ISC2 CC Network Security Practice Test 3 — 15 Questions

Question 1

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?

Accepted Answer

Using encryption protocols (e.g., IPsec, TLS). Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Answer

Implementing VLANs

Answer

Disabling unused ports on the switch

Answer

Deploying an intrusion detection system

Question 2

A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)

Accepted Answer

Use a firewall to control traffic between the DMZ and internal network.. Option A is correct because a firewall must mediate traffic between the DMZ and the internal network, enforcing rules that prevent a compromised DMZ host from directly reaching internal resources; this segmentation is a core DMZ security control. Option C is correct because placing each server type (web, email, DNS) on its own VLAN segments the DMZ and limits lateral movement if one server is compromised, so an attacker cannot easily pivot to the other servers. Option B is incorrect because putting all DMZ servers on one flat VLAN increases the attack surface and enables lateral movement between them. Option D is incorrect because unrestricted outbound traffic from the DMZ enables data exfiltration, command-and-control callbacks, and abuse of the servers; outbound traffic should be restricted to required destinations and ports. Option E is incorrect because disabling logging removes the audit trail needed for detecting and investigating intrusions, and logging is a required security control, not an optional resource saving.

Answer

Place all DMZ servers on the same VLAN to simplify management.

Answer

Allow all outbound traffic from the DMZ to the internet for ease of use.

Answer

Disable logging on DMZ devices to conserve resources.

Question 3

An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)

Accepted Answer

Application identification and control. Option B is correct because an NGFW performs deep packet inspection to identify applications (e.g., via App-ID) and enforce granular control based on the application rather than just port, which is essential against advanced threats that tunnel over allowed ports. Option C is correct because NGFWs integrate with directory services (e.g., Active Directory, LDAP) to map traffic to specific users and groups, enabling identity-based policies that traditional firewalls cannot enforce. Option E is correct because NGFWs bundle an integrated IPS that inspects traffic for known exploit signatures and behavioral anomalies, providing inline threat prevention without a separate appliance. Option A is not correct because static packet filtering based on IP and port is a first-generation firewall capability, not a distinguishing NGFW feature. Option D is not correct because stateful packet inspection is a baseline capability of traditional stateful firewalls and is not unique to NGFWs.

Answer

Static packet filtering based on IP and port

Answer

Stateful packet inspection

Question 4

A security team is investigating a potential man-in-the-middle attack. Which TWO of the following are common techniques used in MITM attacks? (Select TWO.)

Accepted Answer

ARP poisoning. ARP poisoning (A) is a classic MITM technique: the attacker sends forged ARP replies to associate their MAC address with the IP of the default gateway (or another host), causing victim traffic to flow through the attacker, who can then intercept or modify it. Setting up a rogue Wi-Fi access point (D) is also a common MITM method, often called an evil twin attack, where victims connect to the attacker-controlled AP and all their traffic is relayed or captured by the attacker. The other options are denial-of-service or amplification attacks rather than interception techniques: a SYN flood (B) exhausts TCP connection state to deny service, DNS amplification (C) abuses open DNS resolvers to flood a target with large responses, and an ICMP flood (E) overwhelms a target with ping traffic — none of these position the attacker to intercept and relay traffic between two parties.

Answer

SYN flood

Answer

DNS amplification

Answer

ICMP flood

Question 5

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Accepted Answer

Network tap. A network tap is a passive hardware device inserted inline (or via a mirror port) that copies traffic to a monitoring port without altering or delaying the original traffic. This makes it ideal for packet capture and analysis because it provides a true copy of the wire traffic and does not introduce a point of failure or modify packets. Firewalls, IPS, and proxies are all inline devices that can alter or block traffic.

Answer

Firewall

Answer

Intrusion Prevention System (IPS)

Answer

Proxy server

Question 6

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the untrusted internet and the trusted internal LAN, hosting public-facing services like web servers. It allows inbound internet access to the server while firewalls restrict traffic from the DMZ into the internal network, minimizing risk if the server is compromised. This directly satisfies the requirement to isolate the public server from internal networks.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 7

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 8

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Accepted Answer

UDP. UDP is connectionless and has no retransmission, ordering, or congestion-control overhead, which minimizes latency—exactly what VoIP needs. It tolerates some packet loss because voice codecs can interpolate or conceal minor gaps, and retransmitting lost voice packets would arrive too late to be useful anyway.

Answer

ICMP

Answer

SCTP

Answer

TCP

Question 9

A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:

Accepted Answer

Stateless firewall. A stateless firewall inspects each packet in isolation, matching only on source/destination IP addresses and ports (Layer 3/4 headers) without maintaining any connection state table. Because it does not track TCP handshakes or session context, it cannot distinguish a legitimate return packet from a spoofed one. This is the defining characteristic described in the question.

Answer

Application proxy

Answer

Stateful firewall

Answer

Next-generation firewall

Question 10

An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is deployed inline in the traffic path and can actively block malicious traffic in real time by dropping or resetting malicious packets. Because it sits inline, it can make blocking decisions on live traffic, which is exactly what the requirement specifies. This distinguishes it from detection-only or passive tools.

Answer

Vulnerability scanner

Answer

Packet sniffer

Answer

Intrusion Detection System (IDS)

Question 11

Which of the following is a common mitigation technique for a SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies are the canonical mitigation for SYN flood attacks. When the SYN backlog is exhausted or under stress, the server encodes connection state into the initial sequence number (ISN) of the SYN-ACK rather than allocating a half-open socket, so no state is consumed until the client returns the final ACK. This defeats the attacker's ability to exhaust the backlog with spoofed SYNs.

Answer

Use UDP instead of TCP

Answer

Disable TCP timestamps

Answer

Increase the TCP backlog queue

Question 12

A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?

Accepted Answer

TCP port 443. Secure web traffic uses HTTPS, which by default runs over TCP port 443. The question specifies 'secure web traffic,' so the correct protocol/port pairing is TCP 443. HTTPS encrypts HTTP using TLS, protecting confidentiality and integrity of web communications.

Answer

UDP port 443

Answer

TCP port 80

Answer

TCP port 22

Question 13

Which layer of the OSI model is responsible for routing packets across networks?

Accepted Answer

Network layer. The Network layer (Layer 3) of the OSI model is responsible for logical addressing and routing packets across networks. Protocols like IP, ICMP, and routing protocols (OSPF, BGP) operate at this layer, using IP addresses to determine the best path between networks. Routers are the classic Layer 3 devices that forward packets based on routing tables.

Answer

Physical layer

Answer

Transport layer

Answer

Data Link layer

Question 14

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, establishing separate connections with each and relaying (or altering) traffic while both sides believe they are communicating directly. The scenario describes exactly this relay behavior. The attacker can eavesdrop, modify, or inject data because neither endpoint detects the intermediary.

Answer

Phishing

Answer

Replay attack

Answer

DoS

Question 15

Which of the following is a characteristic of a stateful firewall that distinguishes it from a stateless firewall?

Accepted Answer

It uses a state table to track connections. A stateful firewall maintains a state table that tracks active connections (source/destination IP, ports, sequence numbers, TCP flags), allowing it to make decisions based on the context of a session rather than each packet in isolation. This lets it automatically permit return traffic for established connections without explicit rules.

Answer

It can decrypt SSL traffic

Answer

It examines each packet in isolation

Answer

It can filter based on application-layer data