Overview
Network Security covers protecting networks, and N10-009 modernized it with concepts such as zero trust. It has five objectives. Basic security concepts covers the CIA triad, zero trust, least privilege, defense in depth, authentication and authorization, and encryption. Types of attacks covers common attacks such as denial of service, on-path, spoofing, social engineering and malware, and their impact. Security features and defenses covers techniques and solutions such as firewalls, access control lists, network segmentation, network access control and hardening. Remote access covers VPNs and secure remote access methods and their security implications. Physical security covers protecting the physical network and facilities.
At 14%, this is the smallest domain, but security is woven through networking. The exam rewards understanding layered, modern security concepts, recognizing attacks, applying the right defenses, securing remote access, and not overlooking physical security, building on the concepts, implementation and operations of the earlier domains.
How it's tested
Network+ questions in this domain describe a security concept, attack, defense, remote-access or physical need and ask which applies. Network+ questions are vendor-neutral and scenario-based, so read the situation and choose the networking concept, configuration or tool it points to before answering.
-
Security concept
A protection principle is described, and you identify zero trust, least privilege or the CIA element.
-
Attack or defense
An attack or protection need is described, and you identify the attack or choose the defense.
-
Remote or physical
A remote-access or physical need is described, and you choose the secure method or control.
An organization wants no user or device trusted by default, with every access request verified regardless of whether it originates inside or outside the network. A traditional perimeter model trusts internal traffic. Zero trust assumes no implicit trust and verifies every request explicitly with least privilege, which matches the requirement, so zero trust is the security model the exam expects for this modern approach.
Domains 5
Official domains from the CompTIA outline, in outline order.
4.1 Explain the importance of basic network security conceptsCIA triad, zero trust, least privilege and defense in depth.
- What it means
- This covers foundational security concepts: the confidentiality, integrity and availability triad, zero trust, least privilege, defense in depth, authentication, authorization and accounting, and encryption of data at rest and in transit.
- What to understand
- The CIA triad frames security goals. Zero trust assumes no implicit trust and verifies every request. Least privilege grants only needed access, and defense in depth layers controls. Authentication verifies identity while authorization grants access. These principles underpin all network security.
- How it shows up
- A security principle need is described, and you must identify the concept such as zero trust or least privilege.
- Common confusion
- Confusing authentication with authorization, or treating the network perimeter as a trust boundary under zero trust.
4.2 Summarize various types of attacks and their impactDoS, on-path, spoofing, social engineering and malware.
- What it means
- This covers common attack types and their impact: denial of service and distributed denial of service, on-path (man-in-the-middle) attacks, spoofing, VLAN hopping, social engineering such as phishing, malware, and other network attacks.
- What to understand
- Each attack has a mechanism and impact: denial of service overwhelms a target, on-path intercepts traffic, spoofing forges identity, and social engineering manipulates people. Recognizing the attack from its description and knowing its impact is the skill, which also guides the right defense.
- How it shows up
- An attack is described, and you must identify its type or impact.
- Common confusion
- Confusing similar attacks, such as an on-path attack with spoofing, or a denial of service with a distributed one.
4.3 Apply network security features, defense techniques, and solutionsFirewalls, ACLs, segmentation, NAC and hardening.
- What it means
- This covers network security features and defenses: firewalls and their rules, access control lists, network segmentation and screened subnets, network access control, port security, device hardening, and other defensive solutions.
- What to understand
- Defenses are layered: firewalls and access control lists filter traffic, segmentation isolates parts of the network to limit spread, network access control admits only compliant devices, and hardening reduces the attack surface. Choosing the right defense for a threat is the key skill.
- How it shows up
- A protection need is described, and you must choose the security feature or defense.
- Common confusion
- Confusing an access control list with network segmentation; an ACL filters traffic by rules, while segmentation isolates network areas.
4.4 Compare and contrast remote access methods and security implicationsVPNs and secure remote access.
- What it means
- This covers remote access methods and their security: VPN types such as site-to-site and client-to-site, VPN protocols, secure protocols for remote management, and the security implications of each remote access choice.
- What to understand
- VPNs secure remote connections, with site-to-site connecting networks and client-to-site connecting individual users, over encrypted tunnels. Secure protocols such as SSH protect management traffic. The method must match the use case and provide adequate encryption and authentication.
- How it shows up
- A remote-access need is described, and you must choose the VPN type or secure method.
- Common confusion
- Confusing site-to-site with client-to-site VPNs, or using insecure remote protocols.
4.5 Explain physical security conceptsProtecting the physical network and facilities.
- What it means
- This covers physical security: access controls such as locks, badges and biometrics, surveillance, secure areas and server rooms, environmental protections, and preventing unauthorized physical access to network equipment.
- What to understand
- Physical security protects the hardware and facilities, since physical access can bypass logical controls. Locks, badges, surveillance and secure server rooms prevent tampering and theft. Physical security is a layer of defense in depth that is easy to overlook but essential.
- How it shows up
- A physical protection need is described, and you must choose the physical security control.
- Common confusion
- Overlooking physical security as part of overall network security.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
CIA triad
Confidentiality, integrity, availability.
- Remember
- The core security goals.
- Tested as
- Concept questions.
- Trap
- Overlooking one element.
-
Zero trust
No implicit trust; verify every request.
- Remember
- Trust nothing by default.
- Tested as
- Concept questions.
- Trap
- Treating the perimeter as trusted.
-
Least privilege
Grant only needed access.
- Remember
- Limits damage from compromise.
- Tested as
- Concept questions.
- Trap
- Over-granting access.
-
Authentication vs. authorization
Verifying identity versus granting access.
- Remember
- Distinct steps.
- Tested as
- Concept questions.
- Trap
- Confusing the two.
-
Denial of service
Overwhelms a target's resources.
- Remember
- Distributed uses many sources.
- Tested as
- Attack questions.
- Trap
- Confusing DoS with DDoS.
-
On-path attack
Intercepts traffic between parties.
- Remember
- A man-in-the-middle attack.
- Tested as
- Attack questions.
- Trap
- Confusing with spoofing.
-
Firewalls and ACLs
Filter traffic by rules.
- Remember
- Control allowed traffic.
- Tested as
- Defense questions.
- Trap
- Confusing ACLs with segmentation.
-
Network segmentation
Isolates parts of the network.
- Remember
- Limits attack spread.
- Tested as
- Defense questions.
- Trap
- Confusing with an ACL.
-
Network access control
Admits only compliant devices.
- Remember
- Checks device posture.
- Tested as
- Defense questions.
- Trap
- Admitting any device.
-
VPN types
Site-to-site versus client-to-site.
- Remember
- Match to the use case.
- Tested as
- Remote access questions.
- Trap
- Confusing the two.
-
Physical security
Locks, badges, surveillance, secure rooms.
- Remember
- Physical access bypasses logical controls.
- Tested as
- Physical questions.
- Trap
- Overlooking it.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Authentication vs. authorization
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Authentication | Verifies identity | Who you are | Confusing with authorization |
| Authorization | Grants access | What you can do | Confusing with authentication |
ACL vs. segmentation
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Access control list | Filters traffic by rules | Permit or deny traffic | Confusing with segmentation |
| Segmentation | Isolates network areas | Limits spread | Confusing with an ACL |
Site-to-site vs. client-to-site VPN
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Site-to-site | Connects whole networks | Between locations | Confusing with client-to-site |
| Client-to-site | Connects individual users | Remote worker access | Confusing with site-to-site |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Perimeter is trusted
- What candidates pick
- Trust all traffic originating inside the network perimeter.
- Why it looks right
- Internal traffic feels safe.
- Why it's wrong
- Zero trust verifies every request regardless of origin; the perimeter is not a trust boundary.
Clue to watch for The requirement is to trust nothing by default.
-
MFA is authorization
- What candidates pick
- Use authentication to decide what resources a user may access.
- Why it looks right
- Both relate to access.
- Why it's wrong
- Authentication verifies identity; authorization determines what the verified user may do.
Clue to watch for The need is to grant or limit permissions.
-
ACL isolates networks
- What candidates pick
- Use an access control list to isolate a compromised segment from the rest of the network.
- Why it looks right
- ACLs control traffic.
- Why it's wrong
- Network segmentation isolates areas to limit spread; an ACL filters specific traffic by rules.
Clue to watch for The need is to isolate parts of the network.
-
DoS is DDoS
- What candidates pick
- Describe an attack from thousands of distributed sources as a simple denial of service.
- Why it looks right
- Both deny service.
- Why it's wrong
- A distributed denial of service uses many sources; a plain denial of service comes from one.
Clue to watch for The attack originates from many distributed sources.
-
Ignore physical access
- What candidates pick
- Secure the network logically but leave equipment physically accessible.
- Why it looks right
- Logical security seems sufficient.
- Why it's wrong
- Physical access can bypass logical controls, so physical security is an essential layer.
Clue to watch for Unauthorized people could physically reach equipment.
Answer framework
For any Domain 4 scenario, use these steps to find the answer Network+ expects.
- Apply layered defense in depth across identity, network, remote access and physical security.
- For concepts, apply zero trust and least privilege, and distinguish authentication from authorization and the CIA elements.
- Recognize the attack from its description and choose the defense that counters it.
- Choose the right defense: firewalls and access control lists to filter, segmentation to isolate, network access control to admit compliant devices, and hardening.
- Secure remote access with the correct VPN type and secure protocols, and do not overlook physical security of equipment and facilities. Where two options seem to fit, pick the one that most precisely matches the scenario's symptom or requirement.
Practice question
Want more like this? The Network+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Although this is the smallest domain, security is essential and N10-009 modernized it, so study it properly. Start with the concepts: the CIA triad, and especially zero trust and least privilege, which are newly emphasized, plus the authentication-versus-authorization distinction. Then learn to recognize attack types from their descriptions and know their impact, since questions test identification.
Next, learn the defenses and match them to threats: firewalls and access control lists to filter, segmentation to isolate, network access control to admit compliant devices, and hardening. Learn remote access, distinguishing site-to-site from client-to-site VPNs and favoring secure protocols. Finally, do not overlook physical security, which is tested and easy to forget.
Because security threads through networking, relating each control to a real threat helps. Because Network+ rewards hands-on familiarity, practice configuring and troubleshooting on real or simulated devices rather than only reading, and review missed practice questions by domain to find weak spots. Afterwards, move to Domain 5, Network Troubleshooting.
FAQ
How much of Network+ is Domain 4?
Network Security is 14% of the exam, the smallest domain, though security is essential across all networking roles.
What is zero trust?
A security model that assumes no user or device is trusted by default and verifies every access request explicitly, applying least privilege, regardless of whether it originates inside or outside the network. N10-009 newly emphasizes it.
What is the difference between authentication and authorization?
Authentication verifies who a user or device is. Authorization determines what the verified identity is allowed to do. They are distinct steps in controlling access.
What is the difference between an access control list and network segmentation?
An access control list filters specific traffic by permit and deny rules. Network segmentation divides the network into isolated areas to limit how far an attack or problem can spread.
What is the difference between a site-to-site and a client-to-site VPN?
A site-to-site VPN connects whole networks, such as two office locations. A client-to-site VPN connects an individual remote user's device to the network.
Why does physical security matter for networks?
Because physical access to equipment can bypass logical security controls, allowing tampering or theft. Physical controls such as locks, badges and secure server rooms are an essential layer of defense in depth.
How does Domain 4 connect to the rest of the exam?
Security protects the concepts of Domain 1, the implementations of Domain 2 and the operations of Domain 3, and security issues are among those diagnosed in Domain 5.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered security concepts, attacks, defenses, remote access and physical security. Test whether you can choose the right protection under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Network+ AI tutor Get any concept explained your way