SSCP Network and Communications Security — 40 Questions

Question 1

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Accepted Answer

Check the server's running processes and established connections.. Option C is correct because the first step in incident response is to gather forensic evidence and understand the scope of the compromise. Checking running processes and established connections allows the analyst to identify the malicious process, its parent, and the active command-and-control (C2) channel on port 4444, which is commonly associated with reverse shells or backdoor traffic. This data is volatile and must be captured before any disruptive action like disconnection or reboot, which would destroy evidence.

Answer

Disconnect the server from the network.

Answer

Reboot the server to clear any malware.

Answer

Block the outbound traffic at the firewall.

Question 2

A network engineer is designing a secure WAN link between two offices using IPsec VPN. The company requires encryption of all traffic, authentication of both endpoints, and protection against replay attacks. Which combination of IPsec protocols and modes should be used?

Accepted Answer

ESP in tunnel mode. ESP in tunnel mode encrypts and authenticates the entire original IP packet, providing confidentiality, integrity, and authentication for the entire payload. It also includes sequence numbers to protect against replay attacks, making it the correct choice for a secure WAN link between two offices.

Answer

AH in tunnel mode

Answer

AH in transport mode

Answer

ESP in transport mode

Question 3

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Accepted Answer

IEEE 802.1X port-based authentication. IEEE 802.1X port-based authentication is the correct control because it authenticates each device at the network edge before granting access to the wired LAN. It uses an authentication server (e.g., RADIUS) to verify credentials or certificates, effectively preventing unauthorized devices from connecting. Unlike MAC-based controls, 802.1X provides dynamic, per-session authentication that cannot be easily spoofed.

Answer

Port security with sticky MAC

Answer

MAC address filtering

Answer

VLAN segmentation

Question 4

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Accepted Answer

NAT is not configured for outbound traffic.. The firewall rule allows outbound HTTP, but without NAT configured, the internal hosts' private IP addresses (e.g., 192.168.1.x) are used as source addresses in packets sent to the external web server. The web server at 203.0.113.50 will see these private addresses as the source and attempt to reply to them, but private addresses are not routable on the public internet, so the return traffic never reaches the internal hosts. NAT (specifically source NAT or PAT) translates the private source IP to the firewall's public IP, enabling two-way communication.

Answer

The default gateway on the internal hosts is incorrect.

Answer

DNS resolution is failing for the server name.

Answer

An ACL is blocking the destination IP.

Question 5

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

Accepted Answer

WPA2-PSK with AES (CCMP). WPA2-PSK with AES (CCMP) is correct because it provides the highest security level compatible with legacy devices that only support WPA2-PSK. AES-CCMP is the mandatory encryption protocol for WPA2, offering strong data confidentiality and integrity, whereas TKIP is deprecated due to known vulnerabilities. This configuration avoids the need for a RADIUS server (required by WPA2-Enterprise) and does not force an upgrade to WPA3, which legacy devices cannot support.

Answer

WPA2-Enterprise with RADIUS

Answer

WPA3-SAE only

Answer

WPA2-PSK with TKIP

Question 6

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database by monitoring DHCP traffic on untrusted ports. By enabling DHCP snooping on the switch, only DHCP servers connected to trusted ports can assign IP addresses, preventing rogue DHCP server attacks.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 7

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

Accepted Answer

Split tunnel VPN. A split tunnel VPN configuration allows remote users to access the corporate network securely over an encrypted tunnel while simultaneously sending internet-bound traffic directly to the internet without passing through the corporate VPN gateway. This meets the security policy requirement because only traffic destined for the corporate network is encrypted, reducing latency and bandwidth load on the VPN concentrator.

Answer

Remote Desktop Gateway

Answer

Host-to-host VPN

Answer

Full tunnel VPN

Question 8

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

Accepted Answer

To force the switch to act like a hub and allow packet sniffing. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of fake source MAC addresses, the attacker fills the CAM table, causing the switch to fail open and flood all incoming frames out all ports, effectively behaving like a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

To change the MAC address of the switch

Answer

To cause a denial of service on the network

Answer

To bypass 802.1X authentication

Question 9

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Accepted Answer

TCP port 443. HTTPS (HTTP over TLS) uses TCP as its transport protocol because it requires reliable, connection-oriented delivery for secure web traffic. The default port for HTTPS is 443, as defined in RFC 2818. Therefore, allowing TCP port 443 is the correct firewall rule.

Answer

UDP port 80

Answer

UDP port 443

Answer

TCP port 80

Question 10

Which TWO of the following are functions of a network firewall?

Accepted Answer

Filtering traffic based on IP addresses and ports. Option B is correct because a network firewall's primary function is to enforce access control policies by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (ports) information. This stateless or stateful inspection allows the firewall to permit or deny packets according to rules, such as allowing HTTP traffic (TCP port 80) from a specific source IP. This is a core security mechanism to segment networks and block unauthorized access.

Answer

Resolving domain names to IP addresses

Answer

Encrypting data at rest

Answer

Assigning IP addresses to hosts

Question 11

Which TWO of the following are best practices for securing a wireless network?

Accepted Answer

Using WPA2-Enterprise with 802.1X. WPA2-Enterprise with 802.1X is a best practice because it provides strong encryption (AES-CCMP) and per-user authentication via a RADIUS server, eliminating the vulnerabilities of pre-shared keys. The 802.1X framework ensures that each user must authenticate individually, preventing unauthorized access even if a single credential is compromised. This is the gold standard for enterprise wireless security.

Answer

Enabling MAC address filtering

Answer

Using WEP encryption

Answer

Leaving the default administrator password

Question 12

Which THREE of the following are characteristics of a stateful firewall?

Accepted Answer

Is generally slower than a stateless firewall. Stateful firewalls maintain a state table that tracks the state of active connections, allowing them to make decisions based on the context of traffic patterns, such as the TCP three-way handshake. This additional processing overhead generally makes them slower than stateless firewalls, which only inspect packet headers individually without connection tracking.

Answer

Operates only at the network layer (Layer 3)

Answer

Performs deep packet inspection (DPI)

Question 13

Which THREE of the following are common types of network attacks?

Accepted Answer

ARP spoofing. ARP spoofing is a network attack where an attacker sends falsified Address Resolution Protocol (ARP) messages onto a local area network. This links the attacker's MAC address with the IP address of a legitimate host, enabling interception, modification, or blocking of traffic intended for that host. It is a classic Layer 2 attack that exploits the lack of authentication in ARP.

Answer

Pharming

Answer

SQL injection

Question 14

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Accepted Answer

The third device's traffic will be dropped, and a syslog message will be generated.. The port security configuration on the access port has a maximum MAC address count that includes the VoIP phone's MAC address. When a third device connects to the phone's passthrough port, it introduces an additional MAC address, exceeding the configured limit. The switch will then drop traffic from the third device and generate a syslog message, as the default violation mode is 'restrict' (or 'protect' depending on the configuration), which does not error-disable the port but discards offending frames and logs the event.

Answer

The third device will be allowed to communicate because the phone's MAC is not counted.

Answer

The port will be error-disabled.

Answer

The port will remain up but all traffic will be dropped.

Question 15

A security analyst reviews the syslog message from a router. What does this log entry indicate?

Accepted Answer

An internal host attempted to access an external web server and was blocked.. The log entry shows a packet from source IP 10.0.0.2 (internal) to destination IP 203.0.113.5 (external) on port 80 (HTTP) being denied by the router's access control list (ACL). The 'DENY' action indicates the traffic was blocked, not allowed. Since the source is internal and the destination is external, this matches an outbound connection attempt being blocked.

Answer

The router's ACL is misconfigured and is blocking all traffic.

Answer

An external host attempted to access an internal web server and was blocked.

Answer

An internal host successfully accessed an external web server.

Question 16

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

Accepted Answer

Implement VLANs to separate departments and use a router-on-a-stick configuration with a capable router.. Option C is correct because implementing VLANs segments the flat network into smaller broadcast domains, reducing ARP and broadcast traffic, which improves performance. A router-on-a-stick configuration using a capable router that supports VLAN routing (802.1Q trunking) allows inter-VLAN communication without requiring a new switch, addressing both performance and security concerns without purchasing new hardware.

Answer

Divide the network into multiple subnets and connect each to a separate port on the cable modem.

Answer

Upgrade the router to a business-grade model that supports VLAN routing and keep the network flat.

Answer

Replace the switch with a layer 3 switch to route between VLANs without a router.

Question 17

Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.

Question 18

Drag and drop the steps for implementing a patch management process into the correct order.

Question 19

Match each access control model to its description.

Question 20

Match each vulnerability assessment tool to its use.