ISC2 CC Network Security Practice Test 5 — 15 Questions

Question 1

A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)

Accepted Answer

Subnetting. Subnetting (A) is a valid segmentation method because it divides a single IP address space into smaller logical networks using subnet masks, creating separate broadcast domains and controlling traffic flow between subnets via routing. VLANs (C) are also valid segmentation methods because they logically partition a physical switch into multiple isolated Layer 2 broadcast domains, typically defined by 802.1Q tagging, allowing separation of devices regardless of physical location. Firewalls (B) enforce security policy between zones but are access-control devices rather than a segmentation technique themselves. IDS (D) monitors and alerts on malicious traffic but does not segment the network, and honeypots (E) are decoy systems used for detection and research, not segmentation.

Answer

Firewalls

Answer

IDS

Answer

Honeypots

Question 2

A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?

Accepted Answer

SSH on port 22. SSH on TCP port 22 provides encrypted, authenticated remote management of network devices, protecting credentials and session data from eavesdropping. It is the standard secure replacement for Telnet and is widely supported on routers and switches.

Answer

FTP on port 21

Answer

HTTP on port 80

Answer

Telnet on port 23

Question 3

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at Layer 7 and applies rules to block attacks like SQL injection, cross-site scripting (XSS), and malicious bots. It understands web protocols and can examine request bodies, headers, and cookies, which is exactly what is needed to protect internal web applications exposed to external users. This makes WAF the purpose-built device for the scenario.

Answer

Stateful firewall

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Question 4

During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?

Accepted Answer

Man-in-the-middle (MITM). ARP poisoning lets an attacker send forged ARP replies so that the victim's traffic is redirected through the attacker's machine. Because the attacker sits between the client and the server, silently relaying and potentially altering packets, this is a classic man-in-the-middle (MITM) attack. The interception and modification of traffic is the defining characteristic that distinguishes MITM from mere spoofing or sniffing.

Answer

Spoofing

Answer

Denial of Service (DoS)

Answer

Sniffing

Question 5

Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?

Accepted Answer

Packet filtering firewall. A packet filtering firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, examining source and destination IP addresses and port numbers to allow or deny traffic. It is stateless and makes decisions per packet based on configured ACLs.

Answer

Stateful inspection firewall

Answer

Next-generation firewall (NGFW)

Answer

Application proxy firewall

Question 6

A company's public web server is placed in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this network architecture called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting public-facing services while isolating them from internal resources. It is accessible from the internet but separated from the internal network by firewalls, exactly as described. This architecture limits the blast radius if a public server is compromised.

Answer

Subnet

Answer

Honeypot

Answer

VLAN

Question 7

A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending numerous SYN packets with spoofed source addresses, leaving the server with half-open connections that exhaust its backlog queue. The server responds with SYN-ACK to unreachable hosts and waits for the final ACK that never arrives, consuming resources until legitimate connections are refused. This matches the scenario of many incomplete TCP connection requests.

Answer

ICMP flood

Answer

UDP flood

Answer

Smurf attack

Question 8

An organization decides to implement an Intrusion Prevention System (IPS) to protect its network. Which statement about an IPS compared to an IDS is correct?

Accepted Answer

An IPS is placed inline and can automatically block malicious traffic.. An IPS is deployed inline in the traffic path, so it can inspect packets in real time and actively drop or reset malicious sessions, whereas an IDS is passive and only alerts. This inline placement is what enables automatic blocking. The other options describe IDS behavior or overstate the IPS's scope.

Answer

An IPS is placed out of band and monitors traffic.

Answer

An IPS generates alerts but does not block traffic.

Answer

An IPS operates only at the application layer.

Question 9

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

Accepted Answer

UDP. UDP (User Datagram Protocol) is a Transport layer (Layer 4) protocol that is connectionless and unreliable. It does not establish a connection before sending data, and it does not guarantee delivery, ordering, or error recovery. This makes it suitable for applications that prioritize speed over reliability, such as streaming or DNS.

Answer

TCP

Answer

HTTP

Answer

IP

Question 10

A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?

Accepted Answer

VLAN. A VLAN (Virtual LAN, IEEE 802.1Q) logically segments a single physical switch into multiple isolated broadcast domains, allowing the Accounting and HR departments to share hardware while remaining logically separated at Layer 2. This is the standard technology for departmental segmentation on a common switch. Subnetting operates at Layer 3 and does not by itself isolate traffic on the same switch without VLANs or ACLs.

Answer

Subnetting

Answer

DMZ

Answer

Honeypot

Question 11

An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker impersonates a trusted entity (like the CEO) to trick the recipient into revealing sensitive information. The scenario describes an email that appears to come from the CEO, which is a classic phishing attempt. Spoofing (A) refers to falsifying the sender address, but the broader threat here is phishing because it involves deception to extract data. Man-in-the-middle (C) and sniffing (D) are network-level attacks, not email-based social engineering.

Answer

Spoofing

Answer

Man-in-the-middle

Answer

Sniffing

Question 12

A security engineer is evaluating different firewall architectures. Which firewall type can decrypt SSL/TLS traffic, inspect the contents, and then re-encrypt it?

Accepted Answer

Next-generation firewall (NGFW). A Next-Generation Firewall (NGFW) includes SSL/TLS decryption and inspection capabilities, allowing it to decrypt encrypted traffic, inspect the plaintext for threats or policy violations, and then re-encrypt it before forwarding. This is a defining feature that separates NGFWs from traditional firewalls. The other firewall types lack the deep packet inspection and decryption engine required.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 13

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IP addresses) and routing, which determines the best path for data across interconnected networks. It uses protocols like IP, ICMP, and routing protocols (OSPF, BGP) to forward packets based on logical addresses, enabling communication between different networks.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 14

A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?

Accepted Answer

Operates in passive mode by monitoring a copy of traffic. Option B is correct because an IDS is fundamentally a passive monitoring technology: it receives a copy of the traffic (typically via a SPAN/mirror port or a network TAP) and analyzes it without sitting in the forwarding path, so it cannot drop packets. Option E is correct because the core function of an IDS is to detect suspicious or malicious activity and generate alerts (e.g., via signatures or anomaly detection) for analysts to investigate. Option A is wrong because inline blocking is characteristic of an IPS, not an IDS. Option C is wrong because an IDS does not automatically modify firewall rules; that would require integration with a firewall or an IPS/automated response system. Option D is wrong because no detection system guarantees zero false positives; IDS products inherently produce some false positives and false negatives.

Answer

Can be placed inline to block malicious traffic

Answer

Can automatically reconfigure firewall rules

Answer

Ensures zero false positives

Question 15

Which THREE of the following are common mitigation techniques against Denial of Service (DoS) attacks?

Accepted Answer

Implementing rate limiting on servers. DoS mitigation includes using DDoS protection services, rate limiting, and filtering traffic based on IP reputation.

Answer

Disabling all firewall rules

Answer

Allowing all inbound traffic to avoid blocking legitimate users