CompTIA Network+ N10-009 Device Hardening NAC 802.1X ACL Filtering And Zones Practice Test

 

Objective 4.3 • 25 original questions

This CompTIA Network+ N10-009 practice test focuses on network security features and defense techniques. All questions are original ExamSnap scenarios aligned to the current N10-009 blueprint; they are not copied from CompTIA exam content. Use the complete N10-009 collection for broader practice across all five domains. For broader exam preparation, review the CompTIA Network+ N10-009 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to harden a device by eliminating functions that are not needed. Which option is the best fit? The decision applies to a branch-office rollout.

1. Content filtering
2. Change default passwords
3. Screened subnet
4. MAC filtering
5. Disable unused ports/services

Correct answer: E

Why: Reduces attack surface by removing unnecessary listening services and switch interfaces. This directly satisfies the requirement: harden a device by eliminating functions that are not needed.

Option review:

A: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: harden a device by eliminating functions that are not needed.

B: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: harden a device by eliminating functions that are not needed.

C: Places public-facing services in an isolated perimeter segment between trust zones. However, it does not most directly satisfy the requirement in this scenario: harden a device by eliminating functions that are not needed.

D: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: harden a device by eliminating functions that are not needed.

E: Reduces attack surface by removing unnecessary listening services and switch interfaces. This directly satisfies the requirement: harden a device by eliminating functions that are not needed.

Learning point: Use Disable unused ports/services when the key requirement is to harden a device by eliminating functions that are not needed.

Question 2

A ticket at Woodgrove Bank says the team must remove an obvious credential weakness on newly deployed devices. Which technology or concept most directly addresses this requirement? The decision applies to a campus refresh.

802. 802.1X
803. Content filtering
804. Untrusted zone
805. Change default passwords
806. Key management

Correct answer: D

Why: Prevents attackers from using widely known vendor default credentials. This directly satisfies the requirement: remove an obvious credential weakness on newly deployed devices.

Option review:

A: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: remove an obvious credential weakness on newly deployed devices.

B: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: remove an obvious credential weakness on newly deployed devices.

C: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: remove an obvious credential weakness on newly deployed devices.

D: Prevents attackers from using widely known vendor default credentials. This directly satisfies the requirement: remove an obvious credential weakness on newly deployed devices.

E: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. However, it does not most directly satisfy the requirement in this scenario: remove an obvious credential weakness on newly deployed devices.

Learning point: Use Change default passwords when the key requirement is to remove an obvious credential weakness on newly deployed devices.

Question 3

During a design meeting at Blue Yonder Airlines, the junior network administrator needs to enforce access requirements before allowing a device onto the network. What should be selected? The decision applies to a data-center segment.

1. NAC
2. MAC filtering
3. Screened subnet
4. URL filtering
5. Disable unused ports/services

Correct answer: A

Why: Evaluates endpoint/user access policy before or during network admission. This directly satisfies the requirement: enforce access requirements before allowing a device onto the network.

Option review:

A: Evaluates endpoint/user access policy before or during network admission. This directly satisfies the requirement: enforce access requirements before allowing a device onto the network.

B: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: enforce access requirements before allowing a device onto the network.

C: Places public-facing services in an isolated perimeter segment between trust zones. However, it does not most directly satisfy the requirement in this scenario: enforce access requirements before allowing a device onto the network.

D: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: enforce access requirements before allowing a device onto the network.

E: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: enforce access requirements before allowing a device onto the network.

Learning point: Use NAC when the key requirement is to enforce access requirements before allowing a device onto the network.

Question 4

Contoso Health is updating its network standard. Which option best meets the need to restrict an access switch port to approved endpoint MAC addresses? The decision applies to a remote-site migration.

1. Disable unused ports/services
2. Content filtering
3. NAC
4. Port security
5. Key management

Correct answer: D

Why: Limits which MAC addresses can use a switch port and can take action on violations. This directly satisfies the requirement: restrict an access switch port to approved endpoint MAC addresses.

Option review:

A: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: restrict an access switch port to approved endpoint MAC addresses.

B: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: restrict an access switch port to approved endpoint MAC addresses.

C: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: restrict an access switch port to approved endpoint MAC addresses.

D: Limits which MAC addresses can use a switch port and can take action on violations. This directly satisfies the requirement: restrict an access switch port to approved endpoint MAC addresses.

E: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. However, it does not most directly satisfy the requirement in this scenario: restrict an access switch port to approved endpoint MAC addresses.

Learning point: Use Port security when the key requirement is to restrict an access switch port to approved endpoint MAC addresses.

Question 5

A field technician at Litware Manufacturing is validating a proposed solution. The design must require identity-based authentication before a wired or wireless port grants normal access. Which answer is most appropriate? The decision applies to a operations lab.

1. Change default passwords
2. 802.1X
3. ACL
4. Port security
5. URL filtering

Correct answer: B

Why: Provides port-based network access control using an authenticator, supplicant, and authentication server. This directly satisfies the requirement: require identity-based authentication before a wired or wireless port grants normal access.

Option review:

A: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: require identity-based authentication before a wired or wireless port grants normal access.

B: Provides port-based network access control using an authenticator, supplicant, and authentication server. This directly satisfies the requirement: require identity-based authentication before a wired or wireless port grants normal access.

C: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: require identity-based authentication before a wired or wireless port grants normal access.

D: Limits which MAC addresses can use a switch port and can take action on violations. However, it does not most directly satisfy the requirement in this scenario: require identity-based authentication before a wired or wireless port grants normal access.

E: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: require identity-based authentication before a wired or wireless port grants normal access.

Learning point: Use 802.1X when the key requirement is to require identity-based authentication before a wired or wireless port grants normal access.

Question 6

For a new deployment at Woodgrove Bank, the networking team wants to apply a simple device-address allow/deny list where stronger authentication is unavailable. Which choice most directly satisfies the goal? The decision applies to a production maintenance window.

1. Content filtering
2. Untrusted zone
3. Change default passwords
4. MAC filtering
5. Trusted zone

Correct answer: D

Why: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. This directly satisfies the requirement: apply a simple device-address allow/deny list where stronger authentication is unavailable.

Option review:

A: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: apply a simple device-address allow/deny list where stronger authentication is unavailable.

B: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: apply a simple device-address allow/deny list where stronger authentication is unavailable.

C: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: apply a simple device-address allow/deny list where stronger authentication is unavailable.

D: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. This directly satisfies the requirement: apply a simple device-address allow/deny list where stronger authentication is unavailable.

E: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: apply a simple device-address allow/deny list where stronger authentication is unavailable.

Learning point: Use MAC filtering when the key requirement is to apply a simple device-address allow/deny list where stronger authentication is unavailable.

Question 7

At Blue Yonder Airlines, a systems administrator is reviewing a network change. The requirement is to manage cryptographic keys throughout their lifecycle. Which option is the best fit? The decision applies to a new floor deployment.

1. Disable unused ports/services
2. Trusted zone
3. Change default passwords
4. ACL
5. Key management

Correct answer: E

Why: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. This directly satisfies the requirement: manage cryptographic keys throughout their lifecycle.

Option review:

A: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: manage cryptographic keys throughout their lifecycle.

B: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: manage cryptographic keys throughout their lifecycle.

C: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: manage cryptographic keys throughout their lifecycle.

D: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: manage cryptographic keys throughout their lifecycle.

E: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. This directly satisfies the requirement: manage cryptographic keys throughout their lifecycle.

Learning point: Use Key management when the key requirement is to manage cryptographic keys throughout their lifecycle.

Question 8

A ticket at Contoso Health says the team must enforce deterministic Layer 3/4 traffic rules on a router or firewall. Which technology or concept most directly addresses this requirement? The decision applies to a service-recovery review.

1. ACL
2. Untrusted zone
3. Key management
4. Content filtering
5. MAC filtering

Correct answer: A

Why: Permits or denies traffic based on defined packet fields such as addresses and ports. This directly satisfies the requirement: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

Option review:

A: Permits or denies traffic based on defined packet fields such as addresses and ports. This directly satisfies the requirement: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

B: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

C: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. However, it does not most directly satisfy the requirement in this scenario: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

D: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

E: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: enforce deterministic Layer 3/4 traffic rules on a router or firewall.

Learning point: Use ACL when the key requirement is to enforce deterministic Layer 3/4 traffic rules on a router or firewall.

Question 9

During a design meeting at Litware Manufacturing, the junior network administrator needs to prevent users from browsing prohibited web destinations. What should be selected? The decision applies to a branch-office rollout.

1. Disable unused ports/services
2. URL filtering
3. Content filtering
4. Change default passwords
5. ACL

Correct answer: B

Why: Allows or blocks web access based on requested URLs/categories. This directly satisfies the requirement: prevent users from browsing prohibited web destinations.

Option review:

A: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: prevent users from browsing prohibited web destinations.

B: Allows or blocks web access based on requested URLs/categories. This directly satisfies the requirement: prevent users from browsing prohibited web destinations.

C: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: prevent users from browsing prohibited web destinations.

D: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: prevent users from browsing prohibited web destinations.

E: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: prevent users from browsing prohibited web destinations.

Learning point: Use URL filtering when the key requirement is to prevent users from browsing prohibited web destinations.

Question 10

Woodgrove Bank is updating its network standard. Which option best meets the need to filter traffic based on content rather than only addresses/ports? The decision applies to a campus refresh.

1. Content filtering
2. URL filtering
3. ACL
4. MAC filtering
5. Untrusted zone

Correct answer: A

Why: Examines content or categories to block inappropriate or malicious material. This directly satisfies the requirement: filter traffic based on content rather than only addresses/ports.

Option review:

A: Examines content or categories to block inappropriate or malicious material. This directly satisfies the requirement: filter traffic based on content rather than only addresses/ports.

B: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: filter traffic based on content rather than only addresses/ports.

C: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: filter traffic based on content rather than only addresses/ports.

D: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: filter traffic based on content rather than only addresses/ports.

E: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: filter traffic based on content rather than only addresses/ports.

Learning point: Use Content filtering when the key requirement is to filter traffic based on content rather than only addresses/ports.

Question 11

A field technician at Blue Yonder Airlines is validating a proposed solution. The design must apply one policy to systems considered internal/trusted. Which answer is most appropriate? The decision applies to a data-center segment.

1. Trusted zone
2. Disable unused ports/services
3. Change default passwords
4. URL filtering
5. Content filtering

Correct answer: A

Why: Groups systems with a higher trust level under a common security policy boundary. This directly satisfies the requirement: apply one policy to systems considered internal/trusted.

Option review:

A: Groups systems with a higher trust level under a common security policy boundary. This directly satisfies the requirement: apply one policy to systems considered internal/trusted.

B: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: apply one policy to systems considered internal/trusted.

C: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: apply one policy to systems considered internal/trusted.

D: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: apply one policy to systems considered internal/trusted.

E: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: apply one policy to systems considered internal/trusted.

Learning point: Use Trusted zone when the key requirement is to apply one policy to systems considered internal/trusted.

Question 12

For a new deployment at Contoso Health, the networking team wants to apply stricter policy to traffic originating from the public internet. Which choice most directly satisfies the goal? The decision applies to a remote-site migration.

1. Untrusted zone
2. NAC
3. 802.1X
4. ACL
5. URL filtering

Correct answer: A

Why: Represents networks such as the internet that should receive the least implicit trust. This directly satisfies the requirement: apply stricter policy to traffic originating from the public internet.

Option review:

A: Represents networks such as the internet that should receive the least implicit trust. This directly satisfies the requirement: apply stricter policy to traffic originating from the public internet.

B: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: apply stricter policy to traffic originating from the public internet.

C: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: apply stricter policy to traffic originating from the public internet.

D: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: apply stricter policy to traffic originating from the public internet.

E: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: apply stricter policy to traffic originating from the public internet.

Learning point: Use Untrusted zone when the key requirement is to apply stricter policy to traffic originating from the public internet.

Question 13

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to host internet-facing servers without placing them directly on the internal LAN. Which option is the best fit? The decision applies to a operations lab.

1. Disable unused ports/services
2. URL filtering
3. Trusted zone
4. 802.1X
5. Screened subnet

Correct answer: E

Why: Places public-facing services in an isolated perimeter segment between trust zones. This directly satisfies the requirement: host internet-facing servers without placing them directly on the internal LAN.

Option review:

A: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: host internet-facing servers without placing them directly on the internal LAN.

B: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: host internet-facing servers without placing them directly on the internal LAN.

C: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: host internet-facing servers without placing them directly on the internal LAN.

D: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: host internet-facing servers without placing them directly on the internal LAN.

E: Places public-facing services in an isolated perimeter segment between trust zones. This directly satisfies the requirement: host internet-facing servers without placing them directly on the internal LAN.

Learning point: Use Screened subnet when the key requirement is to host internet-facing servers without placing them directly on the internal LAN.

Question 14

During a branch-office rollout, Woodgrove Bank is comparing several networking concepts. Which option is accurately characterized by this statement: Reduces attack surface by removing unnecessary listening services and switch interfaces.

1. URL filtering
2. ACL
3. Disable unused ports/services
4. MAC filtering
5. Trusted zone

Correct answer: C

Why: Reduces attack surface by removing unnecessary listening services and switch interfaces. This directly satisfies the requirement: Reduces attack surface by removing unnecessary listening services and switch interfaces..

Option review:

A: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: Reduces attack surface by removing unnecessary listening services and switch interfaces..

B: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: Reduces attack surface by removing unnecessary listening services and switch interfaces..

C: Reduces attack surface by removing unnecessary listening services and switch interfaces. This directly satisfies the requirement: Reduces attack surface by removing unnecessary listening services and switch interfaces..

D: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: Reduces attack surface by removing unnecessary listening services and switch interfaces..

E: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Reduces attack surface by removing unnecessary listening services and switch interfaces..

Learning point: Use Disable unused ports/services when the key requirement is to harden a device by eliminating functions that are not needed.

Question 15

During a campus refresh, Blue Yonder Airlines is comparing several networking concepts. Which option is accurately characterized by this statement: Prevents attackers from using widely known vendor default credentials.

1. NAC
2. ACL
3. Content filtering
4. Screened subnet
5. Change default passwords

Correct answer: E

Why: Prevents attackers from using widely known vendor default credentials. This directly satisfies the requirement: Prevents attackers from using widely known vendor default credentials..

Option review:

A: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: Prevents attackers from using widely known vendor default credentials..

B: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: Prevents attackers from using widely known vendor default credentials..

C: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: Prevents attackers from using widely known vendor default credentials..

D: Places public-facing services in an isolated perimeter segment between trust zones. However, it does not most directly satisfy the requirement in this scenario: Prevents attackers from using widely known vendor default credentials..

E: Prevents attackers from using widely known vendor default credentials. This directly satisfies the requirement: Prevents attackers from using widely known vendor default credentials..

Learning point: Use Change default passwords when the key requirement is to remove an obvious credential weakness on newly deployed devices.

Question 16

During a data-center segment, Contoso Health is comparing several networking concepts. Which option is accurately characterized by this statement: Evaluates endpoint/user access policy before or during network admission.

1. Trusted zone
2. NAC
3. Change default passwords
4. Port security
5. Content filtering

Correct answer: B

Why: Evaluates endpoint/user access policy before or during network admission. This directly satisfies the requirement: Evaluates endpoint/user access policy before or during network admission..

Option review:

A: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Evaluates endpoint/user access policy before or during network admission..

B: Evaluates endpoint/user access policy before or during network admission. This directly satisfies the requirement: Evaluates endpoint/user access policy before or during network admission..

C: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: Evaluates endpoint/user access policy before or during network admission..

D: Limits which MAC addresses can use a switch port and can take action on violations. However, it does not most directly satisfy the requirement in this scenario: Evaluates endpoint/user access policy before or during network admission..

E: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: Evaluates endpoint/user access policy before or during network admission..

Learning point: Use NAC when the key requirement is to enforce access requirements before allowing a device onto the network.

Question 17

During a remote-site migration, Litware Manufacturing is comparing several networking concepts. Which option is accurately characterized by this statement: Limits which MAC addresses can use a switch port and can take action on violations.

1. Untrusted zone
2. MAC filtering
3. 802.1X
4. NAC
5. Port security

Correct answer: E

Why: Limits which MAC addresses can use a switch port and can take action on violations. This directly satisfies the requirement: Limits which MAC addresses can use a switch port and can take action on violations..

Option review:

A: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: Limits which MAC addresses can use a switch port and can take action on violations..

B: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: Limits which MAC addresses can use a switch port and can take action on violations..

C: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: Limits which MAC addresses can use a switch port and can take action on violations..

D: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: Limits which MAC addresses can use a switch port and can take action on violations..

E: Limits which MAC addresses can use a switch port and can take action on violations. This directly satisfies the requirement: Limits which MAC addresses can use a switch port and can take action on violations..

Learning point: Use Port security when the key requirement is to restrict an access switch port to approved endpoint MAC addresses.

Question 18

During a operations lab, Woodgrove Bank is comparing several networking concepts. Which option is accurately characterized by this statement: Provides port-based network access control using an authenticator, supplicant, and authentication server.

1. MAC filtering
2. Port security
3. Disable unused ports/services
4. Untrusted zone
5. 802.1X

Correct answer: E

Why: Provides port-based network access control using an authenticator, supplicant, and authentication server. This directly satisfies the requirement: Provides port-based network access control using an authenticator, supplicant, and authentication server..

Option review:

A: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: Provides port-based network access control using an authenticator, supplicant, and authentication server..

B: Limits which MAC addresses can use a switch port and can take action on violations. However, it does not most directly satisfy the requirement in this scenario: Provides port-based network access control using an authenticator, supplicant, and authentication server..

C: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: Provides port-based network access control using an authenticator, supplicant, and authentication server..

D: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: Provides port-based network access control using an authenticator, supplicant, and authentication server..

E: Provides port-based network access control using an authenticator, supplicant, and authentication server. This directly satisfies the requirement: Provides port-based network access control using an authenticator, supplicant, and authentication server..

Learning point: Use 802.1X when the key requirement is to require identity-based authentication before a wired or wireless port grants normal access.

Question 19

During a production maintenance window, Blue Yonder Airlines is comparing several networking concepts. Which option is accurately characterized by this statement: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed.

1. ACL
2. Trusted zone
3. URL filtering
4. Disable unused ports/services
5. MAC filtering

Correct answer: E

Why: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. This directly satisfies the requirement: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

Option review:

A: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

B: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

C: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

D: Reduces attack surface by removing unnecessary listening services and switch interfaces. However, it does not most directly satisfy the requirement in this scenario: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

E: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. This directly satisfies the requirement: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed..

Learning point: Use MAC filtering when the key requirement is to apply a simple device-address allow/deny list where stronger authentication is unavailable.

Question 20

During a new floor deployment, Contoso Health is comparing several networking concepts. Which option is accurately characterized by this statement: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys.

1. NAC
2. Change default passwords
3. Key management
4. URL filtering
5. MAC filtering

Correct answer: C

Why: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. This directly satisfies the requirement: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

Option review:

A: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

B: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

C: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. This directly satisfies the requirement: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

D: Allows or blocks web access based on requested URLs/categories. However, it does not most directly satisfy the requirement in this scenario: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

E: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys..

Learning point: Use Key management when the key requirement is to manage cryptographic keys throughout their lifecycle.

Question 21

During a service-recovery review, Litware Manufacturing is comparing several networking concepts. Which option is accurately characterized by this statement: Permits or denies traffic based on defined packet fields such as addresses and ports.

1. Screened subnet
2. Content filtering
3. Key management
4. ACL
5. 802.1X

Correct answer: D

Why: Permits or denies traffic based on defined packet fields such as addresses and ports. This directly satisfies the requirement: Permits or denies traffic based on defined packet fields such as addresses and ports..

Option review:

A: Places public-facing services in an isolated perimeter segment between trust zones. However, it does not most directly satisfy the requirement in this scenario: Permits or denies traffic based on defined packet fields such as addresses and ports..

B: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: Permits or denies traffic based on defined packet fields such as addresses and ports..

C: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. However, it does not most directly satisfy the requirement in this scenario: Permits or denies traffic based on defined packet fields such as addresses and ports..

D: Permits or denies traffic based on defined packet fields such as addresses and ports. This directly satisfies the requirement: Permits or denies traffic based on defined packet fields such as addresses and ports..

E: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: Permits or denies traffic based on defined packet fields such as addresses and ports..

Learning point: Use ACL when the key requirement is to enforce deterministic Layer 3/4 traffic rules on a router or firewall.

Question 22

During a branch-office rollout, Woodgrove Bank is comparing several networking concepts. Which option is accurately characterized by this statement: Allows or blocks web access based on requested URLs/categories.

1. URL filtering
2. Key management
3. Trusted zone
4. Port security
5. NAC

Correct answer: A

Why: Allows or blocks web access based on requested URLs/categories. This directly satisfies the requirement: Allows or blocks web access based on requested URLs/categories..

Option review:

A: Allows or blocks web access based on requested URLs/categories. This directly satisfies the requirement: Allows or blocks web access based on requested URLs/categories..

B: Controls secure generation, distribution, rotation, storage, and revocation of cryptographic keys. However, it does not most directly satisfy the requirement in this scenario: Allows or blocks web access based on requested URLs/categories..

C: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Allows or blocks web access based on requested URLs/categories..

D: Limits which MAC addresses can use a switch port and can take action on violations. However, it does not most directly satisfy the requirement in this scenario: Allows or blocks web access based on requested URLs/categories..

E: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: Allows or blocks web access based on requested URLs/categories..

Learning point: Use URL filtering when the key requirement is to prevent users from browsing prohibited web destinations.

Question 23

During a campus refresh, Blue Yonder Airlines is comparing several networking concepts. Which option is accurately characterized by this statement: Examines content or categories to block inappropriate or malicious material.

802. 802.1X
803. Content filtering
804. ACL
805. Trusted zone
806. Change default passwords

Correct answer: B

Why: Examines content or categories to block inappropriate or malicious material. This directly satisfies the requirement: Examines content or categories to block inappropriate or malicious material..

Option review:

A: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: Examines content or categories to block inappropriate or malicious material..

B: Examines content or categories to block inappropriate or malicious material. This directly satisfies the requirement: Examines content or categories to block inappropriate or malicious material..

C: Permits or denies traffic based on defined packet fields such as addresses and ports. However, it does not most directly satisfy the requirement in this scenario: Examines content or categories to block inappropriate or malicious material..

D: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Examines content or categories to block inappropriate or malicious material..

E: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: Examines content or categories to block inappropriate or malicious material..

Learning point: Use Content filtering when the key requirement is to filter traffic based on content rather than only addresses/ports.

Question 24

During a data-center segment, Contoso Health is comparing several networking concepts. Which option is accurately characterized by this statement: Groups systems with a higher trust level under a common security policy boundary.

1. Trusted zone
2. 802.1X
3. MAC filtering
4. Untrusted zone
5. Content filtering

Correct answer: A

Why: Groups systems with a higher trust level under a common security policy boundary. This directly satisfies the requirement: Groups systems with a higher trust level under a common security policy boundary..

Option review:

A: Groups systems with a higher trust level under a common security policy boundary. This directly satisfies the requirement: Groups systems with a higher trust level under a common security policy boundary..

B: Provides port-based network access control using an authenticator, supplicant, and authentication server. However, it does not most directly satisfy the requirement in this scenario: Groups systems with a higher trust level under a common security policy boundary..

C: Allows/denies devices based on MAC address but is weaker because MAC addresses can be spoofed. However, it does not most directly satisfy the requirement in this scenario: Groups systems with a higher trust level under a common security policy boundary..

D: Represents networks such as the internet that should receive the least implicit trust. However, it does not most directly satisfy the requirement in this scenario: Groups systems with a higher trust level under a common security policy boundary..

E: Examines content or categories to block inappropriate or malicious material. However, it does not most directly satisfy the requirement in this scenario: Groups systems with a higher trust level under a common security policy boundary..

Learning point: Use Trusted zone when the key requirement is to apply one policy to systems considered internal/trusted.

Question 25

During a remote-site migration, Litware Manufacturing is comparing several networking concepts. Which option is accurately characterized by this statement: Represents networks such as the internet that should receive the least implicit trust.

1. Change default passwords
2. NAC
3. Screened subnet
4. Trusted zone
5. Untrusted zone

Correct answer: E

Why: Represents networks such as the internet that should receive the least implicit trust. This directly satisfies the requirement: Represents networks such as the internet that should receive the least implicit trust..

Option review:

A: Prevents attackers from using widely known vendor default credentials. However, it does not most directly satisfy the requirement in this scenario: Represents networks such as the internet that should receive the least implicit trust..

B: Evaluates endpoint/user access policy before or during network admission. However, it does not most directly satisfy the requirement in this scenario: Represents networks such as the internet that should receive the least implicit trust..

C: Places public-facing services in an isolated perimeter segment between trust zones. However, it does not most directly satisfy the requirement in this scenario: Represents networks such as the internet that should receive the least implicit trust..

D: Groups systems with a higher trust level under a common security policy boundary. However, it does not most directly satisfy the requirement in this scenario: Represents networks such as the internet that should receive the least implicit trust..

E: Represents networks such as the internet that should receive the least implicit trust. This directly satisfies the requirement: Represents networks such as the internet that should receive the least implicit trust..

Learning point: Use Untrusted zone when the key requirement is to apply stricter policy to traffic originating from the public internet.