ISC2 CC Network Security — Timed 40 Questions

Question 1

A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?

Accepted Answer

Smurf attack. A Smurf attack involves sending ICMP Echo Requests to a broadcast address with a spoofed source IP (the victim's IP). All hosts on the network reply with ICMP Echo Replies to the victim, flooding it. The victim never sent Echo Requests, which matches the scenario of unsolicited Echo Replies from an external server.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 2

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is used to resolve an IP address to a MAC address on a local network. When a host wants to send data to another host on the same subnet, it broadcasts an ARP request asking 'Who has this IP?' and the owner replies with its MAC address.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 3

An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle. Sending forged ARP messages to associate the attacker's MAC address with another host's IP address is ARP spoofing (also called ARP poisoning), which enables the attacker to intercept and relay traffic between two parties — a man-in-the-middle attack. The scenario explicitly describes interception via forged ARP messages, so MITM is the resulting attack type. The attacker positions themselves inline by poisoning ARP caches on both sides.

Answer

Sniffing

Answer

Spoofing

Answer

DoS

Question 4

Which firewall type is capable of inspecting the contents of application-layer traffic, such as HTTP requests, to detect malicious patterns?

Accepted Answer

Application proxy firewall. An application proxy firewall terminates the client connection and re-establishes a separate connection to the server, fully reconstructing and inspecting application-layer payloads such as HTTP requests, URLs, headers, and form data. This deep inspection at Layer 7 allows it to detect malicious patterns like SQL injection strings or known attack signatures embedded in application traffic.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Packet filtering firewall

Question 5

A security analyst is reviewing network traffic and needs to identify which of the following protocols are inherently insecure because they transmit data in cleartext. (Select TWO.)

Accepted Answer

FTP. FTP (Option C) is correct because it transmits both authentication credentials and data in cleartext over TCP ports 20 and 21, with no built-in encryption, making it inherently insecure. Telnet (Option D) is also correct because it sends all session data, including usernames and passwords, as unencrypted plaintext over TCP port 23. HTTPS (Option B) is not correct because it wraps HTTP in TLS encryption, and SSH (Option E) is not correct because it provides strong encrypted channels for remote sessions. DNS (Option A) is not marked correct because, although traditional DNS queries over UDP/TCP port 53 are cleartext, the protocol itself can be secured via DoH or DoT, so it is not inherently insecure in the same definitive sense as FTP and Telnet.

Answer

DNS

Answer

HTTPS

Answer

SSH

Question 6

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) resolves a known IPv4 address to the corresponding MAC address on a local network segment by broadcasting an ARP request and receiving a unicast ARP reply. This mapping is essential because Ethernet frames require a destination MAC address, while applications work with IP addresses.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 7

An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)

Accepted Answer

NGFW. Stateful inspection tracks connection state to allow return traffic. NGFW includes stateful inspection plus advanced features. Packet filtering alone is stateless; proxy and IDS are not optimal.

Answer

Packet filtering (stateless)

Answer

Application proxy

Answer

IDS

Question 8

A company's network has multiple VLANs. An attacker on VLAN 10 sends a frame with a forged source MAC address to a switch, hoping to intercept traffic intended for the default gateway. Which attack is being executed?

Accepted Answer

ARP spoofing. The attacker is sending a forged source MAC address to intercept traffic destined for the default gateway, which is the hallmark of ARP spoofing. ARP spoofing involves sending gratuitous or forged ARP replies to associate the attacker's MAC with the gateway's IP, causing victims to send traffic to the attacker. This enables man-in-the-middle interception on the same VLAN.

Answer

IP spoofing

Answer

VLAN hopping

Answer

MAC flooding

Question 9

A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)

Accepted Answer

ARP poisoning. ARP poisoning (B) is correct because attackers send forged ARP replies to associate their MAC address with a legitimate IP (typically the default gateway), causing victim traffic to be redirected through the attacker for interception or modification. Rogue Wi-Fi access points (D) are correct because an attacker can set up an evil-twin AP with the same SSID as a legitimate network, luring clients to connect and then capturing or relaying their traffic to perform MITM. SYN flood (A) is a DoS technique that exhausts the TCP backlog with half-open connections and does not by itself intercept or alter traffic. Packet sniffing (B) is a passive capture method that can observe traffic but does not redirect it, so it is not a MITM technique on its own. IP spoofing (E) forges source addresses to impersonate a host but does not establish the bidirectional traffic redirection needed for a classic MITM.

Answer

SYN flood

Answer

Packet sniffing

Answer

IP spoofing

Question 10

A company wants to protect its internal web server from common web application attacks. Which two security measures are most appropriate? (Choose TWO.)

Accepted Answer

Deploy a Web Application Firewall (WAF). Option A is correct because a Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at Layer 7 and can block common web application attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery by applying rule sets like the OWASP ModSecurity Core Rule Set. Option B is correct because implementing HTTPS with a valid certificate encrypts data in transit using TLS, which protects credentials and session tokens from interception and man-in-the-middle attacks, and a valid certificate prevents browser warnings and spoofing. Option C is not appropriate because an IDS in promiscuous mode only passively monitors and alerts on traffic; it does not actively block web attacks. Option D is insufficient because a stateful firewall operates at Layers 3-4 and tracks connection state but cannot inspect application-layer payloads to stop web-specific exploits. Option E is incorrect because enabling SNMP exposes management information and can introduce its own vulnerabilities rather than protecting the web server from web application attacks.

Answer

Deploy an IDS in promiscuous mode

Answer

Use a stateful firewall only

Answer

Enable SNMP on the server

Question 11

A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)

Accepted Answer

Deploy a VPN for remote connections. Option A is correct because a VPN (e.g., IPsec or TLS-based) creates an encrypted tunnel between endpoints, so an attacker positioned in the path cannot read or alter the traffic without detection, directly mitigating MITM interception. Option B is correct because mutual authentication (e.g., TLS client certificates or 802.1X/EAP-TLS) verifies both parties' identities, preventing an attacker from impersonating a legitimate server or client in the session. Option C is correct because ARP spoofing protection (e.g., Dynamic ARP Inspection with DHCP snooping) blocks the forged ARP replies that attackers use to position themselves as the man-in-the-middle on a local network. Option D is not marked correct because HTTPS with certificate validation protects data in transit but does not by itself constitute one of the three selected measures here. Option E is not marked correct because WPA2 encrypts the wireless link only, and does not prevent MITM attacks at higher layers or on wired segments.

Answer

Use HTTPS with proper certificate validation

Answer

Use WPA2 encryption on the Wi-Fi network

Question 12

A financial services firm is designing a defense-in-depth strategy for its internal network. The security architect wants to reduce the risk of lateral movement after an endpoint is compromised and to limit the blast radius of any single compromised host. Which two controls best address these goals? (Choose two.)

Accepted Answer

Microsegmentation that enforces least-privilege traffic flows between workloads. Microsegmentation and network access control both directly restrict how far a compromised endpoint can spread. Microsegmentation enforces least-privilege flows between workloads, while NAC prevents noncompliant or unknown devices from joining the network in the first place. A DMZ, full-disk encryption, and a honeypot address different risks and do not limit internal lateral movement.

Answer

A honeypot placed in a dedicated research subnet

Answer

A demilitarized zone (DMZ) hosting the public web and email servers

Answer

Full-disk encryption on all employee laptops

Question 13

A security analyst at a small e-commerce company notices that customer login credentials are being intercepted when users connect from public Wi-Fi. The company's web application uses HTTPS, but the login page itself is served over HTTP before redirecting to HTTPS. Which mitigation should the analyst implement to prevent credential exposure during the initial login request?

Accepted Answer

Enforce HTTP Strict Transport Security (HSTS) with a long max-age and includeSubDomains directive.. The core issue is that the initial login request is sent over HTTP, allowing an attacker to capture credentials before the redirect to HTTPS. HSTS instructs the browser to only use HTTPS for future connections, eliminating the insecure initial request. Other options do not address the cleartext transmission of credentials during the first request.

Answer

Deploy a web application firewall (WAF) to inspect incoming login requests for malicious patterns.

Answer

Configure the web server to redirect all HTTP traffic to HTTPS using a 301 redirect.

Answer

Implement DNSSEC to ensure that DNS responses for the login page are authentic.

Question 14

A security analyst reviewing wireless logs notices that an attacker is capturing authentication frames from a WPA2-Enterprise network and replaying them to a rogue access point to obtain a valid session key. The organization wants to prevent this specific attack without replacing all client devices. Which control should be implemented?

Accepted Answer

Enable Protected Management Frames (802.11w) on the wireless infrastructure and clients. Protected Management Frames (802.11w) cryptographically protects management frames that attackers abuse to force clients toward rogue access points. Enabling it on both the infrastructure and clients stops the replay-based session-key theft. Hiding the SSID, MAC filtering, and reducing transmit power do not protect those frames and therefore do not stop the attack.

Answer

Disable the SSID broadcast on all access points

Answer

Reduce the access point transmit power to limit coverage outside the building

Answer

Implement MAC address filtering on the wireless controller

Question 15

A hospital's radiology department transmits patient imaging studies to an external specialist clinic over the internet. The security officer requires that the data be protected so that even if intercepted, the contents cannot be read and any modification is detectable. Which technology should be implemented?

Accepted Answer

IPsec in tunnel mode. IPsec tunnel mode provides network-layer confidentiality and integrity for all traffic between two sites across an untrusted network, encapsulating the original packets and hiding internal addressing. That aligns with protecting imaging studies in transit so they cannot be read or altered. The other choices either protect only specific application sessions or leave headers exposed, which does not meet the full requirement.

Answer

TLS for the web-based imaging portal

Answer

SSH tunneling for the file transfer

Answer

IPsec in transport mode

Question 16

A user reports that they can access websites by typing domain names like www.example.com into their browser, but they cannot access the same sites by typing the IP address directly. The network administrator suspects a DNS issue. Which protocol is primarily responsible for translating domain names to IP addresses?

Accepted Answer

DNS. DNS translates domain names to IP addresses, enabling users to access websites by name. The user's ability to access sites by name but not by IP address indicates a DNS resolution issue, confirming that DNS is the protocol involved. The other protocols serve different purposes in network communication.

Answer

DHCP

Answer

ARP

Answer

ICMP

Question 17

A security analyst is reviewing network logs and notices that an attacker is attempting to exhaust the DHCP address pool by sending numerous DHCPDISCOVER messages with spoofed MAC addresses. Which two countermeasures should the analyst recommend to mitigate this attack? (Choose two.)

Accepted Answer

Enable DHCP snooping on access switches.. DHCP starvation is mitigated by controlling DHCP traffic and limiting MAC addresses per port. DHCP snooping rate-limits and filters DHCP messages, while port security caps the number of MAC addresses on a port, preventing a single attacker from generating many spoofed requests. Together, they effectively stop the exhaustion attempt.

Answer

Implement 802.1X authentication on all switch ports.

Answer

Enable IP source guard on all access ports.

Answer

Deploy a second DHCP server for redundancy.

Question 18

A hospital network uses 802.1X for wired port authentication. An attacker connects a rogue switch to an authenticated port and then attaches multiple unauthorized devices, which gain network access using the authenticated port's credentials. Which feature should be enabled to prevent this?

Accepted Answer

802.1X with MAC Authentication Bypass (MAB) and multi-auth host mode restrictions. The attack exploits an authenticated port being shared by multiple devices. Enforcing 802.1X with strict host mode restrictions, such as single-host or multi-auth with per-device authentication, ensures each device must authenticate individually. Port security, DHCP snooping, and MACsec address different threats and do not enforce per-device authentication behind a shared port.

Answer

MACsec encryption

Answer

Port security with MAC address limiting

Answer

DHCP snooping

Question 19

A security engineer is implementing network access control (NAC) in a corporate environment. The goal is to ensure that only compliant and authenticated devices can access the network, and that non-compliant devices are remediated or quarantined. Which two components are essential for a NAC solution to achieve these goals? (Choose two.)

Accepted Answer

A posture assessment mechanism to evaluate device compliance. A NAC solution must authenticate devices and users, typically via RADIUS, and assess their compliance through posture checks. These two components enable the system to make informed access decisions, such as allowing, quarantining, or remediating devices. Other elements like DHCP, WAFs, or specific enforcement protocols are not essential to achieve the stated goals.

Answer

A web application firewall (WAF) to inspect HTTP traffic

Answer

A DHCP server for assigning IP addresses to devices

Answer

A protocol for enforcing access decisions, such as 802.1X

Question 20

Which OSI layer is responsible for routing packets across networks using IP addresses?

Accepted Answer

Layer 3 - Network. The Network layer (Layer 3) is responsible for logical addressing and routing. It uses IP addresses to determine the best path for packets to travel from source to destination across different networks. Protocols like IP (IPv4/IPv6), OSPF, and BGP operate at this layer to perform routing decisions.

Answer

Layer 1 - Physical

Answer

Layer 4 - Transport

Answer

Layer 2 - Data Link