CISSP Communication and Network Security Practice Test 3 — 15 Questions

Question 1

A network administrator is configuring DNSSEC to protect against DNS spoofing. Which record type is used to provide cryptographic verification of DNS data origins?

Accepted Answer

RRSIG. RRSIG (Resource Record Signature) is the DNSSEC record type that contains the cryptographic signature for a DNS record set. It provides data origin authentication and integrity verification by allowing resolvers to validate that the DNS data came from the authoritative source and was not modified in transit.

Answer

DS

Answer

DNSKEY

Answer

NSEC

Question 2

An organization is migrating from WPA2 to WPA3 for its wireless network. Which improvement does WPA3 provide over WPA2?

Accepted Answer

Simultaneous Authentication of Equals (SAE) providing forward secrecy. WPA3 replaces WPA2's Pre-Shared Key (PSK) handshake with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and RFC 7664. SAE uses a Dragonfly key exchange based on discrete logarithm cryptography, which provides forward secrecy: even if an attacker captures the handshake and later obtains the pre-shared key, they cannot decrypt past session traffic. This eliminates the vulnerability to offline dictionary attacks that plagued WPA2-PSK.

Answer

Use of TKIP for backward compatibility

Answer

Mandatory use of WPS for easy setup

Answer

Support for 802.1X only, no personal mode

Question 3

Which type of firewall operates at Layer 7 and can inspect application payloads, such as blocking specific SQL commands or HTTP methods?

Accepted Answer

Application proxy. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 (Application Layer) of the OSI model. It can inspect the full application payload, allowing it to block specific SQL commands, HTTP methods (e.g., PUT, DELETE), or other application-layer content by terminating the connection and re-establishing it after deep inspection.

Answer

Stateful inspection

Answer

Packet filter

Answer

Circuit-level gateway

Question 4

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

Accepted Answer

Stateless nature of ARP with no authentication. ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.

Answer

Lack of encryption in ARP packets

Answer

Weakness in the IP address resolution algorithm

Answer

Use of broadcast frames for all requests

Question 5

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP

Question 6

In IPsec, which protocol provides both authentication and encryption for the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both authentication and encryption for the packet payload, while leaving the IP header unencrypted. This allows intermediate routers to process the packet normally, as the header remains in plaintext, but the payload is protected for confidentiality and integrity.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP (Internet Security Association and Key Management Protocol)

Answer

AH (Authentication Header)

Question 7

A security architect is designing a network segmentation strategy for a financial institution. Which TWO techniques are best suited for implementing micro-segmentation in a data center environment? (Select two.)

Accepted Answer

Software-Defined Networking (SDN). Software-Defined Networking (SDN) is correct because it centralizes control-plane policy and lets the architect program granular, workload-level segmentation rules (e.g., via OpenFlow or APIs) that can be applied dynamically across the data center fabric, which is essential for micro-segmentation. Hypervisor-based firewalls are correct because they enforce Layer 2–4 (and often Layer 7) policy directly at the virtual NIC of each VM, enabling per-workload isolation and east-west traffic control without relying on physical topology. VLANs are not the best fit because they provide coarse Layer 2 broadcast-domain separation (limited to ~4094 IDs) rather than fine-grained per-workload policy. Physical network firewalls are too coarse and chokepoint-oriented for micro-segmentation, as they cannot practically enforce policy between every workload pair. A DMZ (screened subnet) is a perimeter segmentation pattern for exposing services to untrusted networks, not an east-west micro-segmentation technique inside the data center.

Answer

VLANs (Virtual Local Area Networks)

Answer

Physical network firewalls

Answer

DMZ (screened subnet)

Question 8

A company is deploying a VPN solution for remote employees using SSL/TLS VPN. Which TWO security considerations are important when implementing this type of VPN? (Select two.)

Accepted Answer

Implement strong authentication mechanisms such as multi-factor authentication. SSL/TLS VPNs operate at the application layer and are exposed to the internet, making them vulnerable to web-based attacks such as SQL injection and cross-site scripting. Strong authentication, including multi-factor authentication (MFA), is critical to prevent unauthorized access even if credentials are compromised. Patching and hardening the SSL VPN gateway against web application attacks is equally important to mitigate vulnerabilities in the underlying web server or VPN appliance.

Answer

Use IPsec in transport mode for better performance

Answer

Use pre-shared keys for authentication

Answer

Disable encryption to improve speed

Question 9

An incident responder is analyzing a network compromise that involved ICMP attacks. Which THREE types of ICMP attacks could have been used to disrupt network operations? (Select three.)

Accepted Answer

Smurf attack. The Smurf attack (A) is correct because it spoofs the victim's source IP and sends ICMP echo requests to a network's broadcast address, causing every host to reply to the victim and amplifying traffic to disrupt operations. The ICMP redirect attack (B) is correct because forged ICMP Type 5 redirect messages can alter a host's routing table, sending traffic through an attacker-controlled path and disrupting or intercepting network communications. The Ping of Death (E) is correct because it sends malformed or oversized ICMP echo request packets (historically exceeding the 65,535-byte IP packet limit) that can crash or destabilize vulnerable systems. ARP poisoning (C) is not an ICMP attack; it manipulates ARP cache entries at Layer 2. SYN flood (D) is a TCP-based attack abusing the three-way handshake, not ICMP.

Answer

ARP poisoning

Answer

SYN flood

Question 10

Which TWO features are true of IPsec tunnel mode compared to transport mode? (Select two.)

Accepted Answer

A new IP header is added to the packet. In IPsec tunnel mode, the entire original IP packet (including the original IP header) is encapsulated within a new IP packet. A new outer IP header is added, and the entire inner packet is encrypted and optionally authenticated. This is why option B is correct: a new IP header is added to the packet.

Answer

It provides better performance than transport mode

Answer

It is used for end-to-end communication between hosts

Answer

Only the payload of the packet is encrypted

Question 11

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 12

A company is implementing TLS 1.3 to secure web communications. Which of the following features is unique to TLS 1.3 compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 (RFC 8446) mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all handshakes. This ensures that session keys are never derived from long-term static keys, so compromising the server's private key does not compromise past session keys. Earlier TLS versions allowed static RSA key exchange, which lacks forward secrecy.

Answer

Support for RSA key exchange

Answer

Only server-side authentication

Answer

Use of RC4 for encryption

Question 13

A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?

Accepted Answer

authPriv with SHA and AES. SNMPv3's authPriv security level requires both authentication and encryption. SHA (or SHA-2) provides message authentication via HMAC, and AES provides symmetric encryption for the message payload. This combination satisfies the policy requirement for both confidentiality and integrity.

Answer

authPriv with MD5 and DES

Answer

noAuthNoPriv with no security

Answer

authNoPriv with SHA and no encryption

Question 14

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

Accepted Answer

L2TP. L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.

Answer

WireGuard

Answer

IPsec

Answer

PPTP

Question 15

A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?

Accepted Answer

Simultaneous Authentication of Equals (SAE). Simultaneous Authentication of Equals (SAE) is the correct choice because WPA3 Personal replaces the vulnerable Pre-Shared Key (PSK) handshake with SAE, which provides a secure key exchange resistant to offline dictionary attacks. SAE uses a Dragonfly handshake based on a zero-knowledge proof, ensuring that even if an attacker captures the handshake, they cannot brute-force the password without being present for each guess.

Answer

EAP-TLS

Answer

TKIP

Answer

Pre-shared key (PSK)