CISSP Communication and Network Security Practice Test 3 — 15 Questions

Question 1

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

Accepted Answer

Stateless nature of ARP with no authentication. ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.

Answer

Lack of encryption in ARP packets

Answer

Weakness in the IP address resolution algorithm

Answer

Use of broadcast frames for all requests

Question 2

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP

Question 3

In IPsec, which protocol provides both authentication and encryption for the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both authentication and encryption for the packet payload, while leaving the IP header unencrypted. This allows intermediate routers to process the packet normally, as the header remains in plaintext, but the payload is protected for confidentiality and integrity.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP (Internet Security Association and Key Management Protocol)

Answer

AH (Authentication Header)

Question 4

A security architect is designing a network segmentation strategy for a financial institution. Which TWO techniques are best suited for implementing micro-segmentation in a data center environment? (Select two.)

Accepted Answer

Software-Defined Networking (SDN). Software-Defined Networking (SDN) decouples the control plane from the data plane, enabling centralized, programmable network policies. This allows granular, dynamic micro-segmentation at the virtual network level, where traffic flows can be isolated based on application identity or workload attributes, not just IP addresses or VLANs.

Answer

VLANs (Virtual Local Area Networks)

Answer

Physical network firewalls

Answer

DMZ (screened subnet)

Question 5

An organization is reviewing its use of SSH for remote administration. Which TWO features of SSH should be disabled or carefully managed to reduce security risks? (Select two.)

Accepted Answer

Port forwarding. Port forwarding (option A) allows SSH to tunnel arbitrary TCP connections, which can bypass network firewalls and expose internal services to external attackers if misconfigured or left enabled for non-administrative users. Disabling or restricting port forwarding reduces the risk of unauthorized tunneling and lateral movement within the network.

Answer

Using SSH protocol version 1

Answer

Public-key authentication

Answer

Using SSH protocol version 2

Question 6

A company is deploying a VPN solution for remote employees using SSL/TLS VPN. Which TWO security considerations are important when implementing this type of VPN? (Select two.)

Accepted Answer

Implement strong authentication mechanisms such as multi-factor authentication. SSL/TLS VPNs operate at the application layer and are exposed to the internet, making them vulnerable to web-based attacks such as SQL injection and cross-site scripting. Strong authentication, including multi-factor authentication (MFA), is critical to prevent unauthorized access even if credentials are compromised. Patching and hardening the SSL VPN gateway against web application attacks is equally important to mitigate vulnerabilities in the underlying web server or VPN appliance.

Answer

Use IPsec in transport mode for better performance

Answer

Use pre-shared keys for authentication

Answer

Disable encryption to improve speed

Question 7

An incident responder is analyzing a network compromise that involved ICMP attacks. Which THREE types of ICMP attacks could have been used to disrupt network operations? (Select three.)

Accepted Answer

Smurf attack. A Smurf attack is correct because it exploits ICMP echo requests (ping) sent to a network's broadcast address with a spoofed source IP of the victim. This causes all hosts on the network to reply to the victim, overwhelming it with ICMP echo replies and disrupting network operations.

Answer

ARP poisoning

Answer

SYN flood

Question 8

Which TWO features are true of IPsec tunnel mode compared to transport mode? (Select two.)

Accepted Answer

A new IP header is added to the packet. In IPsec tunnel mode, the entire original IP packet (including the original IP header) is encapsulated within a new IP packet. A new outer IP header is added, and the entire inner packet is encrypted and optionally authenticated. This is why option B is correct: a new IP header is added to the packet.

Answer

It provides better performance than transport mode

Answer

It is used for end-to-end communication between hosts

Answer

Only the payload of the packet is encrypted

Question 9

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 10

A company is implementing TLS 1.3 to secure web communications. Which of the following features is unique to TLS 1.3 compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 (RFC 8446) mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all handshakes. This ensures that session keys are never derived from long-term static keys, so compromising the server's private key does not compromise past session keys. Earlier TLS versions allowed static RSA key exchange, which lacks forward secrecy.

Answer

Support for RSA key exchange

Answer

Only server-side authentication

Answer

Use of RC4 for encryption

Question 11

A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?

Accepted Answer

authPriv with SHA and AES. Option D is correct because SNMPv3's authPriv security level requires both authentication and encryption. SHA (or SHA-2) provides message authentication via HMAC, and AES provides symmetric encryption for the message payload. This combination satisfies the policy requirement for both confidentiality and integrity.

Answer

authPriv with MD5 and DES

Answer

noAuthNoPriv with no security

Answer

authNoPriv with SHA and no encryption

Question 12

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

Accepted Answer

L2TP. L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.

Answer

WireGuard

Answer

IPsec

Answer

PPTP

Question 13

A network administrator is deploying a wireless network for a small business and wants to ensure strong security. Which of the following is the best choice for authentication in a WPA3 Personal network?

Accepted Answer

Simultaneous Authentication of Equals (SAE). Simultaneous Authentication of Equals (SAE) is the correct choice because WPA3 Personal replaces the vulnerable Pre-Shared Key (PSK) handshake with SAE, which provides a secure key exchange resistant to offline dictionary attacks. SAE uses a Dragonfly handshake based on a zero-knowledge proof, ensuring that even if an attacker captures the handshake, they cannot brute-force the password without being present for each guess.

Answer

EAP-TLS

Answer

TKIP

Answer

Pre-shared key (PSK)

Question 14

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Accepted Answer

Evil twin attack. The correct answer is C, Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack

Question 15

Which of the following is a secure protocol for transferring files that uses SSH for authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct answer because it is a secure file transfer protocol that operates over the SSH (Secure Shell) protocol, typically on TCP port 22. It leverages SSH's strong authentication and encryption mechanisms to protect both the data in transit and the credentials, making it a secure alternative to FTP.

Answer

FTPS

Answer

SCP

Answer

TFTP