CISSP Timed Practice Test 2 — 10 Questions

Question 1

A network engineer is configuring 802.1X authentication for wired network access. The authentication server supports EAP-TLS. What must be deployed to clients to support this authentication method?

Accepted Answer

Client certificate. EAP-TLS requires mutual authentication using digital certificates on both the client and the server. The client must present a certificate to prove its identity to the authentication server, which is validated against a trusted root CA. Without a client certificate, EAP-TLS cannot establish the TLS tunnel, as it relies on certificate-based client authentication per RFC 5216.

Answer

Server certificate

Answer

RADIUS server

Answer

Shared secret

Question 2

Which TWO of the following are common causes of network performance degradation that can be detected by network monitoring tools?

Accepted Answer

Duplex mismatch on a link. Duplex mismatch occurs when one end of an Ethernet link is configured for full-duplex and the other for half-duplex, causing frame collisions, CRC errors, and severe performance degradation. Network monitoring tools detect this through interface error counters (e.g., runts, FCS errors, late collisions) and can alert on excessive errors. This is a common physical-layer issue that directly impacts throughput and latency.

Answer

Incorrect default gateway

Answer

High CPU utilization on routers

Answer

DNS misconfiguration

Question 3

Which TWO are common techniques to defend against VLAN hopping attacks? (Choose two.)

Accepted Answer

Disable DTP. Disabling Dynamic Trunking Protocol (DTP) on all switch ports prevents interfaces from automatically negotiating trunk links, which is the primary vector for VLAN hopping attacks. By setting ports to 'switchport mode access' and disabling DTP with 'switchport nonegotiate', an attacker cannot trick the switch into forming a trunk and gain access to traffic from multiple VLANs.

Answer

Enable BPDU Guard

Answer

Use Private VLANs

Answer

Enable Port Security

Question 4

An organization is implementing IPsec VPN tunnels between multiple branch offices and the main office. The security team notices that the VPN tunnels are established successfully but no traffic passes through. Which of the following is the most likely cause?

Accepted Answer

Incorrect routing entries in the VPN routing table. When IPsec VPN tunnels are established (IKE Phase 1 and Phase 2 complete) but no traffic passes, the most common cause is incorrect routing entries in the VPN routing table. The tunnel may be up, but if the branch office does not have a route pointing the destination subnet to the tunnel interface (e.g., a static route or policy-based route), packets will be sent out the physical interface unencrypted or dropped. This is distinct from authentication or encryption mismatches, which would prevent tunnel establishment entirely.

Answer

Certificates expired

Answer

Mismatched encryption algorithm

Answer

Mismatched IKE version

Question 5

Refer to the exhibit. A security team is reviewing switch configurations and notices that the native VLAN is set to VLAN 10. An attacker on an access port in VLAN 10 sends a frame with a VLAN tag of VLAN 20 inside another frame. Which type of attack does this configuration make possible?

Accepted Answer

VLAN hopping via double tagging. The configuration with native VLAN 10 allows an attacker on an access port in VLAN 10 to craft a frame with an outer 802.1Q tag for VLAN 20 and an inner tag for VLAN 10. When the switch receives this frame on a trunk port, it strips the outer tag (native VLAN) and forwards the inner tag, causing the frame to hop into VLAN 20. This is the classic VLAN hopping via double tagging attack, exploiting the native VLAN behavior.

Answer

DHCP starvation

Answer

ARP spoofing

Answer

MAC flooding

Question 6

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Accepted Answer

Mismatched proxy IDs (traffic selectors). Phase 1 (IKE SA) establishes a secure channel for key exchange, while Phase 2 (IPsec SA) negotiates the specific traffic to be encrypted. If Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in proxy IDs (traffic selectors), such as local/remote subnets or ports, which prevents the two peers from agreeing on which traffic to protect. This is distinct from authentication or encryption mismatches, which would typically cause Phase 1 to fail.

Answer

Incorrect pre-shared key

Answer

Mismatched authentication algorithm

Answer

Firewall rule blocking IKE traffic

Question 7

A switch port is configured with port security that allows only one MAC address. The help desk reports that a user's device cannot connect after a laptop is replaced. What should the network administrator do to resolve the issue?

Accepted Answer

Clear the port security counters. When port security is configured to allow only one MAC address and a laptop is replaced, the new MAC address is automatically blocked because the switch has already learned and secured the old MAC address. Clearing the port security counters (e.g., using `clear port-security sticky` or `clear port-security dynamic`) resets the learned MAC address, allowing the switch to learn the new device's MAC address on the next link-up. This is the standard remediation without disabling security or causing unnecessary downtime.

Answer

Disable port security

Answer

Shut down the port and re-enable

Answer

Change the port security to sticky MAC

Question 8

A company has multiple offices connected via a WAN. They want to ensure that all traffic between offices is encrypted and authenticated. Which technology is most appropriate?

Accepted Answer

IPsec VPN. IPsec VPN is the most appropriate technology because it operates at the network layer (Layer 3) and provides both encryption and authentication for all IP traffic between sites over an untrusted WAN. It uses protocols such as ESP (Encapsulating Security Payload) for confidentiality and AH (Authentication Header) or ESP for integrity and authentication, ensuring that all inter-office traffic is protected in transit.

Answer

MPLS

Answer

DMVPN

Answer

SSL VPN

Question 9

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Accepted Answer

Data plane. In SDN, the data plane (also called the forwarding plane) is directly responsible for forwarding packets based on flow table entries installed by the controller. It handles per-packet operations like looking up destination addresses, applying actions (e.g., output to port, drop, modify header), and forwarding at line rate. Packet forwarding delays are typically caused by data plane issues such as flow table misses, hardware forwarding pipeline congestion, or inefficient TCAM lookups.

Answer

Application plane

Answer

Control plane

Answer

Management plane

Question 10

A security engineer notices that the IKE phase 1 lifetime is set to 3600 seconds. What is a potential security implication?

Accepted Answer

Short lifetimes may cause frequent reauthentication and potential disruption. IKE phase 1 establishes a secure authenticated channel for subsequent IKE phase 2 negotiations. A lifetime of 3600 seconds (1 hour) is relatively short, causing frequent reauthentication. This can lead to service disruption if the rekeying process fails or if the VPN peers experience transient network issues, potentially dropping active tunnels and impacting production traffic.

Answer

Longer lifetimes reduce rekeying overhead

Answer

Shorter lifetimes increase performance

Answer

The lifetime should be at least 86400 seconds