CompTIA Network+ — Practice Exam
4.0 Network Security: practice questions
Our CompTIA Network+ bank has 46 questions on this topic. Here are 5 of them with answers; the full mock exam draws from every topic, like the real one.
Question 1
Thousands of compromised devices send traffic to one website at once. What is this?
- Distributed denial-of-service (DDoS)
- A single-source denial-of-service flood
- ARP spoofing
- On-path attack
Show the answer
A. Distributed denial-of-service (DDoS) — A DDoS uses many sources (often a botnet), making simple source blocking ineffective.
Question 2
Which feature stops ARP spoofing by checking ARP packets against DHCP snooping records?
- Port mirroring
- BPDU guard on all access ports
- Dynamic ARP inspection
- Jumbo frames
Show the answer
C. Dynamic ARP inspection — DAI drops ARP replies that do not match the trusted IP-to-MAC bindings.
Question 3
Users typing a bank's name are sent to a fake site because the resolver's cache holds a forged record. What attack is this?
- ARP poisoning of the local gateway
- DNS cache poisoning
- Evil twin
- Smurf attack
Show the answer
B. DNS cache poisoning — DNS poisoning inserts false records into a resolver's cache; DNSSEC validation helps prevent it.
Question 4
An unauthorized DHCP server hands clients a malicious default gateway. Which switch feature prevents this?
- Spanning tree
- DHCP snooping
- Jumbo frames
- LACP
Show the answer
B. DHCP snooping — DHCP snooping allows server replies only on trusted ports, blocking rogue DHCP servers.
Question 5
A login asks for a password and then a code from an authenticator app. What is this?
- Single sign-on with a federated identity provider
- Multifactor authentication
- Role-based access control
- Geofencing
Show the answer
B. Multifactor authentication — MFA combines different factor types: something you know plus something you have.