ISC2 CC Network Security — 15 Questions

Question 1

A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?

Accepted Answer

Smurf attack. A Smurf attack involves sending ICMP Echo Requests to a broadcast address with a spoofed source IP (the victim's IP). All hosts on the network reply with ICMP Echo Replies to the victim, flooding it. The victim never sent Echo Requests, which matches the scenario of unsolicited Echo Replies from an external server.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 2

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is used to resolve an IP address to a MAC address on a local network. When a host wants to send data to another host on the same subnet, it broadcasts an ARP request asking 'Who has this IP?' and the owner replies with its MAC address.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 3

An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle. Sending forged ARP messages to associate the attacker's MAC address with another host's IP address is ARP spoofing (also called ARP poisoning), which enables the attacker to intercept and relay traffic between two parties — a man-in-the-middle attack. The scenario explicitly describes interception via forged ARP messages, so MITM is the resulting attack type. The attacker positions themselves inline by poisoning ARP caches on both sides.

Answer

Sniffing

Answer

Spoofing

Answer

DoS

Question 4

Which firewall type is capable of inspecting the contents of application-layer traffic, such as HTTP requests, to detect malicious patterns?

Accepted Answer

Application proxy firewall. An application proxy firewall terminates the client connection and re-establishes a separate connection to the server, fully reconstructing and inspecting application-layer payloads such as HTTP requests, URLs, headers, and form data. This deep inspection at Layer 7 allows it to detect malicious patterns like SQL injection strings or known attack signatures embedded in application traffic.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Packet filtering firewall

Question 5

A security analyst is reviewing network traffic and needs to identify which of the following protocols are inherently insecure because they transmit data in cleartext. (Select TWO.)

Accepted Answer

FTP. FTP (Option C) is correct because it transmits both authentication credentials and data in cleartext over TCP ports 20 and 21, with no built-in encryption, making it inherently insecure. Telnet (Option D) is also correct because it sends all session data, including usernames and passwords, as unencrypted plaintext over TCP port 23. HTTPS (Option B) is not correct because it wraps HTTP in TLS encryption, and SSH (Option E) is not correct because it provides strong encrypted channels for remote sessions. DNS (Option A) is not marked correct because, although traditional DNS queries over UDP/TCP port 53 are cleartext, the protocol itself can be secured via DoH or DoT, so it is not inherently insecure in the same definitive sense as FTP and Telnet.

Answer

DNS

Answer

HTTPS

Answer

SSH

Question 6

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) resolves a known IPv4 address to the corresponding MAC address on a local network segment by broadcasting an ARP request and receiving a unicast ARP reply. This mapping is essential because Ethernet frames require a destination MAC address, while applications work with IP addresses.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 7

An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)

Accepted Answer

NGFW. Stateful inspection tracks connection state to allow return traffic. NGFW includes stateful inspection plus advanced features. Packet filtering alone is stateless; proxy and IDS are not optimal.

Answer

Packet filtering (stateless)

Answer

Application proxy

Answer

IDS

Question 8

A company's network has multiple VLANs. An attacker on VLAN 10 sends a frame with a forged source MAC address to a switch, hoping to intercept traffic intended for the default gateway. Which attack is being executed?

Accepted Answer

ARP spoofing. The attacker is sending a forged source MAC address to intercept traffic destined for the default gateway, which is the hallmark of ARP spoofing. ARP spoofing involves sending gratuitous or forged ARP replies to associate the attacker's MAC with the gateway's IP, causing victims to send traffic to the attacker. This enables man-in-the-middle interception on the same VLAN.

Answer

IP spoofing

Answer

VLAN hopping

Answer

MAC flooding

Question 9

A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)

Accepted Answer

ARP poisoning. ARP poisoning (B) is correct because attackers send forged ARP replies to associate their MAC address with a legitimate IP (typically the default gateway), causing victim traffic to be redirected through the attacker for interception or modification. Rogue Wi-Fi access points (D) are correct because an attacker can set up an evil-twin AP with the same SSID as a legitimate network, luring clients to connect and then capturing or relaying their traffic to perform MITM. SYN flood (A) is a DoS technique that exhausts the TCP backlog with half-open connections and does not by itself intercept or alter traffic. Packet sniffing (B) is a passive capture method that can observe traffic but does not redirect it, so it is not a MITM technique on its own. IP spoofing (E) forges source addresses to impersonate a host but does not establish the bidirectional traffic redirection needed for a classic MITM.

Answer

SYN flood

Answer

Packet sniffing

Answer

IP spoofing

Question 10

A company wants to protect its internal web server from common web application attacks. Which two security measures are most appropriate? (Choose TWO.)

Accepted Answer

Deploy a Web Application Firewall (WAF). Option A is correct because a Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at Layer 7 and can block common web application attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery by applying rule sets like the OWASP ModSecurity Core Rule Set. Option B is correct because implementing HTTPS with a valid certificate encrypts data in transit using TLS, which protects credentials and session tokens from interception and man-in-the-middle attacks, and a valid certificate prevents browser warnings and spoofing. Option C is not appropriate because an IDS in promiscuous mode only passively monitors and alerts on traffic; it does not actively block web attacks. Option D is insufficient because a stateful firewall operates at Layers 3-4 and tracks connection state but cannot inspect application-layer payloads to stop web-specific exploits. Option E is incorrect because enabling SNMP exposes management information and can introduce its own vulnerabilities rather than protecting the web server from web application attacks.

Answer

Deploy an IDS in promiscuous mode

Answer

Use a stateful firewall only

Answer

Enable SNMP on the server

Question 11

A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)

Accepted Answer

Deploy a VPN for remote connections. Option A is correct because a VPN (e.g., IPsec or TLS-based) creates an encrypted tunnel between endpoints, so an attacker positioned in the path cannot read or alter the traffic without detection, directly mitigating MITM interception. Option B is correct because mutual authentication (e.g., TLS client certificates or 802.1X/EAP-TLS) verifies both parties' identities, preventing an attacker from impersonating a legitimate server or client in the session. Option C is correct because ARP spoofing protection (e.g., Dynamic ARP Inspection with DHCP snooping) blocks the forged ARP replies that attackers use to position themselves as the man-in-the-middle on a local network. Option D is not marked correct because HTTPS with certificate validation protects data in transit but does not by itself constitute one of the three selected measures here. Option E is not marked correct because WPA2 encrypts the wireless link only, and does not prevent MITM attacks at higher layers or on wired segments.

Answer

Use HTTPS with proper certificate validation

Answer

Use WPA2 encryption on the Wi-Fi network

Question 12

A financial services firm is designing a defense-in-depth strategy for its internal network. The security architect wants to reduce the risk of lateral movement after an endpoint is compromised and to limit the blast radius of any single compromised host. Which two controls best address these goals? (Choose two.)

Accepted Answer

Microsegmentation that enforces least-privilege traffic flows between workloads. Microsegmentation and network access control both directly restrict how far a compromised endpoint can spread. Microsegmentation enforces least-privilege flows between workloads, while NAC prevents noncompliant or unknown devices from joining the network in the first place. A DMZ, full-disk encryption, and a honeypot address different risks and do not limit internal lateral movement.

Answer

A honeypot placed in a dedicated research subnet

Answer

A demilitarized zone (DMZ) hosting the public web and email servers

Answer

Full-disk encryption on all employee laptops

Question 13

A security analyst at a small e-commerce company notices that customer login credentials are being intercepted when users connect from public Wi-Fi. The company's web application uses HTTPS, but the login page itself is served over HTTP before redirecting to HTTPS. Which mitigation should the analyst implement to prevent credential exposure during the initial login request?

Accepted Answer

Enforce HTTP Strict Transport Security (HSTS) with a long max-age and includeSubDomains directive.. The core issue is that the initial login request is sent over HTTP, allowing an attacker to capture credentials before the redirect to HTTPS. HSTS instructs the browser to only use HTTPS for future connections, eliminating the insecure initial request. Other options do not address the cleartext transmission of credentials during the first request.

Answer

Deploy a web application firewall (WAF) to inspect incoming login requests for malicious patterns.

Answer

Configure the web server to redirect all HTTP traffic to HTTPS using a 301 redirect.

Answer

Implement DNSSEC to ensure that DNS responses for the login page are authentic.

Question 14

A security analyst reviewing wireless logs notices that an attacker is capturing authentication frames from a WPA2-Enterprise network and replaying them to a rogue access point to obtain a valid session key. The organization wants to prevent this specific attack without replacing all client devices. Which control should be implemented?

Accepted Answer

Enable Protected Management Frames (802.11w) on the wireless infrastructure and clients. Protected Management Frames (802.11w) cryptographically protects management frames that attackers abuse to force clients toward rogue access points. Enabling it on both the infrastructure and clients stops the replay-based session-key theft. Hiding the SSID, MAC filtering, and reducing transmit power do not protect those frames and therefore do not stop the attack.

Answer

Disable the SSID broadcast on all access points

Answer

Reduce the access point transmit power to limit coverage outside the building

Answer

Implement MAC address filtering on the wireless controller

Question 15

A hospital's radiology department transmits patient imaging studies to an external specialist clinic over the internet. The security officer requires that the data be protected so that even if intercepted, the contents cannot be read and any modification is detectable. Which technology should be implemented?

Accepted Answer

IPsec in tunnel mode. IPsec tunnel mode provides network-layer confidentiality and integrity for all traffic between two sites across an untrusted network, encapsulating the original packets and hiding internal addressing. That aligns with protecting imaging studies in transit so they cannot be read or altered. The other choices either protect only specific application sessions or leave headers exposed, which does not meet the full requirement.

Answer

TLS for the web-based imaging portal

Answer

SSH tunneling for the file transfer

Answer

IPsec in transport mode