CISSP Communication and Network Security Practice Test 4 — 15 Questions

Question 1

A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?

Accepted Answer

DMZ (screened subnet). A DMZ (screened subnet) is the most appropriate architecture because it places the public-facing web server in a separate, isolated network segment that sits between the internal corporate network and the untrusted internet. Traffic from the internet is allowed only to the DMZ (typically via stateful firewall rules permitting HTTP/HTTPS on TCP ports 80/443), and traffic from the DMZ to the internal network is strictly controlled or proxied, preventing direct lateral movement. This aligns with the principle of defense in depth and is a standard CISSP-recommended design for securing publicly accessible services.

Answer

Micro-segmentation using SDN

Answer

VLAN with no firewall

Answer

Direct connection to internet without segmentation

Question 2

Which type of firewall can inspect the contents of application-layer traffic, such as HTTP requests, and block malicious payloads?

Accepted Answer

Application proxy firewall. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 of the OSI model and can fully inspect the content of application-layer protocols such as HTTP, FTP, and SMTP. By terminating the client connection and establishing a separate connection to the server, it can parse and validate the payload—for example, examining HTTP request bodies for SQL injection strings or malicious scripts—and block them before they reach the internal server. This deep inspection capability distinguishes it from lower-layer firewalls that only examine headers or connection states.

Answer

Packet filter firewall

Answer

Circuit-level gateway

Answer

Stateful inspection firewall

Question 3

An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?

Accepted Answer

Authentication of DNS data origin and integrity. DNSSEC (Domain Name System Security Extensions) provides origin authentication and data integrity verification for DNS responses through digital signatures. It uses public-key cryptography to sign DNS resource record sets (RRSIG records), allowing resolvers to verify that the data has not been modified in transit and originates from the authoritative source. This prevents attacks such as DNS cache poisoning and man-in-the-middle spoofing, but does not provide confidentiality or availability protections.

Answer

Prevention of DDoS attacks on DNS servers

Answer

Anonymization of DNS queries

Answer

Encryption of DNS queries and responses

Question 4

Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP in transport mode. ESP in transport mode encrypts the payload and provides authentication (via an optional ICV), but it does not encrypt the IP header. This matches the question's requirement of payload authentication and encryption without header encryption. In contrast, AH authenticates the entire packet (including the IP header) but provides no encryption.

Answer

AH in transport mode

Answer

AH in tunnel mode

Answer

ESP in tunnel mode

Question 5

A security architect is designing a zero trust network. Which principle is fundamental to a zero trust architecture?

Accepted Answer

Never trust, always verify. Zero trust architecture (ZTA) fundamentally rejects implicit trust based on network location. The principle 'never trust, always verify' mandates continuous authentication and authorization for every access request, regardless of whether it originates from inside or outside the network perimeter. This is enforced through micro-segmentation, least-privilege access, and per-session verification, often using technologies like identity-aware proxies and software-defined perimeters (SDP).

Answer

Trust but verify

Answer

Rely on perimeter defenses

Answer

Trust internal traffic implicitly

Question 6

A network administrator is reviewing the security of the company's VPN solution. They discover that the current VPN uses PPTP. Which TWO of the following are significant security weaknesses associated with PPTP?

Accepted Answer

It uses MS-CHAPv2 authentication which is susceptible to brute-force attacks. PPTP uses Microsoft Point-to-Point Encryption (MPPE), which relies on the RC4 stream cipher. RC4 has known weaknesses, including statistical biases and the ability to recover plaintext after encrypting a large volume of traffic, making it considered weak for modern security requirements. Additionally, PPTP's default authentication protocol is MS-CHAPv2, which is vulnerable to offline brute-force attacks because its challenge-response mechanism uses a weak DES-based hash that can be cracked with tools like Asleap or ChapCrack.

Answer

It relies on IKE for key exchange

Answer

It supports strong authentication with digital certificates

Answer

It provides perfect forward secrecy

Question 7

A company is migrating from WPA2 to WPA3 to improve wireless security. Which THREE of the following are features of WPA3 compared to WPA2?

Accepted Answer

Protected Management Frames (PMF). Protected Management Frames (PMF) are mandatory in WPA3, whereas in WPA2 they were optional. PMF provides integrity and replay protection for management frames, preventing attacks such as deauthentication and disassociation that can be used to disrupt wireless connections.

Answer

Backward compatibility with WPA2 clients without security reduction

Answer

Mandatory use of TKIP for encryption

Question 8

A security analyst is evaluating secure email protocols. Which TWO of the following provide both encryption and digital signing of email messages?

Accepted Answer

S/MIME. S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and digital signing of MIME data. It uses X.509 certificates for key exchange and provides both confidentiality (encryption) and non-repudiation (digital signing) for email messages, making it a correct choice.

Answer

SSL/TLS

Answer

SSH

Answer

IPsec

Question 9

A security analyst notices that an attacker is sending forged ARP messages onto a local area network, linking the attacker's MAC address with the IP address of the default gateway. This allows the attacker to intercept traffic destined for the gateway. Which OSI layer is directly targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP spoofing (or ARP poisoning) operates at Layer 2 (Data Link) because ARP messages are encapsulated directly within Ethernet frames and rely on MAC addresses, not IP routing. By forging ARP replies, the attacker corrupts the IP-to-MAC mapping in the victim's ARP cache, causing frames destined for the default gateway to be sent to the attacker's MAC address instead. This attack exploits the lack of authentication in the ARP protocol (RFC 826) and directly targets the Data Link layer's addressing and frame delivery mechanism.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 10

A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions based solely on static header fields such as source/destination IP addresses, port numbers, and protocol type (TCP/UDP). It does not track connection state or session context, which matches the description of examining each packet independently. This is the defining characteristic of a stateless packet filter, as opposed to stateful or application-layer firewalls.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Question 11

A company is migrating from WPA2 to WPA3 to enhance wireless security. Which of the following cryptographic changes does WPA3 introduce compared to WPA2?

Accepted Answer

WPA3 replaces PSK with SAE and uses GCMP-256 encryption.. WPA3 introduces the Simultaneous Authentication of Equals (SAE) handshake, defined in IEEE 802.11-2016, to replace the Pre-Shared Key (PSK) method used in WPA2, providing forward secrecy and resistance to offline dictionary attacks. Additionally, WPA3 mandates the use of GCMP-256 (Galois/Counter Mode Protocol with a 256-bit key) for encryption, which is stronger than the AES-CCMP (128-bit) used in WPA2.

Answer

WPA3 uses TKIP for backward compatibility.

Answer

WPA3 uses AES-CCMP as the mandatory encryption method.

Answer

WPA3 eliminates the need for 802.1X authentication.

Question 12

A security engineer is recommending a VPN protocol for remote access. The requirements are: strong encryption, perfect forward secrecy, use of elliptic curve cryptography, and minimal overhead. Which VPN protocol best meets these requirements?

Accepted Answer

WireGuard. WireGuard is the correct choice because it uses modern elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through ephemeral session keys, and has minimal overhead due to its streamlined codebase (roughly 4,000 lines of code) and lack of stateful configuration. It operates over UDP with a simple cryptographic design that meets all specified requirements without the complexity of IPsec or SSL/TLS.

Answer

L2TP/IPsec

Answer

IPsec with ESP in tunnel mode

Answer

SSL/TLS VPN

Question 13

An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?

Accepted Answer

Authenticating the origin and ensuring integrity of DNS responses. DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity for DNS responses using digital signatures based on public-key cryptography. It does not encrypt DNS data or provide anonymity; instead, it allows a resolver to verify that a DNS response has not been modified in transit and that it originates from the authoritative source. This directly counters DNS spoofing attacks by ensuring the response is authentic and untampered.

Answer

Providing anonymous DNS resolution

Answer

Encrypting DNS queries to prevent eavesdropping

Answer

Blocking malicious DNS queries at the resolver

Question 14

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

Accepted Answer

PPTP. MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.

Answer

IPsec with IKEv2

Answer

SSL/TLS VPN

Answer

L2TP/IPsec

Question 15

A security analyst is configuring a firewall to allow HTTP traffic (TCP port 80) from the internet to a web server in the DMZ. The firewall should also allow return traffic from the server back to the internet. Which type of firewall is best suited to handle this traffic while maintaining security?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall (C) is best suited because it tracks the state of active connections, allowing return traffic for established sessions (e.g., HTTP responses from the server to the internet) while blocking unsolicited inbound packets. It inspects packets at Layers 3 and 4, maintaining a state table that matches return packets to the original outbound request, ensuring only legitimate responses are permitted. This provides better security than a simple packet filter by preventing spoofed or out-of-context packets.

Answer

Application proxy firewall

Answer

Circuit-level gateway

Answer

Packet filter firewall