N10-009 Question 243
Single answer4.1 Explain the importance of basic network security concepts.A company allows employees to connect personal smartphones and tablets to the corporate wireless network. The network administrator notices that several unmanaged devices can reach internal file shares and printers even though those devices should have internet-only access. Management wants to reduce the risk of unauthorized access without replacing the entire wireless infrastructure. Which solution would BEST address this issue?
- A
Implement network segmentation by placing personal devices on a separate guest VLAN with access control rules that allow only internet connectivity
- B
Increase the wireless signal strength so employee devices connect more reliably and do not attempt to access internal resources
- C
Disable DHCP on the wireless network so unmanaged devices cannot obtain an IP address automatically
- D
Configure port mirroring on the core switch to monitor traffic from employee devices more closely
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use network segmentation with a guest VLAN and restrictive access control policies. One of the most important basic network security concepts is limiting access through segmentation and policy enforcement. BYOD and guest devices are typically considered less trusted than managed corporate endpoints, so they should be isolated from internal resources unless a specific business need exists. This aligns with common security best practices such as least privilege, network isolation, and defense in depth. CompTIA Network+ objectives commonly emphasize segmentation, VLANs, ACLs, and guest network design as practical methods to reduce unauthorized access. Vendor and standards guidance, including common enterprise wireless deployment practices and NIST security recommendations for network access control and segmentation, supports isolating untrusted devices rather than relying on monitoring-only or convenience-based changes.
- A. Correct.
Correct. Segmenting BYOD or guest devices into a separate VLAN and applying ACLs or firewall rules is a core network security practice. It limits lateral access to internal resources by enforcing least privilege and reduces the attack surface. In this scenario, unmanaged devices need internet access but should not reach corporate file shares or printers, making guest network segmentation the best fit.
- B. Incorrect.
Incorrect. Signal strength affects coverage and connectivity, not authorization or access control. A stronger signal would not prevent personal devices from reaching internal resources once they are associated with the network.
- C. Incorrect.
Incorrect. Disabling DHCP may inconvenience users, but it is not an effective security control because devices could still be configured with static IP settings. It also does not enforce segmentation or restrict access to internal systems.
- D. Incorrect.
Incorrect. Port mirroring is useful for monitoring and troubleshooting by sending copies of traffic to an analyzer, but it does not stop unauthorized access. This option improves visibility, not prevention.