4.1 - Network security concepts (802.1X, AAA, Zero Trust)
Network+ N10-009 objective 4.1 covers foundational network security concepts. IEEE 802.1X provides port-based access control on a switch port or wireless network, so a device must authenticate before it can send traffic. Zero Trust assumes no user or device is trusted by default and verifies every request. Defense in depth layers multiple independent controls so no single failure is fatal. For AAA, TACACS+ encrypts the entire packet and separates authentication, authorization and accounting, which suits device administration, while RADIUS is common for network access. You should also know least privilege, network segmentation, honeypots and the CIA triad applied to networks. Expect scenario questions that describe authenticating a port, distrusting everything by default, layering controls, or choosing an AAA protocol, and ask which security concept - 802.1X, Zero Trust, defense in depth or TACACS+ - fits.
Port must authenticate before sending = 802.1X. Trust nothing, verify all = Zero Trust. Layered independent controls = defense in depth. AAA that encrypts the whole packet, splits auth/authz = TACACS+.
Practice questions
1. What does IEEE 802.1X provide on a switch port or wireless network?
- Port-based access control (correct answer)
- Wireless data encryption
- Spanning-tree loop prevention
- VLAN trunk tagging
802.1X is port-based Network Access Control: a device must authenticate (via a RADIUS server) before the port passes traffic. It uses supplicant/authenticator/authentication server.
2. Which AAA protocol encrypts the entire packet and separates authentication from authorization?
- RADIUS
- Kerberos
- TACACS+ (correct answer)
- LDAP
TACACS+ (TCP 49) encrypts the whole payload and splits authentication, authorization and accounting, favored for device administration. RADIUS encrypts only the password and uses UDP.
3. Which UDP ports does RADIUS commonly use for authentication and accounting?
- 1812 and 1813 (correct answer)
- 49 and 50
- 88 and 464
- 389 and 636
RADIUS uses UDP 1812 for authentication and 1813 for accounting. TCP 49 is TACACS+, 88 is Kerberos, 389/636 are LDAP/LDAPS.
4. Which security model assumes no user or device is trusted by default?
- Defense in depth
- Least privilege
- Implicit trust
- Zero trust (correct answer)
Zero trust never assumes trust based on network location; it verifies every request continuously. Defense in depth layers controls; least privilege limits rights.
5. Which practice divides a network into zones to limit lateral movement?
- Segmentation (correct answer)
- Port mirroring
- Load balancing
- NAT
Segmentation splits the network into zones (VLANs/subnets/firewalls) so a breach in one zone cannot freely spread. Port mirroring copies traffic; NAT translates addresses.
6. Which principle layers multiple independent controls so no single failure is fatal?
- Least privilege
- Zero trust
- Separation of duties
- Defense in depth (correct answer)
Defense in depth stacks layered controls (firewall, IPS, segmentation, MFA) so one bypassed control does not compromise everything. Least privilege limits rights.