CISSP Communication and Network Security — Timed 10 Questions

Question 1

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Accepted Answer

The VPN server is not listening on UDP port 500.. Option D is correct because the symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.

Answer

The VPN server is using TCP port 443 instead of UDP 500.

Answer

The firewall rule is applied to the wrong interface.

Answer

The firewall is stateful and blocking the return traffic.

Question 2

A network architect is designing a secure connection between two data centers across an untrusted WAN. The requirement is to encrypt all traffic and authenticate both endpoints. Which protocol should be used?

Accepted Answer

IPsec tunnel mode. IPsec tunnel mode is the correct choice because it encrypts the entire IP packet, including the original IP header, and encapsulates it within a new IP header for secure transport across an untrusted WAN. It also provides mutual authentication of both endpoints using IKE (Internet Key Exchange) with pre-shared keys or certificates, satisfying the requirement for encrypting all traffic and authenticating both data centers.

Answer

SSH

Answer

MPLS

Answer

SSL/TLS

Question 3

A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?

Accepted Answer

The payroll server's default gateway does not have a route back to 10.10.20.0/24.. The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.

Answer

DNS is not resolving the payroll server's IP address.

Answer

The firewall rule is applied to the outbound interface only.

Answer

The accounting subnet is blocked by an implicit deny rule.

Question 4

A company uses WPA2-Enterprise with EAP-TLS for wireless access. An employee reports that a new laptop cannot connect to the wireless network, while older laptops work fine. The employee has installed the correct client certificate. What is the most likely cause?

Accepted Answer

The RADIUS server's certificate is not trusted by the new laptop.. In WPA2-Enterprise with EAP-TLS, mutual authentication requires the client to validate the RADIUS server's certificate. If the new laptop does not trust the RADIUS server's certificate (e.g., its CA root certificate is missing or expired), the EAP-TLS handshake will fail, preventing connection. Older laptops likely have the necessary root CA installed, while the new laptop does not.

Answer

The wireless network uses WPA2-PSK instead of WPA2-Enterprise.

Answer

The client certificate is not correctly associated with the user account.

Answer

The laptop does not support MSCHAPv2.

Question 5

A network engineer is configuring a firewall to allow HTTP traffic from the internet to a web server (10.0.0.10). The firewall has three interfaces: outside (ISP), DMZ (10.0.0.0/24), and inside (192.168.1.0/24). The web server is in the DMZ. Which rule is correct?

Accepted Answer

Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow. Option B is correct because HTTP traffic from the internet arrives on the outside interface, and the firewall rule must match the source interface (Outside), allow any source IP, and specify the destination IP (10.0.0.10) and port 80. This permits inbound web traffic to the DMZ web server while maintaining security boundaries.

Answer

Rule: Source interface Inside, Source any, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface Outside, Source 192.168.1.0/24, Destination 10.0.0.10, Port 80, Action allow

Answer

Rule: Source interface DMZ, Source any, Destination 10.0.0.10, Port 80, Action allow

Question 6

An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?

Accepted Answer

IPsec with IKEv2 and AES-256. IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.

Answer

MPLS Layer 3 VPN

Answer

L2TP without encryption

Answer

PPTP

Question 7

A security analyst is reviewing network logs and sees repeated failed connection attempts from an external IP to the company's SSH server (port 22). The firewall has a rule allowing SSH from anywhere. What is the best immediate action to reduce risk?

Accepted Answer

Change the SSH port to a high-numbered port and restrict source IPs if possible.. Option C is correct because changing the SSH port to a non-standard, high-numbered port reduces automated scanning and brute-force attacks by evading default port 22 scans, while restricting source IPs adds a layer of access control. This balances security with operational continuity, as SSH remains available for legitimate administrative use. The immediate risk reduction comes from making the service less discoverable and limiting the attack surface without fully disabling remote access.

Answer

Remove the firewall rule allowing SSH.

Answer

Disable SSH access entirely.

Answer

Block the offending IP address in the firewall.

Question 8

Which TWO security controls are most effective in preventing VLAN hopping attacks?

Accepted Answer

Set the native VLAN to an unused VLAN ID.. Setting the native VLAN to an unused VLAN ID prevents VLAN hopping via double-tagging attacks. In a double-tagging attack, an attacker sends frames with two 802.1Q tags; the first switch strips the outer tag, forwarding the frame on the native VLAN (which is typically VLAN 1). By changing the native VLAN to an unused ID, any double-tagged frame arriving on an access port will have its outer tag removed and be forwarded onto that unused VLAN, where no legitimate hosts exist, thus breaking the attack path.

Answer

Use VLAN access control lists (VACLs) to filter traffic between VLANs.

Answer

Implement DHCP snooping on all VLANs.

Answer

Enable Spanning Tree Protocol (STP) on all switches.

Question 9

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast.. Disabling SSID broadcast prevents the access point from including the network name in beacon frames. While this does not hide the network from determined attackers using packet analyzers, it reduces casual discovery and is considered a basic security hardening step in defense-in-depth.

Answer

Enable WPS (Wi-Fi Protected Setup).

Answer

Use WEP encryption.

Question 10

Which TWO of the following are valid reasons to implement network segmentation?

Accepted Answer

To isolate sensitive data and systems from the rest of the network.. Network segmentation isolates sensitive data and systems by creating separate broadcast domains or VLANs, restricting unauthorized access and lateral movement. This is a core security principle for protecting critical assets, as it limits the attack surface and enforces access controls between segments.

Answer

To eliminate single points of failure.

Answer

To reduce network latency.

Answer

To simplify routing tables.