ISC2 CC Network Security Practice Test 2 — 15 Questions

Question 1

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Accepted Answer

Network tap. A network tap (or port mirror) creates a copy of traffic for passive monitoring. A firewall blocks/allows traffic, an IPS blocks malicious traffic, and a proxy modifies requests.

Answer

Firewall

Answer

Intrusion Prevention System (IPS)

Answer

Proxy server

Question 2

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that hosts public-facing servers, providing an extra layer of security between the internet and the internal network.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 3

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 4

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Accepted Answer

UDP. UDP is connectionless and faster, making it suitable for real-time applications like VoIP where occasional packet loss is acceptable.

Answer

ICMP

Answer

SCTP

Answer

TCP

Question 5

A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:

Accepted Answer

Stateless firewall. A stateless (packet-filtering) firewall examines each packet independently and does not track connection state.

Answer

Application proxy

Answer

Stateful firewall

Answer

Next-generation firewall

Question 6

An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is inline and can actively block threats, unlike an IDS which only alerts.

Answer

Vulnerability scanner

Answer

Packet sniffer

Answer

Intrusion Detection System (IDS)

Question 7

Which of the following is a common mitigation technique for a SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies allow the server to respond to SYN requests without maintaining state until the connection is verified, reducing the impact of SYN floods.

Answer

Use UDP instead of TCP

Answer

Disable TCP timestamps

Answer

Increase the TCP backlog queue

Question 8

A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?

Accepted Answer

TCP port 443. HTTPS uses port 443 and TLS/SSL for encryption.

Answer

UDP port 443

Answer

TCP port 80

Answer

TCP port 22

Question 9

Which layer of the OSI model is responsible for routing packets across networks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles routing and logical addressing (IP addresses).

Answer

Physical layer

Answer

Transport layer

Answer

Data Link layer

Question 10

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack involves an attacker intercepting and relaying messages between two parties.

Answer

Phishing

Answer

Replay attack

Answer

DoS

Question 11

Which of the following is a characteristic of a stateful firewall that distinguishes it from a stateless firewall?

Accepted Answer

It uses a state table to track connections. A stateful firewall maintains a state table to track active connections, allowing it to make decisions based on the context of the traffic.

Answer

It can decrypt SSL traffic

Answer

It examines each packet in isolation

Answer

It can filter based on application-layer data

Question 12

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within the same network.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 13

A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)

Accepted Answer

Large number of half-open connections. Options D and E are both correct indicators of a SYN flood attack. Option D is correct because a SYN flood sends many SYN packets to initiate TCP connections but never completes the three-way handshake, leaving numerous half-open connections in the SYN_RECEIVED state on the server, which exhausts resources. Option E is correct because the attack generates a high number of SYN packets from the attacker, and since the handshake is never completed, the corresponding ACK packets are absent. Both symptoms—half-open connections and SYN packets without ACK—are characteristic of a SYN flood.

Answer

Increased DNS query responses

Answer

High number of ICMP echo replies

Answer

Unusual outbound traffic on port 80

Question 14

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. VLANs, subnets, and DMZs are common segmentation methods. Firewalls enforce rules but are not segmentation methods themselves; IDS is a monitoring tool.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 15

Which two of the following are best practices to mitigate man-in-the-middle attacks? (Select TWO.)

Accepted Answer

Use HTTPS with proper certificate validation. HTTPS with certificate validation ensures secure communication, and VPNs encrypt traffic between endpoints. Disabling encryption increases risk, and using Telnet sends data in cleartext.

Answer

Disable SSL/TLS on web servers

Answer

Use ARP spoofing detection tools

Answer

Use Telnet for remote administration