ISC2 CC Network Security Practice Test 6 — 15 Questions

Question 1

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. Option A is correct because VLANs are Layer 2 logical constructs that let you group users by function, department, or role rather than by their physical switch port or building location, so a user in one office can belong to the same VLAN as a colleague elsewhere. Option D is correct because each VLAN forms its own broadcast domain, so broadcasts are confined to the VLAN's member ports instead of flooding the entire switched network, thereby reducing broadcast traffic. Option E is correct because placing sensitive systems (for example, servers holding regulated data) in a dedicated VLAN lets you control inter-VLAN traffic with Layer 3 filtering, ACLs, or a firewall, isolating them from general user traffic. Option B is not correct because VLANs operate at Layer 2 and still require Layer 3 addressing (IP subnets) for inter-VLAN routing and end-to-end communication. Option C is not correct because VLANs actually shrink collision domains (each switch port is its own collision domain) and divide broadcast domains; they do not increase the collision domain size.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size

Question 2

A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?

Accepted Answer

MAC address. The Data Link layer (Layer 2) of the OSI model deals with MAC addresses for node-to-node delivery within a local network segment. When troubleshooting connectivity issues at Layer 2, the MAC address is the most relevant address to examine because it identifies the physical network interface and is used by switches to forward frames. IP addresses operate at Layer 3, port numbers at Layer 4, and domain names at Layer 7, so they are not relevant to a Data Link layer problem.

Answer

IP address

Answer

Port number

Answer

Domain name

Question 3

Which of the following protocols operates at the Transport layer and provides reliable, connection-oriented communication?

Accepted Answer

TCP. TCP provides reliable delivery via acknowledgments and retransmissions, and uses a three-way handshake to establish a connection. UDP is connectionless and unreliable.

Answer

HTTP

Answer

IP

Answer

UDP

Question 4

An organization wants to securely manage network devices from remote locations. Which of the following protocols should be used for command-line access?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted command-line access to network devices, ensuring confidentiality and integrity of the session. It is the standard protocol for secure remote administration. The other protocols either lack encryption or are not designed for command-line access.

Answer

HTTP

Answer

Telnet

Answer

FTP

Question 5

A security analyst detects a large number of half-open TCP connections targeting a web server. This is most likely indicative of what type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending numerous SYN packets with spoofed source addresses, causing the server to allocate resources for half-open connections that never complete. The server's connection table fills up, exhausting resources and preventing legitimate connections. This matches the symptom of many half-open TCP connections observed by the analyst.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 6

A company wants to host a public-facing web server and an email server while protecting the internal network. Which network architecture is best suited for this purpose?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the internet and the internal network, hosting public-facing servers while allowing controlled access from both sides.

Answer

Subnetting

Answer

Full mesh topology

Answer

Virtual LAN (VLAN)

Question 7

An organization experiences intermittent network outages. The security team notices that the ARP cache on several switches has entries pointing to an unknown MAC address for the default gateway. Which attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) occurs when an attacker sends forged ARP replies to associate their MAC address with the IP of the default gateway. Switches then populate their ARP caches with the attacker's MAC for the gateway IP, causing traffic to be redirected to the attacker. This matches the symptom of ARP cache entries pointing to an unknown MAC for the gateway.

Answer

DNS poisoning

Answer

IP spoofing

Answer

MAC flooding

Question 8

Which of the following ports is commonly used for secure web traffic (HTTPS)?

Accepted Answer

443. HTTPS uses TCP port 443 by default, wrapping HTTP inside a TLS tunnel so credentials, cookies, and page content are encrypted in transit. Port 443 is the IANA-registered well-known port for HTTPS and is what browsers assume when no port is specified in an https:// URL. This is why secure web traffic is universally associated with 443.

Answer

53

Answer

80

Answer

22

Question 9

A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?

Accepted Answer

IDS. An IDS (Intrusion Detection System) monitors network traffic passively, typically via a SPAN port or network TAP, and generates alerts on suspicious activity without blocking traffic. Because it operates out-of-band and does not sit inline, it does not affect network performance or latency — exactly matching the requirement to detect without impacting performance.

Answer

Honeypot

Answer

IPS

Answer

Firewall

Question 10

During a security assessment, a penetration tester captures network traffic and notices that the source IP address in packets appears to be from a different network. Which technique is the attacker likely using?

Accepted Answer

IP spoofing. IP spoofing involves forging the source IP address field in packet headers so the traffic appears to originate from a different network or host. The scenario explicitly describes source IP addresses appearing to come from a different network, which is the defining symptom of IP spoofing. Attackers use it for reflection/amplification DDoS, evasion, and impersonation.

Answer

DNS spoofing

Answer

ARP spoofing

Answer

MAC spoofing

Question 11

A company deploys a device that inspects HTTP and HTTPS traffic to block SQL injection and cross-site scripting attacks. This device is best described as a:

Accepted Answer

Web application firewall (WAF). A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block application-layer attacks like SQL injection and cross-site scripting (XSS). It operates at Layer 7 and understands web protocols, making it the correct choice for protecting web applications from these threats.

Answer

Stateful firewall

Answer

Honeypot

Answer

Network-based IPS

Question 12

Which of the following is a benefit of using VLANs in a network?

Accepted Answer

Logical segmentation without additional hardware. VLANs allow logical segmentation of a network at Layer 2, improving security and reducing broadcast traffic without requiring additional physical switches.

Answer

Elimination of all broadcast traffic

Answer

Faster data transfer speeds

Answer

Increased physical security

Question 13

An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?

Accepted Answer

802.1X authentication. 802.1X authentication (A) is correct because it enforces port-based network access control on wired switches, requiring devices to authenticate via EAPOL to a RADIUS server before the port is authorized to pass traffic. Port security (C) is correct because it restricts which MAC addresses may be learned on a switch port, limiting connections to known/authorized devices and taking action (shutdown, restrict, or protect) on violations. Firewall rules (B) filter traffic by IP/port but do not authenticate or identify devices at the access layer, so they cannot ensure only authorized devices connect. NAT (D) merely translates addresses for routing/Internet access and provides no device authorization. VLAN segmentation (E) isolates traffic into logical groups but does not by itself verify or restrict which devices are permitted to connect.

Answer

Firewall rules

Answer

NAT

Answer

VLAN segmentation

Question 14

A company is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming the network bandwidth. Which THREE mitigation techniques are most effective?

Accepted Answer

Enable rate limiting on network devices. Traffic filtering, rate limiting, and using a CDN can help absorb DDoS traffic. Changing IP addresses is reactive and not a standard mitigation; disabling ICMP may help against some attacks but is not a primary mitigation.

Answer

Disable ICMP on all devices

Answer

Change the public IP address of the server

Question 15

A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?

Accepted Answer

Data Link. Excessive collisions are a Layer 2 (Data Link) phenomenon because CSMA/CD and collision detection operate at the MAC sublayer of the Data Link layer. When two stations transmit simultaneously on a shared Ethernet segment, their frames collide, and the Data Link layer handles retransmission and backoff. The Physical layer deals with the electrical/optical signalling itself, not collision semantics.

Answer

Physical

Answer

Network

Answer

Transport