ISC2 CC Network Security Practice Test 9 — 15 Questions

Question 1

A security team deploys a passive device that monitors network traffic and generates alerts when it detects suspicious patterns, but it does not take any action. This device is best described as a:

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) passively monitors network traffic, analyzes it against signatures or behavioral baselines, and generates alerts on suspicious activity without blocking or modifying traffic. The question explicitly states the device 'does not take any action,' which is the defining characteristic of an IDS versus an IPS. A WAF and stateful firewall both enforce policy and can block traffic, so they do not fit the passive description.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 2

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

Accepted Answer

TCP. TCP and UDP are the primary Transport layer protocols. IP is Network layer, Ethernet is Data Link, and HTTP is Application layer.

Answer

HTTP

Answer

IP

Answer

Ethernet

Question 3

A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)

Accepted Answer

Web server. Public-facing servers like web, mail, and DNS servers are typically placed in a DMZ to isolate them from the internal network. DHCP servers are usually internal, and database servers are kept internal for security.

Answer

DHCP server

Answer

Database server

Question 4

An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)

Accepted Answer

SYN flood. SYN floods often spoof source IPs to hide the attacker, and DNS amplification attacks use spoofed source IPs to direct responses to the victim. ARP spoofing is local and does not involve IP spoofing in the same way, while MAC flooding and ping of death are different.

Answer

ARP spoofing

Answer

MAC flooding

Answer

Ping of death

Question 5

Which two of the following are characteristics of a stateful firewall? (Choose TWO.)

Accepted Answer

Tracks connection state. A stateful firewall tracks the state of active connections and can block unsolicited inbound traffic. Packet filtering is stateless, and application inspection is typical of proxy firewalls.

Answer

Inspects application-layer data

Answer

Operates only at Layer 3

Answer

Filters packets based on static rules only

Question 6

A security analyst wants to detect and analyze attacker behavior by deploying a decoy system. Which three characteristics apply to a honeypot? (Choose THREE.)

Accepted Answer

It is a decoy system to attract attackers. Honeypots are decoy systems designed to attract attackers, provide early warning, and allow analysis of attacker techniques. They do not contain real production data and are not used for legitimate traffic.

Answer

It contains sensitive production data

Answer

It is used for legitimate network traffic

Question 7

Which three ports are commonly used by secure protocols? (Choose THREE.)

Accepted Answer

443 (HTTPS). HTTPS uses 443, SSH uses 22, and LDAPS uses 636. HTTP (80), Telnet (23), and FTP (21) are insecure or unencrypted.

Answer

80 (HTTP)

Answer

23 (Telnet)

Question 8

A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)

Accepted Answer

VLANs. VLANs (B) are correct because they logically segment a switched network at Layer 2, allowing the administrator to isolate sensitive systems into separate broadcast domains and control traffic between them via inter-VLAN routing or ACLs. Subnetting (E) is correct because dividing a network into smaller IP subnets at Layer 3 separates traffic into distinct address ranges, enabling isolation and controlled routing between sensitive systems and the rest of the network. An IDS (A) only monitors and alerts on malicious activity; it does not segment or isolate traffic. A stateful firewall (C) filters traffic based on connection state but is a control mechanism rather than a segmentation technology itself. A DMZ (D) is a perimeter network design that exposes public-facing services, not a general-purpose segmentation method for isolating internal sensitive systems.

Answer

Intrusion Detection System

Answer

Stateful firewall

Answer

DMZ

Question 9

A hospital's network team needs to provide secure remote access for clinicians who work from home. The clinicians must be able to reach internal medical records systems as if they were on the hospital LAN, but the hospital's security policy requires that all remote traffic be encrypted and that remote devices be prevented from directly accessing the public internet through the hospital network. Which technology best meets these requirements?

Accepted Answer

A full-tunnel VPN. A full-tunnel VPN is the only option that both encrypts remote access and forces all client traffic through the hospital network, satisfying the policy that remote devices must not reach the public internet directly. Split tunneling, SSH port forwarding, and remote desktop gateways each leave internet-bound traffic outside the hospital's control.

Answer

Secure Shell (SSH) port forwarding

Answer

A remote desktop gateway

Answer

A split-tunnel VPN

Question 10

A small business wants to prevent employees from visiting known malicious websites. The owner asks a technician to implement a control that blocks requests to a maintained list of bad domains before any connection is made to those sites. Which solution should the technician deploy?

Accepted Answer

A DNS filtering service that refuses to resolve known malicious domains. DNS filtering is the only listed control that stops a malicious website visit at the name-resolution stage. By refusing to resolve the domain, it prevents the client from learning the destination IP address, so no connection can be initiated. Endpoint antivirus, application-aware firewalls, and intrusion prevention systems all operate later in the connection lifecycle.

Answer

A host-based antivirus scanner that quarantines downloaded files

Answer

An intrusion prevention system placed inline at the network edge

Answer

A next-generation firewall configured with application signatures

Question 11

A security analyst at a mid-sized company is reviewing network traffic logs and notices that an internal host is repeatedly sending TCP SYN packets to many different external IP addresses on port 443, but never completing the three-way handshake. The analyst suspects a malware infection. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. The host is sending numerous TCP SYN packets to various external IP addresses on port 443 without completing the three-way handshake. This pattern indicates a SYN flood attack, where the attacker attempts to exhaust connection resources on targets. The host is likely part of a botnet. The other options describe different attack types that do not match the observed traffic pattern.

Answer

MAC flooding

Answer

Smurf attack

Answer

Ping flood

Question 12

A hospital's network team must allow external vendors to reach a specific internal patient-monitoring system without exposing the rest of the clinical VLAN. The solution must enforce least privilege and terminate vendor sessions at a hardened appliance before any internal resource is contacted. Which technology best meets these requirements?

Accepted Answer

A secure remote access gateway that brokers and inspects vendor sessions before forwarding them.. Brokering vendor access through a hardened gateway enforces least privilege because each session is authenticated, terminated, and inspected before any internal system is contacted. Direct VLAN placement, VPN-to-VLAN access, and site-to-site tunnels all create broader network reachability than necessary, allowing lateral movement if a vendor endpoint is compromised. Only the access gateway keeps the clinical VLAN hidden while permitting tightly scoped, auditable sessions.

Answer

A jump host placed directly on the clinical VLAN with local firewall rules.

Answer

A site-to-site IPsec tunnel built directly between each vendor and the monitoring system.

Answer

A remote access VPN that places vendors on the clinical VLAN after authentication.

Question 13

A small accounting firm wants to let guests connect to the internet in its lobby without exposing the internal file server or the payroll system. The network administrator is told to add a separate wireless network that uses different IP addressing and cannot route to internal resources. Which security principle is the administrator primarily applying?

Accepted Answer

Network segmentation. Separating guest wireless onto distinct IP addressing and preventing routes to internal systems is a segmentation control. Segmentation confines untrusted devices to a limited network zone, so a compromised guest endpoint cannot directly reach the payroll system or file server. The other concepts address data remnants, proof of actions, or user permissions, none of which create the required network boundary.

Answer

Data remanence

Answer

Non-repudiation

Answer

Least privilege

Question 14

A network administrator is configuring a new wireless network for a small office. The office has sensitive data and wants to ensure that all wireless traffic is encrypted and that users authenticate with unique credentials. Which security protocol should the administrator implement?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise provides both strong encryption and unique user authentication via 802.1X and a RADIUS server. This ensures that each user has distinct credentials and that wireless traffic is encrypted. The other options either lack unique authentication (WPA2-Personal, Open) or are insecure (WEP, Open).

Answer

Open authentication

Answer

WEP

Answer

WPA2-Personal

Question 15

A hospital's network team notices that a radiology workstation is receiving a duplicate IP address error. The DHCP server logs show the workstation was assigned 10.10.20.45, but the workstation is manually configured with that same address. Which DHCP feature should have been configured to prevent this conflict?

Accepted Answer

DHCP exclusion range. The conflict occurs because the DHCP server dynamically leases an address that is already statically assigned to another device. To prevent this, the address must be removed from the assignable pool using an exclusion range. This ensures the server never offers that address, eliminating the duplicate IP conflict without changing the workstation's static configuration.

Answer

DHCP snooping

Answer

DHCP relay agent

Answer

DHCP reservation