ISC2 CC Practice Test 26 — 15 Questions

Question 1

An organization wants to prevent malicious HTTP requests targeting a web application. Which security device is specifically designed for this purpose?

Accepted Answer

WAF. WAF (Web Application Firewall) inspects HTTP/HTTPS traffic and applies OWASP rules.

Answer

NIDS

Answer

HIDS

Answer

IPS

Question 2

An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?

Accepted Answer

Spoofing. Spoofing involves falsifying source addresses (IP, ARP, email).

Answer

Sniffing

Answer

Man-in-the-middle

Answer

Denial of Service

Question 3

In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?

Accepted Answer

Layer 2 - Data Link. Layer 2 (Data Link) uses MAC addresses and switches; VLANs operate at this layer.

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Answer

Layer 1 - Physical

Question 4

A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?

Accepted Answer

TCP port 443. HTTPS uses port 443 and TLS/SSL for encryption.

Answer

UDP port 443

Answer

TCP port 80

Answer

TCP port 22

Question 5

A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?

Accepted Answer

IDS. An Intrusion Detection System (IDS) passively monitors traffic and generates alerts, without blocking traffic. An Intrusion Prevention System (IPS) is inline and can block, but may introduce latency.

Answer

Honeypot

Answer

IPS

Answer

Firewall

Question 6

An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that hosts public-facing services and is isolated from the internal network.

Answer

Honeypot

Answer

Subnetting

Answer

VLAN

Question 7

An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)

Accepted Answer

Application identification and control. NGFWs include deep packet inspection, application awareness, and integrated IDS/IPS capabilities.

Answer

Static packet filtering based on IP and port

Answer

Stateful packet inspection

Question 8

A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)

Accepted Answer

Place only public-facing servers (e.g., web, email) in the DMZ.. Proper DMZ design includes: placing only public-facing servers in DMZ, restricting inbound traffic to necessary ports, and preventing direct communication from DMZ to internal network. Using private IPs and disabling firewall are incorrect.

Answer

Configure the DMZ to communicate directly with the internal network without restrictions.

Answer

Allow all inbound traffic to the DMZ from the internet for ease of access.

Question 9

During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?

Accepted Answer

Man-in-the-middle (MITM). ARP poisoning allows an attacker to intercept traffic on a local network, enabling man-in-the-middle attacks.

Answer

Spoofing

Answer

Denial of Service (DoS)

Answer

Sniffing

Question 10

A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?

Accepted Answer

Stateful inspection. Stateful inspection firewalls track connection state and filter based on IP/port.

Answer

Stateless packet filtering

Answer

Application proxy

Answer

Next-generation firewall (NGFW)

Question 11

An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?

Accepted Answer

802.1X authentication. Port security limits the number of MAC addresses on a switch port, and 802.1X requires authentication before granting network access. VLANs segment but do not authenticate, and firewalls filter traffic but not at the access level.

Answer

Firewall rules

Answer

NAT

Answer

VLAN segmentation

Question 12

Which of the following is an indicator of a phishing email?

Accepted Answer

The email contains a sense of urgency and a suspicious link.. Phishing emails often create a sense of urgency to pressure recipients into acting without thinking, such as claiming an account will be closed.

Answer

The email includes an attachment from a trusted source.

Answer

The email has a professional signature with contact details.

Answer

The email is from a known colleague.

Question 13

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack involves an attacker intercepting and relaying messages between two parties.

Answer

Phishing

Answer

Replay attack

Answer

DoS

Question 14

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that hosts public-facing servers, providing an extra layer of security between the internet and the internal network.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 15

An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle. ARP poisoning allows man-in-the-middle attacks by associating attacker's MAC with the victim's IP.

Answer

Sniffing

Answer

Spoofing

Answer

DoS