SSCP Network and Communications Security Practice Test 3 — 15 Questions

Question 1

A security analyst discovers that an internal host is sending traffic to an external IP address known to be a command-and-control server. The analyst wants to block only that specific traffic without affecting other traffic. Which firewall rule should be implemented?

Accepted Answer

Deny traffic from the internal host to the external IP.. Option D is correct because it creates a specific deny rule that matches only the source IP of the internal host and the destination IP of the command-and-control server, blocking that exact traffic flow while allowing all other traffic to and from both hosts. This is the most precise and least disruptive approach, adhering to the principle of least privilege in firewall rule design.

Answer

Deny all traffic from the internal host.

Answer

Deny all traffic to the external IP.

Answer

Deny traffic on the specific port used.

Question 2

Which protocol is used to automatically assign IP addresses to devices on a network?

Accepted Answer

DHCP. DHCP (Dynamic Host Configuration Protocol) is the correct answer because it is specifically designed to automatically assign IP addresses and other network configuration parameters (such as subnet mask, default gateway, and DNS servers) to devices on a network. This eliminates the need for manual IP configuration and reduces the risk of address conflicts.

Answer

ARP

Answer

DNS

Answer

ICMP

Question 3

A network administrator needs to ensure that internal users can access only approved external websites. Which technology should be implemented?

Accepted Answer

Web Proxy with content filtering. A web proxy with content filtering intercepts HTTP/HTTPS requests from internal users and applies policy rules (e.g., URL whitelists, category blocking) to allow only approved external websites. This technology operates at the application layer, inspecting the full URL and content, making it the correct choice for granular access control.

Answer

Intrusion Prevention System (IPS)

Answer

Virtual Private Network (VPN)

Answer

Network Address Translation (NAT)

Question 4

Which of the following is a primary function of a firewall?

Accepted Answer

Filter traffic based on rules. A firewall's primary function is to filter network traffic based on a defined set of security rules, such as source/destination IP addresses, ports, and protocols. It operates at the network layer (or higher) to permit or deny packets, acting as a barrier between trusted and untrusted networks. This rule-based filtering is the core mechanism that enforces access control policies.

Answer

Assign IP addresses

Answer

Encrypt network traffic

Answer

Detect malware on endpoints

Question 5

A security analyst is reviewing traffic logs and sees that a host is sending ICMP echo requests to multiple external IPs. This behavior is most likely indicative of:

Accepted Answer

A ping sweep reconnaissance. ICMP echo requests (ping) sent to multiple external IPs from a single host is characteristic of a ping sweep, which is a reconnaissance technique used to map live hosts on a network. Unlike a DDoS or amplification attack, this activity originates from one host and targets many destinations to identify which IPs are responsive, aiding an attacker in planning further exploitation.

Answer

Normal network monitoring

Answer

A DDoS attack

Answer

A DNS amplification attack

Question 6

A security administrator is configuring a firewall to allow HTTPS traffic from the internet to a web server. Which default port must be permitted?

Accepted Answer

443. HTTPS uses port 443 by default. Port 80 is HTTP, 8080 is common HTTP alternative, and 8443 is HTTPS alternative but not default.

Answer

8443

Answer

8080

Answer

80

Question 7

A company wants to ensure that employees connecting from home use a secure tunnel to access internal resources. Which protocol should be implemented?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN creates an encrypted tunnel over HTTPS (port 443) between the remote user's browser or client and the corporate VPN gateway, securing all traffic to internal resources. This is the standard solution for remote access VPNs because it uses ubiquitous SSL/TLS protocols, avoids the need for IPsec client software, and can traverse firewalls and NAT devices easily.

Answer

SFTP

Answer

Telnet

Answer

SSH

Question 8

An analyst notices unusual outbound traffic from a workstation to an external IP on port 445. Which protocol is likely being used?

Accepted Answer

SMB. Port 445 is the default port for Microsoft-DS (Direct Hosting of SMB over TCP/IP), which is used by the Server Message Block (SMB) protocol for file and printer sharing. Unusual outbound traffic on this port often indicates SMB activity, such as a workstation attempting to connect to a remote share or, in a security context, potential data exfiltration or lateral movement using SMB.

Answer

HTTP

Answer

FTP

Answer

DNS

Question 9

A network engineer is troubleshooting a site-to-site VPN that is failing to establish. The pre-shared key is correct and both sides use IKEv2. The VPN logs show 'no proposal chosen'. What is the most likely cause?

Accepted Answer

Mismatched encryption algorithms. The 'no proposal chosen' error in IKEv2 indicates that the two VPN peers cannot agree on a common set of security parameters during the IKE_SA_INIT exchange. Since the pre-shared key is correct and both sides use IKEv2, the most likely cause is a mismatch in the encryption algorithms (e.g., AES-256 vs. AES-128), hash algorithms (e.g., SHA-256 vs. SHA-1), or Diffie-Hellman groups (e.g., group 14 vs. group 2). This prevents the IKE security association from being established.

Answer

Firewall blocking UDP port 500

Answer

Incorrect peer IP address

Answer

Expired certificates

Question 10

During a security audit, it is discovered that a legacy system uses SNMPv1 for network monitoring. Which of the following is the primary security concern?

Accepted Answer

Community strings transmitted in cleartext. SNMPv1 transmits community strings (effectively passwords) in cleartext over the network. An attacker capturing network traffic can directly read the community string and gain unauthorized access to SNMP-managed devices. This lack of confidentiality is the primary security concern because it exposes the entire monitoring infrastructure to compromise.

Answer

Weak hashing

Answer

No access control

Answer

Lack of encryption

Question 11

A security administrator receives an alert about a potential SYN flood attack on a web server. At which OSI layer does this attack occur?

Accepted Answer

Layer 4 (Transport). A SYN flood attack exploits the TCP three-way handshake by sending a barrage of SYN packets without completing the handshake, exhausting server resources. This attack targets the Transport Layer (Layer 4), where TCP operates, as defined in RFC 793. The security administrator's alert specifically involves TCP SYN segments, which are Layer 4 protocol data units.

Answer

Layer 7 (Application)

Answer

Layer 3 (Network)

Answer

Layer 2 (Data Link)

Question 12

A network has multiple VLANs with an IDS deployed on the core switch using SPAN ports. The IDS is missing some packets during high traffic periods. What is the best course of action to improve packet capture reliability?

Accepted Answer

Deploy the IDS inline. Deploying the IDS inline ensures that all traffic destined for the monitored segment must pass through the device, eliminating packet loss caused by oversubscription of SPAN ports during high traffic periods. SPAN ports rely on switch fabric replication, which can drop packets when the aggregate traffic exceeds the port's bandwidth or the switch's internal buffer capacity. Inline deployment places the IDS directly in the data path, guaranteeing that every packet is inspected without reliance on replication.

Answer

Implement NetFlow for monitoring

Answer

Use multiple SPAN sessions

Answer

Increase the SPAN port buffer

Question 13

A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?

Accepted Answer

An earlier deny rule matches the traffic before the permit rule. The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.

Answer

The firewall rule is disabled

Answer

The database server is down

Answer

The internal IP is on a blacklist

Question 14

An organization is implementing 802.1X authentication for wired network access. Which server is required to authenticate users?

Accepted Answer

RADIUS server. 802.1X is a port-based network access control protocol that uses the Extensible Authentication Protocol (EAP) to authenticate devices before granting network access. The authentication server in an 802.1X deployment must be a RADIUS server, as defined in IEEE 802.1X-2020, because it acts as the backend that validates credentials and communicates with the authenticator (switch) via RADIUS (RFC 2865).

Answer

DHCP server

Answer

TACACS+ server

Answer

Kerberos server

Question 15

A security engineer is designing a DMZ to host public-facing services. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Use a screened subnet with two firewalls. A screened subnet with two firewalls creates a buffer zone, and allowing inbound traffic only on required ports minimizes exposure. Placing web servers on the internal network would expose them, sharing rules with the internal network increases risk, and full mesh connectivity between DMZ hosts facilitates lateral movement.

Answer

Use the same firewall rule set for DMZ and internal network

Answer

Place web servers on the internal network

Answer

Enable full mesh connectivity between DMZ hosts