CISSP Communication and Network Security Practice Test 3 — 15 Questions

Question 1

During a penetration test, the tester successfully performs a VLAN hopping attack by sending packets with a specific tag. Which mitigation technique is most effective at preventing double-tagging VLAN hopping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the native VLAN and explicitly tag all VLANs. Double-tagging VLAN hopping exploits the native VLAN (typically VLAN 1) on a trunk link. By disabling the native VLAN and explicitly tagging all VLANs, including the native VLAN, the switch will not forward untagged frames or frames with a single 802.1Q tag that can be misinterpreted by the next switch, thus preventing the attacker from injecting frames into a different VLAN.

Answer

Use VLAN access control lists (VACLs) only

Answer

Implement port security with sticky MAC

Answer

Enable Dynamic Trunking Protocol (DTP) on all ports

Question 2

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy via ephemeral Diffie-Hellman. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions. This ensures that even if a server's long-term private key is compromised, past session keys cannot be derived, protecting historical communications. In contrast, earlier TLS versions allowed static RSA key exchange, which does not provide forward secrecy.

Answer

Backward compatibility with SSL 3.0

Answer

Use of RSA key exchange for authentication

Answer

Support for RC4 stream cipher

Question 3

A security team is implementing a zero trust architecture. Which component is essential to enforce access decisions based on user identity, device posture, and context before granting access to resources?

Accepted Answer

Software-defined perimeter (SDP). A software-defined perimeter (SDP) is the essential component for enforcing access decisions based on user identity, device posture, and context in a zero trust architecture. SDP creates a dynamic, encrypted micro-perimeter around each resource, requiring authentication and authorization before any connection is established, effectively hiding the resource from unauthorized users. This aligns with the zero trust principle of 'never trust, always verify' by evaluating identity, device health, and contextual factors (e.g., location, time) before granting access.

Answer

Virtual private network (VPN)

Answer

Network Access Control (NAC)

Answer

Next-generation firewall (NGFW)

Question 4

A network administrator is configuring DNSSEC to protect against DNS spoofing. Which record type is used to provide cryptographic verification of DNS data origins?

Accepted Answer

RRSIG. RRSIG (Resource Record Signature) is the DNSSEC record type that contains the cryptographic signature for a DNS record set. It provides data origin authentication and integrity verification by allowing resolvers to validate that the DNS data came from the authoritative source and was not modified in transit.

Answer

DS

Answer

DNSKEY

Answer

NSEC

Question 5

An organization is migrating from WPA2 to WPA3 for its wireless network. Which improvement does WPA3 provide over WPA2?

Accepted Answer

Simultaneous Authentication of Equals (SAE) providing forward secrecy. WPA3 replaces WPA2's Pre-Shared Key (PSK) handshake with Simultaneous Authentication of Equals (SAE), defined in IEEE 802.11-2016 and RFC 7664. SAE uses a Dragonfly key exchange based on discrete logarithm cryptography, which provides forward secrecy: even if an attacker captures the handshake and later obtains the pre-shared key, they cannot decrypt past session traffic. This eliminates the vulnerability to offline dictionary attacks that plagued WPA2-PSK.

Answer

Use of TKIP for backward compatibility

Answer

Mandatory use of WPS for easy setup

Answer

Support for 802.1X only, no personal mode

Question 6

Which type of firewall operates at Layer 7 and can inspect application payloads, such as blocking specific SQL commands or HTTP methods?

Accepted Answer

Application proxy. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 (Application Layer) of the OSI model. It can inspect the full application payload, allowing it to block specific SQL commands, HTTP methods (e.g., PUT, DELETE), or other application-layer content by terminating the connection and re-establishing it after deep inspection.

Answer

Stateful inspection

Answer

Packet filter

Answer

Circuit-level gateway

Question 7

During a security assessment, a penetration tester successfully performs an ARP spoofing attack, redirecting traffic through their machine. This attack exploits which protocol vulnerability?

Accepted Answer

Stateless nature of ARP with no authentication. ARP spoofing succeeds because ARP is a stateless protocol that does not authenticate or verify the legitimacy of ARP replies. Any host on a local network can send an unsolicited ARP reply (gratuitous ARP) to associate any IP address with any MAC address, allowing an attacker to redirect traffic without any validation mechanism.

Answer

Lack of encryption in ARP packets

Answer

Weakness in the IP address resolution algorithm

Answer

Use of broadcast frames for all requests

Question 8

A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.

Answer

FTPS

Answer

TFTP

Answer

SCP

Question 9

In IPsec, which protocol provides both authentication and encryption for the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) provides both authentication and encryption for the packet payload, while leaving the IP header unencrypted. This allows intermediate routers to process the packet normally, as the header remains in plaintext, but the payload is protected for confidentiality and integrity.

Answer

IKE (Internet Key Exchange)

Answer

ISAKMP (Internet Security Association and Key Management Protocol)

Answer

AH (Authentication Header)

Question 10

A company is deploying a VPN solution for remote employees using SSL/TLS VPN. Which TWO security considerations are important when implementing this type of VPN? (Select two.)

Accepted Answer

Implement strong authentication mechanisms such as multi-factor authentication. SSL/TLS VPNs operate at the application layer and are exposed to the internet, making them vulnerable to web-based attacks such as SQL injection and cross-site scripting. Strong authentication, including multi-factor authentication (MFA), is critical to prevent unauthorized access even if credentials are compromised. Patching and hardening the SSL VPN gateway against web application attacks is equally important to mitigate vulnerabilities in the underlying web server or VPN appliance.

Answer

Use IPsec in transport mode for better performance

Answer

Use pre-shared keys for authentication

Answer

Disable encryption to improve speed

Question 11

Which TWO features are true of IPsec tunnel mode compared to transport mode? (Select two.)

Accepted Answer

A new IP header is added to the packet. In IPsec tunnel mode, the entire original IP packet (including the original IP header) is encapsulated within a new IP packet. A new outer IP header is added, and the entire inner packet is encrypted and optionally authenticated. This is why option B is correct: a new IP header is added to the packet.

Answer

It provides better performance than transport mode

Answer

It is used for end-to-end communication between hosts

Answer

Only the payload of the packet is encrypted

Question 12

A security analyst detects an attack where the attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. Which OSI layer is primarily targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) within a single broadcast domain. By forging ARP replies, the attacker poisons the ARP cache of hosts, causing frames destined for the default gateway to be sent to the attacker's MAC address. This directly targets the address resolution process that bridges Layer 2 and Layer 3, but the attack itself is executed at the Data Link layer.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 13

A company is implementing TLS 1.3 to secure web communications. Which of the following features is unique to TLS 1.3 compared to earlier versions?

Accepted Answer

Mandatory forward secrecy using ephemeral Diffie-Hellman. TLS 1.3 (RFC 8446) mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all handshakes. This ensures that session keys are never derived from long-term static keys, so compromising the server's private key does not compromise past session keys. Earlier TLS versions allowed static RSA key exchange, which lacks forward secrecy.

Answer

Support for RSA key exchange

Answer

Only server-side authentication

Answer

Use of RC4 for encryption

Question 14

A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?

Accepted Answer

authPriv with SHA and AES. SNMPv3's authPriv security level requires both authentication and encryption. SHA (or SHA-2) provides message authentication via HMAC, and AES provides symmetric encryption for the message payload. This combination satisfies the policy requirement for both confidentiality and integrity.

Answer

authPriv with MD5 and DES

Answer

noAuthNoPriv with no security

Answer

authNoPriv with SHA and no encryption

Question 15

Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?

Accepted Answer

L2TP. L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.

Answer

WireGuard

Answer

IPsec

Answer

PPTP