ISC2 CC Network Security Practice Test 10 — 15 Questions

Question 1

A small business wants to give employees secure access to internal file shares while they work from home. The company has no dedicated security operations staff and wants a solution that authenticates users and encrypts traffic without deploying agents on every personal device. Which technology is the most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A remote access VPN using TLS or IPsec.. A remote access VPN is designed exactly for this need: it authenticates the user at a central gateway and encrypts traffic between the remote device and the corporate network. The other choices address endpoint protection, local network admission control, or web application defense, none of which establish an authenticated, encrypted path to internal file shares for off-site workers.

Answer

A web application firewall protecting the file server.

Answer

A host-based intrusion prevention system on each laptop.

Answer

A network access control solution enforcing 802.1X on the office switches.

Question 2

A small accounting firm has a single flat network. During a risk review, the consultant recommends placing all wireless guest users on a separate logical network so they cannot reach the internal file server, even though both networks share the same physical switches and access points. Which technology best accomplishes this?

Accepted Answer

VLAN. VLANs let one physical switch infrastructure carry multiple isolated logical networks, which is exactly what is needed to separate guest wireless users from internal resources. Access control lists or firewall rules between the VLANs enforce the policy. NAT, DHCP, and DNS are addressing or naming services and do not by themselves prevent one group of users from reaching another group's systems.

Answer

DNS

Answer

DHCP

Answer

NAT

Question 3

A security engineer is deploying a new VPN solution for remote employees. The company requires that the VPN provide strong encryption, support for multiple users, and the ability to traverse NAT devices. Which VPN protocol should the engineer choose?

Accepted Answer

L2TP/IPsec. L2TP/IPsec provides strong encryption through IPsec, supports multiple users, and can traverse NAT with NAT-T. It is a widely supported standard for remote access VPNs. The other options either lack strong encryption (PPTP), are platform-specific (SSTP), or are not designed for remote access tunneling (IPsec transport mode).

Answer

PPTP

Answer

IPsec in transport mode

Answer

SSTP

Question 4

A hospital's security team wants to detect when an attacker is probing its internal network for open ports, but the team must not block legitimate clinical traffic because doing so could interrupt patient care. The team decides to deploy a solution that only alerts on suspicious activity. Which type of solution best matches this requirement?

Accepted Answer

A network-based intrusion detection system (NIDS). The requirement is detection without disruption, which points to a passive monitoring technology. A network-based intrusion detection system observes copies of traffic and raises alerts on suspicious activity such as port scanning, but it does not sit inline to block. Prevention systems, web application firewalls, and stateful firewalls either block traffic or focus on the wrong layer for this internal reconnaissance scenario.

Answer

A network-based intrusion prevention system (NIPS)

Answer

A stateful packet-filtering firewall

Answer

A web application firewall (WAF)

Question 5

A small business wants to provide secure remote access to its internal file server for employees working from home. The company requires that all traffic between the employee's device and the file server be encrypted and that the internal network topology remain hidden. Which technology best meets these requirements?

Accepted Answer

VPN. A VPN is designed to provide encrypted, tunneled access to an entire network, making it ideal for remote employees who need to reach internal resources securely. It encapsulates traffic, encrypts it, and masks internal addresses, fulfilling both the encryption and topology-hiding requirements. Other options are protocol-specific and cannot deliver equivalent network-level access.

Answer

HTTPS

Answer

SSH

Answer

SFTP

Question 6

A financial services firm must protect a legacy trading application that uses a proprietary protocol on TCP port 7000. The security team wants to block all traffic to this port except from a small set of approved internal subnets, and they must ensure that fragmented packets cannot bypass the rule. Which control most directly achieves this?

Accepted Answer

A packet-filtering firewall that reassembles fragments before applying rules.. The requirement is deterministic network-layer access control on a specific port combined with protection against fragmentation evasion. A packet-filtering firewall that reassembles fragments before applying rules does exactly that, whereas application gateways, stateful inspection, and intrusion prevention systems address different concerns and do not guarantee both the source restriction and the anti-fragmentation behavior in this scenario.

Answer

A stateful inspection firewall that tracks established TCP sessions.

Answer

A network intrusion prevention system tuned to the trading protocol.

Answer

An application-layer gateway that decodes the proprietary protocol.

Question 7

A financial services firm wants to allow employees to securely access internal applications from home without exposing those applications directly to the internet. The security team proposes using a VPN that encrypts traffic at the network layer and can carry non-web protocols. Which VPN technology best meets this requirement?

Accepted Answer

IPsec in tunnel mode. IPsec in tunnel mode encrypts and encapsulates entire IP packets, enabling remote users to securely reach internal applications over any IP-based protocol. Unlike browser-based TLS VPNs or SSH port forwarding, it provides transparent network-layer connectivity without exposing applications to the internet. RADIUS with 802.1X handles LAN access control, not remote traffic encryption, so it cannot meet the stated requirement.

Answer

TLS-based web VPN portal

Answer

RADIUS authentication with 802.1X

Answer

SSH port forwarding

Question 8

A company's security policy requires that all remote employees use a technology that creates an encrypted tunnel over the public internet so their traffic appears to originate from the corporate network. The solution must authenticate users before granting access to internal applications. Which technology should the company deploy?

Accepted Answer

A virtual private network (VPN). The policy requires an encrypted tunnel over the public internet plus user authentication for internal application access. A VPN provides exactly that by encapsulating traffic and terminating at the corporate edge after verifying credentials. DMZs isolate public services, VLANs segment local networks, and proxies forward specific requests, but none deliver the encrypted authenticated remote-access tunnel described.

Answer

A demilitarized zone (DMZ)

Answer

A proxy server

Answer

A virtual local area network (VLAN)

Question 9

A small accounting firm's staff connect to the corporate wireless network using a shared passphrase that every employee knows, and the same passphrase has not been changed in two years. A security consultant recommends moving to a deployment where each user authenticates with their own domain credentials and a RADIUS server validates the logon before network access is granted. Which technology should the consultant recommend?

Accepted Answer

WPA2-Enterprise with 802.1X authentication. Enterprise-mode wireless security couples the 802.1X framework with a RADIUS server so each user presents unique credentials, commonly their domain logon, before access is granted. This eliminates the shared-secret weakness, enables per-user revocation, and produces authentication logs tied to individuals, which is exactly what the consultant was asked to deliver for the accounting firm.

Answer

A captive portal that displays an acceptable-use policy before granting access

Answer

WPA2-Personal with a longer and more complex pre-shared key

Answer

MAC address filtering on the wireless access points

Question 10

A university wants to provide guests with internet access through the same physical wireless infrastructure used by staff, but guests must not reach internal research servers. Staff must authenticate with institutional credentials. Which combination of controls best achieves this separation?

Accepted Answer

Separate SSIDs mapped to different VLANs, with 802.1X for staff and a guest portal for visitors.. Separate SSIDs tied to separate VLANs provide the isolation, and using 802.1X for staff plus a guest portal for visitors supplies the differentiated authentication the university needs. Shared keys, MAC filtering, and a single personal-network SSID all fail to distinguish populations or to prevent guests from reaching internal research servers, so they cannot meet the stated requirements.

Answer

A single pre-shared key for all users plus a captive portal.

Answer

MAC address filtering that allows only registered devices on the wireless network.

Answer

WPA3-Personal on a single SSID with a rotating password posted at reception.

Question 11

An analyst reviewing traffic captures sees a workstation repeatedly sending TCP packets with the SYN flag set to many different destination ports on a single server, but the workstation never completes the three-way handshake. The server's connection table is becoming exhausted. Which type of activity is most likely occurring?

Accepted Answer

A SYN flood denial-of-service attack. The repeated SYN packets without completed handshakes indicate a SYN flood, a denial-of-service technique that exhausts a server's pending connection queue. The server cannot complete legitimate connections because its backlog is full. Other attacks would involve different protocols or completed sessions, so the half-open TCP pattern is the key differentiator.

Answer

A man-in-the-middle attack intercepting session traffic

Answer

A smurf amplification attack using ICMP

Answer

A brute-force password attack against the server

Question 12

A network administrator is configuring a new wireless network for a small office. The office manager wants to ensure that only authorized employees can connect and that traffic between wireless clients is encrypted. Which security protocol should the administrator implement?

Accepted Answer

Wi-Fi Protected Access 2 (WPA2) with Advanced Encryption Standard (AES) and a pre-shared key. WPA2 with AES and a pre-shared key provides both authentication (via the key) and strong encryption for wireless traffic. It is the standard for securing small office wireless networks. Other options either lack encryption or use weak, outdated methods that do not meet the security requirements.

Answer

Media Access Control (MAC) address filtering with a whitelist

Answer

Open authentication with a captive portal for user login

Answer

Wired Equivalent Privacy (WEP) with a 128-bit key

Question 13

A small business wants to prevent employees from visiting known malicious websites. The owner asks for a solution that can block requests based on a constantly updated list of harmful domains without requiring software on each employee device. Which technology should be recommended?

Accepted Answer

DNS filtering. DNS filtering blocks malicious domains by intercepting DNS queries and checking them against a threat intelligence feed. It requires no endpoint agent, applies network-wide, and updates centrally. Host-based antivirus needs per-device installation, stateful firewalls lack domain awareness, and NAC governs device admission rather than web content, so none satisfy the stated constraints.

Answer

Stateful packet inspection firewall

Answer

Network access control (NAC)

Answer

Host-based antivirus

Question 14

A company is deploying a new wireless network for guests and wants to ensure that guest traffic cannot reach internal corporate resources. The network team plans to use a separate SSID for guests. Which additional configuration is most important to enforce the isolation requirement?

Accepted Answer

Map the guest SSID to a dedicated VLAN with firewall rules that deny access to internal subnets. Guest isolation requires a logical network boundary, which is achieved by assigning the guest SSID to a dedicated VLAN and enforcing firewall rules that deny access to internal subnets. Wireless encryption, captive portals, and channel selection do not create that boundary. Without the VLAN and firewall policy, guest devices may reach corporate resources.

Answer

Configure the guest SSID to use a captive portal for user registration

Answer

Enable WPA3-Personal on the guest SSID with a strong pre-shared key

Answer

Set the guest SSID to broadcast on a different wireless channel than the corporate SSID

Question 15

A financial services firm is designing a network that must allow inbound HTTPS from the internet to a public web application while preventing any direct inbound connections to its internal database servers. The security architect proposes placing the web application in a screened subnet and configuring rules so the database can be reached only from the web application. Which design element is the architect primarily relying on?

Accepted Answer

A demilitarized zone (DMZ) with controlled access between zones. The architect needs a screened subnet for the public web application plus enforced rules controlling traffic between the internet, the DMZ, and internal systems. A DMZ with controlled access accomplishes this by allowing inbound HTTPS to the web tier while denying direct inbound access to database servers. A flat network, NAT alone, or a hub topology lacks the required separation and rule enforcement.

Answer

A hub-based network topology

Answer

A flat network with a single perimeter firewall

Answer

Network address translation (NAT) alone