SSCP Practice Test 49 — 15 Questions

Question 1

Which transport layer protocol is used by DNS for its queries and responses, and why is it appropriate?

Accepted Answer

UDP, because it is connectionless and fast, suitable for short exchanges.. DNS primarily uses UDP for its fast, low-overhead queries. TCP is used for zone transfers or when responses exceed 512 bytes.

Answer

UDP, because it guarantees packet ordering.

Answer

TCP, because it provides error checking and retransmission.

Answer

TCP, because reliability is critical for DNS resolution.

Question 2

A network administrator is tasked with segmenting the network to isolate a DMZ containing public-facing web servers from the internal corporate network. Which device should be placed between the DMZ and internal network, and what type of traffic should it allow?

Accepted Answer

Firewall; allow only specific traffic from internal to DMZ and block DMZ-initiated connections to internal.. A firewall should be used to control traffic; it should allow only necessary inbound and outbound traffic while blocking direct access from DMZ to internal network.

Answer

Router; allow all traffic but use NAT.

Answer

IDS; monitor traffic but do not block.

Answer

Switch; allow all traffic between DMZ and internal network.

Question 3

Which wireless security protocol uses the Simultaneous Authentication of Equals (SAE) handshake to replace the Pre-Shared Key (PSK) method and provides stronger protection against offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE for secure key exchange, replacing WPA2's PSK.

Answer

WPA2

Answer

WPA

Answer

WEP

Question 4

A company wants to deploy a network IDS that can analyze traffic patterns and detect anomalies. Where should the IDS sensor be placed to monitor all traffic on a network segment without introducing latency?

Accepted Answer

Connected to a switch SPAN port. A passive tap or SPAN port allows the IDS to monitor traffic without being inline, avoiding latency.

Answer

Inline between the router and the switch

Answer

At the core switch as a transparent bridge

Answer

On the same segment as the router

Question 5

A security administrator is hardening a wireless network. Which TWO of the following should be avoided due to known vulnerabilities?

Accepted Answer

WEP. WEP and WPA2-PSK have known vulnerabilities; WEP is broken, and WPA2-PSK is vulnerable to offline dictionary attacks (PMKID, KRACK).

Answer

WPA3-Enterprise

Answer

WPA3-Personal

Answer

WPA2-Enterprise

Question 6

An organization is setting up a site-to-site VPN between two branch offices. They require encryption of the entire IP packet, including the original IP header, and plan to use IPsec. Which mode should they configure?

Accepted Answer

Tunnel mode. IPsec tunnel mode encrypts the entire original IP packet and adds a new IP header, suitable for site-to-site VPNs.

Answer

Transport mode

Answer

ESP mode

Answer

AH mode

Question 7

A company is migrating from WPA2-PSK to WPA3 for its wireless network. Which THREE benefits does WPA3 provide compared to WPA2?

Accepted Answer

Mandatory use of Protected Management Frames (PMF). WPA3 uses Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks, mandates Protected Management Frames (PMF) to prevent deauth attacks, and offers 192-bit security for Enterprise mode.

Answer

Use of TKIP as the mandatory encryption protocol

Answer

Backward compatibility with WEP devices

Question 8

A network administrator wants to prevent unauthorized devices from connecting to the wired network. Which technology can be used to enforce authentication at the switch port level before granting network access?

Accepted Answer

802.1X. 802.1X is a port-based access control standard used in NAC to authenticate devices before network access.

Answer

MAC address filtering

Answer

WPA2-Enterprise

Answer

VLAN segmentation

Question 9

An attacker sends a large number of DHCP request messages with spoofed MAC addresses to a network's DHCP server, causing the server to exhaust its IP address pool and deny service to legitimate clients. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation floods the DHCP server with fake requests to deplete the IP address pool.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

DHCP spoofing

Question 10

Which of the following protocols operates on TCP port 443 and provides encrypted communication between a web browser and a web server?

Accepted Answer

HTTPS. HTTPS uses TLS/SSL over TCP port 443 to secure HTTP traffic.

Answer

SMTP

Answer

SSH

Answer

HTTP

Question 11

A company wants to implement a firewall that can track the state of network connections and make decisions based on the context of traffic (e.g., allowing return packets for an established connection). Which type of firewall should they choose?

Accepted Answer

Stateful firewall. Stateful firewalls maintain connection state tables and allow return traffic for established sessions.

Answer

Application proxy firewall

Answer

Stateless packet filter

Answer

Next-generation firewall

Question 12

A security analyst is reviewing firewall logs and notices a high rate of TCP SYN packets to multiple ports on a server, but no corresponding ACK or RST packets. This is characteristic of which type of attack?

Accepted Answer

SYN flood. SYN flood sends many SYN packets without completing the handshake, exhausting server resources.

Answer

UDP flood

Answer

Smurf attack

Answer

Ping of death

Question 13

A security analyst discovers that an internal DNS server is returning incorrect IP addresses for legitimate domains. The analyst suspects that an attacker has compromised the DNS resolver's cache. Which type of attack has likely occurred?

Accepted Answer

DNS poisoning. DNS poisoning involves inserting false DNS records into a resolver's cache, redirecting users to malicious sites.

Answer

DNS amplification attack

Answer

SYN flood

Answer

DNS tunneling

Question 14

A security analyst is investigating a network where an attacker successfully redirected traffic from a legitimate web server to a malicious server by corrupting the target domain's DNS records in a local resolver cache. Which attack technique was used?

Accepted Answer

DNS poisoning. DNS poisoning injects false DNS records into a resolver's cache, redirecting traffic to malicious sites.

Answer

SYN flood

Answer

ARP spoofing

Answer

Smurf attack

Question 15

An organization is designing network segmentation to protect sensitive data. Which TWO of the following are effective methods for implementing network segmentation?

Accepted Answer

Firewalls. VLANs segment traffic at Layer 2, and firewalls control traffic between segments at Layer 3+.

Answer

Honeypots

Answer

NAT

Answer

Port security