Network Security Explained for Network+: Attacks, AAA and Hardening

Why it matters. Network Security is 14% of the exam, and most questions are “which attack is this?” or “which control stops it?”. Learn the pairs and you’ve learned the domain.

The CIA triad

Goal	Means	Protected by
Confidentiality	Only the right people can read it	Encryption, access control
Integrity	Nobody changed it	Hashing, digital signatures (like DNSSEC)
Availability	It’s there when needed	Redundancy, backups, DDoS protection

Remember it: Can’t read it, Isn’t changed, Always there.

AAA: who, what, and what happened

A	Question	Example
Authentication	Who are you?	Password plus MFA code
Authorization	What are you allowed to do?	Read-only on the switch, full access on the printer
Accounting	What did you do?	A log of every command you typed

	RADIUS	TACACS+
Transport	UDP (1812, 1813)	TCP 49
Encrypts	Only the password	The whole conversation
Typical use	Network access: Wi-Fi, VPN, 802.1X	Admins logging in to network devices

Remember it: “Who are you, what can you do, what did you do?” And TACACS+ = TCP, Total encryption.

802.1X and network access control (NAC)

802.1X keeps a port or Wi-Fi network closed until a device proves who it is. Three roles: the supplicant (your laptop) asks to join, the authenticator (the switch or access point) holds the door, and the authentication server (usually RADIUS) decides. NAC can also check posture (is antivirus running, is the OS patched?) and drop unhealthy devices into a quarantine VLAN.

Remember it: A nightclub: the supplicant is the guest, the authenticator is the bouncer, the RADIUS server is the manager with the list.

Attacks and the control that stops each one

Attack	What happens	Stop it with	See it
ARP spoofing / on-path	A device answers “that’s me” for the gateway and reads traffic in the middle	Dynamic ARP Inspection	ARP lab
Rogue DHCP server	A fake server hands out a bad gateway or DNS	DHCP snooping (only trusted ports may offer addresses)	DHCP lab
MAC flooding	Thousands of fake MACs overflow the switch’s table, so it floods frames to every port	Port security (limit MACs per port)	—
VLAN hopping	Switch spoofing (pretending to be a trunk) or double tagging to reach another VLAN	Turn off trunk auto-negotiation; don’t use VLAN 1 as the native VLAN	VLAN lab
DNS poisoning	False answers send users to the attacker’s server	DNSSEC validation, trusted resolvers	DNSSEC lab
Evil twin / rogue AP	A fake access point copies a real network name	802.1X (Enterprise) Wi-Fi, wireless intrusion detection	Wi-Fi explainer
DDoS	Floods of traffic from many machines knock a service offline	Upstream scrubbing, rate limiting, redundancy	Latency lab
Spanning tree attack	A rogue switch claims to be the root bridge	BPDU guard on access ports	—
Social engineering	Phishing, tailgating, pretexting: attacking people	Training, MFA, access control vestibules	—

Remember it: Pair each attack with the guard that shares its first word: ARP → ARP Inspection, DHCP → DHCP snooping, MAC flood → port (MAC) security, BPDU → BPDU guard.

I tried every attack in that table in our own labs. In my defence, Nova made me write down the fix each time. — Nyx

Harden every device

• Change default passwords and remove unused accounts.
• Use secure protocols: SSH not Telnet, HTTPS not HTTP, SFTP not FTP, SNMPv3 not v1/v2c (see the Syslog and SNMP lab).
• Disable unused ports and services, and put unused switch ports in an unused VLAN.
• Patch firmware, and keep a baseline config to compare against.
• Least privilege: give each account only what its job needs.

Remember it: Telnet tells everyone; SSH keeps a secret. If the old protocol’s name has no “S”, it’s probably sending passwords in the clear.

Segmentation, screened subnets and zero trust

Segmentation splits a network into zones (VLANs, subnets) so a problem in one can’t spread freely. A screened subnet (once called a DMZ) holds public-facing servers between the internet and the internal network. Defense in depth means several layers, so one failure isn’t fatal. Zero trust drops the idea that being “inside” makes you trusted: every request is checked, every time.

Remember it: A screened subnet is the hotel lobby: visitors can come in, but not up to the rooms. Zero trust is the key card that’s checked at every door, not just the front one.

Secure remote access

Option	What it is	Memory hook
IPsec ESP	Encrypts and authenticates the packet	ESP = Encryption
IPsec AH	Authenticates only, no encryption	AH = Authentication only
Site-to-site VPN	Joins two networks permanently	Our WireGuard lab builds one
Client VPN	One user into the network	Full tunnel sends everything; split tunnel only company traffic
Jump box	A hardened server admins log in through first	One guarded staircase to the server room

Physical security

Badge readers, cameras, locked racks, and an access control vestibule (two doors where only one can open at a time) to stop tailgating, someone following you through a door. Physical access beats most network controls, so the exam counts it.

Remember it: A vestibule is an airlock: one door shuts before the next opens.

Practise it

These topics are in the Network+ practice test, scored by exam domain.

NextTest yourself: the Network+ practice test→

Go deeper

• ARP lab — spoofing and duplicate IPs, hands-on
• NAT and firewalls lab — why NAT isn’t a firewall
• Network+ roadmap — the full path

Explainer, written by StashGrid with AI help and checked against the CompTIA Network+ N10-009 objectives before publishing. Speeds and distances are the standard ratings; real-world results are lower. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.