CISSP Communication and Network Security — 25 Questions

Question 1

During a security assessment, a penetration tester sends TCP SYN packets to various ports on a target server. Based on the responses, the tester determines which ports are open. This technique is commonly used at which OSI layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Layer 4 – Transport. The TCP SYN scan operates at Layer 4 (Transport) of the OSI model because it manipulates TCP segment headers, specifically the SYN flag, to probe port states. The tester sends SYN packets and interprets the response (SYN-ACK for open, RST for closed) to infer port availability, which is a transport-layer function defined by RFC 793.

Answer

Layer 7 – Application

Answer

Layer 3 – Network

Answer

Layer 2 – Data Link

Question 2

An organization is deploying a wireless network with WPA3-Enterprise. Which THREE of the following are features or improvements of WPA3 compared to WPA2? (Select THREE.)

Accepted Answer

Protected Management Frames (PMF). Protected Management Frames (PMF) are mandatory in WPA3, whereas in WPA2 they were optional. PMF provides integrity and replay protection for management frames. WPA3 also introduces forward secrecy (preventing decryption of captured traffic even if the password is later compromised) and replaces WPA2-PSK with Simultaneous Authentication of Equals (SAE) for personal networks to resist offline dictionary attacks.

Answer

Use of TKIP for encryption

Answer

Support for WEP compatibility

Question 3

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol), SCP (Secure Copy Protocol), and FTPS (FTP Secure) all provide encryption for data in transit. SFTP and SCP both run over SSH (typically TCP port 22), encrypting both credentials and data. FTPS uses SSL/TLS to encrypt the control and data channels. FTP and TFTP transmit data in plaintext and do not provide encryption.

Answer

FTP

Answer

TFTP

Question 4

A security engineer is evaluating VPN protocols for a remote access solution. The requirements are: strong encryption with perfect forward secrecy, support for mutual authentication, and no reliance on pre-shared keys that could be brute-forced. Which protocol best meets these requirements?

Accepted Answer

WireGuard. WireGuard is the correct choice because it uses modern cryptographic primitives (Curve25519, ChaCha20, Poly1305, BLAKE2s) that inherently provide perfect forward secrecy via ephemeral Diffie-Hellman key exchanges, supports mutual authentication through public-key-based handshakes, and eliminates pre-shared keys as the sole authentication factor—though an optional PSK can be added for post-quantum resistance, it is not required and does not weaken security if omitted.

Answer

L2TP/IPsec with pre-shared keys

Answer

PPTP with MS-CHAPv2

Answer

IPsec with IKEv2 using pre-shared keys

Question 5

A security architect is designing a network segmentation strategy for a financial institution. Which TWO techniques are best suited for implementing micro-segmentation in a data center environment? (Select two.)

Accepted Answer

Software-Defined Networking (SDN). Software-Defined Networking (SDN) and hypervisor-based firewalls are the primary technologies used to achieve micro-segmentation in modern virtualized data centers. SDN decouples the control plane from the data plane, allowing centralized, programmable, and dynamic policy enforcement at the individual workload level. Hypervisor-based firewalls (or distributed firewalls) run directly within the virtualization layer (hypervisor), enabling stateful inspection of east-west traffic between virtual machines on the same host or virtual network without requiring traffic to be hairpinned to physical firewalls. Traditional VLANs and physical firewalls are too coarse-grained and do not scale effectively for micro-segmentation.

Answer

VLANs (Virtual Local Area Networks)

Answer

Physical network firewalls

Answer

DMZ (screened subnet)

Question 6

An organization is reviewing its use of SSH for remote administration. Which TWO features of SSH should be disabled or carefully managed to reduce security risks? (Select two.)

Accepted Answer

Port forwarding. Port forwarding (Option A) allows SSH to tunnel arbitrary TCP connections, which can bypass network firewalls and expose internal services to external attackers. X11 forwarding (Option C) allows graphical applications to be run remotely, but it can expose the local X11 display to security risks, such as keystroke logging or screen scraping by malicious users on the remote server. Both features should be disabled or carefully managed to reduce security risks. SSH protocol version 1 (Option B) is obsolete and insecure and must be disabled entirely, not just managed. Public-key authentication (Option D) and SSH protocol version 2 (Option E) are secure practices that should be enabled.

Answer

Using SSH protocol version 1

Answer

Public-key authentication

Answer

Using SSH protocol version 2

Question 7

An incident responder is analyzing a network compromise that involved ICMP attacks. Which THREE types of ICMP attacks could have been used to disrupt network operations? (Select three.)

Accepted Answer

Smurf attack. A Smurf attack, an ICMP redirect attack, and the Ping of Death are all ICMP-based attacks:

1. A Smurf attack exploits ICMP echo requests sent to a broadcast address with a spoofed source IP of the victim, causing a flood of replies that overwhelms the victim.
2. An ICMP redirect attack uses ICMP Type 5 (Redirect) messages sent to a host to alter its routing table, redirecting its traffic through a malicious gateway (man-in-the-middle).
3. The Ping of Death involves sending an oversized ICMP packet (greater than 65,535 bytes) that fragments and crashes the target system upon reassembly.

ARP poisoning operates at Layer 2 (Data Link) using ARP, and SYN flood operates at Layer 4 (Transport) using TCP, so neither is an ICMP attack.

Answer

ARP poisoning

Answer

SYN flood

Question 8

A company is migrating from WPA2 to WPA3 to improve wireless security. Which THREE of the following are features of WPA3 compared to WPA2?

Accepted Answer

Protected Management Frames (PMF). WPA3 introduces several key security enhancements over WPA2:

1. **Protected Management Frames (PMF)**: Mandatory in WPA3 (it was optional in WPA2), PMF protects unicast and multicast management frames (such as deauthentication and disassociation frames) from spoofing and forging.
2. **Simultaneous Authentication of Equals (SAE)**: Replaces the Pre-Shared Key (PSK) exchange used in WPA2-Personal. SAE is a secure key establishment protocol that is highly resistant to offline dictionary attacks.
3. **Forward Secrecy**: Because of the SAE handshake, WPA3 provides forward secrecy (perfect forward secrecy), meaning that even if an attacker compromises the network password in the future, they cannot decrypt previously captured wireless traffic.

Answer

Backward compatibility with WPA2 clients without security reduction

Answer

Mandatory use of TKIP for encryption

Question 9

A security analyst is evaluating secure email protocols. Which TWO of the following provide both encryption and digital signing of email messages?

Accepted Answer

S/MIME. S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP/GPG (Pretty Good Privacy / GNU Privacy Guard) both provide end-to-end security for email messages, including both encryption (confidentiality) and digital signing (integrity, authentication, and non-repudiation). S/MIME relies on a hierarchical PKI using X.509 certificates, while PGP/GPG typically uses a decentralized Web of Trust. Both protocols secure the message body itself, rather than just the transmission channel.

Answer

SSL/TLS

Answer

SSH

Answer

IPsec

Question 10

A company is migrating from WPA2 to WPA3 to enhance wireless security. Which of the following cryptographic changes does WPA3 introduce compared to WPA2?

Answer

WPA3 replaces PSK with SAE and uses GCMP-256 encryption.

Answer

WPA3 uses TKIP for backward compatibility.

Answer

WPA3 uses AES-CCMP as the mandatory encryption method.

Answer

WPA3 eliminates the need for 802.1X authentication.

Question 11

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) and is encapsulated directly within an Ethernet frame, not an IP packet. The attack described—ARP spoofing—forges ARP replies to poison the target's ARP cache, which is a Layer 2 function. Therefore, the attack occurs at Layer 2 of the OSI model.

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 12

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

Accepted Answer

WireGuard. WireGuard is the correct choice because it is a modern VPN protocol that uses elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through its ephemeral session keys, and is designed with a minimal, auditable codebase (around 4,000 lines) for efficiency and security. These features directly match the organization's requirements for a modern protocol with PFS, ECC, and a lean implementation.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec with IKEv2

Question 13

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 14

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

Accepted Answer

PGP/GPG. PGP/GPG implements a web of trust model where users sign each other's keys to establish trust, rather than relying on a centralized Certificate Authority (CA). It provides both encryption and digital signatures for email, making it the correct choice for an organization that explicitly wants to avoid hierarchical PKI.

Answer

S/MIME

Answer

TLS

Answer

SSH

Question 15

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Accepted Answer

SHA for authentication, AES for privacy. SNMPv3 supports both authentication and encryption via separate User-based Security Model (USM) parameters. To meet the requirement for both, you must select an authentication protocol (e.g., SHA) and a privacy (encryption) protocol (e.g., AES). Option C correctly pairs SHA for authentication with AES for privacy, providing integrity verification and confidentiality of SNMP messages.

Answer

MD5 for authentication, no privacy

Answer

SHA for authentication, no privacy

Answer

MD5 for authentication, DES for privacy

Question 16

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

Accepted Answer

WPA3. WPA3 replaces the Pre-Shared Key (PSK) authentication used in WPA2 with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and specified in RFC 7664. SAE provides forward secrecy by using a Diffie-Hellman key exchange that ensures even if the long-term password is compromised, past session keys remain secure. This eliminates vulnerabilities to offline dictionary attacks that plague WPA2-PSK.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with CCMP

Question 17

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

Accepted Answer

Evil twin attack. This is an evil twin attack because the attacker creates a rogue access point that broadcasts the same SSID as a legitimate network, tricking users into connecting to it. Once connected, the attacker can capture credentials or other sensitive data by acting as a man-in-the-middle. The key differentiator is the impersonation of a legitimate SSID to deceive users, not just the presence of an unauthorized AP.

Answer

Deauthentication attack

Answer

Rogue AP attack

Answer

Karma attack

Question 18

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting publicly accessible servers like web and email. It uses firewall rules to allow inbound traffic from the internet to the DMZ servers while blocking direct access to the internal network, and typically permits only specific outbound responses or updates from the DMZ to the internal LAN. This architecture provides the isolation and controlled access required by the scenario.

Answer

Micro-segmentation

Answer

VPN

Answer

VLAN

Question 19

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 20

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions, eliminating static RSA and static DH key exchanges. This ensures that even if the server's long-term private key is compromised, past session keys cannot be derived, protecting historical traffic. Earlier TLS versions allowed static key exchanges, making them vulnerable to retrospective decryption.

Answer

Support for RC4 encryption

Answer

Support for DES and 3DES

Answer

Use of static RSA key exchange