Worth 14% of the CompTIA Network+ (N10-009) exam. CertClue has 54 questions on this objective.
Physical access defeats most logical controls, so Network+ expects awareness of how equipment rooms and devices are protected and monitored.
Exam tip. If an attacker has physical access to a switch console, no logical hardening on that device is sufficient. Physical security is the expected answer in those scenarios.
Objective 4.1 covers foundational security concepts. These principles recur throughout the domain, and most security questions are really asking which principle a described control implements.
Exam tip. Map the described control back to CIA. Questions that seem to be about a product are usually testing which of the three goals that product addresses.
Objective 4.2 covers attack types. Each has a distinctive symptom, so learn what an administrator would actually observe rather than only the definition.
Exam tip. Learn the attack-to-mitigation pairs above as pairs. Network+ asks for the specific switch feature that stops a named layer 2 attack far more often than it asks for a definition.
Objective 4.3 covers hardening. The expected answers reduce attack surface: turn off what is unused, change what is default, and encrypt what is in transit.
Exam tip. Disabling unused switch ports is a frequently correct answer for preventing unauthorised physical connection, and it is cheaper than the alternatives usually offered.
Segmentation limits how far an intrusion can spread. Questions describe systems that should not reach each other and expect the appropriate isolation mechanism.
Exam tip. Unpatchable devices such as cameras, printers and industrial controllers are almost always answered with segmentation rather than with patching or endpoint protection.
Network+ covers the protocols behind authentication, not just the concept. Know which protocol serves network access, which serves device administration, and which underpins single sign-on.
Exam tip. TACACS+ versus RADIUS is a reliable exam distinction: TACACS+ encrypts the whole packet and separates the AAA functions, making it the answer for administrative access control.
Objective 4.1 includes the governance side of security. Know the vocabulary of risk assessment and the major regulations by what data they protect.
Exam tip. Vulnerability scan versus penetration test is commonly confused. A scan identifies possible weaknesses; a penetration test exploits them to demonstrate real impact.
Free, with the answer and the reasoning. No account needed.
1. Which switch feature validates ARP responses against known DHCP bindings to prevent on-path attacks?
Dynamic ARP inspection checks ARP messages against the DHCP snooping binding table and discards those that do not match, defeating ARP poisoning. Snooping builds the table but does not itself inspect ARP, BPDU guard protects spanning tree, and storm control limits broadcast rates.
2. A company grants each employee only the specific network and system access required to perform their job, nothing more. Which security principle does this reflect?
The principle of least privilege grants users only the minimum access necessary to perform their job functions, reducing the potential damage from a compromised account. Defense in depth layers multiple independent security controls, a honeypot is a decoy system to attract attackers, and network segmentation divides a network into isolated zones - related but distinct concepts.
The full CompTIA Network+ bank, the study notes behind these summaries, and a readiness score that tells you which objective to revise next. Free, no paid tier.
Take the free CompTIA Network+ practice test