CISSP Communication and Network Security Practice Test 3 — 15 Questions

Question 1

A company needs to provide secure remote access to employees using company-issued laptops. The solution must support both web applications and legacy client-server apps without installing client software on the laptops. Which VPN technology is best?

Accepted Answer

SSL VPN with clientless web access and port forwarding. SSL VPN with clientless web access and port forwarding is the best choice because it meets the requirement of supporting both web applications and legacy client-server apps without installing client software. Clientless web access provides secure HTTPS-based access to internal web applications via a browser, while port forwarding allows legacy TCP-based client-server applications to be tunneled through the SSL VPN without requiring a full VPN client on the laptop. This approach leverages the existing browser and OS capabilities, eliminating the need for additional software installation.

Answer

L2TP over IPsec

Answer

MPLS Layer 3 VPN

Answer

IPsec tunnel mode

Question 2

A network engineer is troubleshooting a slow VPN connection between two sites. The link is symmetric 100 Mbps, but throughput tests show only 20 Mbps. The VPN uses AES-256 encryption. What is the most likely cause?

Accepted Answer

CPU bottleneck on the VPN endpoints. AES-256 encryption is computationally intensive, and the throughput of a VPN is often limited by the cryptographic processing capacity of the endpoint CPUs rather than the link bandwidth. A symmetric 100 Mbps link with only 20 Mbps throughput strongly indicates that the VPN endpoints cannot encrypt/decrypt fast enough, creating a CPU bottleneck.

Answer

Packet loss due to link congestion

Answer

MTU mismatch causing fragmentation

Answer

Incorrect TCP window scaling

Question 3

An organization is designing a multicast network for live video streaming. They need to ensure that only authorized receivers can access the multicast group. Which technique should be implemented?

Accepted Answer

IGMP filtering. IGMP filtering allows the network to control which hosts are permitted to join a multicast group by filtering IGMP membership reports at the access layer. This ensures that only authorized receivers can become members of the multicast group, providing access control for live video streaming. It is the most direct technique for enforcing authorization at the receiver level.

Answer

Multicast VLAN registration

Answer

Static IGMP entries

Answer

IGMP snooping with port security

Question 4

A company has multiple offices connected via a WAN. They want to ensure that all traffic between offices is encrypted and authenticated. Which technology is most appropriate?

Accepted Answer

IPsec VPN. IPsec VPN is the most appropriate technology because it operates at the network layer (Layer 3) and provides both encryption and authentication for all IP traffic between sites over an untrusted WAN. It uses protocols such as ESP (Encapsulating Security Payload) for confidentiality and AH (Authentication Header) or ESP for integrity and authentication, ensuring that all inter-office traffic is protected in transit.

Answer

MPLS

Answer

DMVPN

Answer

SSL VPN

Question 5

A security analyst receives an alert that a host in the internal network is sending abnormal amounts of traffic to an external IP. The traffic uses destination port 53. What is the most likely attack?

Accepted Answer

DNS tunneling. The alert describes a host sending abnormal traffic to an external IP on destination port 53, which is the default port for DNS. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data (e.g., commands or exfiltrated files) within DNS queries and responses, allowing covert communication through firewalls that typically allow DNS traffic. The abnormal volume of traffic to a single external IP is a classic indicator of a DNS tunnel, as the compromised host continuously sends encoded data to an external command-and-control server.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 6

A network architect is designing a network to comply with PCI DSS requirements that cardholder data must be encrypted during transmission over open networks. Which protocol should be used for encrypting traffic between a point-of-sale (POS) terminal and the payment gateway?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is a widely accepted, secure protocol for encrypting data in transit, and it meets PCI DSS requirements for strong cryptography. PCI DSS explicitly prohibits the use of SSL and early TLS versions (1.0) due to known vulnerabilities, and TLS 1.2 provides robust cipher suites and forward secrecy.

Answer

TLS 1.0

Answer

SSH

Answer

SSL 3.0

Question 7

A switch port is configured with port security that allows only one MAC address. The help desk reports that a user's device cannot connect after a laptop is replaced. What should the network administrator do to resolve the issue?

Accepted Answer

Clear the port security counters. When port security is configured to allow only one MAC address and a laptop is replaced, the new MAC address is automatically blocked because the switch has already learned and secured the old MAC address. Clearing the port security counters (e.g., using `clear port-security sticky` or `clear port-security dynamic`) resets the learned MAC address, allowing the switch to learn the new device's MAC address on the next link-up. This is the standard remediation without disabling security or causing unnecessary downtime.

Answer

Disable port security

Answer

Shut down the port and re-enable

Answer

Change the port security to sticky MAC

Question 8

A company wants to implement 802.1X authentication on their wired network. Which components are required?

Accepted Answer

Supplicant, authenticator, and authentication server. 802.1X requires three distinct roles to function: the supplicant (client software requesting access), the authenticator (network device like a switch that enforces port-based access control), and the authentication server (typically a RADIUS server that validates credentials). Without all three, the EAP (Extensible Authentication Protocol) exchange cannot complete, as the authenticator acts as a proxy between the supplicant and the authentication server. Option C is correct because it lists all three mandatory components.

Answer

Supplicant and authenticator

Answer

Authenticator and authentication server

Answer

Supplicant and authentication server

Question 9

During a security audit, it is discovered that a network firewall is allowing traffic based on source IP address only, without inspecting application-layer data. Which type of firewall is this?

Accepted Answer

Packet filter. A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions solely based on source and destination IP addresses, ports, and protocols. It does not inspect application-layer data (Layer 7), which matches the scenario where traffic is allowed based on source IP address only. This is the simplest and fastest type of firewall, but it lacks the ability to block attacks embedded in application payloads.

Answer

Circuit-level gateway

Answer

Application gateway

Answer

Stateful inspection

Question 10

Which TWO options are valid methods for providing confidentiality in network communications? (Choose two.)

Accepted Answer

ESP in transport mode. ESP (Encapsulating Security Payload) in transport mode provides confidentiality by encrypting the payload of an IP packet while leaving the original IP header intact. This is a core function of IPsec, where ESP can optionally include authentication but its primary role is encryption, making it a valid method for ensuring data confidentiality in network communications.

Answer

SSH

Answer

HMAC

Answer

AH in tunnel mode

Question 11

Which TWO are common techniques to defend against VLAN hopping attacks? (Choose two.)

Accepted Answer

Disable DTP. Disabling Dynamic Trunking Protocol (DTP) on all switch ports prevents interfaces from automatically negotiating trunk links, which is the primary vector for VLAN hopping attacks. By setting ports to 'switchport mode access' and disabling DTP with 'switchport nonegotiate', an attacker cannot trick the switch into forming a trunk and gain access to traffic from multiple VLANs.

Answer

Enable BPDU Guard

Answer

Use Private VLANs

Answer

Enable Port Security

Question 12

Which THREE are essential elements of a Transport Layer Security (TLS) handshake? (Choose three.)

Accepted Answer

Key generation. Key generation is essential because during a TLS handshake, the client and server derive session keys using the pre-master secret exchanged via asymmetric encryption (e.g., RSA or Diffie-Hellman). These keys are then used for symmetric encryption of the session, ensuring confidentiality and integrity. Without key generation, no secure communication channel can be established.

Answer

User authentication

Answer

Session ticket exchange

Question 13

A security engineer notices that the IKE phase 1 lifetime is set to 3600 seconds. What is a potential security implication?

Accepted Answer

Short lifetimes may cause frequent reauthentication and potential disruption. IKE phase 1 establishes a secure authenticated channel for subsequent IKE phase 2 negotiations. A lifetime of 3600 seconds (1 hour) is relatively short, causing frequent reauthentication. This can lead to service disruption if the rekeying process fails or if the VPN peers experience transient network issues, potentially dropping active tunnels and impacting production traffic.

Answer

Longer lifetimes reduce rekeying overhead

Answer

Shorter lifetimes increase performance

Answer

The lifetime should be at least 86400 seconds

Question 14

A remote user at 203.0.113.5 cannot access the internal web server at 10.0.0.10 over HTTPS. What is the most likely cause of the denial?

Accepted Answer

The ACL is missing a permit rule for the user's IP. The user at 203.0.113.5 is attempting to reach the internal web server at 10.0.0.10 over HTTPS (TCP/443). If an ACL is applied on the firewall or router interface that filters inbound traffic from the remote user, the most direct cause of denial is the absence of a permit rule for the source IP 203.0.113.5. ACLs process rules sequentially, and if no explicit permit matches the user's traffic, the implicit deny at the end of the ACL will drop the packet.

Answer

The ACL is applied in the wrong direction

Answer

The firewall is not performing stateful inspection

Answer

The web server is not listening on port 443

Question 15

A network administrator has configured private VLANs on a switch. The host in this port is part of PVLAN 100, and its associated secondary PVLAN is 200. What is the expected behavior for traffic from this host to other hosts in the same primary VLAN 100?

Accepted Answer

It can communicate with the promiscuous port only. In a private VLAN (PVLAN) configuration, a host in a community or isolated secondary VLAN cannot communicate with other hosts in the same primary VLAN unless they share the same secondary VLAN. However, the question specifies that the host is in PVLAN 100 and its associated secondary PVLAN is 200, but does not state that the host is in a community VLAN; the only way a host in a secondary VLAN can communicate with any other host is via the promiscuous port (typically connected to a router or firewall). Since the host is in an isolated secondary VLAN (or community without a matching community), it can only send traffic to the promiscuous port, which then forwards it as needed.

Answer

It cannot communicate with any other host

Answer

It can communicate only with other hosts in the same secondary VLAN 200

Answer

It can communicate with all hosts in primary VLAN 100