ISC2 CC Network Security Practice Test 8 — 15 Questions

Question 1

Which layer of the OSI model is responsible for routing packets based on IP addresses?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing and routing of packets.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 2

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 3

An organization deploys a network security device that inspects application-layer payloads, can block malicious HTTP requests, and uses OWASP rules. Which type of device is this?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is designed to filter and monitor HTTP/HTTPS traffic, often using OWASP rules to protect against web vulnerabilities.

Answer

Intrusion Detection System (IDS)

Answer

Next-Generation Firewall (NGFW)

Answer

Intrusion Prevention System (IPS)

Question 4

A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?

Accepted Answer

VLAN. VLANs (Virtual Local Area Networks) allow logical segmentation on a switch, separating traffic at Layer 2 without extra hardware.

Answer

Subnetting

Answer

VPN

Answer

DMZ

Question 5

Which protocol is considered insecure because it transmits data, including credentials, in cleartext?

Accepted Answer

Telnet. Telnet (port 23) sends all data in cleartext, making it vulnerable to eavesdropping. SSH is the secure alternative.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 6

A security team deploys a passive device that monitors network traffic and generates alerts when it detects suspicious patterns, but it does not take any action. This device is best described as a:

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is passive, monitoring and alerting without blocking traffic, unlike an IPS which is inline.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 7

A company wants to protect its internal web server from common web application attacks. Which two security measures are most appropriate? (Choose TWO.)

Accepted Answer

Deploy a Web Application Firewall (WAF). A WAF specifically filters HTTP/HTTPS traffic, and HTTPS encryption protects data in transit. A firewall alone is not application-aware, and IDS/IPS are not specific to web applications.

Answer

Deploy an IDS in promiscuous mode

Answer

Use a stateful firewall only

Answer

Enable SNMP on the server

Question 8

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

Accepted Answer

TCP. TCP and UDP are the primary Transport layer protocols. IP is Network layer, Ethernet is Data Link, and HTTP is Application layer.

Answer

HTTP

Answer

IP

Answer

Ethernet

Question 9

A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)

Accepted Answer

Web server. Public-facing servers like web, mail, and DNS servers are typically placed in a DMZ to isolate them from the internal network. DHCP servers are usually internal, and database servers are kept internal for security.

Answer

DHCP server

Answer

Database server

Question 10

An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)

Accepted Answer

SYN flood. SYN floods often spoof source IPs to hide the attacker, and DNS amplification attacks use spoofed source IPs to direct responses to the victim. ARP spoofing is local and does not involve IP spoofing in the same way, while MAC flooding and ping of death are different.

Answer

ARP spoofing

Answer

MAC flooding

Answer

Ping of death

Question 11

Which two of the following are characteristics of a stateful firewall? (Choose TWO.)

Accepted Answer

Tracks connection state. A stateful firewall tracks the state of active connections and can block unsolicited inbound traffic. Packet filtering is stateless, and application inspection is typical of proxy firewalls.

Answer

Inspects application-layer data

Answer

Operates only at Layer 3

Answer

Filters packets based on static rules only

Question 12

A security analyst wants to detect and analyze attacker behavior by deploying a decoy system. Which three characteristics apply to a honeypot? (Choose THREE.)

Accepted Answer

It is a decoy system to attract attackers. Honeypots are decoy systems designed to attract attackers, provide early warning, and allow analysis of attacker techniques. They do not contain real production data and are not used for legitimate traffic.

Answer

It contains sensitive production data

Answer

It is used for legitimate network traffic

Question 13

A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)

Accepted Answer

Deploy a VPN for remote connections. VPNs create an encrypted tunnel for remote connections, securing data in transit and preventing interception. Mutual authentication ensures both client and server verify each other's identities, thwarting impersonation. ARP spoofing protection prevents attackers from intercepting local network traffic by spoofing MAC addresses. While HTTPS with proper certificate validation is effective for web traffic, it does not protect against all types of MITM attacks. WPA2 only encrypts Wi-Fi traffic and does not prevent MITM at higher layers. Therefore, the most effective measures are A, B, and C.

Answer

Use HTTPS with proper certificate validation

Answer

Use WPA2 encryption on the Wi-Fi network

Question 14

Which three ports are commonly used by secure protocols? (Choose THREE.)

Accepted Answer

443 (HTTPS). HTTPS uses 443, SSH uses 22, and LDAPS uses 636. HTTP (80), Telnet (23), and FTP (21) are insecure or unencrypted.

Answer

80 (HTTP)

Answer

23 (Telnet)

Question 15

A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)

Accepted Answer

VLANs. VLANs provide logical segmentation at Layer 2, and subnetting divides IP networks, often used with routing to isolate traffic. DMZ is a specific segment for public servers, not general segmentation. Firewalls and IDS are security devices, not segmentation technologies.

Answer

Intrusion Detection System

Answer

Stateful firewall

Answer

DMZ