It undermines trust in name resolution.

An unauthorized person follows an employee through a badge-controlled door without presenting credentials. Which technique is this?

• a.Dumpster diving
• b.Phishing
• c.Tailgating✓
• d.Shoulder surfing

Tailgating (or piggybacking) is when an unauthorized person slips through a secured door behind an authorized one. Access control vestibules and security awareness reduce it. It is a physical social-engineering technique.

Watching a user type their password over their shoulder to steal it is an example of which technique?

• a.Shoulder surfing✓
• b.Whaling
• c.Pretexting
• d.Vishing

Shoulder surfing is directly observing someone entering credentials or sensitive data. Privacy screens, positioning, and awareness counter it. It requires no technical tools, only proximity.

Which attack sends many TCP SYN packets without completing the handshake, exhausting a server's connection table?

• a.Ping of death
• b.ARP poisoning
• c.SYN flood✓
• d.Cross-site scripting

A SYN flood sends numerous SYN requests but never completes the three-way handshake, filling the server's half-open connection table until it can accept no new sessions. SYN cookies and rate limiting mitigate it. It is a classic denial-of-service technique.

An attacker changes their NIC's hardware address to bypass a MAC-based allow list. What is this technique called?

• a.Port mirroring
• b.DNS tunneling
• c.IP spoofing
• d.MAC spoofing✓

MAC spoofing alters a device's hardware address to impersonate an allowed device and defeat MAC filtering. Because MAC filtering is easily bypassed this way, it is considered weak on its own. Strong authentication such as 802.1X is far more reliable.

Which attack sends small spoofed queries to open DNS or NTP servers so large responses flood a victim?

• a.Tailgating
• b.MAC flooding
• c.Evil twin
• d.Reflection and amplification attack✓

A reflection and amplification attack spoofs the victim's source address in small queries to open servers, which reply with much larger responses aimed at the victim. DNS and NTP are common amplifiers. Disabling open recursion and rate limiting reduce exposure.

Which switch-hardening practice prevents an intruder from simply plugging into an unused wall jack and reaching the network?

• a.Using the default VLAN 1 on all ports
• b.Enabling all ports by default
• c.Administratively shutting down unused ports✓
• d.Broadcasting the SSID everywhere

Disabling or shutting down unused switch ports stops someone from gaining access by plugging into a live but unmonitored jack. Ports can also be placed in an unused, isolated VLAN. This is a basic but effective network-hardening step.

What is the most important first hardening step after installing a new network appliance?

• a.Disable logging to save disk space
• b.Enable Telnet for easy access
• c.Change the default administrative credentials✓
• d.Open all firewall ports temporarily

Default credentials are widely published, so changing the default administrator username and password is the essential first hardening step on any new device. Leaving defaults invites trivial compromise. Disabling insecure services like Telnet should follow.

Which feature uses the DHCP snooping binding table to drop forged ARP replies and stop ARP poisoning?

• a.PortFast
• b.Dynamic ARP Inspection✓
• c.Split tunneling
• d.Band steering

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table and drops those with spoofed IP-to-MAC mappings. This defeats ARP poisoning and on-path attacks. It depends on DHCP snooping being enabled first.

Which solution checks a device's identity and health, such as patch level and antivirus, before allowing it onto the network?

• a.Network access control (NAC)✓
• b.A load balancer
• c.A syslog server
• d.A content delivery network

Network access control (NAC) enforces posture assessment, checking a device's identity and health before granting access, and can quarantine non-compliant devices. It integrates with 802.1X and can remediate before admission. NAC keeps risky endpoints off the production network.

Which decoy system is deliberately exposed to attract and study attackers away from production assets?

• a.A proxy server
• b.A jump box
• c.A honeypot✓
• d.A screened subnet

A honeypot is a decoy system made attractive to attackers so their activity can be observed and diverted from real assets. It provides early warning and threat intelligence. A network of honeypots is called a honeynet.

Placing IoT devices on their own isolated VLAN so a compromise cannot easily reach servers is an example of what?

• a.Network segmentation✓
• b.Link aggregation
• c.Port mirroring
• d.Load balancing

Network segmentation divides the network into isolated zones so a breach in one, such as vulnerable IoT devices, cannot easily spread to critical systems. It limits lateral movement and shrinks the attack surface. VLANs and firewalls commonly enforce segmentation.

Which physical control uses two interlocking doors so only one person is admitted at a time, preventing tailgating?

• a.Faraday cage
• b.Asset tag
• c.Access control vestibule (mantrap)✓
• d.Bollard

An access control vestibule, formerly called a mantrap, uses two interlocking doors so only one authenticated person passes at a time, blocking tailgating. Bollards stop vehicles, and Faraday cages block electromagnetic signals. The vestibule specifically controls pedestrian entry.

Which physical security measure best prevents unauthorized removal of switches from a wiring closet?

• a.Enabling WPA3 encryption
• b.Disabling SSID broadcast
• c.Locking equipment racks and the closet door✓
• d.Shortening the DHCP lease time

Physically locking racks and the wiring-closet door prevents theft or tampering with network hardware. Logical controls like encryption or DHCP settings do nothing against physical removal. Physical and logical security must work together.

Within IPsec, which protocol provides confidentiality by encrypting the payload rather than only authenticating it?

• a.GRE
• b.ESP (Encapsulating Security Payload)✓
• c.IKE only
• d.AH (Authentication Header)

ESP encrypts the payload to provide confidentiality, and can also offer integrity and authentication. AH provides integrity and authentication but no encryption. IKE negotiates the keys, and GRE is an unencrypted tunneling protocol.

Which VPN type permanently connects two office networks over the internet so hosts communicate as if on one network, without client software on each device?

• a.Site-to-site VPN✓
• b.Host-to-host VPN
• c.Full-tunnel client VPN
• d.Clientless SSL VPN

A site-to-site VPN links two networks through gateways, encrypting traffic between locations so hosts communicate transparently without individual client software. It is typically always on between offices. Remote-access VPNs, by contrast, connect individual users.

A remote user's VPN sends only corporate-bound traffic through the tunnel while internet browsing goes directly out. Which configuration is this?

• a.Full tunnel
• b.Clientless VPN
• c.Split tunnel✓
• d.Site-to-site tunnel

Split tunneling routes only traffic destined for the corporate network through the VPN while other traffic goes directly to the internet. It saves bandwidth but reduces visibility and control over general browsing. Full tunnel sends all traffic through the VPN for tighter security.

Which remote-access method lets a user reach internal web applications through an HTTPS portal without installing a dedicated VPN client?

• a.Clientless SSL/TLS VPN✓
• b.GRE tunnel
• c.IPsec site-to-site VPN
• d.L2TP tunnel

A clientless SSL/TLS VPN provides access to internal web applications through a standard browser over HTTPS, with no dedicated client software. It is convenient for occasional access from untrusted devices. Full VPN clients are still preferred for broad, native network access.

Administrators connect to a single hardened, monitored host and from there manage sensitive servers. What is this host called?

• a.A honeypot
• b.A proxy cache
• c.A load balancer
• d.A jump box (bastion host)✓

A jump box, or bastion host, is a hardened, closely monitored system through which administrators access sensitive segments. Funneling admin access through it centralizes logging and control. It reduces direct exposure of critical systems to the broader network.

A login that requires a password plus a one-time code from an authenticator app satisfies which security concept?

• a.Single sign-on
• b.Multifactor authentication✓
• c.Federation
• d.Role-based access control (RBAC)

Multifactor authentication combines factors from different categories, here something you know (the password) and something you have (the authenticator app). This makes a stolen password alone insufficient. Requiring distinct factor types is what makes it multifactor.

Which AAA protocol separates authentication, authorization, and accounting and encrypts the entire packet body, making it popular for device administration?

• a.TACACS+✓
• b.Kerberos
• c.LDAP
• d.RADIUS

TACACS+ separates the three AAA functions and encrypts the full payload, giving granular command authorization prized for network device administration. RADIUS combines authentication and authorization and encrypts only the password. TACACS+ also runs over TCP for reliability.

Which AAA protocol is commonly paired with 802.1X to authenticate wired and wireless clients and encrypts only the password field?

• a.TACACS+
• b.SNMPv3
• c.RADIUS✓
• d.SAML

RADIUS is widely used with 802.1X to authenticate network clients and encrypts only the password within its packets. It combines authentication and authorization and runs over UDP. It is the standard back end for enterprise Wi-Fi and NAC.

Which 802.1X authentication method requires a digital certificate on both the client and the server, avoiding passwords entirely?

• a.Open authentication
• b.PSK
• c.EAP-TLS✓
• d.PAP

EAP-TLS uses mutual certificate authentication, requiring valid certificates on both client and server, so no password is transmitted. This makes it one of the strongest 802.1X methods. It requires a PKI to issue and manage the certificates.

Which capability lets a user authenticate once and then access multiple applications without logging in again?

• a.Least privilege
• b.Multifactor authentication
• c.Single sign-on (SSO)✓
• d.Separation of duties

Single sign-on lets a user authenticate once and gain access to many applications without repeated logins, improving convenience and reducing password fatigue. It is often paired with MFA for strong assurance. Federation extends SSO across organizational boundaries.

Requiring two different administrators to each perform part of a sensitive task so no one person controls it end to end describes which principle?

• a.Least privilege
• b.Separation of duties✓
• c.Zero trust
• d.Defense in depth

Separation of duties splits a sensitive task among multiple people so no single individual can complete it alone, reducing fraud and error. Least privilege limits each person's access, a related but distinct idea. Together they strengthen internal control.