ISC2 CC Network Security Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

Accepted Answer

HTTP traffic from any source to 192.168.1.100. The exhibit shows an access control list (ACL) that permits TCP traffic from any source to destination host 192.168.1.100 on port 80 (HTTP). The ACL entry is `permit tcp any host 192.168.1.100 eq 80`, which matches only HTTP traffic. Therefore, only HTTP traffic from any source to 192.168.1.100 is permitted.

Answer

All traffic from 192.168.1.100

Answer

All traffic from 10.0.1.0/24

Answer

SSH traffic from any source to 192.168.1.100

Question 2

Refer to the exhibit. Based on the exhibit, why was the packet denied?

Accepted Answer

The packet was blocked by an inbound access list. The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.

Answer

Source IP is internal

Answer

The packet was blocked by an outbound access list

Answer

Destination IP is external

Question 3

Refer to the exhibit. Based on the exhibit, which statement best describes the effect of this policy?

Accepted Answer

Allows DescribeInstances action only from IPs within 10.0.0.0/16. The policy uses an 'Allow' effect with a condition that restricts the source IP to the 10.0.0.0/16 range. Since IAM policies default to implicit deny, only requests matching both the action (DescribeInstances) and the condition (source IP within 10.0.0.0/16) are allowed. This effectively permits DescribeInstances only from the specified CIDR block.

Answer

Allows all actions on EC2 instances from 10.0.0.0/16

Answer

Allows DescribeInstances action from any IP but with a condition

Answer

Denies DescribeInstances action from IPs outside 10.0.0.0/16

Question 4

A company wants to segment its network into separate broadcast domains to improve performance and security. Which device should be used to achieve this?

Accepted Answer

Router. A router is the correct device because it operates at Layer 3 (Network layer) of the OSI model and can segment a network into separate broadcast domains by forwarding packets based on IP addresses while blocking broadcast traffic (e.g., ARP requests) from crossing between interfaces. This isolation improves performance by reducing broadcast overhead and enhances security by controlling traffic flow between segments.

Answer

Switch

Answer

Hub

Answer

Repeater

Question 5

A helpdesk technician receives a report that a user in the finance department cannot access a shared folder on the server. The same server is accessible from other departments. What is the most likely cause?

Accepted Answer

A firewall rule is blocking traffic from the finance VLAN to the server. The scenario describes a user in the finance department unable to access a shared folder on a server that is reachable from other departments. This points to a segmentation or access control issue specific to the finance VLAN. A firewall rule blocking traffic from the finance VLAN to the server is the most likely cause because it would selectively prevent access for that subnet while allowing other VLANs to reach the server, matching the symptom of partial connectivity.

Answer

The server is down

Answer

The network cable is unplugged

Answer

The user's account is disabled

Question 6

Which of the following protocols provides secure remote administration of a network device over an untrusted network?

Accepted Answer

SSH. SSH (Secure Shell) is correct because it encrypts all traffic, including authentication credentials and commands, using strong cryptographic algorithms, making it safe for remote administration over untrusted networks. It operates on TCP port 22 and provides confidentiality, integrity, and authentication, unlike cleartext protocols. SSH is the standard for secure CLI access to network devices such as routers and switches.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 7

A network administrator is configuring a DMZ for a company's web and email servers. Which firewall rule is most appropriate for traffic from the internet to the DMZ?

Accepted Answer

Allow inbound HTTP, HTTPS, SMTP, and DNS to DMZ. Option B is correct because a DMZ must selectively permit essential services from the internet to the public-facing servers while blocking all other inbound traffic. HTTP (80), HTTPS (443), SMTP (25), and DNS (53) are the standard protocols required for web and email servers to function. This rule implements the principle of least privilege by allowing only the necessary traffic to the DMZ.

Answer

Deny all inbound traffic to DMZ but allow outbound

Answer

Allow inbound only to the web server on ports 80 and 443

Answer

Allow all inbound traffic to DMZ

Question 8

A company uses WPA2-Enterprise for wireless authentication. What additional security measure should be implemented to protect against rogue access points?

Accepted Answer

Deploy a wireless intrusion prevention system (WIPS). WPA2-Enterprise uses 802.1X for authentication, but it does not inherently detect or block rogue access points (APs) that mimic legitimate SSIDs. A Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, identifies unauthorized APs by analyzing beacon frames, probe responses, and MAC addresses, and can automatically contain them by sending deauthentication frames or alerting administrators. This is the most direct and effective measure to protect against rogue APs in an enterprise WLAN.

Answer

Enable MAC filtering

Answer

Implement 802.1X with mutual authentication

Answer

Use WPA3

Question 9

A network administrator needs to allow secure remote access for teleworkers. Which VPN protocol provides the best confidentiality and integrity while using a single UDP port?

Accepted Answer

SSL/TLS (OpenVPN). SSL/TLS (OpenVPN) is correct because it provides robust confidentiality and integrity through TLS encryption (e.g., AES-256-GCM) and HMAC authentication, while operating over a single UDP port (typically 1194). This makes it ideal for teleworkers as it can traverse NAT and firewalls easily, unlike protocols that require multiple ports or IPsec's complex port/protocol handling.

Answer

PPTP

Answer

L2TP/IPsec

Answer

IKEv2

Question 10

A security auditor discovers that during a VLAN hopping attack, a threat actor was able to send frames from a workstation on VLAN 10 to a target on VLAN 20. Which configuration flaw is most likely responsible?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. Option A is correct because a VLAN hopping attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link between the attacker's workstation and the switch. If DTP is enabled on an access port, the attacker can send DTP frames to form a trunk, allowing frames from VLAN 10 to be tagged and forwarded to VLAN 20. Disabling DTP on all access ports with the 'switchport nonegotiate' command prevents this attack.

Answer

The trunk port is set to native VLAN 1

Answer

The switch is using default VLAN 1 for management

Answer

Port security is not configured

Question 11

A company's network uses a perimeter firewall and an internal firewall. The DMZ sits between them. A new application server needs to be accessible from the internet on TCP port 8443 and must be able to make outbound HTTPS connections to an external license server. Which firewall rules should be implemented? (Assume default deny)

Accepted Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443 with stateful inspection. Option B is correct because it allows inbound traffic on TCP 8443 to the server and outbound traffic on TCP 443 from the server to the internet. Stateful inspection automatically tracks the outbound HTTPS connection and permits the return traffic (the license server's response) without needing an explicit inbound rule. This matches the requirement while maintaining a default-deny posture.

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443; allow inbound from internet to server on 443 for license server response

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443

Answer

Allow inbound from internet to server on 8443 and 443; allow outbound from server to internet on any

Question 12

A security engineer is reviewing logs and notices that an internal server is receiving excessive SYN packets from an external IP, but never completing the three-way handshake. What type of attack is likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (i.e., not sending the final ACK). This exhausts the server's connection table resources, preventing legitimate connections. The log evidence—excessive SYN packets from an external IP with no handshake completion—is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

Ping of death

Answer

ARP poisoning

Question 13

An organization wants to protect against man-in-the-middle attacks on a switched network. Which TWO measures should be implemented? (Choose two.)

Accepted Answer

DHCP Snooping. C is correct because DHCP Snooping filters untrusted DHCP messages on access ports, preventing a rogue DHCP server from assigning malicious IP configurations that enable man-in-the-middle attacks. D is correct because Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP Snooping binding table, blocking spoofed ARP replies that would redirect traffic through an attacker.

Answer

BPDU guard

Answer

Port security

Answer

Storm control

Question 14

Which TWO technologies provide network segmentation? (Choose two.)

Accepted Answer

Routers with ACLs. Routers with ACLs (Access Control Lists) provide network segmentation by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (port numbers) criteria, effectively dividing a network into separate security zones or subnets. VLANs (Virtual Local Area Networks) segment a network at Layer 2 by logically grouping devices into separate broadcast domains, even if they share the same physical switch. Both technologies isolate traffic to enforce security policies and reduce attack surfaces.

Answer

Firewalls

Answer

Hubs

Answer

Switches

Question 15

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

ISC2 CC Network Security Practice Test 4 — 15 Questions

Exhibit

ISC2 CC Network Security Practice Test 4 — 15 Questions

Exhibit