CompTIA Network+ (N10-008): Explain Common Security Concepts

1. Introduction to common network security concepts

Network security is not a bolt-on feature. You see it in how traffic gets allowed or blocked, how we split up the network, how users prove who they are, how we keep an eye out for trouble, and how we manage devices without basically putting a target on them. Every switchport, VLAN, ACL, firewall rule, SSID, VPN tunnel, and management interface changes the security posture one way or another, whether we’re paying attention or not. For Network+ study, the best mindset is practical: what does this control do, what risk does it reduce, and where does it belong?

Exam note: this topic was commonly studied under Network+ N10-008, but that exam has been retired. The concepts remain highly relevant, but current candidates should verify objectives against the active Network+ version, including N10-009 where applicable.

Keep these core terms straight:

• Risk: the chance of loss or damage
• Threat: something capable of causing harm
• Vulnerability: a weakness
• Exploit: the method used to abuse a weakness
• Exposure: how reachable or visible that weakness is
• Identification: claiming an identity, such as entering a username
• Authentication: proving that identity
• Authorization: determining what that identity can do
• Accounting: recording actions

A simple example: an unpatched internet-facing VPN gateway is a vulnerability with high exposure. If there’s a known exploit floating around publicly, the threat level goes up fast. If remote work depends on it, the risk is even higher.

Security also involves trade-offs. IPS inspection, deep logging, VPN encryption, and NAC posture checks definitely make things safer, but they can also add latency, create more admin work, and make onboarding a little painful for users. Good design balances confidentiality, integrity, and availability instead of over-focusing on one at the expense of the others.

2. CIA triad and foundational principles

The CIA triad stands for confidentiality, integrity, and availability.

Confidentiality means only authorized users or systems can view data. In networking terms, that’s things like segmentation, VPNs, TLS, secure Wi-Fi authentication, and keeping the management plane locked down. A guest SSID that can still reach internal printers is a confidentiality failure.

Integrity means data has not been altered without authorization. Hashes, digital signatures, message authentication codes, and certificate checks all help protect integrity. Encryption by itself doesn’t guarantee integrity. Usually, you’re getting integrity from a MAC, authenticated encryption, or a digital signature depending on the protocol. Modern secure protocols often provide both confidentiality and integrity together.

Availability means services remain reachable when needed. Redundant links, HA firewalls, active/standby pairs, clustering, load balancing, UPS units, and first-hop redundancy all help keep services up when something fails. Availability failures are not just outages from accidents; they also include DoS and DDoS attacks.

Three foundational ideas show up constantly:

• Defense in depth: multiple layers of control
• Attack surface reduction: remove unnecessary services, ports, and exposure
• Least functionality: enable only what is required

Example: if a router only needs SSH and SNMPv3 from the management subnet, then Telnet, HTTP, and unused services should be disabled. That reduces attack surface and follows least functionality.

3. Identity, AAA, and access control

AAA stands for authentication, authorization, and accounting. Authentication answers “Who are you?” Authorization answers “What are you allowed to do?” Accounting answers “What did you do?”

IAM extends that idea into centralized identity and access management. Instead of local accounts on every device, organizations often use a directory or identity platform such as Active Directory or LDAP-backed services. Kerberos may also appear conceptually as a centralized authentication mechanism in enterprise environments.

MFA combines factors such as something you know, have, or are. That’s especially important for VPNs, cloud management portals, and privileged admin access. SSO improves usability by letting users authenticate once and access multiple services, while federation allows one trust domain to accept identity assertions from another.

RADIUS and TACACS+ are common AAA protocols. For exam purposes, remember these distinctions:

Deployment details vary by vendor, but that distinction is commonly tested.

Access control models matter too. Least privilege gives only the permissions required. Need to know limits data visibility. Separation of duties prevents one person from controlling every critical step. RBAC assigns permissions by role, rule-based access control uses conditions such as subnet or time, and ABAC makes decisions using multiple attributes such as device type, posture, location, and user role.

Exam trap: RBAC is based on role. Rule-based control is based on conditions, not job titles. ABAC evaluates multiple attributes together.

4. Network Access Control and 802.1X components

802.1X is port-based access control for wired and wireless networks. The three roles are:

• Supplicant: the client device
• Authenticator: the switch or access point
• Authentication server: usually a RADIUS server

The client and authenticator exchange identity information using EAPOL conceptually, and the authenticator forwards the authentication request to RADIUS. If successful, the user or device may be placed into a specific VLAN or policy role.

Common EAP methods include PEAP and EAP-TLS. PEAP usually relies on a server certificate and then carries the user’s credentials inside a protected tunnel. EAP-TLS uses certificates and is generally stronger, but it requires certificate lifecycle management.

NAC adds policy enforcement beyond identity. It can also check things like device posture, patch level, endpoint protection status, or whether the device is actually managed by the organization. A compliant corporate laptop might get normal access, while an unmanaged device may get shoved into a guest or remediation VLAN instead. Some non-802.1X devices such as printers, phones, and IoT systems may require exceptions, MAC Authentication Bypass, or dedicated VLANs.

Common troubleshooting flow: if a user cannot join the network, check the supplicant settings, switch or AP authenticator status, RADIUS reachability, and directory or policy results in that order.

5. Common threats, attacks, and indicators

Network+ expects you to recognize common threats and map them to the best control.

• Phishing / social engineering: tricks users into giving up credentials or running malware. Mitigate with MFA, filtering, and training.
• Malware / ransomware / botnets: spreads through phishing, weak patching, or poor segmentation. Mitigate with patching, endpoint protection, and least privilege.
• Credential attacks: brute force, password spraying, credential stuffing. Mitigate with MFA, lockout policies, monitoring, and strong password practices.
• MITM / on-path attacks: traffic is intercepted or redirected. Mitigate with TLS, certificate validation, VPNs, and anti-spoofing controls.
• ARP spoofing: false ARP replies redirect local traffic. Symptoms include intermittent gateway problems or duplicate MAC anomalies.
• Rogue DHCP: unauthorized DHCP offers hand out bad gateway or DNS settings. Symptoms include sudden wrong addressing or users landing on the wrong network.
• MAC spoofing: attacker changes a MAC address to impersonate another device or bypass weak controls.
• VLAN hopping: attempts to cross VLAN boundaries through switch misconfiguration or tagging abuse.
• DNS poisoning / spoofing: users are redirected to malicious destinations.
• Rogue AP vs evil twin: a rogue AP is unauthorized wireless equipment on the network; an evil twin impersonates a legitimate SSID to trick users.
• Deauthentication / disassociation attacks: wireless clients are forced off the network.
• DoS / DDoS: overwhelm services and reduce availability.
• Zero-day: exploit for a vulnerability before defenders are prepared or before a patch is available.

Best-control examples: stop rogue DHCP with DHCP snooping; reduce ARP spoofing with Dynamic ARP Inspection; require per-user Wi-Fi authentication with 802.1X and RADIUS; centralize router admin logging with TACACS+.

6. Segmentation, Layer 2/3 protections, and DMZ design

Segmentation reduces blast radius by dividing the network into trust zones. That might be physical segmentation, logical segmentation with VLANs, a separate management network, a DMZ, or even microsegmentation in more advanced environments. VLANs provide logical separation at Layer 2, but policy enforcement between VLANs happens through Layer 3 devices, ACLs, or firewalls.

A typical design separates users, servers, voice, guest, IoT, and management. Guest networks should be denied access to all internal networks and allowed only required internet-bound traffic. Management networks should be reachable only from authorized admin systems.

ACLs filter traffic by source, destination, port, and protocol. Rule order matters. More specific permit rules usually come before broader deny rules, and you’ll often see an implicit deny at the end. A least-privilege example is: allow management subnet to SSH and HTTPS to network devices, allow users to application servers only on required ports, deny users to management VLAN, deny guest to internal networks.

DMZ means a separate security zone for public-facing services. It is not safe by default; it is simply isolated. Traffic into the DMZ and from the DMZ toward internal networks should be tightly controlled. A public web server might accept HTTPS from the internet, then be allowed to reach an internal database only on a specific backend port. It should not have unrestricted access to the LAN. Common patterns include a single firewall with multiple zones or dual-firewall screened subnet designs, often with a reverse proxy in front of the application.

Important Layer 2 protections include:

• Port security: limits learned MAC addresses; common violation modes include protect, restrict, and shutdown
• DHCP snooping: marks trusted ports and blocks rogue DHCP on untrusted ports
• Dynamic ARP Inspection (DAI): validates ARP traffic, often using DHCP snooping bindings
• BPDU Guard / Root Guard: helps protect spanning tree integrity
• Storm control: limits broadcast, multicast, or unknown unicast floods
• Disable unused ports and place them in a parking VLAN

Port security is useful for fixed devices, but it can create issues with phones, docking stations, pass-through devices, or virtualized hosts if not tuned correctly.

At Layer 3, anti-spoofing controls include ingress filtering, egress filtering, and source validation such as uRPF where supported.

7. Security devices, monitoring, and secure management

Security controls can be preventive, detective, corrective, deterrent, or compensating. Firewalls and NAC are preventive. IDS and SIEM are detective. Backups and failover are corrective. Warning banners are deterrent. A jump host may act as a compensating control.

Firewalls enforce policy between zones. IDS commonly monitors mirrored SPAN or TAP traffic out-of-band and alerts. IPS is inline and can drop or reject traffic, but it must be tuned to reduce false positives and avoid disrupting production. Proxies, content filtering, and access-control filtering provide visibility and control over outbound access. VPN gateways terminate remote-access or site-to-site tunnels.

Logging and visibility matter just as much as blocking. Devices often send syslog to a collector or SIEM. SNMP traps/informs can report important events. SIEM platforms correlate logs from firewalls, VPNs, switches, servers, and identity systems so you can actually see the bigger picture instead of staring at one lonely alert. Accurate timestamps require NTP; without time synchronization, log correlation becomes unreliable.

Secure management deserves special attention. Use SSH instead of Telnet, HTTPS instead of HTTP, SFTP instead of FTP, and SNMPv3 instead of SNMPv1/v2c. SNMPv1 and SNMPv2c rely on community strings, so they don’t give you strong authentication or encryption. SNMPv3 adds authentication, integrity, and optional privacy protection. At a high level, remember authNoPriv means authentication without encryption, and authPriv adds encryption.

SFTP is not the same as FTPS. SFTP runs over SSH. FTPS is FTP protected with TLS.

Hardening steps include restricting management access by ACL to admin subnets, using MFA for remote admin access, disabling unused services, enforcing session timeouts, preferring key-based SSH where possible, disabling old TLS versions and weak ciphers, and keeping configuration backups.

8. Encryption, PKI, wireless security, and VPN basics

Encryption protects confidentiality. Hashing supports integrity. Digital signatures support integrity and authenticity. For password verification, secure systems use salted password hashing or KDFs such as bcrypt, scrypt, or PBKDF2 rather than plain unsalted hashes.

PKI manages trust using certificates. A CA issues and signs certificates. Clients validate certificates by checking the trust chain, validity period, hostname, and sometimes revocation status through CRL or OCSP. A trust chain usually includes a root CA and one or more intermediate CAs. A CSR is used to request a certificate. In practice, missing intermediates, expired certificates, hostname mismatches, or incorrect time settings often break trust.

Certificate troubleshooting basics: if a VPN or HTTPS service suddenly fails, check expiration, SAN/CN hostname matching, trusted issuer, client time and NTP, missing intermediate CA certificates, and revocation reachability. Some clients warn; others fail hard.

Wireless security is a major exam topic. WEP is obsolete and insecure. WPA2-Enterprise remains widely used and secure when properly configured. WPA3-Personal uses SAE instead of the older PSK exchange, improving resistance to offline password guessing. WPA3-Enterprise strengthens enterprise authentication options.

For enterprise Wi-Fi, know the difference between PEAP and EAP-TLS, and remember that dynamic VLAN assignment can place users into different network segments after authentication. Guest wireless should live on its own SSID with firewall isolation, and you can add a captive portal if the business needs it. A captive portal is useful for guest workflow, but it is not the same thing as strong authentication.

For VPNs, distinguish remote access from site-to-site, and understand split tunnel versus full tunnel. A common troubleshooting issue is an IPsec mismatch in peer settings, authentication method, proposal, or phase parameters.

9. Integrated branch-office example and troubleshooting guide

Consider a 40-user branch office. A solid design includes a firewall at the edge, VLANs for users, voice, IoT/printers, guest, servers if needed, and management, plus secure Wi-Fi and remote-access VPN with MFA. Wired and wireless corporate access use 802.1X with RADIUS. Guest Wi-Fi has internet-only access. Management interfaces are reachable only from the management subnet. Switches use DHCP snooping, DAI where supported, BPDU Guard on edge ports, and unused ports are disabled.

Use this quick troubleshooting matrix:

Exam-style distinctions to memorize: authentication is not authorization; IDS detects while IPS blocks; VLAN separates while ACL filters; NAC decides whether a device should be allowed on at all; encryption hides data while hashing detects change; rogue AP is unauthorized infrastructure while evil twin impersonates a legitimate network.

If you can explain what a control does, why it fits a specific threat, and how to troubleshoot it when it fails, you are thinking like both a network technician and a security-minded administrator. That is exactly what this objective is trying to build.