ISC2 CC Network Security Practice Test 2 — 15 Questions

Question 1

A user reports that they can access websites by typing domain names like www.example.com into their browser, but they cannot access the same sites by typing the IP address directly. The network administrator suspects a DNS issue. Which protocol is primarily responsible for translating domain names to IP addresses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS. DNS translates domain names to IP addresses, enabling users to access websites by name. The user's ability to access sites by name but not by IP address indicates a DNS resolution issue, confirming that DNS is the protocol involved. The other protocols serve different purposes in network communication.

Answer

DHCP

Answer

ARP

Answer

ICMP

Question 2

A security analyst is reviewing network logs and notices that an attacker is attempting to exhaust the DHCP address pool by sending numerous DHCPDISCOVER messages with spoofed MAC addresses. Which two countermeasures should the analyst recommend to mitigate this attack? (Choose two.)

Accepted Answer

Enable DHCP snooping on access switches.. DHCP starvation is mitigated by controlling DHCP traffic and limiting MAC addresses per port. DHCP snooping rate-limits and filters DHCP messages, while port security caps the number of MAC addresses on a port, preventing a single attacker from generating many spoofed requests. Together, they effectively stop the exhaustion attempt.

Answer

Implement 802.1X authentication on all switch ports.

Answer

Enable IP source guard on all access ports.

Answer

Deploy a second DHCP server for redundancy.

Question 3

A hospital network uses 802.1X for wired port authentication. An attacker connects a rogue switch to an authenticated port and then attaches multiple unauthorized devices, which gain network access using the authenticated port's credentials. Which feature should be enabled to prevent this?

Accepted Answer

802.1X with MAC Authentication Bypass (MAB) and multi-auth host mode restrictions. The attack exploits an authenticated port being shared by multiple devices. Enforcing 802.1X with strict host mode restrictions, such as single-host or multi-auth with per-device authentication, ensures each device must authenticate individually. Port security, DHCP snooping, and MACsec address different threats and do not enforce per-device authentication behind a shared port.

Answer

MACsec encryption

Answer

Port security with MAC address limiting

Answer

DHCP snooping

Question 4

A security engineer is implementing network access control (NAC) in a corporate environment. The goal is to ensure that only compliant and authenticated devices can access the network, and that non-compliant devices are remediated or quarantined. Which two components are essential for a NAC solution to achieve these goals? (Choose two.)

Accepted Answer

A posture assessment mechanism to evaluate device compliance. A NAC solution must authenticate devices and users, typically via RADIUS, and assess their compliance through posture checks. These two components enable the system to make informed access decisions, such as allowing, quarantining, or remediating devices. Other elements like DHCP, WAFs, or specific enforcement protocols are not essential to achieve the stated goals.

Answer

A web application firewall (WAF) to inspect HTTP traffic

Answer

A DHCP server for assigning IP addresses to devices

Answer

A protocol for enforcing access decisions, such as 802.1X

Question 5

Which OSI layer is responsible for routing packets across networks using IP addresses?

Accepted Answer

Layer 3 - Network. The Network layer (Layer 3) is responsible for logical addressing and routing. It uses IP addresses to determine the best path for packets to travel from source to destination across different networks. Protocols like IP (IPv4/IPv6), OSPF, and BGP operate at this layer to perform routing decisions.

Answer

Layer 1 - Physical

Answer

Layer 4 - Transport

Answer

Layer 2 - Data Link

Question 6

A security analyst notices unusual traffic from an internal workstation to an external IP address on port 25. Which protocol is most likely being used?

Accepted Answer

SMTP. SMTP (Simple Mail Transfer Protocol) operates over TCP port 25 by default for relaying and receiving email. Unusual outbound traffic on port 25 from an internal workstation often indicates a compromised host sending spam or a malware infection attempting to exfiltrate data via email. The other protocols listed use different default ports: FTP uses 20/21, DNS uses 53, and HTTP uses 80.

Answer

FTP

Answer

DNS

Answer

HTTP

Question 7

In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?

Accepted Answer

Layer 2 - Data Link. The Data Link layer (Layer 2) is responsible for framing, MAC addressing, and forwarding frames within a local network segment. VLANs (802.1Q) are a Layer 2 construct that logically segments a switch into multiple broadcast domains, and VLAN tags are inserted into Ethernet frames — making Layer 2 the correct answer. Switches use MAC address tables to forward frames and enforce VLAN membership.

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Answer

Layer 1 - Physical

Question 8

An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?

Accepted Answer

Spoofing. Spoofing is the act of forging a source IP address (or other identity field) to impersonate a trusted host. In this scenario, the attacker captures traffic and crafts packets with a falsified source IP to make them appear to originate from a trusted system. This is the definition of IP spoofing, a foundational network threat.

Answer

Sniffing

Answer

Man-in-the-middle

Answer

Denial of Service

Question 9

A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at the application layer (Layer 7) and is specifically designed to inspect HTTP/HTTPS traffic, blocking malicious requests such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It understands HTTP semantics like headers, cookies, methods, and payloads, making it the right tool for application-layer request filtering.

Answer

Intrusion Prevention System (IPS)

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Stateful firewall

Question 10

Which TCP segment is sent to initiate the three-way handshake?

Accepted Answer

SYN. The TCP three-way handshake begins with the client sending a SYN segment to the server to request a connection and synchronize sequence numbers. The server responds with SYN-ACK, and the client completes with ACK. Therefore, the segment that initiates the handshake is SYN.

Answer

ACK

Answer

SYN-ACK

Answer

FIN

Question 11

An organization wants to place its public web server, email server, and DNS server in a network that is accessible from the internet but isolated from the internal corporate network. Which network design should be used?

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually the internet. It adds an additional layer of security by isolating these services from the internal corporate network. Public web, email, and DNS servers are typically placed in a DMZ to allow external access while protecting the internal network.

Answer

VPN

Answer

VLAN

Answer

Subnet

Question 12

Which firewall type inspects the entire packet, including application data, and can enforce rules based on user identity?

Accepted Answer

Next-generation firewall (NGFW). A Next-Generation Firewall (NGFW) goes beyond traditional port/protocol inspection by performing deep packet inspection (DPI) up to Layer 7, identifying applications regardless of port, and integrating user identity awareness (via LDAP, Active Directory, or captive portal) to enforce policies based on who the user is. It combines stateful inspection, application control, IPS, and identity-based rules in a single platform. This matches the question's requirement of inspecting application data and enforcing rules based on user identity.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 13

A security analyst detects an ARP spoofing attack on the local network. What is the primary goal of an ARP spoofing attack?

Accepted Answer

To redirect traffic to the attacker's machine for eavesdropping or modification. ARP spoofing allows an attacker to intercept traffic by associating their MAC address with the IP address of a legitimate host.

Answer

To disable the switch by sending fake VLAN tags

Answer

To overwhelm the network with broadcast traffic

Answer

To corrupt the DNS cache

Question 14

Which protocol is considered insecure because it transmits data in cleartext, including passwords?

Accepted Answer

Telnet. Telnet is considered insecure because it transmits all data — including usernames and passwords — in cleartext over the network, with no encryption whatsoever. Anyone with access to the traffic path (via packet capture or MITM) can read credentials directly. This is why Telnet has been replaced by SSH for remote administration.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 15

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack