CISSP Communication and Network Security Practice Test 4 — 15 Questions

Question 1

During a penetration test, an ethical hacker sets up a rogue access point with the same SSID as the corporate network and broadcasts a stronger signal. Users inadvertently connect to the rogue AP, allowing the hacker to capture credentials. What is this attack called?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Evil twin attack. Evil twin attack. This attack involves setting up a rogue access point that broadcasts the same SSID as a legitimate corporate network but with a stronger signal, causing users to connect to it instead. Once connected, the attacker can capture credentials or other sensitive data through man-in-the-middle techniques, exploiting the lack of mutual authentication in many Wi-Fi implementations.

Answer

Deauthentication attack

Answer

ARP spoofing

Answer

Karma attack

Question 2

Which of the following is a secure protocol for transferring files that uses SSH for authentication and encryption?

Accepted Answer

SFTP. SFTP (SSH File Transfer Protocol) is the correct answer because it is a secure file transfer protocol that operates over the SSH (Secure Shell) protocol, typically on TCP port 22. It leverages SSH's strong authentication and encryption mechanisms to protect both the data in transit and the credentials, making it a secure alternative to FTP.

Answer

FTPS

Answer

SCP

Answer

TFTP

Question 3

A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?

Accepted Answer

DMZ (screened subnet). A DMZ (screened subnet) is the most appropriate architecture because it places the public-facing web server in a separate, isolated network segment that sits between the internal corporate network and the untrusted internet. Traffic from the internet is allowed only to the DMZ (typically via stateful firewall rules permitting HTTP/HTTPS on TCP ports 80/443), and traffic from the DMZ to the internal network is strictly controlled or proxied, preventing direct lateral movement. This aligns with the principle of defense in depth and is a standard CISSP-recommended design for securing publicly accessible services.

Answer

Micro-segmentation using SDN

Answer

VLAN with no firewall

Answer

Direct connection to internet without segmentation

Question 4

Which type of firewall can inspect the contents of application-layer traffic, such as HTTP requests, and block malicious payloads?

Accepted Answer

Application proxy firewall. An application proxy firewall (also known as an application-level gateway) operates at Layer 7 of the OSI model and can fully inspect the content of application-layer protocols such as HTTP, FTP, and SMTP. By terminating the client connection and establishing a separate connection to the server, it can parse and validate the payload—for example, examining HTTP request bodies for SQL injection strings or malicious scripts—and block them before they reach the internal server. This deep inspection capability distinguishes it from lower-layer firewalls that only examine headers or connection states.

Answer

Packet filter firewall

Answer

Circuit-level gateway

Answer

Stateful inspection firewall

Question 5

An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?

Accepted Answer

Authentication of DNS data origin and integrity. DNSSEC (Domain Name System Security Extensions) provides origin authentication and data integrity verification for DNS responses through digital signatures. It uses public-key cryptography to sign DNS resource record sets (RRSIG records), allowing resolvers to verify that the data has not been modified in transit and originates from the authoritative source. This prevents attacks such as DNS cache poisoning and man-in-the-middle spoofing, but does not provide confidentiality or availability protections.

Answer

Prevention of DDoS attacks on DNS servers

Answer

Anonymization of DNS queries

Answer

Encryption of DNS queries and responses

Question 6

Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?

Accepted Answer

ESP in transport mode. ESP in transport mode encrypts the payload and provides authentication (via an optional ICV), but it does not encrypt the IP header. This matches the question's requirement of payload authentication and encryption without header encryption. In contrast, AH authenticates the entire packet (including the IP header) but provides no encryption.

Answer

AH in transport mode

Answer

AH in tunnel mode

Answer

ESP in tunnel mode

Question 7

A security architect is designing a zero trust network. Which principle is fundamental to a zero trust architecture?

Accepted Answer

Never trust, always verify. Zero trust architecture (ZTA) fundamentally rejects implicit trust based on network location. The principle 'never trust, always verify' mandates continuous authentication and authorization for every access request, regardless of whether it originates from inside or outside the network perimeter. This is enforced through micro-segmentation, least-privilege access, and per-session verification, often using technologies like identity-aware proxies and software-defined perimeters (SDP).

Answer

Trust but verify

Answer

Rely on perimeter defenses

Answer

Trust internal traffic implicitly

Question 8

A network administrator is reviewing the security of the company's VPN solution. They discover that the current VPN uses PPTP. Which TWO of the following are significant security weaknesses associated with PPTP?

Accepted Answer

It uses MS-CHAPv2 authentication which is susceptible to brute-force attacks. PPTP uses Microsoft Point-to-Point Encryption (MPPE), which relies on the RC4 stream cipher. RC4 has known weaknesses, including statistical biases and the ability to recover plaintext after encrypting a large volume of traffic, making it considered weak for modern security requirements. Additionally, PPTP's default authentication protocol is MS-CHAPv2, which is vulnerable to offline brute-force attacks because its challenge-response mechanism uses a weak DES-based hash that can be cracked with tools like Asleap or ChapCrack.

Answer

It relies on IKE for key exchange

Answer

It supports strong authentication with digital certificates

Answer

It provides perfect forward secrecy

Question 9

A company is migrating from WPA2 to WPA3 to improve wireless security. Which THREE of the following are features of WPA3 compared to WPA2?

Accepted Answer

Protected Management Frames (PMF). Option B is correct because WPA3 mandates Protected Management Frames (PMF, defined in 802.11w), which cryptographically protect management frames such as deauthentication and disassociation, preventing forgery and denial-of-service attacks that were possible under WPA2. Option C is correct because WPA3 replaces the WPA2 Pre-Shared Key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks. Option D is correct because SAE provides forward secrecy, meaning a compromised session key or password cannot be used to decrypt previously captured traffic, a property WPA2-PSK lacks. Option A is not correct as stated because WPA3's backward-compatible WPA3-Personal transition mode allows WPA2 clients to connect only by operating in a mixed mode that can be downgraded, so it does not preserve full WPA3 security without reduction. Option E is not correct because WPA3 does not mandate TKIP; TKIP is a deprecated WPA cipher, and WPA3 requires CCMP-128 (and optionally GCMP-256) with AES.

Answer

Backward compatibility with WPA2 clients without security reduction

Answer

Mandatory use of TKIP for encryption

Question 10

A security analyst is evaluating secure email protocols. Which TWO of the following provide both encryption and digital signing of email messages?

Accepted Answer

S/MIME. S/MIME (Option A) is correct because it uses X.509 digital certificates to provide end-to-end message encryption and digital signing of email content, ensuring confidentiality, integrity, authentication, and non-repudiation. PGP/GPG (Option C) is also correct because it uses public/private key pairs to encrypt and digitally sign email messages, offering the same cryptographic protections for message body and attachments. SSL/TLS (Option B) only encrypts the transport channel between mail clients and servers (e.g., IMAP over TLS, SMTP over TLS) and does not itself digitally sign messages. SSH (Option D) is a secure remote-access and tunneling protocol unrelated to email message signing or encryption. IPsec (Option E) secures IP packets at the network layer for VPNs and does not provide email-level signing or encryption.

Answer

SSL/TLS

Answer

SSH

Answer

IPsec

Question 11

A security analyst notices that an attacker is sending forged ARP messages onto a local area network, linking the attacker's MAC address with the IP address of the default gateway. This allows the attacker to intercept traffic destined for the gateway. Which OSI layer is directly targeted by this attack?

Accepted Answer

Layer 2 – Data Link. ARP spoofing (or ARP poisoning) operates at Layer 2 (Data Link) because ARP messages are encapsulated directly within Ethernet frames and rely on MAC addresses, not IP routing. By forging ARP replies, the attacker corrupts the IP-to-MAC mapping in the victim's ARP cache, causing frames destined for the default gateway to be sent to the attacker's MAC address instead. This attack exploits the lack of authentication in the ARP protocol (RFC 826) and directly targets the Data Link layer's addressing and frame delivery mechanism.

Answer

Layer 4 – Transport

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Question 12

A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions based solely on static header fields such as source/destination IP addresses, port numbers, and protocol type (TCP/UDP). It does not track connection state or session context, which matches the description of examining each packet independently. This is the defining characteristic of a stateless packet filter, as opposed to stateful or application-layer firewalls.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Question 13

A security engineer is recommending a VPN protocol for remote access. The requirements are: strong encryption, perfect forward secrecy, use of elliptic curve cryptography, and minimal overhead. Which VPN protocol best meets these requirements?

Accepted Answer

WireGuard. WireGuard is the correct choice because it uses modern elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through ephemeral session keys, and has minimal overhead due to its streamlined codebase (roughly 4,000 lines of code) and lack of stateful configuration. It operates over UDP with a simple cryptographic design that meets all specified requirements without the complexity of IPsec or SSL/TLS.

Answer

L2TP/IPsec

Answer

IPsec with ESP in tunnel mode

Answer

SSL/TLS VPN

Question 14

An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?

Accepted Answer

Authenticating the origin and ensuring integrity of DNS responses. DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity for DNS responses using digital signatures based on public-key cryptography. It does not encrypt DNS data or provide anonymity; instead, it allows a resolver to verify that a DNS response has not been modified in transit and that it originates from the authoritative source. This directly counters DNS spoofing attacks by ensuring the response is authentic and untampered.

Answer

Providing anonymous DNS resolution

Answer

Encrypting DNS queries to prevent eavesdropping

Answer

Blocking malicious DNS queries at the resolver

Question 15

During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?

Accepted Answer

PPTP. MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.

Answer

IPsec with IKEv2

Answer

SSL/TLS VPN

Answer

L2TP/IPsec