ISC2 CC Network Security Practice Test 11 — 15 Questions

Question 1

A small accounting firm has a flat network where all employee workstations and a guest Wi-Fi access point connect to the same switch. The owner asks a security consultant to keep guests from reaching the payroll server, which resides on the same subnet as employee devices. Which control should the consultant implement to meet this requirement with the least disruption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate VLAN for guests and apply an access control list that denies guest subnet traffic to the payroll server.. Segmenting guest traffic into its own VLAN removes it from the employee broadcast domain, and an ACL on the Layer 3 device enforces the rule that guests cannot reach the payroll server. This addresses the requirement directly without redesigning the employee network. Host firewalls, key rotation, and intrusion prevention do not provide the same deterministic isolation.

Answer

Deploy an IPS between the guest access point and the switch to block attacks aimed at the payroll server.

Answer

Enable a host-based firewall on the payroll server that permits only the payroll application's TCP port.

Answer

Change the guest Wi-Fi pre-shared key every 30 days and publish it only to visitors.

Question 2

An e-commerce company hosts its public storefront in a screened subnet. During a review, the security team finds that the database server holding customer records sits in the same subnet and accepts connections from any host on the internal corporate LAN. The team wants to allow storefront-to-database traffic while preventing ordinary employee workstations from reaching the database directly. Which control best meets this goal?

Accepted Answer

A firewall rule set that permits database access only from the storefront server's address and denies all other sources. Reachability between network segments is governed by filtering rules on a firewall or router ACL, so the only control listed that actually limits which sources may open sessions to the database is a rule permitting the storefront and denying everything else. This enforces least privilege and shrinks the attack surface without disrupting the application's legitimate path.

Answer

A network-based intrusion prevention system placed inline between the LAN and the screened subnet

Answer

A host-based antivirus agent installed on each employee workstation

Answer

Full-disk encryption on the database server's storage volumes

Question 3

A security architect is designing defenses against on-path attacks on a corporate wireless network where employees connect to internal applications. Which two controls most directly protect the confidentiality and integrity of employee traffic against an attacker who can observe or modify wireless frames? (Choose two.)

Accepted Answer

Requiring TLS for all internal application traffic between clients and servers.. Protecting against an on-path attacker requires cryptography at both the wireless link and the application layer. WPA3-Enterprise with protected management frames secures the radio hop and prevents management-frame manipulation, while TLS secures application data end to end. Monitoring, SSID hiding, and MAC filtering may add visibility or friction but do not encrypt or integrity-protect the traffic itself, so they do not directly meet the stated goal.

Answer

Deploying a wireless intrusion detection system to alert on rogue access points.

Answer

Implementing MAC address filtering to admit only known corporate devices.

Answer

Disabling SSID broadcast to make the corporate network harder to find.

Question 4

A hospital's biomedical team connects a new MRI workstation to the clinical VLAN. The workstation must reach a PACS archive on a different subnet, but the team reports that no traffic leaves the workstation. A technician confirms the workstation has an IP address of 10.20.30.44/24 and the PACS archive is 10.20.40.10/24. Which device should the workstation be configured to use as its default gateway?

Accepted Answer

A router interface on the 10.20.30.0/24 subnet. The workstation needs a next-hop address inside its own subnet so it can ARP for that device and hand off traffic destined for 10.20.40.0/24. Only a router interface on 10.20.30.0/24 provides a reachable Layer 2 next hop that can also route to the PACS subnet. The other candidates either sit outside the local subnet or cannot perform IP routing.

Answer

The PACS archive server itself at 10.20.40.10

Answer

The DNS server address assigned by DHCP

Answer

A Layer 2 switch's management IP address on the 10.20.30.0/24 subnet

Question 5

A security administrator is configuring a wireless network for a small office. The requirement is to use a protocol that provides strong encryption and authentication, and that is resistant to offline dictionary attacks on captured handshakes. Which protocol should be selected?

Accepted Answer

Wi-Fi Protected Access 3 (WPA3) with Simultaneous Authentication of Equals (SAE). WPA3 with SAE is designed to replace WPA2-PSK's vulnerable four-way handshake with a mutually authenticated exchange that resists offline dictionary attacks. It also provides stronger encryption through the use of SAE and, in WPA3-Personal, forward secrecy. The other options either lack strong encryption or remain susceptible to offline attacks.

Answer

Open authentication with Captive Portal

Answer

Wi-Fi Protected Access 2 (WPA2) with Pre-Shared Key (PSK)

Answer

Wired Equivalent Privacy (WEP)

Question 6

A security engineer is reviewing firewall logs and notices that an internal host is making repeated outbound connections to a known malicious IP address on port 443. The firewall is configured to allow all outbound traffic to port 443. The engineer wants to block this specific traffic without disrupting other legitimate HTTPS traffic. Which action should the engineer take?

Accepted Answer

Create an outbound rule to block all traffic to the malicious IP address on any port.. A targeted outbound block rule for the specific malicious IP address stops the communication without affecting legitimate HTTPS traffic. This approach is precise, does not require deep packet inspection, and is effective regardless of the port used. Other methods either do not guarantee a block or require additional capabilities like SSL decryption.

Answer

Implement a URL filtering rule to block the domain name associated with the malicious IP.

Answer

Enable intrusion prevention system (IPS) signatures to detect and block the malicious traffic.

Answer

Configure a quality of service (QoS) policy to throttle traffic to the malicious IP address.

Question 7

A network administrator is hardening a corporate wireless network. Management wants to ensure that only authorized devices can associate and that wireless traffic cannot be easily read by someone nearby with a packet capture tool. Which two controls should the administrator implement? (Choose two.)

Accepted Answer

WPA3 with strong authentication. Strong wireless encryption with robust authentication, such as WPA3, protects traffic from nearby eavesdropping, while 802.1X ensures only authenticated devices or users can associate. Together they address confidentiality and access control. WEP is broken, SSID hiding is easily defeated, and MAC filtering can be bypassed through spoofing, so none of those reliably satisfy the requirements.

Answer

Media Access Control (MAC) address filtering

Answer

Wired Equivalent Privacy (WEP)

Answer

Service Set Identifier (SSID) broadcasting disabled

Question 8

A hospital's security team wants to give remote clinicians access to internal patient systems without exposing those systems directly to the internet. The team requires strong encryption, per-user authentication, and the ability to log every session. Which solution best fits these requirements?

Accepted Answer

A remote access VPN terminating on a VPN concentrator with user authentication and session logging. A remote access VPN provides the encrypted tunnel, individual user authentication, and auditable session records that the hospital requires, while keeping internal systems unreachable from the public internet. It scales to a distributed clinical workforce far better than fixed site-to-site links and gives the security team the visibility it needs.

Answer

A remote desktop gateway that publishes the internal applications over HTTPS

Answer

A site-to-site IPsec tunnel between the hospital and each clinician's home router

Answer

Publishing the patient systems through a reverse proxy with TLS

Question 9

A hospital's radiology department transmits large medical images to a remote clinic over a public network. The security team must ensure that the images cannot be read or modified in transit, and that the remote clinic can verify the images came from the hospital. Which combination of controls should the team use?

Accepted Answer

IPsec in tunnel mode with confidentiality and data origin authentication enabled.. IPsec in tunnel mode with ESP confidentiality and authentication provides encryption for the images and cryptographically verifies the hospital as the origin. The remote clinic can validate the sender and detect any modification in transit. TLS with a certificate issued to the wrong party, shared SFTP credentials, and unencrypted GRE do not meet both requirements.

Answer

SFTP with a shared username and password for the radiology and clinic staff.

Answer

A site-to-site VPN using GRE without encryption or authentication.

Answer

TLS 1.3 with a server certificate issued to the remote clinic.

Question 10

A financial services company is designing a demilitarized zone (DMZ) for its public web and email relay servers. The security architect wants to reduce the attack surface and limit what an attacker can reach if a DMZ host is compromised. Which two design practices should be implemented? (Choose two.)

Accepted Answer

Permit only the specific inbound ports required for the public services into the DMZ.. A DMZ should expose only the ports required for public services and should enforce strict, default-deny rules on the internal firewall so that a compromised DMZ host cannot freely reach internal systems. These two practices reduce attack surface and contain lateral movement. Opening management paths or sharing VLANs and rule sets with internal networks removes the separation that makes the DMZ valuable.

Answer

Allow the DMZ hosts to initiate connections to any internal server for management convenience.

Answer

Place the DMZ servers on the same VLAN as internal user workstations to simplify routing.

Answer

Use the same firewall rule set for both the external and internal firewalls to reduce administrative effort.

Question 11

A network architect is designing a demilitarized zone (DMZ) for a company that hosts a public web server and a public DNS server. The requirement is to ensure that if either public server is compromised, it cannot initiate connections to the internal network. Which design approach best meets this requirement?

Accepted Answer

Create a DMZ on a separate subnet with firewall rules that allow inbound traffic to the servers but deny all outbound traffic from the DMZ to the internal network.. The most effective way to prevent a compromised DMZ host from reaching the internal network is to segment the DMZ on its own subnet and enforce firewall rules that deny outbound traffic from the DMZ to the internal network. This limits lateral movement and contains potential breaches. Other options either place servers on the internal network or allow unrestricted DMZ-to-internal traffic, failing the requirement.

Answer

Use a single firewall with three interfaces: internet, DMZ, and internal, with rules that allow any traffic from the DMZ to the internal network.

Answer

Place both servers on the internal network and use host-based firewalls to restrict outbound traffic.

Answer

Place the servers on the internal network and use a reverse proxy to handle all incoming requests.

Question 12

A financial services firm wants to give remote employees encrypted access to internal trading applications without exposing those applications directly to the internet. The security team requires that only the remote client's traffic to specific internal resources is tunneled, and that the internal application servers never initiate connections back to the client. Which technology best meets these requirements?

Accepted Answer

A remote access VPN terminating on a VPN concentrator. Remote employees need an encrypted path into the internal network that they initiate, so internal servers never connect back to them. A remote access VPN terminated on a concentrator provides exactly this client-initiated tunnel and can be scoped to specific internal resources. Site-to-site tunnels, reverse proxies, and NAC address different problems and do not meet both stated constraints.

Answer

A network access control (NAC) solution

Answer

A reverse proxy published in the DMZ

Answer

A site-to-site IPsec tunnel between two data centers

Question 13

A security team is designing a network segmentation strategy to protect a database server that contains sensitive customer information. The database server should only be accessible by the application server, and no other systems should be able to initiate connections to it. Which two controls should the team implement to achieve this? (Choose two.)

Accepted Answer

Place the database server in a separate VLAN and configure firewall rules to allow traffic only from the application server's IP address.. Combining network segmentation with firewall rules and a host-based firewall provides defense in depth. The VLAN and network firewall restrict access at the network perimeter, while the host firewall adds protection directly on the server. Together, they ensure only the application server can connect, aligning with least privilege.

Answer

Use network address translation (NAT) to hide the database server's IP address from other internal systems.

Answer

Enable port security on the switch port connected to the database server to restrict MAC addresses.

Answer

Deploy an intrusion detection system (IDS) to monitor traffic to the database server and alert on suspicious connections.

Question 14

A financial services firm is redesigning its internal network after an incident in which malware spread from a compromised workstation to several unrelated departments. The security architect proposes dividing the flat network into smaller zones so that a future compromise stays contained. Which two measures best support this goal? (Choose two.)

Accepted Answer

Applying the principle of least privilege to internal firewall rule sets and access control lists. Containment requires both breaking the flat network into isolated zones and restricting what traffic may cross between them. VLANs with firewall-enforced inter-VLAN rules provide the zones, while least-privilege ACLs and rule sets ensure that any permitted crossing is minimal, together limiting how far a single compromised workstation can spread.

Answer

Deploying a signature-based intrusion detection sensor on the core switch

Answer

Increasing the bandwidth of the internal network backbone between departments

Answer

Enabling dynamic host configuration protocol snooping on all access switches

Question 15

A financial services company wants to allow employees to use personal laptops on the corporate wireless network without installing company-managed certificates on those devices. The company still needs to authenticate each user and apply role-based access to internal applications. Which approach best meets these requirements?

Accepted Answer

WPA2-Enterprise with PEAP-MSCHAPv2 using corporate directory credentials, plus a NAC or RADIUS authorization policy for role mapping.. PEAP-MSCHAPv2 authenticates users against the corporate directory using usernames and passwords, so no client certificate is needed on personal laptops. A RADIUS or NAC authorization policy then maps the authenticated identity to a role that governs access to internal applications. EAP-TLS requires certificates, WPA2-Personal has no per-user identity, and a captive portal lacks strong authentication and authorization.

Answer

WPA2-Personal with a strong pre-shared key and MAC address filtering for known laptops.

Answer

An open wireless network with a captive portal that asks users to type their employee ID.

Answer

WPA2-Enterprise with EAP-TLS using a client certificate issued by the corporate PKI.