CISSP Communication and Network Security — 30 Questions

Question 1

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. Option D is correct because the symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 2

A network architect is designing a secure connection between two data centers across an untrusted WAN. The requirement is to encrypt all traffic and authenticate both endpoints. Which protocol should be used?

Accepted Answer

IPsec tunnel mode. IPsec tunnel mode is the correct choice because it encrypts the entire IP packet, including the original IP header, and encapsulates it within a new IP header for secure transport across an untrusted WAN. It also provides mutual authentication of both endpoints using IKE (Internet Key Exchange) with pre-shared keys or certificates, satisfying the requirement for encrypting all traffic and authenticating both data centers.

Answer

SSH

Answer

MPLS

Answer

SSL/TLS

Question 3

A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?

Accepted Answer

The payroll server's default gateway does not have a route back to 10.10.20.0/24.. The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.

Answer

DNS is not resolving the payroll server's IP address.

Answer

The firewall rule is applied to the outbound interface only.

Answer

The accounting subnet is blocked by an implicit deny rule.

Question 4

A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?

Accepted Answer

The RADIUS server's certificate is not trusted by the new laptop.. In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.

Answer

The wireless network uses WPA2-PSK instead of WPA2-Enterprise.

Answer

The client certificate is not correctly associated with the user account.

Answer

The laptop does not support MSCHAPv2.

Question 5

A network engineer is configuring a firewall to allow HTTP traffic from the internet to a web server (10.0.0.10). The firewall has three interfaces: outside (ISP), DMZ (10.0.0.0/24), and inside (192.168.1.0/24). The web server is in the DMZ. Which rule is correct?

Accepted Answer

Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow. Option B is correct because HTTP traffic from the internet arrives on the outside interface, and the firewall rule must match the source interface (Outside), allow any source IP, and specify the destination IP (10.0.0.10) and port 80. This permits inbound web traffic to the DMZ web server while maintaining security boundaries.

Answer

Rule: Source interface Inside, Source any, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface Outside, Source 192.168.1.0/24, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface DMZ, Source any, Destination 10.0.0.10, Port 80, Action allow

Question 6

An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?

Accepted Answer

IPsec with IKEv2 and AES-256. IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.

Answer

MPLS Layer 3 VPN

Answer

L2TP without encryption

Answer

PPTP

Question 7

A security analyst is reviewing network logs and sees repeated failed connection attempts from an external IP to the company's SSH server (port 22). The firewall has a rule allowing SSH from anywhere. What is the best immediate action to reduce risk?

Accepted Answer

Change the SSH port to a high-numbered port and restrict source IPs if possible.. Option C is correct because changing the SSH port to a non-standard, high-numbered port reduces automated scanning and brute-force attacks by evading default port 22 scans, while restricting source IPs adds a layer of access control. This balances security with operational continuity, as SSH remains available for legitimate administrative use. The immediate risk reduction comes from making the service less discoverable and limiting the attack surface without fully disabling remote access.

Answer

Remove the firewall rule allowing SSH.

Answer

Disable SSH access entirely.

Answer

Block the offending IP address in the firewall.

Question 8

Which TWO security controls are most effective in preventing VLAN hopping attacks?

Accepted Answer

Set the native VLAN to an unused VLAN ID.. Setting the native VLAN to an unused VLAN ID prevents VLAN hopping via double-tagging attacks. In a double-tagging attack, an attacker sends frames with two 802.1Q tags; the first switch strips the outer tag, forwarding the frame on the native VLAN (which is typically VLAN 1). By changing the native VLAN to an unused ID, any double-tagged frame arriving on an access port will have its outer tag removed and be forwarded onto that unused VLAN, where no legitimate hosts exist, thus breaking the attack path.

Answer

Use VLAN access control lists (VACLs) to filter traffic between VLANs.

Answer

Implement DHCP snooping on all VLANs.

Answer

Enable Spanning Tree Protocol (STP) on all switches.

Question 9

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast.. Disabling SSID broadcast prevents the access point from including the network name in beacon frames. While this does not hide the network from determined attackers using packet analyzers, it reduces casual discovery and is considered a basic security hardening step in defense-in-depth.

Answer

Enable WPS (Wi-Fi Protected Setup).

Answer

Use WEP encryption.

Question 10

Which TWO of the following are valid reasons to implement network segmentation?

Accepted Answer

To isolate sensitive data and systems from the rest of the network.. Network segmentation isolates sensitive data and systems by creating separate broadcast domains or VLANs, restricting unauthorized access and lateral movement. This is a core security principle for protecting critical assets, as it limits the attack surface and enforces access controls between segments.

Answer

To eliminate single points of failure.

Answer

To reduce network latency.

Answer

To simplify routing tables.

Question 11

Refer to the exhibit. The ACL is applied inbound on the DMZ interface. What is the effect of this configuration?

Accepted Answer

The ACL allows HTTP requests to the web server and allows the web server to respond, but blocks it from initiating new connections to the inside.. The ACL is applied inbound on the DMZ interface, meaning it filters traffic entering the DMZ from the outside. The specific permit statement allows HTTP (TCP port 80) traffic from any source to the web server's IP address. Because the ACL is inbound, it only controls traffic arriving at the DMZ interface; return traffic from the web server to the inside is not subject to this ACL (it is evaluated by the outbound ACL on the inside interface or by stateful inspection). Thus, the web server can respond to HTTP requests (which are part of the same session), but it cannot initiate new connections to the inside because those would be outbound from the DMZ and not permitted by the inbound ACL on the DMZ interface.

Answer

The ACL permits all HTTP traffic to the web server and blocks all other traffic.

Answer

The ACL permits the web server to respond to HTTP requests but blocks all other outbound traffic.

Answer

The ACL allows the web server to initiate connections to the internal network.

Question 12

Refer to the exhibit. The VPN tunnel is not coming up. What is the most likely configuration error?

Accepted Answer

The crypto map is applied to the Tunnel interface instead of the physical interface.. The crypto map must be applied to the physical interface (e.g., GigabitEthernet0/0) that connects to the VPN peer, not to the Tunnel interface. The Tunnel interface is a logical construct used for overlay routing (e.g., GRE or IPsec VTI), but the crypto map defines the IPsec security associations on the actual egress interface. Applying it to the Tunnel interface prevents the IPsec process from matching outbound traffic to the correct physical path, so the tunnel never establishes.

Answer

The encryption algorithm AES 256 is not supported.

Answer

The hash algorithm SHA256 is not supported.

Answer

The Diffie-Hellman group 14 is not strong enough.

Question 13

You are the security architect for a global financial firm. The organization has recently deployed a new cloud-based application that requires low-latency connections between data centers in New York, London, and Tokyo. The existing WAN uses MPLS L3 VPNs with IPsec encryption. However, the application team reports excessive latency and packet loss during peak hours. The network team confirms that the MPLS links are underutilized, but the IPsec tunnels show high CPU usage on the edge routers. Additionally, the security policy mandates that all inter-data center traffic must be encrypted and authenticated. The firm has a budget for hardware upgrades but wants to minimize operational changes. Which of the following is the BEST course of action?

Accepted Answer

Upgrade the edge routers to models that support hardware-accelerated IPsec encryption.. Option D is correct because the high CPU usage on edge routers is a classic symptom of software-based IPsec encryption overwhelming the router's CPU. Hardware-accelerated IPsec offloads the cryptographic operations to dedicated ASICs or crypto engines, reducing CPU load and eliminating the latency and packet loss caused by processing bottlenecks. This directly addresses the root cause without changing the security policy or requiring major operational changes.

Answer

Reduce the IPsec encryption algorithm to AES-128 and the hash to SHA-1 to lower CPU usage.

Answer

Replace MPLS with dedicated point-to-point circuits and remove IPsec encryption.

Answer

Increase the MTU on the WAN interfaces to reduce packet fragmentation.

Question 14

Drag and drop the steps for a secure software development lifecycle (SDLC) in the correct order.

Question 15

Match each threat type to its description.

Question 16

A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?

Accepted Answer

No routing is configured between the HR and IT VLANs.. VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.

Answer

Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.

Answer

The HR workstation has an incorrect subnet mask.

Answer

The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.

Question 17

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 18

A company is deploying a wireless network for guests. The security requirement is to provide internet access only, with no access to the internal corporate network. Which technology should be used?

Accepted Answer

A separate guest VLAN with ACLs restricting access to internal networks. A separate guest VLAN with ACLs restricting access to internal networks is the correct choice because it provides network segmentation at Layer 2 (VLAN) and Layer 3/4 (ACLs), ensuring guest traffic is isolated from the corporate network while allowing internet access. This approach aligns with the principle of least privilege and is a standard best practice for guest wireless deployments, as it does not rely on authentication or encryption alone to enforce access control.

Answer

WPA3-SAE

Answer

MAC address filtering

Answer

WPA2-Enterprise with 802.1X

Question 19

An organization is implementing IPsec VPN tunnels between multiple branch offices and the main office. The security team notices that the VPN tunnels are established successfully but no traffic passes through. Which of the following is the most likely cause?

Accepted Answer

Incorrect routing entries in the VPN routing table. When IPsec VPN tunnels are established (IKE Phase 1 and Phase 2 complete) but no traffic passes, the most common cause is incorrect routing entries in the VPN routing table. The tunnel may be up, but if the branch office does not have a route pointing the destination subnet to the tunnel interface (e.g., a static route or policy-based route), packets will be sent out the physical interface unencrypted or dropped. This is distinct from authentication or encryption mismatches, which would prevent tunnel establishment entirely.

Answer

Certificates expired

Answer

Mismatched encryption algorithm

Answer

Mismatched IKE version

Question 20

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies