CompTIA Updated N10-009 Exam Questions and Answers by amayah

A full-tunnel VPN forces a remote user’s traffic—including access to public internet resources—to traverse the corporate VPN tunnel and egress from the organization’s network. This is commonly required to ensure consistent enforcement of corporate security controls such as web filtering, IDS/IPS inspection, DLP policies, logging, and access control. In Network+ terms, full-tunnel VPNing routes the user’s default gateway through the VPN, meaning both internal traffic (to corporate subnets) and external traffic (to internet destinations) is sent through the encrypted tunnel.

By contrast, a split-tunnel VPN (not listed) would send only corporate-bound traffic through the VPN while allowing internet traffic to go directly out the user’s local ISP—reducing corporate bandwidth usage but also reducing centralized inspection and control. Clientless VPN usually refers to browser-based access to specific internal applications without a full network tunnel for all traffic. Site-to-site VPN connects entire networks to each other (e.g., branch office to HQ) rather than an individual remote user. SSE (Security Service Edge) is a cloud security framework/service model, not the classic VPN configuration described in the question. Hence, full-tunnel is the correct answer.

A warm site typically has a full infrastructure ready, but it lacks the most up-to-date data or is not immediately operational. It requires some configuration or data restoration to become fully functional.

=================

The key difference is that an Intrusion Prevention System (IPS) is installed in line with network traffic, allowing it to actively block threats. In contrast, an Intrusion Detection System (IDS) only monitors and alerts without actively blocking traffic.

Breakdown of Options:

A. An IPS needs to be installed in line with traffic and an IDS does not. ✅ Correct answer. IPS actively prevents threats, while IDS only detects them.

B. An IPS is signature-based and an IDS is not. – False, both can use signature-based detection.

C. An IPS is less susceptible to false positives than an IDS. – False, both can produce false positives, depending on configurations.

D. An IPS requires less administrative overhead than an IDS. – False, IPS requires more administrative effort due to real-time blocking decisions.

Multi-factor authentication (MFA) requires two or more different categories of authentication factors:

Something you know (password, PIN)

Something you have (smart card, hardware token)

Something you are (biometric)

The only valid second factor here is a hard token (e.g., a key fob generating one-time codes).

A. PIN is still “something you know,” the same category as a password.

B. Favorite color is a weak knowledge-based factor, not a true second factor.

D. Mother’s maiden name is also “something you know” and insecure.

References (CompTIA Network+ N10-009):

Domain: Network Security — Authentication methods, MFA factor categories.