CISSP Communication and Network Security Practice Test 2 — 15 Questions

Question 1

A company uses VLANs to separate traffic between the IT, HR, and Finance departments. A user in the HR VLAN reports that she cannot access a file server located in the IT VLAN. The file server's default gateway is correctly set to the IT VLAN interface. All workstations have correct IP addresses and subnet masks. What is the most likely cause of this issue?

Accepted Answer

No routing is configured between the HR and IT VLANs.. VLANs create separate broadcast domains, so traffic between different VLANs must be routed. Since the HR workstation is in a different VLAN than the file server, and no routing is configured between the HR and IT VLANs, the HR workstation cannot reach the file server even though the server's default gateway is correctly set. This is the most likely cause because all other network settings (IP addresses, subnet masks, switch port configurations) are described as correct.

Answer

Spanning Tree Protocol (STP) is blocking the link between the HR and IT switches.

Answer

The HR workstation has an incorrect subnet mask.

Answer

The HR VLAN switch port is incorrectly configured with the wrong VLAN ID.

Question 2

A network security analyst receives an alert from the intrusion detection system (IDS) indicating a high volume of TCP SYN packets to a single external IP address from a compromised internal host. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target, exhausting its connection table and preventing legitimate connections. The IDS alert specifically describes a compromised internal host generating many SYN packets to a single external IP, which matches the classic behavior of a SYN flood where the attacker spoofs the source IP or uses a bot to saturate the target's resources.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 3

A company is deploying a wireless network for guests. The security requirement is to provide internet access only, with no access to the internal corporate network. Which technology should be used?

Accepted Answer

A separate guest VLAN with ACLs restricting access to internal networks. A separate guest VLAN with ACLs restricting access to internal networks is the correct choice because it provides network segmentation at Layer 2 (VLAN) and Layer 3/4 (ACLs), ensuring guest traffic is isolated from the corporate network while allowing internet access. This approach aligns with the principle of least privilege and is a standard best practice for guest wireless deployments, as it does not rely on authentication or encryption alone to enforce access control.

Answer

WPA3-SAE

Answer

MAC address filtering

Answer

WPA2-Enterprise with 802.1X

Question 4

An organization is implementing IPsec VPN tunnels between multiple branch offices and the main office. The security team notices that the VPN tunnels are established successfully but no traffic passes through. Which of the following is the most likely cause?

Accepted Answer

Incorrect routing entries in the VPN routing table. When IPsec VPN tunnels are established (IKE Phase 1 and Phase 2 complete) but no traffic passes, the most common cause is incorrect routing entries in the VPN routing table. The tunnel may be up, but if the branch office does not have a route pointing the destination subnet to the tunnel interface (e.g., a static route or policy-based route), packets will be sent out the physical interface unencrypted or dropped. This is distinct from authentication or encryption mismatches, which would prevent tunnel establishment entirely.

Answer

Certificates expired

Answer

Mismatched encryption algorithm

Answer

Mismatched IKE version

Question 5

A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?

Accepted Answer

Encryption at the network layer (e.g., IPsec). IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.

Answer

Network segmentation

Answer

Intrusion prevention system (IPS)

Answer

Strong password policies

Question 6

A network engineer is configuring 802.1X authentication for wired network access. The authentication server supports EAP-TLS. What must be deployed to clients to support this authentication method?

Accepted Answer

Client certificate. EAP-TLS requires mutual authentication using digital certificates on both the client and the server. The client must present a certificate to prove its identity to the authentication server, which is validated against a trusted root CA. Without a client certificate, EAP-TLS cannot establish the TLS tunnel, as it relies on certificate-based client authentication per RFC 5216.

Answer

Server certificate

Answer

RADIUS server

Answer

Shared secret

Question 7

During a security assessment, a penetration tester successfully performed a VLAN hopping attack from a host in VLAN 10 to a host in VLAN 20. The switches are configured with IEEE 802.1Q trunking. Which misconfiguration likely allowed this attack?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. D is correct because VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) to negotiate a trunk link between an attacker's host and a switch port. If DTP is enabled on an access port, the attacker can spoof DTP messages to form a trunk, gaining access to traffic from multiple VLANs, including VLAN 20 from VLAN 10.

Answer

The native VLAN is not used on any trunk ports

Answer

Spanning Tree Protocol is disabled

Answer

Port security is disabled on all ports

Question 8

A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?

Accepted Answer

Microsegmentation (e.g., using virtual firewalls on each hypervisor). Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Single point of failure elimination

Question 9

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Accepted Answer

Mismatched proxy IDs (traffic selectors). Phase 1 (IKE SA) establishes a secure channel for key exchange, while Phase 2 (IPsec SA) negotiates the specific traffic to be encrypted. If Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in proxy IDs (traffic selectors), such as local/remote subnets or ports, which prevents the two peers from agreeing on which traffic to protect. This is distinct from authentication or encryption mismatches, which would typically cause Phase 1 to fail.

Answer

Incorrect pre-shared key

Answer

Mismatched authentication algorithm

Answer

Firewall rule blocking IKE traffic

Question 10

Which TWO of the following are characteristics of a VPN that uses TLS?

Accepted Answer

Provides confidentiality. TLS-based VPNs, such as OpenVPN in TLS mode, provide confidentiality through encryption of the tunneled traffic using symmetric ciphers (e.g., AES) negotiated during the TLS handshake. They also provide integrity via message authentication codes (e.g., HMAC) applied to each record, ensuring data has not been altered in transit. These are fundamental security services of the TLS protocol itself.

Answer

Requires a digital certificate on the server

Answer

Operates at the network layer

Answer

Typically uses UDP port 500

Question 11

Which THREE of the following are valid methods for securing wireless networks against unauthorized access?

Accepted Answer

MAC address filtering. MAC address filtering (A) can be used as a basic access control mechanism by configuring the wireless access point to only allow devices with specific MAC addresses to connect. However, it is not a strong security method because MAC addresses can be easily spoofed using tools like `macchanger` or `airmon-ng`, making it a weak defense against determined attackers.

Answer

Using WEP with a complex key

Answer

Disabling SSID broadcast

Question 12

Which TWO of the following are common causes of network performance degradation that can be detected by network monitoring tools?

Accepted Answer

Duplex mismatch on a link. Duplex mismatch occurs when one end of an Ethernet link is configured for full-duplex and the other for half-duplex, causing frame collisions, CRC errors, and severe performance degradation. Network monitoring tools detect this through interface error counters (e.g., runts, FCS errors, late collisions) and can alert on excessive errors. This is a common physical-layer issue that directly impacts throughput and latency.

Answer

Incorrect default gateway

Answer

High CPU utilization on routers

Answer

DNS misconfiguration

Question 13

Refer to the exhibit. A security team is reviewing switch configurations and notices that the native VLAN is set to VLAN 10. An attacker on an access port in VLAN 10 sends a frame with a VLAN tag of VLAN 20 inside another frame. Which type of attack does this configuration make possible?

Accepted Answer

VLAN hopping via double tagging. The configuration with native VLAN 10 allows an attacker on an access port in VLAN 10 to craft a frame with an outer 802.1Q tag for VLAN 20 and an inner tag for VLAN 10. When the switch receives this frame on a trunk port, it strips the outer tag (native VLAN) and forwards the inner tag, causing the frame to hop into VLAN 20. This is the classic VLAN hopping via double tagging attack, exploiting the native VLAN behavior.

Answer

DHCP starvation

Answer

ARP spoofing

Answer

MAC flooding

Question 14

Refer to the exhibit. The firewall rules above are applied to the outside interface. A penetration tester from the internet attempts to establish a connection to 192.168.1.10 on TCP port 8080. What will happen?

Accepted Answer

The connection is denied because the port is not explicitly allowed. Option D is correct because firewall rules operate on an implicit-deny model: if no rule explicitly permits traffic, it is denied by default. Since the exhibit shows no rule allowing TCP port 8080 from the internet to 192.168.1.10, the connection is dropped. The destination is reachable (192.168.1.10 is a valid internal IP), but the lack of an explicit permit for port 8080 causes the denial.

Answer

The connection is permitted only if the tester uses a VPN

Answer

The connection is permitted

Answer

The connection is denied because the destination is not reachable

Question 15

Refer to the exhibit. A security auditor is reviewing the network ACLs for a cloud VPC. Which of the following is the most significant security concern?

Accepted Answer

SSH (port 22) is allowed from a large IP range. Allowing SSH (port 22) from a large IP range (e.g., 0.0.0.0/0 or a wide CIDR) exposes the management interface to the entire internet, making it trivial for attackers to launch brute-force or credential-stuffing attacks. This violates the principle of least privilege and is a common misconfiguration that leads to unauthorized access.

Answer

The outbound rules allow all traffic

Answer

RDP (port 3389) is allowed from a trusted internal subnet

Answer

The VPC ID is exposed