4.3 - Network security devices (NAC, NGFW, IDS)
Network+ N10-009 objective 4.3 covers the devices that enforce network security. Network access control (NAC) checks a device's posture - patches, antivirus, configuration - before granting network access, quarantining non-compliant hosts. A next-generation firewall (NGFW) adds application awareness, intrusion prevention and identity to traditional packet filtering, deciding by app rather than just port. An IDS passively monitors a copy of traffic and only alerts on threats, while an IPS blocks in-line; know that difference. A unified threat management (UTM) appliance bundles firewall, antivirus, IPS and content filtering into one box, convenient for smaller sites. You should also know proxies, VPN concentrators and jump servers. Expect scenario questions that describe checking posture, filtering by application, passively alerting versus blocking, or an all-in-one appliance, and ask which security device - NAC, NGFW, IDS or UTM - fits.
Check device posture before access = NAC. Firewall with app awareness + IPS + identity = NGFW. Passive, copy of traffic, only alerts = IDS (IPS blocks in-line). All-in-one FW/AV/IPS/filter = UTM.
Practice questions
1. Which protocol suite creates encrypted tunnels for site-to-site VPNs at Layer 3?
- RADIUS
- SNMPv3
- IPsec (correct answer)
- HTTPS
IPsec secures IP traffic with AH (integrity) and ESP (encryption), used for site-to-site and client VPNs. RADIUS is AAA, SNMPv3 is device management, HTTPS secures web sessions.
2. Which hardened host is the single controlled entry point for administering internal servers?
- Decoy honeypot host
- Jump box (bastion) (correct answer)
- DNS forwarder host
- Server load balancer
A jump box/bastion host is a hardened, logged gateway admins connect through to reach internal systems, shrinking exposure. A honeypot is a decoy, not an admin path.
3. Which device inspects traffic and actively blocks detected attacks inline?
- IDS
- Proxy
- IPS (correct answer)
- Syslog server
An IPS sits inline and can drop malicious traffic in real time. An IDS only detects and alerts (out of band); a proxy relays sessions.
4. Which firewall type tracks the state of connections to allow return traffic?
- Packet filter (stateless)
- Stateful firewall (correct answer)
- Proxy cache
- Hub
A stateful firewall tracks connection state so replies to allowed outbound sessions are permitted automatically. A stateless packet filter checks each packet in isolation.
5. Which appliance sits between users and the web to filter and cache requests?
- Load balancer
- Reverse proxy
- Forward proxy (correct answer)
- IDS sensor
A forward proxy sits in front of internal clients to filter, log and cache their outbound web requests. A reverse proxy fronts servers for inbound traffic.
6. Which control checks device posture (patches, AV) before granting network access?
- ACL
- VPN
- DMZ
- NAC (correct answer)
NAC (Network Access Control) checks identity and posture and can quarantine noncompliant devices. An ACL filters traffic; a DMZ is a screened zone.