ISC2 CC Network Security Practice Test 4 — 15 Questions

Question 1

A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?

Accepted Answer

SSH on port 22. SSH (port 22) provides encrypted remote access, unlike Telnet which sends data in cleartext.

Answer

FTP on port 21

Answer

HTTP on port 80

Answer

Telnet on port 23

Question 2

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specialized for filtering HTTP/HTTPS traffic and protecting web applications.

Answer

Stateful firewall

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Question 3

During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?

Accepted Answer

Man-in-the-middle (MITM). ARP poisoning allows an attacker to intercept traffic on a local network, enabling man-in-the-middle attacks.

Answer

Spoofing

Answer

Denial of Service (DoS)

Answer

Sniffing

Question 4

Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?

Accepted Answer

Packet filtering firewall. Packet filtering firewalls are stateless and examine packet headers in isolation.

Answer

Stateful inspection firewall

Answer

Next-generation firewall (NGFW)

Answer

Application proxy firewall

Question 5

A company's public web server is placed in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this network architecture called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a buffer network for public-facing services.

Answer

Subnet

Answer

Honeypot

Answer

VLAN

Question 6

A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?

Accepted Answer

SYN flood. SYN flood is a DoS attack that exhausts server resources by initiating many half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Smurf attack

Question 7

An organization decides to implement an Intrusion Prevention System (IPS) to protect its network. Which statement about an IPS compared to an IDS is correct?

Accepted Answer

An IPS is placed inline and can automatically block malicious traffic.. An IPS is inline and can actively block traffic, while an IDS is passive and only alerts.

Answer

An IPS is placed out of band and monitors traffic.

Answer

An IPS generates alerts but does not block traffic.

Answer

An IPS operates only at the application layer.

Question 8

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

Accepted Answer

UDP. UDP is connectionless and does not guarantee delivery, making it fast but unreliable.

Answer

TCP

Answer

HTTP

Answer

IP

Question 9

A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?

Accepted Answer

VLAN. VLANs can partition a physical switch into multiple logical segments, isolating traffic between groups.

Answer

Subnetting

Answer

DMZ

Answer

Honeypot

Question 10

An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?

Accepted Answer

Phishing. The attack is a form of phishing, where an attacker uses social engineering via email (appearing to be the CEO) to trick the employee into revealing sensitive data. Phishing is a broader category of social engineering attacks that often use spoofing techniques, but the threat itself is classified as phishing.

Answer

Spoofing

Answer

Man-in-the-middle

Answer

Sniffing

Question 11

A security engineer is evaluating different firewall architectures. Which firewall type can decrypt SSL/TLS traffic, inspect the contents, and then re-encrypt it?

Accepted Answer

Next-generation firewall (NGFW). NGFWs often include SSL inspection capabilities to examine encrypted traffic for threats.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 12

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) handles IP addressing and routing decisions.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 13

A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?

Accepted Answer

Operates in passive mode by monitoring a copy of traffic. IDS is passive, monitors traffic, and generates alerts but does not block traffic. It can be network-based or host-based.

Answer

Can be placed inline to block malicious traffic

Answer

Can automatically reconfigure firewall rules

Answer

Ensures zero false positives

Question 14

Which THREE of the following are common mitigation techniques against Denial of Service (DoS) attacks?

Accepted Answer

Implementing rate limiting on servers. DoS mitigation includes using DDoS protection services, rate limiting, and filtering traffic based on IP reputation.

Answer

Disabling all firewall rules

Answer

Allowing all inbound traffic to avoid blocking legitimate users

Question 15

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size