CISSP Communication and Network Security — Timed 10 Questions

Question 1

An organization is deploying a wireless network with WPA3-Enterprise. Which THREE of the following are features or improvements of WPA3 compared to WPA2? (Select THREE.)

Accepted Answer

Protected Management Frames (PMF). Option A (Protected Management Frames, PMF) is correct because WPA3 mandates PMF (802.11w) to protect management frames such as deauthentication and disassociation from spoofing and forgery attacks, whereas PMF was optional in WPA2. Option B (Forward secrecy) is correct because WPA3-Enterprise requires the use of 192-bit cryptographic suites and SAE/ECDHE-based key exchange, ensuring that a compromised session key cannot be used to derive past or future session keys. Option D (Simultaneous Authentication of Equals, SAE) is correct because SAE is the WPA3-Personal replacement for WPA2's PSK handshake, providing a dragonfly handshake resistant to offline dictionary attacks and enabling forward secrecy. Option C (TKIP) is incorrect because TKIP is a deprecated WPA/WPA2 cipher and WPA3 requires CCMP-128 or GCMP-256, not TKIP. Option E (WEP compatibility) is incorrect because WEP is an obsolete, insecure protocol that WPA3 does not support in any form.

Answer

Use of TKIP for encryption

Answer

Support for WEP compatibility

Question 2

Which of the following is a key feature of TLS 1.3 that enhances security compared to earlier versions?

Accepted Answer

Mandatory forward secrecy via ephemeral Diffie-Hellman. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (DHE or ECDHE) key exchange for all sessions. This ensures that even if a server's long-term private key is compromised, past session keys cannot be derived, protecting historical communications. In contrast, earlier TLS versions allowed static RSA key exchange, which does not provide forward secrecy.

Answer

Backward compatibility with SSL 3.0

Answer

Use of RSA key exchange for authentication

Answer

Support for RC4 stream cipher

Question 3

An organization is reviewing its use of SSH for remote administration. Which TWO features of SSH should be disabled or carefully managed to reduce security risks? (Select two.)

Accepted Answer

Port forwarding. Port forwarding (Option A) is correct because SSH tunneling can bypass firewall and network segmentation controls, allowing users to pivot into protected networks or exfiltrate data, so it should be disabled or tightly restricted via the AllowTcpForwarding directive. X11 forwarding (Option C) is correct because it can expose the local X server to remote hosts, enabling keystroke sniffing, screen capture, or unauthorized access to the client's display, so it should be disabled with X11Forwarding no unless explicitly required. SSH protocol version 1 (Option B) is not among the marked correct answers here, though it is indeed insecure and deprecated. Public-key authentication (Option D) is a recommended, strong authentication method and should not be disabled. SSH protocol version 2 (Option E) is the current secure protocol version and should be used, not disabled.

Answer

Using SSH protocol version 1

Answer

Public-key authentication

Answer

Using SSH protocol version 2

Question 4

A company is migrating from WPA2 to WPA3 to enhance wireless security. Which of the following cryptographic changes does WPA3 introduce compared to WPA2?

Answer

WPA3 replaces PSK with SAE and uses GCMP-256 encryption.

Answer

WPA3 uses TKIP for backward compatibility.

Answer

WPA3 uses AES-CCMP as the mandatory encryption method.

Answer

WPA3 eliminates the need for 802.1X authentication.

Question 5

A security architect is designing a network for a healthcare organization that must comply with HIPAA. The network will use a Demilitarized Zone (DMZ) to host public-facing web servers. The architect must ensure that if a web server in the DMZ is compromised, the attacker cannot directly access the internal database servers. Which TWO of the following controls are MOST effective to achieve this? (Choose two.)

Accepted Answer

Deploy an intrusion prevention system (IPS) between the DMZ and the internal network to detect and block attacks from the DMZ to the internal network.. The most effective controls to prevent a compromised DMZ web server from accessing internal databases are a firewall with strict rules and an IPS. The firewall enforces least privilege by allowing only necessary traffic, while the IPS adds detection and prevention of attacks. Together, they provide defense in depth. Other options either increase risk, break functionality, or do not directly address the threat.

Answer

Segment the network using VLANs, placing web servers and database servers in separate VLANs with no inter-VLAN routing.

Answer

Place the database servers in the same DMZ as the web servers but use host-based firewalls on the database servers.

Answer

Use a reverse proxy in the DMZ to handle all client requests, and configure the web servers to only accept connections from the reverse proxy.

Question 6

A security analyst observes a network attack where an attacker sends forged ARP messages to associate the attacker's MAC address with the IP address of the default gateway. This attack occurs at which layer of the OSI model?

Accepted Answer

Layer 2 – Data Link. ARP operates at Layer 2 (Data Link) because it maps IP addresses (Layer 3) to MAC addresses (Layer 2) and is encapsulated directly within an Ethernet frame, not an IP packet. The attack described—ARP spoofing—forges ARP replies to poison the target's ARP cache, which is a Layer 2 function. Therefore, the attack occurs at Layer 2 of the OSI model.

Answer

Layer 3 – Network

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 7

An organization is deploying a VPN solution for remote employees. The security team requires a modern protocol with perfect forward secrecy, uses elliptic curve cryptography, and is known for its efficient, minimal codebase. Which VPN protocol should they choose?

Accepted Answer

WireGuard. WireGuard is the correct choice because it is a modern VPN protocol that uses elliptic curve cryptography (Curve25519) for key exchange, provides perfect forward secrecy by default through its ephemeral session keys, and is designed with a minimal, auditable codebase (around 4,000 lines) for efficiency and security. These features directly match the organization's requirements for a modern protocol with PFS, ECC, and a lean implementation.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec with IKEv2

Question 8

A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?

Accepted Answer

Packet filter firewall. A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.

Answer

Stateful inspection firewall

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 9

During a security assessment, a penetration tester sends TCP SYN packets to various ports on a target server. Based on the responses, the tester determines which ports are open. This technique is commonly used at which OSI layer?

Accepted Answer

Layer 4 – Transport. The TCP SYN scan operates at Layer 4 (Transport) of the OSI model because it manipulates TCP segment headers, specifically the SYN flag, to probe port states. The tester sends SYN packets and interprets the response (SYN-ACK for open, RST for closed) to infer port availability, which is a transport-layer function defined by RFC 793.

Answer

Layer 7 – Application

Answer

Layer 3 – Network

Answer

Layer 2 – Data Link

Question 10

An organization wants to secure email communications by providing encryption and digital signatures. They require a solution that uses a web of trust model rather than a hierarchical PKI. Which protocol should they implement?

Accepted Answer

PGP/GPG. PGP/GPG implements a web of trust model where users sign each other's keys to establish trust, rather than relying on a centralized Certificate Authority (CA). It provides both encryption and digital signatures for email, making it the correct choice for an organization that explicitly wants to avoid hierarchical PKI.

Answer

S/MIME

Answer

TLS

Answer

SSH