ISC2 CC Network Security — 30 Questions

Question 1

Which OSI layer is responsible for routing packets across networks using IP addresses?

Accepted Answer

Layer 3 - Network. The Network layer (Layer 3) is responsible for logical addressing and routing. It uses IP addresses to determine the best path for packets to travel from source to destination across different networks. Protocols like IP (IPv4/IPv6), OSPF, and BGP operate at this layer to perform routing decisions.

Answer

Layer 1 - Physical

Answer

Layer 4 - Transport

Answer

Layer 2 - Data Link

Question 2

A security analyst notices unusual traffic from an internal workstation to an external IP address on port 25. Which protocol is most likely being used?

Accepted Answer

SMTP. Port 25 is the default port for SMTP (Simple Mail Transfer Protocol).

Answer

FTP

Answer

DNS

Answer

HTTP

Question 3

In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?

Accepted Answer

Layer 2 - Data Link. Layer 2 (Data Link) uses MAC addresses and switches; VLANs operate at this layer.

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Answer

Layer 1 - Physical

Question 4

An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?

Accepted Answer

Spoofing. Spoofing involves falsifying source addresses (IP, ARP, email).

Answer

Sniffing

Answer

Man-in-the-middle

Answer

Denial of Service

Question 5

A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) specifically inspects HTTP/HTTPS traffic and can block attacks like SQL injection and XSS.

Answer

Intrusion Prevention System (IPS)

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Stateful firewall

Question 6

Which TCP segment is sent to initiate the three-way handshake?

Accepted Answer

SYN. The three-way handshake starts with a SYN (synchronize) packet from the client.

Answer

ACK

Answer

SYN-ACK

Answer

FIN

Question 7

An organization wants to place its public web server, email server, and DNS server in a network that is accessible from the internet but isolated from the internal corporate network. Which network design should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a buffer network for public-facing servers.

Answer

VPN

Answer

VLAN

Answer

Subnet

Question 8

Which firewall type inspects the entire packet, including application data, and can enforce rules based on user identity?

Accepted Answer

Next-generation firewall (NGFW). Next-generation firewalls (NGFW) combine deep inspection with application ID and user ID.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 9

A security analyst detects an ARP spoofing attack on the local network. What is the primary goal of an ARP spoofing attack?

Accepted Answer

To redirect traffic to the attacker's machine for eavesdropping or modification. ARP spoofing allows an attacker to intercept traffic by associating their MAC address with the IP address of a legitimate host.

Answer

To disable the switch by sending fake VLAN tags

Answer

To overwhelm the network with broadcast traffic

Answer

To corrupt the DNS cache

Question 10

Which protocol is considered insecure because it transmits data in cleartext, including passwords?

Accepted Answer

Telnet. Telnet (port 23) sends all data, including credentials, in plaintext.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 11

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack

Question 12

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?

Accepted Answer

Using encryption protocols (e.g., IPsec, TLS). Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Answer

Implementing VLANs

Answer

Disabling unused ports on the switch

Answer

Deploying an intrusion detection system

Question 13

A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)

Accepted Answer

Use a firewall to control traffic between the DMZ and internal network.. Proper segmentation and access control are key; placing servers on separate VLANs and restricting inbound/outbound traffic with firewalls are essential.

Answer

Place all DMZ servers on the same VLAN to simplify management.

Answer

Allow all outbound traffic from the DMZ to the internet for ease of use.

Answer

Disable logging on DMZ devices to conserve resources.

Question 14

An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)

Accepted Answer

Application identification and control. NGFWs include deep packet inspection, application awareness, and integrated IDS/IPS capabilities.

Answer

Static packet filtering based on IP and port

Answer

Stateful packet inspection

Question 15

A security team is investigating a potential man-in-the-middle attack. Which TWO of the following are common techniques used in MITM attacks? (Select TWO.)

Accepted Answer

ARP poisoning. ARP poisoning redirects traffic, and rogue Wi-Fi access points intercept communications.

Answer

SYN flood

Answer

DNS amplification

Answer

ICMP flood

Question 16

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Accepted Answer

Network tap. A network tap (or port mirror) creates a copy of traffic for passive monitoring. A firewall blocks/allows traffic, an IPS blocks malicious traffic, and a proxy modifies requests.

Answer

Firewall

Answer

Intrusion Prevention System (IPS)

Answer

Proxy server

Question 17

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that hosts public-facing servers, providing an extra layer of security between the internet and the internal network.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 18

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 19

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Accepted Answer

UDP. UDP is connectionless and faster, making it suitable for real-time applications like VoIP where occasional packet loss is acceptable.

Answer

ICMP

Answer

SCTP

Answer

TCP

Question 20

A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:

Accepted Answer

Stateless firewall. A stateless (packet-filtering) firewall examines each packet independently and does not track connection state.

Answer

Application proxy

Answer

Stateful firewall

Answer

Next-generation firewall