ISC2 CC Network Security Practice Test 3 — 15 Questions

Question 1

Which OSI layer is responsible for routing packets based on IP addresses?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles packet forwarding and routing using IP addresses.

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Answer

Layer 2 – Data Link

Question 2

An attacker captures network traffic using Wireshark and reads unencrypted emails. Which security goal is most directly compromised?

Accepted Answer

Confidentiality. Sniffing captures sensitive data, violating confidentiality.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 3

A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?

Accepted Answer

Stateful inspection. Stateful inspection firewalls track connection state and filter based on IP/port.

Answer

Stateless packet filtering

Answer

Application proxy

Answer

Next-generation firewall (NGFW)

Question 4

A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?

Accepted Answer

Smurf attack. Unsolicited ICMP replies may indicate a DoS attack using reflected traffic.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 5

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP to MAC addresses.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 6

A company places a web server and an email server in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this segment called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) hosts public-facing services with controlled access to internal network.

Answer

VLAN

Answer

Honeypot

Answer

Subnet

Question 7

An organization wants to prevent malicious HTTP requests targeting a web application. Which security device is specifically designed for this purpose?

Accepted Answer

WAF. WAF (Web Application Firewall) inspects HTTP/HTTPS traffic and applies OWASP rules.

Answer

NIDS

Answer

HIDS

Answer

IPS

Question 8

Which of the following is a connectionless, unreliable transport protocol?

Accepted Answer

UDP. UDP is connectionless and does not guarantee delivery.

Answer

IP

Answer

TCP

Answer

ICMP

Question 9

An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle. ARP poisoning allows man-in-the-middle attacks by associating attacker's MAC with the victim's IP.

Answer

Sniffing

Answer

Spoofing

Answer

DoS

Question 10

Which of the following ports is used by HTTPS for secure web traffic?

Accepted Answer

443. HTTPS uses port 443 by default.

Answer

80

Answer

22

Answer

53

Question 11

What is the primary difference between an IDS and an IPS?

Accepted Answer

IDS only alerts, IPS can block traffic. IDS is passive (alerts), IPS is inline (can block).

Answer

IDS is faster than IPS

Answer

IDS is hardware, IPS is software

Answer

IDS monitors only hosts, IPS monitors network

Question 12

A network engineer wants to mitigate ARP spoofing attacks. Which of the following is the most effective technique?

Accepted Answer

Implement Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets to prevent spoofing.

Answer

Enable STP

Answer

Use static ARP entries

Answer

Disable ICMP

Question 13

A security analyst is investigating a potential DDoS attack. Which of the following are common indicators of a DDoS? (Choose TWO)

Accepted Answer

Unusually high traffic volume from multiple IP addresses. High volume of traffic from many sources and increased latency are signs of DDoS.

Answer

Low CPU usage on servers

Answer

Single source sending many packets

Answer

Decrease in DNS queries

Question 14

Which of the following are effective defenses against man-in-the-middle attacks? (Choose THREE)

Accepted Answer

Educating users to verify certificates. HTTPS, VPNs, and certificate validation help prevent MITM.

Answer

Using HTTP instead of HTTPS

Answer

Disabling ARP

Question 15

A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)

Accepted Answer

Subnetting. VLANs and subnetting are common segmentation techniques.

Answer

Firewalls

Answer

IDS

Answer

Honeypots