Introduction
A functioning network delivers traffic. A secure network must also decide which traffic should be permitted, which identities are trusted for which actions, and how to detect or contain misuse. Those choices have consequences for availability and business operations.
Domain 4 covers three official objectives: basic security concepts, attacks and their effects, and defenses that can be applied in real network environments. The exam does not expect you to become a specialist penetration tester. It expects you to understand enough about threats and protections to recognize what is happening and choose a sound control.
Security concepts often overlap with networking concepts. A VLAN is a segmentation mechanism, but segmentation is only effective when the routing and access policies between segments are also correct. Encryption protects data, but it does not replace authentication or authorization.
4.1 — Network security principles and mechanisms
Confidentiality, integrity, and availability
The CIA triad is the foundation of information security:
| Principle | What it protects | Network example |
|---|---|---|
| Confidentiality | Limits disclosure to authorized parties | Encrypting data in transit across an untrusted network |
| Integrity | Helps detect or prevent improper modification | Validating signed configuration artifacts |
| Availability | Keeps services usable when required | Redundant gateways and denial-of-service protection |
A single incident may affect more than one principle. A compromised router that both leaks traffic and blocks service threatens confidentiality and availability.
Encryption, certificates, and PKI
Data in transit is information moving between systems. TLS and appropriately configured VPN technologies can protect it from interception or tampering along relevant paths.
Data at rest is stored information. Disk or volume encryption protects data under certain storage-loss or unauthorized-access scenarios. It does not prevent a legitimately authenticated but compromised application from accessing information it is authorized to decrypt.
A digital certificate binds a public key to identity or other attributes, with assurance depending on the issuing and validating process. Public key infrastructure (PKI) supports issuance, trust chains, validation, lifecycle, and revocation processes.
A self-signed certificate signs itself. It may be useful in controlled trust arrangements, but a client cannot assume it has independent third-party validation merely because it exists. Certificate trust and encryption are different things: an encrypted connection to the wrong endpoint is still a problem.
Identity, authentication, and authorization
Authentication verifies a claimed identity. Authorization decides what that identity may do. Accounting or auditing records relevant activity.
Multifactor authentication (MFA) combines factors from different categories, such as a memorized secret with a hardware security key. Two passwords are two instances of the same knowledge factor, not true multifactor authentication.
Single sign-on (SSO) lets an identity authenticate once and use related services under defined trust relationships. It improves usability but makes identity infrastructure and session protection critically important.
| Technology | Primary role | Avoid this confusion |
|---|---|---|
| RADIUS | Centralized AAA, commonly for network access | Not a directory database by definition |
| TACACS+ | Network-device administration AAA, with command authorization/accounting capabilities | Not simply another name for RADIUS |
| LDAP | Directory access protocol | LDAP alone does not describe every SSO or federation flow |
| SAML | Federation of identity/assertions between parties | Not a transport replacement for LDAP |
| MFA | Stronger verification through multiple factor classes | Does not automatically grant broad authorization |
| RBAC | Permission assignment by role | A role must still be appropriately scoped |
Time-based access can restrict privileges or access to approved periods or conditions. Geofencing uses geographic criteria as one policy signal, but location data can be inaccurate or evaded and should not be mistaken for an identity proof.
Least privilege grants only the permissions necessary for a legitimate purpose. It applies to people, services, devices, APIs, and administrative roles. Network administrators should not use a highly privileged account for ordinary web browsing simply because it is convenient.
Physical security and deception
Locks and cameras protect or observe physical access to networking spaces. Cameras provide evidence and deterrence but cannot physically stop an intruder by themselves. Locks limit entry but require key, badge, and emergency-access management.
A honeypot is a deliberately controlled decoy intended to attract or detect suspicious activity. A honeynet contains multiple such systems or a simulated network. They can provide insight, but must be isolated and managed so they do not become an unauthorized path into production.
Threat, vulnerability, exploit, and risk
These words are related but not interchangeable:
| Term | Meaning |
|---|---|
| Threat | A potential source or event capable of causing harm |
| Vulnerability | A weakness that could be abused or triggered |
| Exploit | A method or action that takes advantage of a weakness |
| Risk | A function of uncertain harmful outcomes, likelihood, impact, and context |
A disclosed software flaw is a vulnerability. An attacker attempting to use it is a threat acting through an exploit. The business's risk depends on exposure, affected systems, compensating controls, and potential consequences.
Audits, compliance, and data locality
Audits evaluate evidence against defined criteria. Regulatory compliance depends on applicable laws and standards, not simply installing a firewall.
PCI DSS is a payment-card security standard relevant to organizations handling cardholder data under its applicability rules. GDPR is European Union data protection law with defined territorial and processing scope. Data locality addresses where data resides, moves, or is processed, including requirements imposed by business, law, or contract. This is educational context, not a legal determination for a specific organization.
Why segmentation matters
Networks may separate employee, guest, management, server, Internet of Things (IoT), and bring-your-own-device (BYOD) traffic. Some environments also contain Industrial IoT (IIoT) and operational systems such as SCADA, industrial control systems (ICS), and other operational technology (OT).
OT environments may have strict availability and safety requirements, older protocols, and constrained change windows. Controls appropriate for a typical office workstation may be unsafe to apply without assessment to a production control system. Segmentation and carefully defined access paths are especially important.
Scenario: A visitor joins guest Wi-Fi and should reach the internet but not employee laptops or industrial controllers. A distinct guest segment with appropriate routing and firewall policy meets that intent more directly than putting everybody on the same trusted VLAN.
4.2 — Common attacks and how they affect networks
The exam tests attack recognition. Understand the symptom and the underlying trust assumption being abused.
Availability attacks
A denial-of-service (DoS) attack tries to overwhelm or otherwise prevent normal use of a service. Distributed DoS (DDoS) uses many participating sources or systems. The sources may be compromised, reflected, or spoofed depending on the attack. A sudden traffic spike alone is not proof of a DDoS attack; legitimate demand can also surge.
Layer 2 manipulation
VLAN hopping attempts to make traffic cross a VLAN boundary in an unintended way, often exploiting switching or trunk assumptions. Proper port roles, native VLAN handling, and segmentation policy matter.
MAC flooding attempts to overwhelm a switch's MAC-learning table so normal forwarding behavior may degrade or change. It is different from a high volume of ordinary broadcast traffic, though both can have operational effects.
ARP spoofing/poisoning introduces false associations between IPv4 addresses and hardware addresses on a local network. It can redirect or disrupt traffic. ARP is limited to relevant local-network behavior and is not how remote internet routers learn arbitrary MAC addresses.
Naming and address assignment attacks
DNS spoofing or poisoning supplies misleading name-resolution information, potentially directing users to an attacker-controlled destination. The terms are closely related but may refer to the falsification of replies versus contamination of resolver state.
A rogue DHCP server can hand out incorrect addresses, gateways, or DNS settings. A rogue wireless access point introduces unauthorized wireless connectivity. An evil twin imitates a legitimate wireless network to trick users into connecting to an attacker-controlled network.
The shared pattern is the abuse of a service or identity the client assumes is legitimate.
On-path and social engineering
An on-path attack places an adversary where they can observe, alter, or interfere with traffic. Encryption with correct endpoint authentication helps protect confidentiality and integrity, but not every possible availability threat.
Social engineering manipulates people or organizational processes:
| Technique | How it works |
|---|---|
| Phishing | Deceptive messages or sites seek credentials, actions, or information |
| Dumpster diving | Gathering discarded sensitive material |
| Shoulder surfing | Observing sensitive activity or credentials in person |
| Tailgating | Following an authorized person into a restricted physical area |
Malware is malicious software that can steal, damage, disrupt, or give unauthorized control. Network symptoms may include unexpected outbound traffic, command-and-control communication, abnormal DNS queries, or service interruption. None of these observations alone proves a particular malware family.
Recognize the pattern
| Observation | Plausible concern | What it does not prove |
|---|---|---|
| Unexpected gateway MAC changes across clients | ARP manipulation or legitimate failover | Malicious intent without other evidence |
| A lookalike SSID near an office | Evil twin or unauthorized AP | Every duplicate-looking SSID is hostile |
| Clients suddenly receive unknown DNS servers | Rogue/misconfigured DHCP | DHCP server compromise without verification |
| Public service overwhelmed from many sources | DDoS or extraordinary demand | Attribution to a specific actor |
This distinction between indicator and conclusion is central to responsible network security.
4.3 — Applying network defenses
No single control solves every attack. A strong design uses several controls that address different failure modes.
Device hardening
Disable unused services and ports to reduce unnecessary exposure. Change default credentials and ensure account access is managed appropriately. Keep relevant firmware and software supported and patched under change control. A service disabled in a configuration file is not proof that it is unreachable from every network segment; verification matters.
Network access control
Network access control (NAC) evaluates whether a device or user should receive network connectivity under defined policies. Depending on architecture, enforcement may involve identity, device posture, VLAN assignment, or restricted access.
802.1X controls access to a port or wireless network using an authenticator and an authentication process, commonly backed by RADIUS. It provides stronger identity-based control than trusting whatever device appears on a cable.
Port security can restrict which MAC addresses appear on a switch port. MAC filtering uses hardware-address allow/deny decisions. MAC addresses can be spoofed, so such controls should not be equated with strong cryptographic identity.
Key management
Encryption is only as dependable as the protection and life cycle of its keys. Good key management covers generation, access, storage, rotation, expiration, revocation or replacement, and recovery procedures. Storing an encryption key beside the unprotected data it protects can negate important parts of the design.
Filtering and security rules
| Defense | Common purpose | Important limitation |
|---|---|---|
| Access control list (ACL) | Permit or deny traffic according to defined criteria | Rule order, direction, and specificity matter |
| URL filtering | Restrict destinations by URL or category where visible | Encryption and application behavior affect visibility |
| Content filtering | Inspect or classify accessible content | May require appropriate proxy/decryption design and privacy controls |
| Trusted/untrusted zones | Group interfaces or systems by security policy | Names do not enforce anything without rules |
| Screened subnet / DMZ | Isolate exposed services from sensitive internal systems | Public service compromise must not imply unrestricted internal access |
The phrase screened subnet is often associated with a perimeter segment protected by filtering boundaries. It is not a guarantee that exposed servers are safe, and it should not be confused with a simple VLAN tag.
Defenses mapped to concerns
| Concern | Relevant controls |
|---|---|
| Unknown device plugged into an office switch | NAC/802.1X, port policy, inventory and monitoring |
| Unauthorized connection between guest and internal systems | Segmentation, routing restrictions, firewall ACLs |
| Weak default management access | Device hardening, identity controls, encrypted management, least privilege |
| Forged DNS information | DNSSEC validation where supported, controlled resolvers, monitoring |
| Rogue or evil-twin wireless access | Managed WLAN security, client validation, wireless monitoring and user awareness |
| Sensitive public application | Screened subnet, restricted access paths, monitored dependencies |
Controls have limits. DNSSEC does not prevent every phishing domain, and a VLAN does not automatically prevent inter-VLAN routing. Understand what the chosen protection addresses.
One scenario, several security layers
An organization provides wireless access to employees, visitors, and specialized building-control devices. A credible design separates those groups based on risk and function.
Employee connectivity may use enterprise identity and device policy. Guest connectivity should have an intentionally limited path. Building-control systems may require controlled management entry points and carefully reviewed network access because outages can affect physical operations.
If an unauthorized AP appears, wireless monitoring and physical investigation matter. If users are redirected to a fraudulent site, examine DNS, endpoint configuration, certificates, and the relevant path. If service availability collapses, consider legitimate demand, routing faults, congestion, and denial-of-service before declaring an attack.
Security is not an isolated box on a diagram. It is a set of decisions that must remain consistent across access, identity, data, and operations.
Original practice questions
1. A network administrator can log in but should manage only access switches, not core routers. What principle applies?
Answer: Least privilege. Authentication has succeeded, but authorization should restrict the scope of administrative actions.
2. Which service is commonly used for centralized 802.1X network authentication?
Answer: RADIUS. It supports the AAA functions commonly used by network access infrastructure.
3. A switch sees many forged MAC addresses on one port. What attack class might be involved?
Answer: MAC flooding. The attack attempts to disrupt normal MAC learning behavior; confirm using counters and evidence.
4. Clients receive an unexpected default gateway and resolver after a new device appears. Which service should be investigated?
Answer: DHCP, including the possibility of a rogue or misconfigured server. The supplied settings are a clue to the assignment source.
5. Does HTTPS encryption alone prove that the destination website is trustworthy?
Answer: No. TLS can protect the connection, but a malicious site may also use a valid certificate. Correct hostname validation and independent trust in the site still matter.
6. What is the distinction between DNSSEC and DoH?
Answer: DNSSEC checks signed DNS data for authenticity/integrity; DoH encrypts transport of DNS exchanges between supporting endpoints.
7. An organization wants to restrict what connects to switch ports using identity-based network authorization. Which control fits better than MAC filtering alone?
Answer: 802.1X with a suitable authentication and NAC design. MAC addresses can be forged and are weak as stand-alone identity.
8. A public web server must be reachable without exposing internal finance systems. What architectural concept is relevant?
Answer: A screened subnet/DMZ with explicit filtering rules. The separation limits the paths available from the exposed service to protected systems.
Domain 4 readiness check
You should be able to:
- Compare confidentiality, integrity, availability, encryption in transit/at rest, certificate trust, PKI, and self-signed certificates.
- Distinguish authentication, authorization, MFA, SSO, RADIUS, TACACS+, LDAP, SAML, time-based access, RBAC, least privilege, and geofencing.
- Explain cameras, locks, honeypots/honeynets, risk, threats, vulnerabilities, exploits, audits, data locality, PCI DSS, and GDPR at the conceptual level.
- Explain why guest, BYOD, IoT, IIoT, SCADA/ICS/OT systems may require different network boundaries.
- Recognize DoS/DDoS, VLAN hopping, MAC flooding, ARP and DNS spoofing/poisoning, rogue DHCP/APs, evil twins, on-path attacks, social engineering, and malware.
- Connect device hardening, NAC, port security, 802.1X, MAC filtering, key management, ACLs, URL/content filtering, security zones, and screened subnets to the threats they reduce.
Official source
CompTIA Network+ N10-009 Exam Objectives, version 4.0 (PDF), Domain 4.0, objectives 4.1–4.3.
Tech Little Brawta is an independent educational publisher and is not affiliated with or endorsed by CompTIA. Original scenarios and questions, not real exam items. Last verified November 1, 2026.