RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 20 of 29

Week 20: Walls, traps and auditors

In this chapter Objectives 4.1

  1. Physical security and deception
  2. Audits and compliance
  3. Network segmentation enforcement
  4. Practice questions
  5. Chapter recap

Objective 4.1

Physical security and deception

Cameras and locks

Network security starts with the door. Cameras deter and record who entered the closet. Locks (keys, badge readers, keypads, locked racks and cages) keep people away from switches and console ports. Someone with physical access can reset a device, plug in a rogue AP, or walk off with a drive.

Exam tip Badge locks also create an access log; cameras give proof. Use both for server rooms and IDFs.

Honeypots and honeynets

Deception technologies lure attackers. A honeypot is a fake system that looks valuable (an 'old file server') but has no real data; any connection to it is suspicious. A honeynet is a whole network of honeypots. They give early warning and show attacker techniques.

Exam tip Honeypot traffic is never legit: no real user has a reason to touch it.

Objective 4.1

Audits and compliance

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) applies to anyone who stores, processes or transmits card data. It requires things like firewalls, segmenting the cardholder data environment, encryption, access control, logging and regular testing. Kibble's store registers are in scope.

Exam tip Segmenting card systems shrinks PCI scope: fewer systems to audit.

GDPR and data locality

The General Data Protection Regulation (GDPR) is EU law protecting personal data of people in the EU: consent, rights to access and erasure, breach notification. Data locality (data residency) rules require certain data to be stored or processed inside a specific country or region, which affects where you put cloud servers and backups.

Exam tip Kibble ships to EU customers? Their personal data falls under GDPR, even though Kibble is in the US.

Objective 4.1

Network segmentation enforcement

Why segment

Segmentation splits the network into zones (VLANs, subnets, firewalls, ACLs) so one compromised device can't reach everything. CompTIA calls out four groups that need their own segments:

  • IoT and IIoT: cameras, thermostats, sensors; industrial IoT on factory floors. Often weak and hard to patch.
  • SCADA, ICS, OT: systems that control physical processes (conveyors, HVAC, power). Safety-critical.
  • Guest: visitors get internet only, isolated from internal systems.
  • BYOD: personal phones and laptops: limited access, often via NAC and a separate SSID.

OT is different

Operational technology (OT) includes industrial control systems (ICS) and SCADA (supervisory control and data acquisition, which monitors and controls processes across sites). Patching can mean stopping production, and availability and safety come first. Isolate them tightly and allow only the specific flows they need.

Exam tip Can't patch the conveyor controller? Segment it and restrict traffic: a compensating defense.

Check yourself 1Kibble wants to shrink how many systems the card auditors must review. What is the most effective step?

  1. Buy cyber insurance
  2. Encrypt the guest Wi-Fi
  3. Segment the payment systems
  4. Add a honeypot to the store network
Show the answer

Answer: C. Segment the payment systems

Isolating the cardholder data environment limits PCI DSS scope to the systems in that segment.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1A company wants network admins' switch logins checked centrally, with every command they type authorized and logged separately, and the whole session payload encrypted. Which protocol fits BEST?

  1. SAML
  2. TACACS+
  3. LDAP
  4. RADIUS
Show the answer

Answer: B. TACACS+

TACACS+ (TCP 49) separates authentication, authorization and accounting, supports per-command authorization and encrypts the entire payload, so it suits device administration.

Question 2Wireless clients using WPA3-Enterprise must have their credentials checked against a central AAA server. Which protocol does the access point or controller use to reach that server?

  1. RADIUS
  2. TACACS+
  3. SAML
  4. Kerberos
Show the answer

Answer: A. RADIUS

802.1X/WPA-Enterprise uses RADIUS between the authenticator (AP or controller) and the authentication server. RADIUS uses UDP 1812 for authentication and 1813 for accounting.

Question 3Which ports does RADIUS normally use for authentication and accounting?

  1. UDP 1812 and 1813
  2. TCP 49 and 50
  3. UDP 161 and 162
  4. TCP 389 and 636
Show the answer

Answer: A. UDP 1812 and 1813

RADIUS uses UDP 1812 (authentication) and UDP 1813 (accounting). TACACS+ uses TCP 49.

Question 4An application queries the company directory to look up users and groups. The security team requires that the queries be encrypted. Which should the app use?

  1. LDAP on TCP 389
  2. LDAPS on TCP 636
  3. SAML over port 80
  4. RADIUS on UDP 1812
Show the answer

Answer: B. LDAPS on TCP 636

LDAP over SSL/TLS (LDAPS) uses TCP 636. Plain LDAP on 389 is unencrypted unless StartTLS is used.

Question 5A cloud HR app trusts the company's identity provider. After users log in to the identity provider, it sends the app an XML assertion stating who they are. Which standard is this?

  1. TACACS+
  2. SAML
  3. RADIUS
  4. LDAP
Show the answer

Answer: B. SAML

Security Assertion Markup Language passes XML assertions from an identity provider (IdP) to a service provider (SP) to enable web SSO.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.