Legacy Haven University

A Network+ candidate stops unwanted traffic at named appliances and named rules. CompTIA tests whether you can place a firewall, apply an access control list (ACL), and tell an intrusion detection system (IDS) from an intrusion prevention system (IPS) without mixing those jobs.

Official N10-009 Domain 4.0 (Network Security) is 14% of the exam. Firewalls and IDS/IPS also sit in objective 1.2 as physical or virtual appliances. ACL sits in 4.3 as a security rule. When those rules break reachability, objective 5.3 lists ACL as a network-service issue to troubleshoot.

What the official map actually names

Treat the marketing title as the problem. Treat the objectives PDF as the testable list.

CompTIA prints a disclaimer in that same document: the bullet lists are not exhaustive. Other related tasks can appear. That disclaimer does not authorize invented command syntax or unlisted product classes.

Study the full N10-009 path from the How to Pass CompTIA Network+ (N10-009) hub. Use that page as the cluster home for this series.

Firewall: the appliance that enforces the boundary

Objective 1.2 groups firewall with router, switch, IDS/IPS, load balancer, and proxy. The exam asks you to compare those jobs, not to memorize a vendor GUI.

A firewall is a physical or virtual appliance that inspects traffic and applies policy at a trust boundary. Traffic arrives on one interface. The appliance evaluates that flow against configured security rules. It forwards the flow or it drops the flow.

Place the firewall where trust changes.

• Trusted zone. Hosts and users the organization already accepts. Objective 4.3 names this zone.
• Untrusted zone. Traffic the organization does not accept by default. The public internet is the usual example. Objective 4.3 names this zone.
• Screened subnet. A separate zone that holds systems visitors must reach (a public web server is the usual design) without placing those systems inside the trusted zone. Objective 4.3 names screened subnet. The official list does not use other unofficial nicknames as the required term.

The firewall does not replace every other control. Objective 4.3 also lists device hardening (disable unused ports and services; change default passwords), NAC (port security, 802.1X, MAC filtering), and key management. Those controls sit on hosts, switches, and identity systems. The firewall sits on the path.

URL filtering and content filtering sit next to ACL under security rules. The firewall, or a paired filtering function, can allow or block a destination by Uniform Resource Locator (URL). It can also allow or block content classes the policy names. CompTIA lists those two rules. It does not list a product name for the filter engine.

ACL: the rule list the appliance walks

An access control list (ACL) is an ordered list of permit and deny statements. Objective 4.3 files it under security rules. The appliance reads the list against each flow. The first matching statement decides the action.

An ACL answers four operator questions:

1. What source may speak?
2. What destination may it reach?
3. Which traffic class does this statement cover?
4. Does this statement permit or deny?

CompTIA does not name “standard ACL” or “extended ACL” in Exam Objectives Document Version 5.0. The same-day PM calendar title uses those words. Do not treat the calendar title as an official N10-009 bullet. If Cree later pastes a lab that uses those labels, map the lab to 4.3 ACL and 5.3 ACL troubleshooting. Do not claim CompTIA printed the labels.

CompTIA also does not print:

• numbered ranges
• wildcard-mask math
• interface direction words as required exam vocabulary
• an official sample command

Write [CREE MUST FILL] on any configuration line until that lab text exists.

A broken ACL is a reachability problem. Objective 5.3 places ACLs in the network-services troubleshooting list beside incorrect VLAN assignment and route selection. A ticket that says “the host can ping the gateway but cannot reach the application” is an ACL candidate. Confirm the path. Then read the list in order. A deny that matches first will hide a permit that sits later. A missing statement can leave the flow unmatched. Do not invent what the unmatched action is. CompTIA does not name that action in Version 5.0.

IDS and IPS: watch versus stop

Objective 1.2 lists intrusion detection system (IDS)/intrusion prevention system (IPS) as one appliance pair. The slash is the exam hint. Both appliances inspect traffic for hostile patterns. They do not share the same action.

• IDS. Detection. The system watches a copy of the traffic or a sensor feed. It raises an alert when a pattern matches policy. It does not have to sit in the forwarding path.
• IPS. Prevention. The system sits where it can drop or reset a matching flow. The alert still matters. The stop is the job.

Official Version 5.0 does not name host IDS versus network IDS, signature detection versus anomaly detection, or span-port versus inline placement. Do not study those splits as named N10-009 bullets.

A firewall enforces the written ACL. An IDS or IPS looks for hostile use that an allow rule still permits. Objective 4.2 names the attack classes that make that second look necessary: denial-of-service (DoS) and distributed denial-of-service (DDoS), VLAN hopping, Media Access Control (MAC) flooding, Address Resolution Protocol (ARP) poisoning and ARP spoofing, DNS poisoning and DNS spoofing, rogue devices and services, evil twin, on-path attack, social engineering, and malware. The firewall ACL does not, by itself, describe those attacks. The IDS/IPS pair is the appliance CompTIA lists for inspection beyond the allow/deny list.

Do not build or describe exploit steps for any 4.2 item. Name the class. Point the control at the class.

How the three pieces share one path

Walk a packet from the untrusted zone toward a host in a screened subnet.

1. The packet hits the firewall appliance (1.2).
2. The firewall evaluates security rules (4.3): ACL, and if configured, URL filtering or content filtering.
3. A permit sends the packet toward the screened subnet. A deny stops it.
4. An IPS in the path can still drop a permitted flow that matches an intrusion signature or policy. An IDS off the path can still alert.
5. If a later ticket reports “policy looks open, path is dead,” treat ACL as a 5.3 service issue. Read the list. Do not guess a command.

Zones keep the blast radius small. Guest, bring-your-own-device (BYOD), Internet of Things (IoT), Industrial Internet of Things (IIoT), supervisory control and data acquisition (SCADA), industrial control system (ICS), and operational technology (OT) sit under 4.3 network segmentation enforcement. Those segments do not belong on the same trust level as internal workstations. The firewall and the ACL are how you enforce that split. The IDS/IPS pair is how you watch the split after the rule is written.

Exam-day habits that stay inside the PDF

• Name the appliance first: firewall, IDS, or IPS (1.2).
• Name the rule type second: ACL, URL filtering, or content filtering (4.3).
• Name the zone third: trusted, untrusted, or screened subnet (4.3).
• If the scenario is an outage after a rule change, move to 5.3 and treat ACL as a service fault.