CompTIA Network+ Security Concepts: AAA, Segmentation, Zones, and Remote Access

What N10-009 objectives 4.1, 4.3, and 3.5 cover

On CompTIA Network+ N10-009 (V9), Network Security carries 14% of the exam. Objective 4.1 asks you to explain basic security concepts: encryption in transit and at rest, certificates, identity and access management (IAM), geofencing, physical security, deception technologies, risk terms, compliance, and network segmentation. Objective 4.3 is the scenario objective for defenses, including zones and the screened subnet. Objective 3.5, in Network Operations, covers VPNs and how administrators reach devices.

Most of these concepts become a choice in a scenario: which protocol, which segment, which zone, which tunnel. This page works through those choices at Network+ depth. Attacks and the controls that break them are in the network attacks guide.

RADIUS vs TACACS+ as a Network+ decision

RFC 8907 calls the separation of authentication, authorization, and accounting a key element of the TACACS+ design, and that separation is what lets a server authorize each command on its own. Many study sources also say TACACS+ "encrypts" the whole packet, but the protocol's own RFC chooses the word obfuscated. The safe summary is that TACACS+ obfuscates the whole body, and RADIUS hides the password.

Worked decision. A fictional regional bank has two requirements. Staff must join the corporate Wi-Fi with their own directory accounts, and network engineers must log in to routers and switches with individual accounts. Help desk staff may run show commands but not configuration commands, and every command must be recorded. The Wi-Fi requirement is network access, which points to RADIUS behind WPA3-Enterprise. The router requirement needs a separate authorization decision for each command, which is the reason TACACS+ splits the three functions.

The free mixed set of 20 Network+ questions includes an item on switch admins whose every command must be authorized and logged. You can try the per-command authorization question →, with each option explained.

Other identity and access terms in objective 4.1

• MFA. Two or more different kinds of proof, such as a password and a code from a phone.
• SSO. One sign-in that grants access to several systems.
• LDAP. The protocol for querying a directory of accounts. The 1.4 port table lists LDAP on 389 and LDAPS on 636.
• SAML. Signed assertions that let one system vouch for a user's sign-in to a web application.
• Time-based authentication. The objectives do not define it. The phrase is used both for limiting logins to certain hours and for one-time codes that change with time, so recognize both.
• Least privilege and role-based access control. Give each account only what its role needs, and grant access through roles rather than one person at a time.
• Geofencing. Allow or deny access based on location.

Two certificate terms also appear. A certificate from a public key infrastructure (PKI) is vouched for by a certificate authority that clients trust. A self-signed certificate vouches for itself, so clients cannot verify it without extra steps, which is why it suits a lab better than a public service. The remaining 4.1 terms are definition-level: honeypots and honeynets as decoys, risk, vulnerability, exploit, and threat, the CIA triad, and compliance terms such as PCI DSS for payment card data, GDPR for personal data protection, and data locality for where data is stored. Know what each one names. This page gives no legal advice.

For identity and access at Security+ depth, see Passy's Security+ identity and access management guide.

Segmenting IoT, OT, guest, and BYOD devices on one site

Objective 4.1 lists segmentation for IoT and IIoT, for SCADA, ICS, and OT systems, for guests, and for BYOD. Here is one way to apply it at Lakeside Foods, a fictional plant with offices and a production floor.

The VLANs only create the boundaries. The policy is the ACL or firewall rule set between them. A camera VLAN with no rules applied between it and the corporate VLAN is separated in name only.

Trusted, untrusted, and screened subnet placement

Objective 4.3 names three kinds of zone. The trusted zone is your internal network, and the untrusted zone is the internet. A screened subnet sits between them. NIST's glossary, citing SP 800-113, describes a DMZ as a perimeter network segment logically between internal and external networks that gives outside sources restricted access while shielding the internal networks. Another NIST definition on the same page uses "screened subnet" as a synonym.

The rules that make it work: from the internet into the screened subnet, only the published services, such as HTTPS. From the screened subnet into the LAN, only the specific connections it needs, or none. Administration of screened-subnet servers comes from the management side, not from the internet.

The free set's zone item asks where to put a new internet-facing web server. To check your placement, place the public web server in the free mixed set →.

Remote access and management choices (objective 3.5)

• Site-to-site VPN joins two networks, such as a branch and headquarters, through gateways at each end. Users do nothing.
• Client-to-site VPN runs from one user's device. A clientless VPN gives access to web applications through a browser portal, with no VPN client installed.
• Full tunnel vs. split tunnel. In a full tunnel, all the user's traffic goes through the VPN. NIST's glossary, citing SP 800-113, defines split tunneling as routing organization-specific traffic through the tunnel and other traffic through the user's default gateway.
• Connection methods for devices are SSH, a GUI, an API, and the console port.
• Jump box. A hardened host that admins connect to first, and from which they reach the devices they manage.
• In-band vs. out-of-band management. In-band management uses the production network. Out-of-band management uses a separate path, such as a console server on its own connection, so it still works when the production network is down.

Worked trade-off. A fictional field-engineering team needs the internal ticket system and file shares, while its customer video calls run on a public cloud service. With a full tunnel, every call travels to headquarters and back out again. With a split tunnel, only routes to the corporate ranges, say 10.0.0.0/8, enter the tunnel, and the calls go straight out. The cost is that internet traffic no longer passes through headquarters' filtering, so the policy has to decide which matters more.

The free mixed set also has a remote-access item in which a full tunnel fills the headquarters link. You can work the split-versus-full tunnel question with explanations →.

Hardening and network access control in objective 4.3

The remaining 4.3 defenses are short to name and easy to mix up:

• Device hardening: disable unused ports and services, and change default passwords.
• Network access control (NAC): port security limits the MAC addresses a port learns, 802.1X makes a device authenticate before its port passes traffic, and MAC filtering allows or blocks listed addresses.
• Key management: create, store, rotate, and retire the keys behind encryption and certificates.
• Security rules: ACLs filter by address and port, URL filtering blocks sites by their web address, and content filtering blocks by what the content is.

Cloud security groups and SASE are introduced in cloud and data-center concepts.