CISSP Communication and Network Security — All Questions With Answers

Question 1

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) and is encapsulated directly within an Ethernet frame, not an IP packet. The attack described—ARP spoofing—forges ARP replies to poison the target's ARP cache, which is a Layer 2 function. Therefore, the attack occurs at Layer 2 of the OSI model.

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 2

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

Accepted Answer

WireGuard. WireGuard is the correct choice because it is a modern VPN protocol that uses elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through its ephemeral session keys, and is designed with a minimal, auditable codebase (around 4,000 lines) for efficiency and security. These features directly match the organization's requirements for a modern protocol with PFS, ECC, and a lean implementation.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec with IKEv2

Question 3

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 4

During a security assessment, a penetration tester sends TCP SYN packets to various ports on a target server. Based on the responses, the tester determines which ports are open. This technique is commonly used at which OSI layer?

Accepted Answer

Layer 4 – Transport. The TCP SYN scan operates at Layer 4 (Transport) of the OSI model because it manipulates TCP segment headers, specifically the SYN flag, to probe port states. The tester sends SYN packets and interprets the response (SYN-ACK for open, RST for closed) to infer port availability, which is a transport-layer function defined by RFC 793.

Answer

Layer 7 – Application

Answer

Layer 3 – Network

Answer

Layer 2 – Data Link

Question 5

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

Accepted Answer

PGP/GPG. PGP/GPG implements a web of trust model where users sign each other's keys to establish trust, rather than relying on a centralized Certificate Authority (CA). It provides both encryption and digital signatures for email, making it the correct choice for an organization that explicitly wants to avoid hierarchical PKI.

Answer

S/MIME

Answer

TLS

Answer

SSH

Question 6

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Accepted Answer

SHA for authentication, AES for privacy. SNMPv3 supports both authentication and encryption via separate User-based Security Model (USM) parameters. To meet the requirement for both, you must select an authentication protocol (e.g., SHA) and a privacy (encryption) protocol (e.g., AES). Option C correctly pairs SHA for authentication with AES for privacy, providing integrity verification and confidentiality of SNMP messages.

Answer

MD5 for authentication, no privacy

Answer

SHA for authentication, no privacy

Answer

MD5 for authentication, DES for privacy

Question 7

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

Accepted Answer

WPA3. WPA3 replaces the Pre-Shared Key (PSK) authentication used in WPA2 with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and specified in RFC 7664. SAE provides forward secrecy by using a Diffie-Hellman key exchange that ensures even if the long-term password is compromised, past session keys remain secure. This eliminates vulnerabilities to offline dictionary attacks that plague WPA2-PSK.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with CCMP

Question 8

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

Accepted Answer

Evil twin attack. This is an evil twin attack because the attacker creates a rogue access point that broadcasts the same SSID as a legitimate network, tricking users into connecting to it. Once connected, the attacker can capture credentials or other sensitive data by acting as a man-in-the-middle. The key differentiator is the impersonation of a legitimate SSID to deceive users, not just the presence of an unauthorized AP.

Answer

Deauthentication attack

Answer

Rogue AP attack

Answer

Karma attack

Question 9

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting publicly accessible servers like web and email. It uses firewall rules to allow inbound traffic from the internet to the DMZ servers while blocking direct access to the internal network, and typically permits only specific outbound responses or updates from the DMZ to the internal LAN. This architecture provides the isolation and controlled access required by the scenario.

Answer

Micro-segmentation

Answer

VPN

Answer

VLAN

Question 10

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Accepted Answer

Digital signatures of DNS records. DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.

Answer

Hashing of DNS responses without keys

Answer

Transport Layer Security for DNS

Answer

Symmetric encryption of DNS queries

Question 11

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions, eliminating static RSA and static DH key exchanges. This ensures that even if the server's long-term private key is compromised, past session keys cannot be derived, protecting historical traffic. Earlier TLS versions allowed static key exchanges, making them vulnerable to retrospective decryption.

Answer

Support for RC4 encryption

Answer

Support for DES and 3DES

Answer

Use of static RSA key exchange

Question 12

A security architect is designing a zero-trust network. Which principle is fundamental to a zero-trust architecture (ZTA) such as BeyondCorp?

Accepted Answer

Never trust, always verify. In a zero-trust architecture (ZTA) like Google's BeyondCorp, the foundational principle is 'never trust, always verify.' This means no entity—user, device, or network—is trusted by default, regardless of its location (inside or outside the corporate perimeter). Every access request must be authenticated, authorized, and continuously validated before granting access to resources, eliminating implicit trust based on network location.

Answer

Trust but verify

Answer

Trust internal users implicitly

Answer

Trust network location as a primary factor

Question 13

A network engineer is configuring an IPsec VPN in tunnel mode. Which IPsec protocol provides both authentication and encryption of the entire IP packet?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) in tunnel mode provides both authentication and encryption for the entire original IP packet, including the original header and payload. It encapsulates the packet with a new IP header and ESP trailer, ensuring confidentiality via encryption and integrity via authentication. This makes it the correct choice for a VPN requiring both security services.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP

Answer

AH (Authentication Header)

Question 14

Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?

Accepted Answer

Next-generation firewall. A next-generation firewall (NGFW) goes beyond traditional stateful inspection by incorporating deep packet inspection (DPI) of application-layer data, the ability to decrypt and inspect SSL/TLS traffic, and integrated intrusion prevention system (IPS) capabilities. This convergence allows NGFWs to identify and block threats within encrypted sessions and enforce policies based on application identity rather than just ports and protocols.

Answer

Packet filter firewall

Answer

Application proxy firewall

Answer

Stateful firewall

Question 15

A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?

Accepted Answer

The private key must be kept secret by the user. In SSH public-key authentication, the private key is the secret half of the asymmetric key pair and must be kept confidential by the user. The server stores only the public key, and authentication is proven by the client signing a challenge with the private key, which the server verifies using the stored public key. This ensures that even if the server is compromised, the private key remains safe on the client side.

Answer

The public key is used to decrypt the session

Answer

Public-key authentication does not require a passphrase

Answer

The private key is stored on the server

Question 16

A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)

Accepted Answer

They allow logical grouping of devices regardless of physical location. VLANs operate at Layer 2 (Data Link Layer) and allow network administrators to segment devices into distinct broadcast domains based on logical criteria such as department or function, regardless of their physical location on the network. This logical grouping reduces the scope of broadcast traffic because broadcasts are confined to the VLAN, not the entire physical network. By containing broadcasts, VLANs improve network performance and security by limiting unnecessary traffic and isolating potential threats.

Answer

They provide encryption of network traffic

Answer

They eliminate the need for firewalls

Answer

They provide inherent protection against ARP spoofing

Question 17

An organization is deploying a wireless network with WPA3-Enterprise. Which THREE of the following are features or improvements of WPA3 compared to WPA2? (Select THREE.)

Accepted Answer

Protected Management Frames (PMF). Protected Management Frames (PMF) are mandatory in WPA3, whereas in WPA2 they were optional. PMF provides integrity and replay protection for management frames (e.g., deauthentication and disassociation frames), preventing attacks such as deauth floods that can force clients to reconnect and expose handshake data.

Answer

Use of TKIP for encryption

Answer

Support for WEP compatibility

Question 18

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is correct because it operates over the SSH protocol (typically port 22), which provides strong encryption for both authentication and data in transit. Unlike FTP, SFTP encrypts all commands and data, ensuring confidentiality and integrity during file transfers.

Answer

FTP

Answer

TFTP

Question 19

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?

Accepted Answer

Evil twin attack. The correct answer is C, Evil twin attack. This attack involves an attacker setting up a rogue access point that mimics a legitimate access point by spoofing its MAC address (BSSID) and broadcasting a stronger signal, causing clients to associate with the attacker's device instead of the legitimate AP. The key distinction is the active impersonation of a specific legitimate AP, not just the presence of an unauthorized AP.

Answer

Rogue access point

Answer

Karma attack

Answer

ARP spoofing

Question 20

An organization is implementing network segmentation to enhance security. They create a DMZ to host public-facing servers and want to ensure that if a server is compromised, the attacker cannot pivot to the internal network. Which firewall placement best achieves this?

Accepted Answer

Implement a screened subnet with two firewalls: one between internet and DMZ, and one between DMZ and internal network. Option D is correct because a screened subnet architecture uses two firewalls to create a DMZ that is logically isolated from both the internet and the internal network. The first firewall (internet-facing) controls inbound traffic to the DMZ, while the second firewall (internal-facing) strictly controls outbound traffic from the DMZ to the internal network, typically allowing only specific return traffic. This prevents an attacker who compromises a DMZ server from directly initiating connections to internal hosts, as the internal firewall would block such traffic unless explicitly permitted.

Answer

Place the DMZ on the internal network side with a strong host-based firewall on each server

Answer

Place a single firewall between the internet and the DMZ, and allow traffic from DMZ to internal network

Answer

Use a stateful firewall that only allows return traffic from internal to DMZ

CISSP Communication and Network Security — All Questions With Answers

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

During a security assessment, a penetration tester sends TCP SYN packets to various ports on a target server. Based on the responses, the tester determines which ports are open. This technique is commonly used at which OSI layer?

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

A security architect is designing a zero-trust network. Which principle is fundamental to a zero-trust architecture (ZTA) such as BeyondCorp?

A network engineer is configuring an IPsec VPN in tunnel mode. Which IPsec protocol provides both authentication and encryption of the entire IP packet?

Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?

A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?

A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)

An organization is deploying a wireless network with WPA3-Enterprise. Which THREE of the following are features or improvements of WPA3 compared to WPA2? (Select THREE.)

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?

An organization is implementing network segmentation to enhance security. They create a DMZ to host public-facing servers and want to ensure that if a server is compromised, the attacker cannot pivot to the internal network. Which firewall placement best achieves this?

A security engineer is evaluating VPN protocols for a remote access solution. The requirements are: strong encryption with perfect forward secrecy, support for mutual authentication, and no reliance on pre-shared keys that could be brute-forced. Which protocol best meets these requirements?

An attacker sends a flood of SYN packets to a server, consuming its resources and preventing legitimate connections. Which OSI layer is this attack targeting?

A company wants to secure email communications for its employees. They need to ensure message confidentiality and integrity, and also verify the sender's identity. Which protocol uses a hierarchical public key infrastructure (PKI) for email encryption and signing?

A security administrator is configuring SNMPv3 for network device monitoring. The requirement is to provide both authentication and encryption of SNMP traffic. Which combination of options should be used?

During a penetration test, the tester successfully performs a VLAN hopping attack by sending packets with a specific tag. Which mitigation technique is most effective at preventing double-tagging VLAN hopping?

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

A security team is implementing a zero trust architecture. Which component is essential to enforce access decisions based on user identity, device posture, and context before granting access to resources?

A network administrator is configuring DNSSEC to protect against DNS spoofing. Which record type is used to provide cryptographic verification of DNS data origins?

An organization is migrating from WPA2 to WPA3 for its wireless network. Which improvement does WPA3 provide over WPA2?

Which type of firewall operates at Layer 7 and can inspect application payloads, such as blocking specific SQL commands or HTTP methods?

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

In IPsec, which protocol provides both authentication and encryption for the packet payload, but does not encrypt the IP header?

A security architect is designing a network segmentation strategy for a financial institution. Which TWO techniques are best suited for implementing micro-segmentation in a data center environment? (Select two.)

An organization is reviewing its use of SSH for remote administration. Which TWO features of SSH should be disabled or carefully managed to reduce security risks? (Select two.)

A company is deploying a VPN solution for remote employees using SSL/TLS VPN. Which TWO security considerations are important when implementing this type of VPN? (Select two.)

An incident responder is analyzing a network compromise that involved ICMP attacks. Which THREE types of ICMP attacks could have been used to disrupt network operations? (Select three.)

Which TWO features are true of IPsec tunnel mode compared to transport mode? (Select two.)

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

A company is implementing TLS 1.3 to secure web communications. Which of the following features is unique to TLS 1.3 compared to earlier versions?

A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Which of the following is a secure protocol for transferring files that uses SSH for authentication and encryption?

A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?

Which type of firewall can inspect the contents of application-layer traffic, such as HTTP requests, and block malicious payloads?

An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?

Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?

A security architect is designing a zero trust network. Which principle is fundamental to a zero trust architecture?

A network administrator is reviewing the security of the company's VPN solution. They discover that the current VPN uses PPTP. Which TWO of the following are significant security weaknesses associated with PPTP?

A company is migrating from WPA2 to WPA3 to improve wireless security. Which THREE of the following are features of WPA3 compared to WPA2?

A security analyst is evaluating secure email protocols. Which TWO of the following provide both encryption and digital signing of email messages?

A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?

A company is migrating from WPA2 to WPA3 to enhance wireless security. Which of the following cryptographic changes does WPA3 introduce compared to WPA2?

A security engineer is recommending a VPN protocol for remote access. The requirements are: strong encryption, perfect forward secrecy, use of elliptic curve cryptography, and minimal overhead. Which VPN protocol best meets these requirements?

An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

A security analyst is configuring a firewall to allow HTTP traffic (TCP port 80) from the internet to a web server in the DMZ. The firewall should also allow return traffic from the server back to the internet. Which type of firewall is best suited to handle this traffic while maintaining security?

CISSP Communication and Network Security — All Questions With Answers

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

During a security assessment, a penetration tester sends TCP SYN packets to various ports on a target server. Based on the responses, the tester determines which ports are open. This technique is commonly used at which OSI layer?

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?

Which wireless security protocol replaces the pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) to provide stronger security and forward secrecy?

A security analyst discovers an attack where an attacker sets up a rogue wireless access point with a legitimate SSID to trick users into connecting. Once connected, the attacker captures credentials. This type of attack is known as:

An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?

A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

A security architect is designing a zero-trust network. Which principle is fundamental to a zero-trust architecture (ZTA) such as BeyondCorp?

A network engineer is configuring an IPsec VPN in tunnel mode. Which IPsec protocol provides both authentication and encryption of the entire IP packet?

Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?

A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?

A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)

An organization is deploying a wireless network with WPA3-Enterprise. Which THREE of the following are features or improvements of WPA3 compared to WPA2? (Select THREE.)

A security administrator is evaluating secure file transfer protocols. Which THREE of the following protocols provide encryption for data in transit? (Select THREE.)

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?