SSCP Network and Communications Security — 30 Questions

Question 1

Which protocol and port combination is commonly used for secure remote administration of a server?

Accepted Answer

SSH on TCP 22. SSH operates on TCP port 22 and provides encrypted remote administration, while Telnet (port 23) is unencrypted. HTTPS (443) is for web traffic, and RDP (3389) is for remote desktop but not primarily for command-line administration.

Answer

HTTPS on TCP 443

Answer

Telnet on TCP 23

Answer

RDP on TCP 3389

Question 2

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing involves sending forged ARP replies to associate the attacker's MAC with the victim's IP, enabling man-in-the-middle attacks at Layer 2.

Answer

SYN flood

Answer

DNS poisoning

Answer

DHCP starvation

Question 3

A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?

Accepted Answer

Stateful firewall. Stateful firewalls maintain a state table and track the state of connections, allowing them to make more intelligent filtering decisions compared to stateless packet filters.

Answer

Stateless packet filter

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 4

During a wireless penetration test, an attacker captures the four-way handshake of a WPA2-PSK network and attempts to crack the passphrase offline. Which attack is the attacker likely using?

Accepted Answer

Evil twin attack. In the given scenario, the attacker captures the four-way handshake of a WPA2-PSK network. The most likely method to capture such a handshake is an evil twin attack, where the attacker sets up a rogue access point impersonating a legitimate network. Once a client connects to the rogue AP, the attacker captures the handshake and can then attempt to crack the passphrase offline using dictionary or brute-force attacks.

Answer

WPS PIN attack

Answer

KRACK attack

Answer

PMKID attack

Question 5

Which protocol is used for secure web browsing and operates on TCP port 443?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Answer

HTTP

Answer

SSH

Answer

FTP

Question 6

An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?

Accepted Answer

Network Access Control (NAC) with 802.1X. Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Firewall rules

Question 7

A network administrator wants to block all inbound traffic except for web and email services. Which firewall rule configuration would achieve this?

Accepted Answer

Default-deny with allow rules for HTTP, HTTPS, and SMTP. A default-deny rule blocks all traffic by default, and then explicit allow rules for specific services (HTTP, HTTPS, SMTP) permit desired inbound traffic.

Answer

Stateful inspection without default policy

Answer

Stateless packet filtering with a rule per service

Answer

Default-allow with deny rules for unwanted services

Question 8

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman key exchange, ensuring that session keys cannot be derived if the server's private key is compromised later.

Answer

Reduced cipher suite options including CBC mode

Answer

Use of RC4 cipher

Answer

Support for static RSA key exchange

Question 9

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests with the victim's spoofed source IP to the broadcast address, causing all hosts to reply to the victim, amplifying traffic.

Answer

Ping of death

Answer

SYN flood

Answer

DNS amplification

Question 10

A company is deploying a VPN for remote employees. They require strong encryption and authentication, and the solution must be compatible with native OS clients without additional software. Which VPN protocol is most appropriate?

Accepted Answer

IPsec with IKEv2. IKEv2 with IPsec is widely supported natively on major operating systems, provides strong security, and is suitable for remote access VPNs.

Answer

PPTP

Answer

SSL VPN with proprietary client

Answer

L2TP/IPsec with pre-shared keys

Question 11

During a security audit, a penetration tester successfully extracts the PMKID from a wireless beacon. What information can be derived from this attack?

Accepted Answer

The ability to crack the passphrase offline. The PMKID attack allows offline brute-forcing of the WPA2-PSK passphrase by computing the PMKID locally and comparing it to the captured value.

Answer

The PMK (pairwise master key) directly

Answer

The encryption keys used in the session

Answer

The PSK (pre-shared key) directly

Question 12

Which UDP port is used by the Simple Network Management Protocol (SNMP) for receiving traps?

Accepted Answer

UDP 162. SNMP traps are sent from agents to managers on UDP port 162, while SNMP queries typically use port 161.

Answer

UDP 161

Answer

UDP 123

Answer

UDP 514

Question 13

A security engineer is designing a network segmentation strategy to isolate a DMZ containing public-facing web servers from the internal corporate network. Which TWO controls should be implemented? (Select two)

Accepted Answer

Separate VLANs for DMZ and internal networks. A firewall with rules restricting traffic between DMZ and internal networks, and separate VLANs for DMZ and internal networks, are key segmentation controls. IDS/IPS are detection, not segmentation. NAC controls access, not segmentation. DMZ subnet is a concept, not a control.

Answer

Network Access Control (NAC) on all endpoints

Answer

A separate IP subnet for the DMZ

Answer

An intrusion detection system (IDS) monitoring traffic between segments

Question 14

A company is migrating from WPA2 to WPA3 for wireless security. Which THREE features does WPA3 introduce? (Select three)

Accepted Answer

192-bit security suite for Enterprise networks. WPA3 introduces SAE (Simultaneous Authentication of Equals) to replace PSK, mandates PMF (Protected Management Frames), and offers 192-bit security for Enterprise mode. WPS is removed in WPA3. CCMP is used in WPA2 as well.

Answer

Wi-Fi Protected Setup (WPS)

Answer

CCMP encryption as mandatory

Question 15

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Accepted Answer

Implement DNSSEC to validate DNS responses. DNSSEC validates DNS responses to prevent spoofing, and using secure DNS resolvers (like Quad9 or Cloudflare) can filter malicious domains. Disabling recursion is a best practice but not a direct countermeasure against poisoning. DHCP snooping is for DHCP attacks. Firewalls don't prevent DNS poisoning.

Answer

Configure firewall rules to block UDP port 53

Answer

Disable DNS recursion on authoritative servers

Answer

Enable DHCP snooping on switches

Question 16

Which of the following network protocols operates on TCP port 22 and provides secure remote administration of network devices?

Accepted Answer

SSH. SSH (Secure Shell) uses TCP port 22 for encrypted remote administration, replacing insecure Telnet.

Answer

Telnet

Answer

RDP

Answer

FTP

Question 17

An attacker sends a flood of DHCP request packets with spoofed MAC addresses to exhaust the DHCP server's IP address pool, preventing legitimate clients from obtaining IP addresses. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation exhausts the IP pool by sending many fake DHCP requests, leading to denial of service.

Answer

ARP poisoning

Answer

MAC flooding

Answer

DHCP spoofing

Question 18

During a penetration test, a security analyst captures a packet containing a gratuitous ARP reply that associates the attacker's MAC address with the default gateway's IP address. This is a classic indicator of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) sends gratuitous ARP replies to redirect traffic, enabling man-in-the-middle attacks.

Answer

DHCP spoofing

Answer

MAC cloning

Answer

DNS poisoning

Question 19

Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?

Accepted Answer

WPA2. WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption, as defined in 802.11i.

Answer

WEP

Answer

WPA

Answer

WPA3

Question 20

A security administrator is configuring a VPN between two branch offices. The requirement is to encrypt the entire original IP packet and add a new IP header for routing over the internet. Which IPsec mode should be used?

Accepted Answer

Tunnel mode. In tunnel mode, the entire original IP packet is encapsulated and encrypted, with a new IP header added, suitable for site-to-site VPNs.

Answer

Aggressive mode

Answer

Transport mode

Answer

Main mode