ISC2 CC Network Security Practice Test 6 — 15 Questions

Question 1

A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?

Accepted Answer

Data Link. Collisions occur at the Data Link layer (Layer 2) where frames are transmitted over shared media. Hubs and CSMA/CD operate at this layer.

Answer

Physical

Answer

Network

Answer

Transport

Question 2

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses, operating at Layer 2/3 boundary.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 3

A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?

Accepted Answer

ICMP flood (DDoS). A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.

Answer

ARP spoofing

Answer

Man-in-the-middle

Answer

SYN flood

Question 4

Which firewall type reads packet headers and also tracks the state of active connections to make filtering decisions?

Accepted Answer

Stateful inspection. Stateful inspection firewalls maintain a state table to track connections, allowing return traffic for permitted outbound connections.

Answer

Packet filtering

Answer

Application proxy

Answer

NGFW

Question 5

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a separate network segment that hosts public-facing services, isolated from the internal LAN.

Answer

Honeypot

Answer

Subnet

Answer

VLAN

Question 6

Which of the following is a security concern associated with the Telnet protocol?

Accepted Answer

It transmits data in cleartext.. Telnet transmits data, including credentials, in cleartext, making it susceptible to sniffing. SSH is the secure alternative.

Answer

It requires certificate management.

Answer

It is vulnerable to DNS poisoning.

Answer

It uses encryption that is too weak.

Question 7

An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Answer

MAC flooding

Answer

DNS spoofing

Answer

IP spoofing

Question 8

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

Accepted Answer

WAF. A Web Application Firewall (WAF) specializes in filtering and monitoring HTTP/HTTPS traffic, often using OWASP rules to detect attacks like SQL injection.

Answer

IDS

Answer

Honeypot

Answer

IPS

Question 9

Which protocol operates at the Transport layer and provides reliable, connection-oriented data delivery?

Accepted Answer

TCP. TCP (Transmission Control Protocol) uses a three-way handshake, sequencing, and acknowledgments to ensure reliable delivery.

Answer

UDP

Answer

IP

Answer

HTTP

Question 10

A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?

Accepted Answer

IPS. An Intrusion Prevention System (IPS) sits inline and can block traffic based on deep inspection, but may cause false positives that disrupt legitimate communications.

Answer

Firewall

Answer

WAF

Answer

IDS

Question 11

An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?

Accepted Answer

VLAN. VLANs (Virtual Local Area Networks) logically segment a switch into multiple isolated broadcast domains, improving security and reducing broadcast traffic.

Answer

DMZ

Answer

Honeypot

Answer

Subnetting

Question 12

Which of the following ports is used by HTTPS?

Accepted Answer

443. HTTPS uses port 443 by default for encrypted web traffic.

Answer

80

Answer

21

Answer

25

Question 13

A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which ONE transport layer protocol fits this description? (Select ONE)

Accepted Answer

UDP. UDP (User Datagram Protocol) is a transport layer protocol that does not guarantee delivery and has no error recovery. TCP is connection-oriented and provides reliability. HTTP and ARP are not transport layer protocols. ICMP operates at the network layer, not the transport layer. Therefore, UDP correctly fits the description.

Answer

TCP

Answer

HTTP

Answer

ICMP

Answer

ARP

Question 14

An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)

Accepted Answer

NGFW. Stateful inspection tracks connection state to allow return traffic. NGFW includes stateful inspection plus advanced features. Packet filtering alone is stateless; proxy and IDS are not optimal.

Answer

Packet filtering (stateless)

Answer

Application proxy

Answer

IDS

Question 15

A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)

Accepted Answer

Place only public-facing servers (e.g., web, email) in the DMZ.. Proper DMZ design includes: placing only public-facing servers in DMZ, restricting inbound traffic to necessary ports, and preventing direct communication from DMZ to internal network. Using private IPs and disabling firewall are incorrect.

Answer

Configure the DMZ to communicate directly with the internal network without restrictions.

Answer

Allow all inbound traffic to the DMZ from the internet for ease of access.