ISC2 CC Network Security — 30 Questions

Question 1

A security analyst notices that an internal web server is receiving a high volume of TCP SYN packets from a single external IP address, but the server is not sending SYN-ACK replies. The server's CPU and memory usage are normal. What is the most likely cause?

Accepted Answer

The server is under a SYN flood attack, filling the connection queue. The correct answer is B because a SYN flood attack works by sending a high volume of TCP SYN packets to a server, filling its half-open connection queue (the backlog) and preventing it from completing the three-way handshake. Since the server's CPU and memory are normal, the issue is not resource exhaustion but rather the queue being saturated, causing the server to stop sending SYN-ACK replies to new connection requests.

Answer

A firewall rule is blocking inbound SYN-ACK packets

Answer

The server's TCP/IP stack has crashed

Answer

The server is experiencing a distributed denial-of-service (DDoS) attack

Question 2

A network administrator is designing a DMZ to host a public-facing web server and a database server that should only be accessible from the web server. Which of the following firewall rule sets best achieves this design?

Accepted Answer

Allow inbound HTTP/HTTPS to web server; allow web server to database on port 3306; deny all else. Option A is correct because it implements the principle of least privilege for a DMZ: it allows inbound HTTP/HTTPS traffic (ports 80/443) to the public-facing web server, then permits only the web server to initiate outbound connections to the database server on port 3306 (MySQL/MariaDB default), and denies all other traffic. This ensures the database is not directly accessible from the internet, reducing the attack surface while still supporting the required application flow.

Answer

Allow web server to initiate outbound connections to internet; allow database to initiate connections to web server; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow all traffic from web server to database; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow inbound SQL from internet to database; deny all else

Question 3

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Accepted Answer

The switch is now using a different certificate that is not trusted by the clients. The error 'Unknown CA certificate' indicates that the client does not trust the certificate presented by the RADIUS server during PEAP-MSCHAPv2 authentication. After a switch firmware update, the switch may have been reconfigured to use a different server certificate (e.g., a self-signed or internally issued certificate) that is not in the trusted root store of the affected workstations. Since PEAP requires the client to validate the server certificate, a mismatch causes intermittent authentication failures.

Answer

The switch is not forwarding EAP packets properly due to a firmware bug

Answer

The RADIUS shared secret was changed during the firmware update

Answer

The authentication server (NPS) is overloaded and dropping requests

Question 4

A security engineer is configuring a network intrusion detection system (NIDS) to monitor traffic on a critical subnet. To minimize false positives, which of the following should the engineer baseline first?

Accepted Answer

The normal traffic patterns during peak business hours. Baselining normal traffic patterns during peak business hours establishes a reference of legitimate network behavior, which is essential for a NIDS to distinguish benign anomalies from actual threats. Without this baseline, the NIDS may generate false positives by flagging legitimate peak-hour traffic spikes as malicious. This aligns with the principle that anomaly-based detection relies on a statistical model of normal activity to reduce noise.

Answer

The results of a recent vulnerability scan

Answer

The latest attack signatures from the vendor

Answer

The firewall logs from the past 24 hours

Question 5

A company's remote access VPN uses IPsec with pre-shared keys. Employees report that they cannot connect from home. The VPN server logs show 'IKE authentication failed.' The help desk confirms the pre-shared keys are correct. Which of the following is the most likely cause?

Accepted Answer

The IKE phase 1 parameters (encryption, hash, DH group) do not match. Option D is correct because 'IKE authentication failed' specifically indicates a failure during IKE phase 1, where the peers negotiate security parameters. Even if the pre-shared key is correct, mismatched encryption (e.g., AES vs. 3DES), hash (e.g., SHA-1 vs. SHA-256), or Diffie-Hellman group (e.g., group 2 vs. group 14) will cause the IKE SA to fail, preventing phase 1 authentication from completing.

Answer

The client is behind a NAT device that blocks IPsec traffic

Answer

The VPN server is not responding to IKE requests

Answer

The client's certificate has expired

Question 6

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Accepted Answer

Perform a stealth scan using a zombie host to hide the attacker's identity. Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Answer

Spoof the source IP address of the attacker's machine

Answer

Launch a denial-of-service attack against the target

Answer

Evade a firewall by fragmenting packets

Question 7

Which TWO of the following are best practices for securing a wireless network? (Select exactly two.)

Accepted Answer

Implement MAC address filtering. Option C is correct because MAC address filtering restricts network access to devices with pre-approved MAC addresses, adding a layer of access control. While not foolproof (MACs can be spoofed), it is a recognized best practice for reducing the attack surface in small or home networks.

Answer

Use WEP encryption for compatibility

Answer

Disable SSID broadcast

Answer

Disable DHCP and use static IP addressing

Question 8

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Accepted Answer

It can automatically allow return traffic for outbound connections. A stateful firewall automatically allows return traffic for outbound connections because it tracks the state of each connection in a state table. When a packet from an internal host initiates an outbound TCP connection (e.g., SYN), the firewall creates an entry in the state table. When the corresponding return packet (e.g., SYN-ACK) arrives, the firewall checks the state table and permits it without needing an explicit inbound rule, as it recognizes the packet as part of an established session.

Answer

It inspects application-layer payloads

Answer

It filters packets based solely on source/destination IP and port

Question 9

Refer to the exhibit. An administrator configures the above ACLs on a router. The goal is to allow internal users (192.168.1.0/24) to browse the web, and to allow SSH management from the internet to a server at 10.0.0.10. However, users report that they cannot browse external websites. What is the most likely reason?

Accepted Answer

ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users. ACL 100 is applied outbound on the internal interface (e.g., GigabitEthernet0/0). Outbound ACLs filter traffic leaving the interface, but internal users' web traffic originates from the internal network and must be allowed inbound on the internal interface (or outbound on the external interface). Since ACL 100 is applied outbound on the internal interface, it only filters traffic that has already been routed out of that interface, which is not the path for internal users' outbound web requests. The correct approach is to apply the ACL inbound on the internal interface or outbound on the external interface.

Answer

ACL 100 does not permit DNS traffic, so users cannot resolve domain names

Answer

ACL 110 blocks the return traffic from the internet

Answer

The implicit deny at the end of ACL 100 blocks established connections

Question 10

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Accepted Answer

An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3. The alert indicates a downgrade from TLS 1.2 to SSLv3, which is the hallmark of an SSL stripping attack. In this attack, an adversary intercepts the client's TLS handshake request and forces the connection to use the weaker SSLv3 protocol, often by manipulating the ClientHello message to remove TLS options. This allows the attacker to exploit known vulnerabilities in SSLv3, such as POODLE, to decrypt or hijack the session.

Answer

The server is experiencing a buffer overflow attack

Answer

The server's certificate has expired and the client is falling back to SSLv3

Answer

The server has been misconfigured to use SSLv3 instead of TLS

Question 11

A medium-sized company uses a network with three VLANs: VLAN 10 (Users, 192.168.10.0/24), VLAN 20 (Servers, 192.168.20.0/24), and VLAN 30 (DMZ, 192.168.30.0/24). A Layer 3 switch with an ACL is used for inter-VLAN routing. The company has a web server in the DMZ that must be accessible from the internet (via a public IP mapped to 192.168.30.10). Users in VLAN 10 need to access the web server on its private IP (192.168.30.10) for internal testing. The ACL is applied inbound on the VLAN 10 SVI. The ACL currently has the following entries: permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255; deny ip any 192.168.20.0 0.0.0.255; permit ip any any. Recently, the security team noticed that users can access the web server on its private IP, but they cannot access the web server via the public IP (which goes through the firewall and then to the DMZ). The firewall logs show that traffic from the users to the public IP is allowed and reaches the DMZ web server, but the return traffic is blocked. The web server's default gateway is the Layer 3 switch (192.168.30.1). Which of the following is the most likely cause of the problem?

Accepted Answer

The ACL on the DMZ SVI (VLAN 30) is blocking the return traffic from the web server to the firewall. The correct answer is B. The web server's default gateway is the Layer 3 switch (192.168.30.1). When users access the web server via the public IP, traffic enters the DMZ through the firewall, but the web server sends return traffic to its default gateway (the Layer 3 switch) instead of back to the firewall. The ACL applied inbound on the VLAN 30 SVI (the DMZ SVI) blocks this return traffic because the source is the web server (192.168.30.10) and the destination is the user's IP (192.168.10.x), which is not explicitly permitted by the ACL (the ACL only permits traffic from VLAN 10 to DMZ, not the reverse).

Answer

The web server's default gateway should be set to the firewall, not the Layer 3 switch

Answer

The ACL on the VLAN 10 SVI is blocking the traffic to the public IP because it only allows private IP ranges

Answer

The firewall is blocking the return traffic due to a stateful inspection rule

Question 12

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Accepted Answer

Implementing firewall rules between internal zones.. Option A is correct because implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Answer

Deploying an intrusion detection system (IDS) on the core switch.

Answer

Placing public-facing servers in a DMZ.

Answer

Using VPN for remote access.

Question 13

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that permits TCP traffic from the client to the server on port 80 (HTTP) but denies all other IP traffic from the client. Therefore, the HTTP request is permitted, but any other traffic from the client (e.g., DNS, ICMP) is blocked. Option D correctly states that the HTTP request is blocked, but other traffic is allowed, which matches the ACL behavior.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.

Question 14

You are the network security lead for a medium-sized financial firm with 500 employees. The network consists of a core switch, distribution switches, and access switches. There are three main VLANs: VLAN 10 (Management - 192.168.10.0/24), VLAN 20 (Finance - 192.168.20.0/24), and VLAN 30 (Guest Wi-Fi - 192.168.30.0/24). The network uses a single firewall with three interfaces: inside (trusted), outside (untrusted), and DMZ. The firewall is configured with default-deny rules. Recently, the helpdesk reported that employees in the Finance VLAN cannot access a web-based accounting application hosted on a server at 10.0.0.5, which is in the DMZ. The server's default gateway is the firewall's DMZ interface (10.0.0.1). The accounting application runs on HTTPS (TCP 443). Employees in the Management VLAN can access the application without issue. You have verified that the Finance VLAN has connectivity to the firewall's inside interface (192.168.20.1). The firewall's inside interface has an IP of 192.168.20.1. There is no ACL on the inside interface. The firewall's DMZ interface has an ACL permitting TCP/443 from any to 10.0.0.5. The firewall's routing table shows a route to 10.0.0.0/24 via DMZ interface. What is the most likely cause of the issue?

Accepted Answer

The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.. The firewall uses a default-deny policy between zones. Even though the inside interface has no ACL and the DMZ ACL permits HTTPS from any source, the firewall still requires an explicit policy rule allowing traffic from the inside (Finance) zone to the DMZ zone. Without this policy, packets from VLAN 20 to the DMZ server are dropped by the firewall's stateful inspection engine, regardless of interface ACLs or routing.

Answer

The routing table on the firewall does not have a return route to the Finance subnet.

Answer

The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.

Answer

An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.

Question 15

Drag and drop the steps for the incident response process according to NIST into the correct order.

Question 16

Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.

Question 17

Match each network security concept to its purpose.

Question 18

Match each risk management term to its meaning.

Question 19

A network administrator notices unusual traffic from an internal workstation to an external IP address on port 443. The workstation has no business reason for such communication. Which action should the administrator take first?

Accepted Answer

Investigate the workstation for possible malware.. Option C is correct because the first priority when encountering unexpected outbound traffic to an external IP on port 443 (HTTPS) is to investigate the workstation for possible malware. This traffic could indicate a command-and-control (C2) beacon or data exfiltration, and immediate investigation allows the administrator to gather forensic evidence before taking disruptive actions. Disabling the port or blocking traffic without investigation could destroy evidence or alert an attacker, while allowing the traffic would be negligent.

Answer

Disable the workstation's network port.

Answer

Block all outbound traffic from that workstation immediately.

Answer

Configure a firewall rule to allow the traffic and log it.

Question 20

A security engineer is designing a DMZ for a web server that must be accessible from the internet. The web server needs to query an internal database server. Which network security approach best limits exposure?

Accepted Answer

Place the web server in the DMZ and the database server in the internal network, with a firewall allowing only specific traffic from the web server to the database.. Option D is correct because it implements a true DMZ architecture: the web server resides in the DMZ (a semi-trusted zone) while the database server remains in the internal network, protected by a firewall that permits only specific traffic (e.g., TCP/3306 for MySQL or TCP/1433 for MSSQL) from the web server. This minimizes the attack surface by ensuring that even if the web server is compromised, the database server is not directly reachable from the internet, and the firewall enforces strict stateful inspection and access control.

Answer

Use a single firewall with rules that allow all traffic from the internet to the internal network.

Answer

Place both servers in the same subnet with a firewall allowing all traffic.

Answer

Place the database server in the DMZ with the web server.