SSCP Network and Communications Security Practice Test 2 — 15 Questions

Question 1

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

Accepted Answer

Implement VLANs to separate departments and use a router-on-a-stick configuration with a capable router.. Option C is correct because implementing VLANs segments the flat network into smaller broadcast domains, reducing ARP and broadcast traffic, which improves performance. A router-on-a-stick configuration using a capable router that supports VLAN routing (802.1Q trunking) allows inter-VLAN communication without requiring a new switch, addressing both performance and security concerns without purchasing new hardware.

Answer

Divide the network into multiple subnets and connect each to a separate port on the cable modem.

Answer

Upgrade the router to a business-grade model that supports VLAN routing and keep the network flat.

Answer

Replace the switch with a layer 3 switch to route between VLANs without a router.

Question 2

Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.

Question 3

Drag and drop the steps for implementing a patch management process into the correct order.

Question 4

Match each access control model to its description.

Question 5

Match each vulnerability assessment tool to its use.

Question 6

A security analyst is troubleshooting a network issue where users on VLAN 10 cannot reach a server on VLAN 20. The router has an ACL applied to the interface connected to VLAN 10. Which step should the analyst take first to isolate the problem?

Accepted Answer

Review the ACL configuration on the router interface. The ACL applied to the router interface connected to VLAN 10 is the most likely cause of the connectivity issue, as it can explicitly permit or deny traffic from VLAN 10 to VLAN 20. Reviewing the ACL configuration first allows the analyst to quickly determine if the traffic is being blocked by a deny statement or missing permit entry, which is a common and immediate cause of such inter-VLAN routing failures. This step is the most efficient because it directly addresses the access control mechanism at the routing boundary.

Answer

Run a traceroute from a user machine to the server

Answer

Check the ARP table for the server's MAC address

Answer

Verify the VLAN configuration on the switch

Question 7

A company wants to secure wireless communication for guests. Which protocol provides the strongest encryption for a wireless network?

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) provides the strongest encryption for wireless networks, using 128-bit AES in CCMP mode for encryption and replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks. This makes it the most secure option among the choices, especially for guest networks where authentication security is critical.

Answer

WEP with 128-bit key

Answer

WPA2-PSK with TKIP

Answer

WPA2-PSK with AES

Question 8

During a security audit, it is discovered that network devices are using Telnet for management. Which of the following is the most secure replacement to ensure encrypted remote access?

Accepted Answer

SSH with public key authentication. SSH (Secure Shell) provides encrypted remote access and authentication, replacing the insecure Telnet protocol. Public key authentication adds a second factor (the private key) and is resistant to brute-force password attacks, making it the most secure option for managing network devices.

Answer

SNMPv3 with authentication and encryption

Answer

HTTPS with self-signed certificate

Answer

SSH with password authentication

Question 9

Refer to the exhibit. A security analyst notices that multiple internal hosts are using the same inside global IP address but different port numbers. Which technology is being used?

Accepted Answer

PAT (Port Address Translation). The scenario describes multiple internal hosts sharing a single inside global IP address but using different port numbers. This is the defining behavior of Port Address Translation (PAT), also known as NAT overload. PAT maps multiple private IP addresses to one public IP by differentiating sessions based on the transport-layer port number (TCP/UDP), allowing many hosts to share a single public address.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Port forwarding

Question 10

Refer to the exhibit. A user at IP 10.0.0.1 reports that they cannot access a web server at 203.0.113.5 on port 443. What is the most likely cause?

Accepted Answer

The firewall does not have a rule permitting outbound traffic.. Option D is correct because the user at 10.0.0.1 cannot reach 203.0.113.5:443, which indicates that outbound traffic to that destination is not permitted. Firewalls by default block all traffic unless explicitly allowed; if no rule permits outbound HTTPS (TCP/443) traffic, the connection will be dropped. The symptom (inability to access an external web server) points to a missing outbound rule, not an inbound rule issue.

Answer

The firewall only permits inbound traffic to specific IPs.

Answer

The firewall rule order is incorrect.

Answer

The firewall blocks all outbound traffic.

Question 11

Refer to the exhibit. A network engineer is configuring a site-to-site VPN. The remote peer is using AES-256 encryption and SHA-1 for integrity. Which configuration parameter is likely misconfigured?

Accepted Answer

Group 5. The remote peer is using AES-256 encryption and SHA-1 for integrity, which are both supported in an IPsec transform-set. However, the exhibit shows that the local peer is configured with Group 5 (Diffie-Hellman 1536-bit), while the remote peer likely expects a different DH group (e.g., Group 2 or Group 14). DH group mismatch during Phase 1 (IKE) negotiation causes the VPN tunnel to fail, even if encryption and integrity algorithms match.

Answer

Transform-set

Answer

Pre-shared key

Answer

IKE lifetime

Question 12

A network administrator is implementing segmentation to limit the spread of malware. Which two technologies can achieve network segmentation? (Choose two.)

Accepted Answer

Firewalls. Firewalls are correct because they can enforce network segmentation by controlling traffic between network segments based on security policies. By placing firewalls at segment boundaries, administrators can filter traffic using rules that inspect source/destination IP addresses, ports, and application-layer data, thereby limiting the lateral spread of malware.

Answer

VPN

Answer

NAT

Answer

Subnetting

Question 13

Which three of the following are best practices for securing a wireless network? (Choose three.)

Accepted Answer

Disable SSID broadcast. Disabling SSID broadcast prevents the access point from including its network name in beacon frames, making the network less visible to casual scanning tools. While this does not provide true security (as the SSID can still be discovered via passive monitoring of probe responses or association frames), it reduces the attack surface by hiding the network from non-malicious users and automated discovery scripts.

Answer

Use MAC address filtering

Answer

Set a weak passphrase for guest network

Question 14

A security analyst is reviewing network device logs and finds multiple failed SSH login attempts from a single external IP. Which three actions should the analyst take to mitigate this brute-force attack? (Choose three.)

Accepted Answer

Disable password-based authentication for SSH.. Disabling password-based authentication for SSH (Option B) eliminates the primary vector for brute-force attacks, as attackers cannot guess passwords. This forces the use of cryptographic key pairs, which are computationally infeasible to brute-force. Combined with an ACL to block the offending IP (Option C) and enabling only public key authentication (Option D), these three actions directly mitigate the ongoing and future brute-force attempts.

Answer

Increase the SSH login timeout.

Answer

Change the SSH port to a non-standard port.

Question 15

A company uses a hub-and-spoke VPN topology with a central site and multiple branch offices. The central site's firewall is being upgraded. Which technology can provide link redundancy with automatic failover for the VPN connections?

Accepted Answer

BGP. BGP is correct because it supports dynamic routing and can be configured with multiple paths to provide automatic failover for VPN connections in a hub-and-spoke topology. When the central site's firewall is upgraded, BGP can reroute traffic through alternate paths without manual intervention, ensuring link redundancy. This is achieved through BGP's path selection algorithm and the ability to advertise multiple routes via different VPN tunnels.

Answer

STP

Answer

VRRP

Answer

OSPF