ISC2 CC Network Security Practice Test 8 — 15 Questions

Question 1

An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is a segmented network that sits between the internal trusted network and the untrusted internet, specifically designed to host publicly accessible services like web servers while isolating them from internal systems. Firewall rules control traffic between the internet, the DMZ, and the internal network, so if the web server is compromised, the attacker cannot directly reach internal resources.

Answer

Honeypot

Answer

Subnetting

Answer

VLAN

Question 2

A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?

Accepted Answer

Intrusion Detection System (IDS). An IDS (Intrusion Detection System) is passive and only alerts, while an IPS actively blocks.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Next-Generation Firewall (NGFW)

Question 3

An attacker sends a flood of SYN packets to a server, never completing the three-way handshake, exhausting the server's resources and causing it to become unresponsive. What type of attack is this?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending many SYN packets with spoofed source addresses, causing the server to allocate resources for half-open connections that are never completed. This exhausts the server's connection table and backlog, making it unresponsive to legitimate traffic. It is a classic denial-of-service attack.

Answer

ICMP flood

Answer

UDP flood

Answer

ARP spoofing

Question 4

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to inspect HTTP and HTTPS traffic at Layer 7, apply rule sets such as the OWASP ModSecurity Core Rule Set, and block malicious requests like SQL injection, XSS, and CSRF before they reach the web server. It understands web protocols and can enforce positive/negative security models based on HTTP headers, cookies, and payloads. This matches the described requirement exactly.

Answer

Honeypot

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 5

An organization decides to implement a security control that can detect and block attacks in real-time by sitting inline in the network. Which of the following should be chosen to meet these requirements?

Accepted Answer

Intrusion Prevention System (IPS). An IPS is designed to sit inline in the traffic path, inspect packets in real time, and actively block malicious traffic by dropping or resetting connections. This matches the requirement to both detect and block attacks inline. An IDS only detects and alerts; it cannot block because it is not inline.

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Answer

Honeypot

Question 6

Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?

Accepted Answer

Telnet. Telnet transmits all data, including usernames and passwords, in cleartext over the network, making it trivial to intercept with packet capture. It lacks encryption and integrity protection, so it is considered insecure and should be replaced by SSH for remote administration. This is why Telnet is the correct answer.

Answer

SSH

Answer

SFTP

Answer

HTTPS

Question 7

Which common port is used by DNS and which transport layer protocol does it primarily use?

Accepted Answer

Port 53, both UDP and TCP. DNS uses port 53 for both UDP and TCP: UDP is used for standard queries and responses because it is fast and low-overhead, while TCP is used for zone transfers, DNSSEC responses, and queries with responses larger than 512 bytes (or EDNS0-negotiated sizes). This dual-protocol design is why the correct answer must include both.

Answer

Port 53, UDP only

Answer

Port 161, UDP

Answer

Port 53, TCP only

Question 8

Which port number is associated with HTTPS, and what protocol encrypts the communication?

Accepted Answer

Port 443, SSL/TLS. HTTPS uses TCP port 443 by default, and the communication is encrypted using SSL/TLS (with TLS 1.2/1.3 being the modern versions). Port 443 is the IANA-assigned port for HTTP over TLS, and SSL/TLS provides the encryption, integrity, and server authentication for the session.

Answer

Port 80, SSL/TLS

Answer

Port 8080, SSL/TLS

Answer

Port 443, SSH

Question 9

Which three of the following are benefits of using VLANs in a network? (Choose three.)

Accepted Answer

Enhanced security through network segmentation. Option A is correct because VLANs logically segment a physical switch into isolated broadcast domains, so traffic from one VLAN cannot reach another without a Layer 3 device (router or multilayer switch), which enforces policy and limits unauthorized access. Option D is correct because each VLAN is its own broadcast domain, so broadcasts are confined to the ports assigned to that VLAN rather than flooding the entire switched network, reducing overall broadcast traffic. Option E is correct because VLAN membership is a logical configuration, so when a user relocates, an administrator can reassign the port or use dynamic VLAN assignment (e.g., via 802.1Q or VMPS) instead of physically rewiring or moving the user to a different switch. Option B is not correct because inter-VLAN communication still requires Layer 3 routing (router-on-a-stick, SVIs, or a Layer 3 switch), so routing is not eliminated. Option C is not correct because VLANs actually reduce the size of broadcast domains and do not increase collision domains; collision domains are determined by switch ports and full-duplex links, not by VLAN creation.

Answer

Eliminates the need for routing

Answer

Increased collision domains

Question 10

An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)

Accepted Answer

Use a separate VLAN for DMZ servers to isolate traffic. Option C is correct because placing DMZ servers on a dedicated VLAN segments their broadcast domain and Layer 2 traffic from the internal LAN, so a compromised web or email host cannot directly reach internal systems at Layer 2 and lateral movement is constrained. Option D is correct because a dual-firewall (screened subnet) design puts one firewall between the internet and the DMZ and a second between the DMZ and the internal network, enforcing defense in depth so that even if a DMZ host is compromised, the internal firewall still blocks access to internal resources. Option E is correct because strict access control rules implementing least privilege—permitting only the specific ports and protocols required (for example, TCP 80/443 to the web server and TCP 25/587 to the mail server)—minimize the attack surface and prevent unnecessary services from being reachable. Option A is not correct because a single firewall with three interfaces, while workable, does not provide the layered separation and defense in depth that a dual-firewall DMZ design offers. Option B is not correct because allowing all traffic from the DMZ to the internal network violates least privilege and would let a compromised DMZ host pivot freely into the internal network.

Answer

Use a single firewall to connect internet, DMZ, and internal network

Answer

Allow all traffic from the DMZ to the internal network for ease of management

Question 11

Which layer of the OSI model is responsible for routing packets based on IP addresses?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing and routing packets based on IP addresses. It determines the best path for data to travel across multiple networks, using routers to forward packets hop-by-hop. This layer encapsulates data into packets and handles fragmentation and reassembly when necessary.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 12

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 13

An organization deploys a network security device that inspects application-layer payloads, can block malicious HTTP requests, and uses OWASP rules. Which type of device is this?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at Layer 7, inspects HTTP/HTTPS payloads, blocks malicious requests such as SQL injection and XSS, and commonly uses rule sets like the OWASP ModSecurity Core Rule Set. The question's emphasis on application-layer payload inspection, HTTP request blocking, and OWASP rules maps directly to WAF capabilities. WAFs are typically deployed in front of web servers or via cloud services (AWS WAF, Cloud Armor, Azure WAF).

Answer

Intrusion Detection System (IDS)

Answer

Next-Generation Firewall (NGFW)

Answer

Intrusion Prevention System (IPS)

Question 14

A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?

Accepted Answer

VLAN. VLANs (Virtual LANs) allow a single Layer 2 switch to be logically partitioned into multiple broadcast domains, separating traffic between departments without buying additional hardware. Each VLAN behaves like a separate physical switch, and inter-VLAN traffic must be routed.

Answer

Subnetting

Answer

VPN

Answer

DMZ

Question 15

Which protocol is considered insecure because it transmits data, including credentials, in cleartext?

Accepted Answer

Telnet. Telnet transmits all data, including usernames and passwords, in cleartext over the network, making it trivial to intercept with packet sniffing. It lacks encryption and is considered insecure for any authentication or sensitive data. This is why Telnet has been replaced by SSH for remote administration.

Answer

SFTP

Answer

SSH

Answer

HTTPS