ISC2 CC Network Security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Accepted Answer

The workstation is sending traffic with multiple source MAC addresses.. The port-security configuration with a maximum MAC address count of 2 and violation mode 'shutdown' causes the port to err-disable when a single workstation sends traffic with multiple source MAC addresses. This is a classic symptom of a device (e.g., a virtual machine host or a switch behind the port) generating frames from different MACs, exceeding the allowed limit and triggering the violation.

Answer

The port-security maximum is set to 2, so it should allow up to 2 MACs; the issue is elsewhere.

Answer

Sticky MAC learning is disabled.

Answer

The violation mode should be 'restrict' instead of 'shutdown'.

Question 2

Refer to the exhibit. A security engineer applies this S3 bucket policy to restrict access. Users outside the 10.0.0.0/16 network report being denied access, which is expected. However, users inside that network also report access denied. What is the likely issue?

Accepted Answer

The policy only allows GetObject; users likely need ListBucket or other actions.. Option C is correct because the S3 bucket policy only grants the s3:GetObject action, but users inside the 10.0.0.0/16 network are likely performing other actions such as s3:ListBucket (e.g., listing objects) or s3:PutObject. Even though the source IP condition allows access from the trusted network, the explicit Allow statement is scoped solely to GetObject. Any request for a different action (like listing the bucket) will be implicitly denied by default, as IAM and S3 policies are deny-by-default unless an explicit Allow exists for that specific action.

Answer

The condition syntax is incorrect and causes all requests to be evaluated incorrectly.

Answer

The Deny statement overrides the Allow statement for all requests.

Answer

The resource ARN includes a wildcard, causing a mismatch with the bucket name.

Question 3

Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?

Accepted Answer

The ICMP rule only allows incoming echo requests; outgoing echo replies are not covered by the displayed rules and must be allowed by the OUTPUT chain.. Option D is correct because the displayed iptables rules only govern the INPUT chain, which controls incoming packets. While the rule allows incoming ICMP echo requests (type 8), the server's response—an ICMP echo reply (type 0)—is an outgoing packet that must traverse the OUTPUT chain. If the OUTPUT chain has a default policy of DROP or lacks an explicit ACCEPT rule for ICMP echo replies, the replies are dropped, preventing ping from working even though SSH succeeds (since SSH uses TCP, which is handled differently).

Answer

The default policy DROP on the INPUT chain drops echo replies, but they should be matched by the ESTABLISHED,RELATED rule.

Answer

The ICMP rule is placed after the ESTABLISHED,RELATED rule, so it is never evaluated for new ICMP packets.

Answer

The ACCEPT rule for ICMP only permits echo request (type 8), but ping requires echo reply (type 0) which is not allowed.

Question 4

A company recently experienced a DoS attack targeting their web server. They want to implement a solution that can differentiate between legitimate traffic and attack traffic based on behavior patterns. Which technology should they deploy?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is the correct choice because it can analyze traffic patterns and behavior in real time, using signature-based and anomaly-based detection to distinguish legitimate traffic from DoS attack traffic. Unlike a WAF, which focuses on application-layer threats like SQL injection, an IPS can inspect network and transport layers to identify volumetric or protocol-based DoS patterns and actively block malicious flows.

Answer

Web Application Firewall (WAF)

Answer

Load balancer

Answer

Stateful firewall

Question 5

A network administrator needs to provide secure remote access to internal resources for employees working from home. The solution must encrypt all traffic and authenticate users before granting access. Which protocol should be used?

Accepted Answer

SSL/TLS VPN. C is correct because SSL/TLS VPNs (e.g., Cisco AnyConnect) provide encrypted tunnels over HTTPS (port 443) and support user authentication via certificates, RADIUS, or LDAP. This allows secure remote access to internal resources without requiring a persistent IPsec tunnel, making it ideal for home workers with dynamic IPs.

Answer

SSH

Answer

IPsec

Answer

SNMPv3

Question 6

An organization has multiple network segments for accounting, HR, and engineering. They want to prevent unauthorized traffic between segments while allowing necessary communication. Which security control should be implemented?

Accepted Answer

VLAN segmentation with ACLs. VLAN segmentation with ACLs is the correct choice because VLANs create separate broadcast domains at Layer 2, isolating traffic between network segments (accounting, HR, engineering). ACLs applied to the Layer 3 interface (SVI) or trunk ports then enforce granular rules to permit only necessary inter-VLAN communication, such as allowing HR to access a shared server while blocking all other cross-segment traffic.

Answer

Intrusion Detection System (IDS)

Answer

Proxy server

Answer

Honeypot

Question 7

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's VPN concentrator. Which type of attack is most likely occurring?

Accepted Answer

Brute force. Repeated failed login attempts from a single external IP targeting a VPN concentrator are the hallmark of a brute force attack. The attacker systematically tries many username/password combinations to gain unauthorized access, exploiting weak or common credentials rather than exploiting a protocol vulnerability.

Answer

Spoofing

Answer

Man-in-the-Middle (MITM)

Answer

Denial of Service (DoS)

Question 8

A network engineer is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which port must be opened?

Accepted Answer

443. HTTPS (HTTP Secure) uses TLS/SSL encryption over TCP port 443 by default. To allow inbound HTTPS traffic to a web server, the firewall rule must permit TCP destination port 443. Port 80 is used for unencrypted HTTP, not HTTPS.

Answer

3389

Answer

22

Answer

80

Question 9

An organization wants to detect and alert on potential network intrusions but does not want to risk blocking legitimate traffic. Which system should they deploy?

Accepted Answer

Network-based Intrusion Detection System (NIDS). A Network-based Intrusion Detection System (NIDS) passively monitors network traffic and generates alerts when suspicious patterns are detected, but it does not take any inline action to block traffic. This makes it the correct choice for an organization that wants to detect and alert on potential intrusions without any risk of blocking legitimate traffic, as the NIDS operates out-of-band and cannot drop packets.

Answer

Unified Threat Management (UTM) appliance

Answer

Firewall with deep packet inspection

Answer

Network-based Intrusion Prevention System (NIPS)

Question 10

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 11

A security administrator is concerned about MAC address spoofing on the network. Which technology can help mitigate this risk by associating a specific MAC address with a port?

Accepted Answer

Port security. Port security is the correct answer because it directly mitigates MAC address spoofing by allowing an administrator to statically or dynamically associate a specific MAC address with a switch port. When a device with a different MAC address attempts to use that port, port security can either disable the port (errdisable) or drop the traffic, preventing unauthorized access. This is a Layer 2 security feature that enforces MAC-to-port binding.

Answer

Dynamic ARP inspection

Answer

DHCP snooping

Answer

VLAN hopping prevention

Question 12

During a security assessment, a penetration tester captures unencrypted credentials over the network. Which protocol is most likely being used?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including credentials, in cleartext over the network. When a penetration tester captures unencrypted credentials, FTP is a likely candidate because it does not encrypt the authentication process, making it vulnerable to packet sniffing attacks.

Answer

SMTPS

Answer

SSH

Answer

HTTPS

Question 13

A security administrator is reviewing network security controls. Which TWO of the following are examples of network segmentation technologies? (Select TWO)

Accepted Answer

Subnetting. Subnetting divides a larger network into smaller, logical subnetworks by manipulating the subnet mask (e.g., using VLSM or CIDR). This creates separate broadcast domains at Layer 3, allowing administrators to isolate traffic and apply distinct security policies between subnets, which is a core function of network segmentation.

Answer

Proxy servers

Answer

Honeypots

Answer

Firewalls

Question 14

Which TWO of the following are common methods to authenticate users on a wireless network? (Select TWO)

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) is a common method to authenticate users on a wireless network because it replaces the pre-shared key (PSK) exchange with a secure password-based authentication protocol that is resistant to offline dictionary attacks. It uses a Diffie-Hellman key exchange combined with a shared password to derive a Pairwise Master Key (PMK), ensuring forward secrecy and mutual authentication.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC address filtering

Question 15

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

ISC2 CC Network Security Practice Test 3 — 15 Questions

Exhibit

ISC2 CC Network Security Practice Test 3 — 15 Questions

Exhibit