ISC2 CC Network Security Practice Test 7 — 15 Questions

Question 1

A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ICMP flood (DDoS). A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.

Answer

ARP spoofing

Answer

Man-in-the-middle

Answer

SYN flood

Question 2

Which firewall type reads packet headers and also tracks the state of active connections to make filtering decisions?

Accepted Answer

Stateful inspection. Stateful inspection firewalls maintain a state table to track connections, allowing return traffic for permitted outbound connections.

Answer

Packet filtering

Answer

Application proxy

Answer

NGFW

Question 3

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a perimeter subnetwork that hosts public-facing services such as web, mail, and DNS servers while keeping them separated from the internal trusted network. Traffic from the internet reaches the DMZ, but the DMZ is firewalled off from the internal LAN, so a compromised public server cannot pivot directly into internal systems. This is the standard architecture for isolating externally accessible servers.

Answer

Honeypot

Answer

Subnet

Answer

VLAN

Question 4

Which of the following is a security concern associated with the Telnet protocol?

Accepted Answer

It transmits data in cleartext.. Telnet transmits all data, including usernames and passwords, in cleartext, making it vulnerable to eavesdropping and credential theft. This lack of encryption is the primary security concern associated with Telnet. Other options do not accurately describe Telnet's security weaknesses.

Answer

It requires certificate management.

Answer

It is vulnerable to DNS poisoning.

Answer

It uses encryption that is too weak.

Question 5

An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Answer

MAC flooding

Answer

DNS spoofing

Answer

IP spoofing

Question 6

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

Accepted Answer

WAF. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block malicious payloads such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It operates at the application layer (Layer 7) and can enforce custom rules based on HTTP request contents. An IDS or IPS may detect or block some attacks but is not purpose-built for web application protection.

Answer

IDS

Answer

Honeypot

Answer

IPS

Question 7

Which protocol operates at the Transport layer and provides reliable, connection-oriented data delivery?

Accepted Answer

TCP. TCP (Transmission Control Protocol) uses a three-way handshake, sequencing, and acknowledgments to ensure reliable delivery.

Answer

UDP

Answer

IP

Answer

HTTP

Question 8

A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?

Accepted Answer

IPS. An IPS (Intrusion Prevention System) inspects packet payloads and application data in real time and can actively block malicious traffic. The fact that it occasionally blocks legitimate traffic is a classic false-positive behavior of IPS devices, which is why tuning is required.

Answer

Firewall

Answer

WAF

Answer

IDS

Question 9

An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?

Accepted Answer

VLAN. A VLAN (Virtual Local Area Network) logically partitions a single physical switch into multiple separate broadcast domains. Each VLAN operates as its own Layer 2 network, and broadcast traffic from one VLAN is not forwarded to another without a Layer 3 device. This is the standard technology for network segmentation at Layer 2.

Answer

DMZ

Answer

Honeypot

Answer

Subnetting

Question 10

Which of the following ports is used by HTTPS?

Accepted Answer

443. HTTPS (Hypertext Transfer Protocol Secure) operates over TCP port 443 by default, using TLS to encrypt HTTP traffic between client and server. This is the IANA-assigned well-known port for HTTPS, so any browser request to https:// implicitly targets port 443 unless overridden. Port 80 is the counterpart for unencrypted HTTP, which is why the two are so often confused.

Answer

80

Answer

21

Answer

25

Question 11

A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which ONE transport layer protocol fits this description? (Select ONE)

Accepted Answer

UDP. UDP (User Datagram Protocol) is a connectionless transport layer protocol that does not guarantee delivery, ordering, or error recovery. It is designed for speed and low overhead, making it suitable for applications like streaming, DNS, and VoIP where occasional packet loss is acceptable. The question explicitly asks for a protocol that does not guarantee delivery and has no error recovery, which matches UDP's characteristics.

Answer

TCP

Answer

HTTP

Answer

ICMP

Answer

ARP

Question 12

A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)

Accepted Answer

Place only public-facing servers (e.g., web, email) in the DMZ.. Option A is correct because a DMZ is specifically designed to host public-facing services such as web and email servers, isolating them from the trusted internal network so that a compromise of these exposed hosts does not directly expose internal assets. Option B is correct because a firewall (or multiple firewalls) must mediate and filter traffic among the internet, the DMZ, and the internal network, enforcing distinct security policies for each zone rather than allowing unrestricted flows. Option E is correct because inbound traffic to the DMZ should be limited to only the ports and protocols required by the hosted services — for example TCP 80/443 for HTTP/HTTPS and TCP 25 for SMTP — following the principle of least privilege to minimize the attack surface. Option C is incorrect because unrestricted DMZ-to-internal communication defeats the purpose of segmentation and would let a compromised DMZ host pivot directly into the internal network. Option D is incorrect because allowing all inbound internet traffic to the DMZ exposes unnecessary ports and services, greatly increasing the risk of exploitation.

Answer

Configure the DMZ to communicate directly with the internal network without restrictions.

Answer

Allow all inbound traffic to the DMZ from the internet for ease of access.

Question 13

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Accepted Answer

Sniffing / Eavesdropping. Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.

Answer

Spoofing

Answer

DoS

Answer

Man-in-the-middle

Question 14

Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles IP addresses, routing, and packet forwarding.

Answer

Layer 2 – Data Link

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 15

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall maintains a state table that tracks active connections and only allows packets that match an established connection. It inspects packet headers and maintains connection state, dropping packets that do not match. This is the definition of a stateful inspection firewall. It operates at the network and transport layers and provides better security than simple packet filtering.

Answer

Application proxy firewall

Answer

Next-generation firewall

Answer

Packet filtering firewall