A device or software that filters traffic between networks based on a set of security rules.
A firewall enforces an access control policy by inspecting packets and permitting or dropping them based on rules tied to source/destination IP, port, and protocol. Packet-filtering firewalls evaluate each packet in isolation, while stateful firewalls maintain a connection-state table and only allow return traffic matching an established session, making them far more resistant to spoofed packets. The N10-009 exam contrasts stateful inspection with next-generation firewalls (NGFWs), which add application-layer visibility, intrusion prevention, and SSL/TLS decryption. Know that an IDS/IPS detects or blocks threats within allowed traffic, whereas a firewall controls which traffic is permitted at all; they are complementary, not interchangeable.
Systems that detect (IDS) or detect and block (IPS) malicious traffic on a network.
An Intrusion Detection System monitors a copy of traffic passively, deployed out-of-band, and can only generate alerts — it never stops an attack. An Intrusion Prevention System sits inline so it can drop or reset malicious connections before they reach the target. Both apply signature-based detection, which matches known patterns quickly but misses novel threats, and anomaly-based (behavioral) detection, which baselines normal activity and flags deviations to catch zero-days at the cost of more false positives. For N10-009, remember IDS = passive/out-of-band/alerts; IPS = inline/blocks. Unlike a firewall filtering by port and address, an IPS inspects packets against signatures regardless of port.
A system that enforces policy on devices before granting them access to the network.
Network Access Control enforces security policy by evaluating a device’s posture — patch level, antivirus status, OS version — before allowing it onto the network. Devices that fail the check are redirected to a quarantine VLAN where they can remediate without touching production resources. The exam often contrasts NAC with 802.1X: 802.1X handles port-based authentication (who you are), while NAC adds posture assessment (whether your device is compliant). In practice, 802.1X is the enforcement mechanism NAC often rides on, but NAC is the broader policy framework.
A Distributed Denial of Service attack that floods a target with traffic from many sources to disrupt it.
A Distributed Denial of Service attack coordinates traffic from many compromised hosts—a botnet—to exhaust a target’s bandwidth, connection table, or application resources until legitimate users cannot reach it. Unlike a simple DoS attack from one source, the distributed origin makes source-based blocking ineffective because thousands of IP addresses hit at once. For N10-009, know the three flood categories: volumetric (UDP/ICMP floods that saturate bandwidth), protocol (SYN floods that exhaust connection-state tables), and application-layer (HTTP GET floods targeting web servers). Mitigation relies on upstream scrubbing centers, rate limiting, and anycast diffusion—not merely adding firewall rules.
A switch feature that limits which MAC addresses can use a port to block unauthorized devices.
Port security is a managed-switch (Layer 2) feature that restricts which MAC addresses may communicate through a physical port. An administrator sets a maximum MAC count per port and chooses how addresses are learned: dynamically, statically, or sticky (learned then saved to the config). On a violation — an unauthorized MAC or exceeding the limit — the switch responds in protect (silently drop), restrict (drop and log), or shutdown (disable the port, needing manual recovery) mode. Unlike 802.1X, which authenticates identity via a server, port security filters by MAC, which can be spoofed.