CISSP Communication and Network Security Practice Test 4 — 15 Questions

Question 1

A network engineer is troubleshooting an IPsec VPN tunnel between two sites. The tunnel is established but no traffic is passing. Which command should the engineer use to verify the phase 2 security associations?

Accepted Answer

show crypto ipsec sa. The command 'show crypto ipsec sa' displays the IPsec security associations (SAs) for Phase 2, which include encryption and authentication parameters, SPI values, and packet counters. Since the tunnel is established but no traffic passes, this command reveals whether the Phase 2 SAs are properly negotiated and active, or if they are in a mismatch state (e.g., mismatched proxy IDs or transform sets).

Answer

Traceroute between site gateways

Answer

Ping between site gateways

Answer

show crypto isakmp sa

Question 2

A company wants to secure its wireless network. Which approach provides the strongest authentication and encryption?

Accepted Answer

WPA2-Enterprise with RADIUS. WPA2-Enterprise with RADIUS provides the strongest authentication and encryption for wireless networks because it uses 802.1X/EAP for per-user authentication against a central RADIUS server, and AES-CCMP for encryption. This eliminates the shared passphrase vulnerability of PSK modes and supports dynamic, unique encryption keys per session, making it resistant to offline dictionary attacks and key reuse.

Answer

WEP

Answer

Disabling SSID broadcast

Answer

WPA2-PSK with a strong passphrase

Question 3

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 4

A security administrator is configuring a stateful firewall to allow HTTP traffic from the internet to a web server. The firewall uses a default-deny policy. What is the correct rule placement?

Accepted Answer

Place the allow rule before the deny all rule. In a stateful firewall with a default-deny policy, rules are processed in sequential order from top to bottom. Placing the allow rule before the deny all rule ensures that HTTP traffic (TCP port 80) is explicitly permitted before the catch-all deny rule drops all unmatched packets. If the deny all rule were placed first, all traffic would be dropped, including the intended HTTP traffic, making the allow rule unreachable.

Answer

Place the allow rule after the deny all rule

Answer

Use a stateless firewall instead

Answer

Use an implicit deny rule

Question 5

A security analyst is evaluating the impact of upgrading web servers from TLS 1.2 to TLS 1.3. Which advantage does TLS 1.3 offer in terms of handshake efficiency?

Accepted Answer

Fewer round trips during handshake. TLS 1.3 reduces the handshake from two round trips (2-RTT) in TLS 1.2 to one round trip (1-RTT) for a full handshake, and offers 0-RTT for resumed sessions. This is achieved by combining the ClientHello and ServerHello with key exchange parameters, eliminating the separate round trip for the ServerHello and Certificate exchange. The result is lower latency and faster connection establishment, which is critical for performance-sensitive applications.

Answer

It supports the same cipher suites as TLS 1.2

Answer

More round trips during handshake

Answer

It eliminates the need for asymmetric encryption

Question 6

A remote user needs to securely connect to the corporate network over the internet. Which protocol provides both encryption and authentication?

Accepted Answer

IPsec. IPsec is the correct answer because it is a suite of protocols (AH and ESP) that provides both encryption (confidentiality) and authentication (integrity and origin verification) at the network layer. It operates in either transport or tunnel mode, making it suitable for secure site-to-site or remote-access VPNs over the internet.

Answer

L2TP

Answer

PPTP

Answer

SSL

Question 7

A network analyst suspects a host on the internal network is sending abnormal amounts of traffic. Which tool should be used to capture and analyze the packets?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is a packet analyzer that captures live network traffic and provides deep inspection of individual packets, including headers and payloads. This allows the analyst to examine the abnormal traffic patterns, identify source/destination IPs, protocols, and payload content to diagnose the issue.

Answer

Nmap

Answer

Netstat

Answer

Traceroute

Question 8

A company uses BGP to exchange routes with its ISP. To prevent prefix hijacking, which mechanism should be implemented?

Accepted Answer

RPKI. RPKI (Resource Public Key Infrastructure) is the correct mechanism because it cryptographically validates the origin AS of a BGP route announcement, preventing prefix hijacking by ensuring that only the legitimate owner of an IP prefix can announce it. Unlike other options, RPKI provides a trust anchor based on the IP address allocation hierarchy, making it the only solution that directly addresses the root cause of hijacking—unauthorized origin AS claims.

Answer

BGP MD5 authentication

Answer

BGP community values

Answer

AS-path filtering

Question 9

An organization wants to ensure that only devices that meet security policies can connect to the network. Which technology should be deployed?

Accepted Answer

NAC. Network Access Control (NAC) is the correct technology because it enforces security policies by assessing the compliance of devices (e.g., patch level, antivirus status, OS version) before granting network access. NAC can quarantine non-compliant devices, redirect them to a remediation network, or block them entirely, ensuring only authorized and policy-compliant endpoints connect.

Answer

Firewall

Answer

SIEM

Answer

IDS

Question 10

Which two methods provide strong encryption and authentication for wireless networks? (Choose TWO.)

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (C) is correct because it uses IEEE 802.1X authentication with a RADIUS server, providing mutual authentication and per-session dynamic encryption keys via the 4-way handshake using AES-CCMP. WPA3 (E) is correct because it introduces Simultaneous Authentication of Equals (SAE) to replace the pre-shared key (PSK) handshake, offering forward secrecy and stronger encryption with GCMP-256, and also supports 802.1X for enterprise deployments.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC filtering

Question 11

Which three are network-layer security controls in a defense-in-depth strategy? (Choose THREE.)

Accepted Answer

Access control lists (ACLs). Access control lists (ACLs) operate at Layer 3 by filtering traffic based on source and destination IP addresses, using rules that permit or deny packets as they traverse a router or Layer 3 switch. This makes ACLs a fundamental network-layer security control in a defense-in-depth strategy, as they enforce traffic segmentation and restrict unauthorized network access.

Answer

Antivirus

Answer

Data encryption at rest

Question 12

Which three BGP security mechanisms help protect against route hijacking? (Choose THREE.)

Accepted Answer

Resource Public Key Infrastructure (RPKI). RPKI is correct because it uses cryptographically signed Route Origin Authorizations (ROAs) to validate that an AS is authorized to originate specific IP prefixes. This prevents route hijacking by allowing routers to reject BGP announcements that do not match the registered origin AS.

Answer

BGP Flowspec

Answer

BGP MED attribute

Question 13

Refer to the exhibit. Based on the output, which integrity algorithm is configured for the IPsec tunnel?

Accepted Answer

HMAC-SHA1. The output shows 'esp-sha-hmac' under the transform set, which indicates the integrity algorithm is HMAC-SHA1 (SHA-1 hashing with HMAC). In Cisco IOS, 'esp-sha-hmac' specifically refers to HMAC-SHA1 (96-bit hash), not SHA-256 or MD5. This is the correct interpretation because the command 'crypto ipsec transform-set' uses 'esp-sha-hmac' to denote SHA-1-based integrity.

Answer

HMAC-MD5

Answer

HMAC-SHA256

Answer

AES-GCM

Question 14

Refer to the exhibit. A security analyst is reviewing the network ACL inbound rules. Which statement is true?

Accepted Answer

SSH access is limited to the 10.0.0.0/8 subnet.. Option A is correct because the ACL inbound rule explicitly permits TCP port 22 (SSH) only from source IP addresses within the 10.0.0.0/8 range, and the implicit deny at the end of the ACL blocks all other traffic, including SSH from any other subnet. This restricts SSH administrative access to the private 10.0.0.0/8 network, enhancing security by preventing external SSH connections.

Answer

Outbound rules are not shown.

Answer

The rule order is irrelevant.

Answer

All inbound HTTP traffic is denied.

Question 15

A multinational corporation operates a private MPLS VPN network connecting 50 branch offices to a central data center. The network uses BGP as the routing protocol within the VPN, with each branch announcing its internal prefixes to the data center routers. Over the past week, several branch offices have reported intermittent connectivity issues, with traffic being routed to incorrect destinations before recovering. Network logs show that during these incidents, the data center router receives unexpected BGP updates from one of the branch routers, advertising prefixes that belong to other branches. BGP sessions remain established without flaps. The security team is concerned that this could be a route leak or intentional hijack. The network engineer has verified that all BGP sessions are authenticated with MD5 and that RPKI validation is not currently deployed. Which course of action should the engineer take first to mitigate the issue?

Accepted Answer

Configure inbound BGP prefix filtering on the data center routers.. The intermittent connectivity issues are caused by a branch router advertising prefixes that belong to other branches, which is a classic route leak or hijack scenario. Configuring inbound BGP prefix filtering on the data center routers is the immediate and most effective mitigation because it allows the engineer to explicitly define which prefixes are accepted from each BGP neighbor, preventing unauthorized or incorrect routes from being installed in the routing table. This approach does not require additional infrastructure or protocol changes and directly addresses the root cause of the traffic misdirection.

Answer

Implement BGP Flowspec to rate-limit traffic to the affected prefixes.

Answer

Deploy RPKI validation across all routers.

Answer

Increase the BGP hold timer on data center routers.