RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 19 of 29

Week 19: Who goes there?

In this chapter Objectives 4.1

  1. Security terms and the CIA triad
  2. Logical security
  3. Practice questions
  4. Chapter recap

Objective 4.1

Security terms and the CIA triad

Risk, threat, vulnerability, exploit

A vulnerability is a weakness (unpatched firmware). A threat is something that could exploit it (an attacker, malware, a flood). An exploit is the actual method or code that takes advantage of the weakness. Risk is the likelihood and impact of a threat exploiting a vulnerability.

Exam tip Weakness = vulnerability. Who/what could hurt you = threat. The tool used = exploit. Chance x damage = risk.

The CIA triad

Security protects three things:

  • Confidentiality: only authorized people see data (encryption, access control)
  • Integrity: data isn't changed without detection (hashes, signatures)
  • Availability: systems are up when needed (redundancy, DDoS protection)
A triangle with one goal at each corner. Confidentiality at the top: only authorized people see data, protected by encryption and access control. Integrity at bottom left: data is not changed without detection, protected by hashes and signatures. Availability at bottom right: systems are up when needed, protected by redundancy, backups and DDoS protection.
Confidentiality, integrity and availability: every attack hurts at least one corner.

Exam tip A DDoS attack hits availability. A tampered config hits integrity. A leaked customer list hits confidentiality.

Objective 4.1

Logical security

Encryption: in transit and at rest

Data in transit moves across a network; protect it with TLS, IPsec, SSH. Data at rest sits on disks, backups and phones; protect it with full-disk or database encryption. Encrypting one does not protect the other.

Exam tip A stolen backup tape is a data-at-rest problem. A sniffed Wi-Fi login is a data-in-transit problem.

Certificates: PKI vs. self-signed

A certificate binds a public key to a name. In a public key infrastructure (PKI), a trusted certificate authority (CA) signs certificates, so browsers and devices trust them. A self-signed certificate is signed by its own key: traffic is still encrypted, but clients warn because no trusted CA vouches for it.

Exam tip Self-signed is fine for a lab; use an internal or public CA for anything users touch.

Authentication factors and MFA

Authentication proves who you are. Multifactor authentication (MFA) needs two or more DIFFERENT factor types: something you know (password), have (phone, token), are (fingerprint), plus somewhere you are. Time-based authentication typically means a TOTP code that changes every 30 seconds; access can also be limited to certain hours.

Four tiles, one per authentication factor. Something you know: a password or PIN. Something you have: a phone, token or smart card. Something you are: a fingerprint or face. Somewhere you are: location or network. A note below says MFA needs two different tiles; a password plus a PIN is one tile twice, so it is not MFA.
MFA means factors from two or more different categories.

Exam tip Password + PIN is NOT MFA: both are 'something you know'.

SSO, LDAP, SAML

Single sign-on (SSO): log in once, reach many apps. LDAP (TCP 389; LDAPS 636) queries directory services such as Active Directory for users and groups. SAML is an XML standard that passes authentication assertions from an identity provider (IdP) to web apps (service providers): common for web and cloud SSO.

RADIUS vs. TACACS+

Both are AAA servers. RADIUS (UDP 1812/1813) combines authentication and authorization and encrypts only the password; it is the standard for Wi-Fi 802.1X and VPN logins. TACACS+ (TCP 49, Cisco-made) separates authentication, authorization and accounting and encrypts the whole payload; it is the favorite for logging admins into network devices with per-command control.

Exam tip Device admin with command-level authorization → TACACS+. Wi-Fi/802.1X user logins → RADIUS.

Authorization: least privilege and RBAC

Authorization decides what you may do after you log in. Least privilege: give only the access needed for the job, nothing more. Role-based access control (RBAC): permissions attach to roles (Help Desk, Network Admin), and users get roles, which makes joiners, movers and leavers easy.

Exam tip Store staff should not have switch admin rights 'just in case'. That breaks least privilege.

Geofencing

Geofencing uses location (GPS, IP geolocation, Wi-Fi) to allow, block or change access. Example: the warehouse inventory app only works on devices inside the warehouse, or logins from outside the country are blocked.

Check yourself 1Dev wants switch admins to log in with their own accounts, with each command authorized and logged, and the full session encrypted. Which should he deploy?

  1. SAML
  2. LDAP
  3. RADIUS
  4. TACACS+
Show the answer

Answer: D. TACACS+

TACACS+ separates AAA, supports per-command authorization and encrypts the whole payload: ideal for device administration.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1Visitors browsing to a new internal web app get a browser warning that the certificate is not trusted, although the connection is encrypted. The admin generated the certificate on the server itself. What is the MOST likely cause?

  1. The server negotiated TLS 1.3 instead of TLS 1.2
  2. The certificate uses a 2048-bit RSA public key
  3. The site is served on the default HTTPS port 443
  4. The certificate is self-signed, not CA-issued
Show the answer

Answer: D. The certificate is self-signed, not CA-issued

A self-signed certificate is not chained to a CA the browser trusts, so the browser warns even though traffic is encrypted. Issuing it from the company's PKI (trusted by clients) fixes it.

Question 2In a public key infrastructure (PKI), which entity signs and issues digital certificates?

  1. Registration server
  2. Certificate authority (CA)
  3. Key escrow agent
  4. RADIUS server
Show the answer

Answer: B. Certificate authority (CA)

A certificate authority verifies identity (sometimes through a registration authority) and signs certificates that clients trust because they trust the CA.

Question 3A VPN login requires a password and then a code from an authenticator app on the user's phone. Which concept is this?

  1. Multifactor authentication
  2. Role-based access control
  3. Least privilege
  4. Single sign-on
Show the answer

Answer: A. Multifactor authentication

Combining something you know (password) with something you have (the phone app code) is MFA.

Question 4Which pair would NOT count as multifactor authentication?

  1. A password and a security question
  2. A password and a hardware token code
  3. A fingerprint and a PIN
  4. A smart card and a PIN
Show the answer

Answer: A. A password and a security question

A password and a security question are both something you know, so they are one factor used twice. The other pairs mix different factor types.

Question 5Employees sign in once in the morning and can then open email, the HR portal and the ticket system without signing in again. What provides this?

  1. Single sign-on (SSO)
  2. Geofencing
  3. Port security
  4. Multifactor authentication
Show the answer

Answer: A. Single sign-on (SSO)

SSO lets one authentication grant access to many trusted applications, often using SAML or OpenID Connect.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.