ISC2 CC Network Security Practice Test 7 — 15 Questions

Question 1

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Accepted Answer

Sniffing / Eavesdropping. Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.

Answer

Spoofing

Answer

DoS

Answer

Man-in-the-middle

Question 2

Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles IP addresses, routing, and packet forwarding.

Answer

Layer 2 – Data Link

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 3

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall tracks connections and blocks unsolicited inbound traffic.

Answer

Application proxy firewall

Answer

Next-generation firewall

Answer

Packet filtering firewall

Question 4

An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that hosts public-facing services and is isolated from the internal network.

Answer

Honeypot

Answer

Subnetting

Answer

VLAN

Question 5

A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?

Accepted Answer

Intrusion Detection System (IDS). An IDS (Intrusion Detection System) is passive and only alerts, while an IPS actively blocks.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Next-Generation Firewall (NGFW)

Question 6

An attacker sends a flood of SYN packets to a server, never completing the three-way handshake, exhausting the server's resources and causing it to become unresponsive. What type of attack is this?

Accepted Answer

SYN flood. A SYN flood is a type of DoS attack that exploits the TCP three-way handshake by sending many SYN packets and not completing the handshake.

Answer

ICMP flood

Answer

UDP flood

Answer

ARP spoofing

Question 7

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to protect web applications by inspecting HTTP/HTTPS traffic and applying rules like OWASP.

Answer

Honeypot

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 8

An organization decides to implement a security control that can detect and block attacks in real-time by sitting inline in the network. Which of the following should be chosen to meet these requirements?

Accepted Answer

Intrusion Prevention System (IPS). An IPS (Intrusion Prevention System) is inline and can block attacks. IDS is passive.

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Answer

Honeypot

Question 9

Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?

Accepted Answer

Telnet. Telnet (port 23) transmits data in cleartext. SSH is its secure replacement.

Answer

SSH

Answer

SFTP

Answer

HTTPS

Question 10

Which common port is used by DNS and which transport layer protocol does it primarily use?

Accepted Answer

Port 53, both UDP and TCP. DNS uses port 53 and primarily uses UDP for queries, though TCP is used for zone transfers.

Answer

Port 53, UDP only

Answer

Port 161, UDP

Answer

Port 53, TCP only

Question 11

A company's network has multiple VLANs. An attacker on VLAN 10 sends a frame with a forged source MAC address to a switch, hoping to intercept traffic intended for the default gateway. Which attack is being executed?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending forged ARP messages to associate the attacker's MAC with the IP of another device (e.g., default gateway), enabling traffic interception.

Answer

IP spoofing

Answer

VLAN hopping

Answer

MAC flooding

Question 12

Which port number is associated with HTTPS, and what protocol encrypts the communication?

Accepted Answer

Port 443, SSL/TLS. HTTPS uses port 443 and is encrypted using SSL/TLS.

Answer

Port 80, SSL/TLS

Answer

Port 8080, SSL/TLS

Answer

Port 443, SSH

Question 13

A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)

Accepted Answer

ARP poisoning. ARP poisoning and rogue Wi-Fi are common MITM techniques. IP spoofing can be part of MITM but is not a standalone technique; SYN flood is DoS.

Answer

SYN flood

Answer

Packet sniffing

Answer

IP spoofing

Question 14

Which three of the following are benefits of using VLANs in a network? (Choose three.)

Accepted Answer

Enhanced security through network segmentation. VLANs improve security through segmentation, reduce broadcast traffic, and simplify network changes. They do not increase collision domains (switches eliminate collisions) and do not replace routing.

Answer

Eliminates the need for routing

Answer

Increased collision domains

Question 15

An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)

Accepted Answer

Use a separate VLAN for DMZ servers to isolate traffic. Firewalls on both sides, strict access rules, and separate VLANs are best practices. Direct internal access and single firewall are not recommended.

Answer

Use a single firewall to connect internet, DMZ, and internal network

Answer

Allow all traffic from the DMZ to the internal network for ease of management