SSCP Network and Communications Security — 50 Questions

Question 1

During a wireless penetration test, an attacker captures the four-way handshake of a WPA2-PSK network and attempts to crack the passphrase offline. Which attack is the attacker likely using?

Accepted Answer

Evil twin attack. In the given scenario, the attacker captures the four-way handshake of a WPA2-PSK network. The most likely method to capture such a handshake is an evil twin attack, where the attacker sets up a rogue access point impersonating a legitimate network. Once a client connects to the rogue AP, the attacker captures the handshake and can then attempt to crack the passphrase offline using dictionary or brute-force attacks.

Answer

WPS PIN attack

Answer

KRACK attack

Answer

PMKID attack

Question 2

An organization wants to deploy a firewall that can inspect the payload of application-layer protocols such as HTTP and FTP, and make access decisions based on application data. Which type of firewall best meets this requirement?

Accepted Answer

Application proxy firewall. An application proxy firewall operates at the application layer (Layer 7), acting as an intermediary that fully understands protocols like HTTP and FTP. It terminates the client connection, inspects the payload, and makes access decisions based on application data, which meets the requirement to inspect application-layer protocols.

Answer

Stateless packet filter

Answer

Next-generation firewall

Answer

Stateful packet filter

Question 3

Which protocol is used to securely transfer files over a network and operates on TCP port 22?

Accepted Answer

SSH. SSH (Secure Shell) is the correct answer because it is the protocol that provides secure, encrypted communication over TCP port 22. While SSH is commonly used for remote command-line access, it also supports secure file transfer through its subsystems, such as SFTP and SCP. The question asks for the protocol that securely transfers files over a network on port 22, and SSH is the foundational protocol that enables this secure transfer. SFTP, although it also uses port 22, is a file transfer protocol that runs over SSH, but the question specifically asks for the protocol that operates on port 22, which is SSH itself.

Answer

Telnet

Answer

SFTP

Answer

FTP

Question 4

An organization deploys a firewall that examines the entire packet, including application-layer data, and can block specific commands or content. Which type of firewall is this?

Accepted Answer

Application proxy firewall. An application proxy firewall operates at the application layer (Layer 7) and examines the entire packet, including application-layer data. It can understand specific protocols like HTTP, FTP, and SMTP, and can block specific commands or content based on configured policies. This deep inspection distinguishes it from stateful and stateless firewalls.

Answer

Stateful firewall

Answer

Next-generation firewall

Answer

Stateless packet filter

Question 5

In IPsec VPNs, which protocol provides authentication and encryption of the entire IP packet, including the IP header, in tunnel mode?

Accepted Answer

ESP. ESP (Encapsulating Security Payload) is the IPsec protocol that provides both confidentiality (encryption) and authentication for the entire IP packet in tunnel mode. In tunnel mode, ESP encapsulates the original IP packet—including its header—inside a new IP packet, encrypting the payload and optionally authenticating it via HMAC. AH, by contrast, only provides authentication and integrity, not encryption. Therefore, ESP is the correct answer.

Answer

L2TP

Answer

IKE

Answer

AH

Question 6

Which of the following is a primary advantage of using TLS 1.3 over earlier versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by requiring ephemeral key exchange mechanisms like ECDHE, ensuring that session keys cannot be compromised even if the server's long-term private key is later exposed. This is a fundamental security improvement over earlier versions where forward secrecy was optional.

Answer

Reduced handshake latency with 0-RTT

Answer

Support for RC4 cipher suites

Answer

Backward compatibility with SSL 3.0

Question 7

During a security assessment, a penetration tester discovers that the network uses WPA2-PSK. Which attack could be used to recover the pre-shared key without interacting with the access point after capturing a single handshake?

Accepted Answer

PMKID attack. The PMKID attack (discovered by hashcat's team in 2018) allows an attacker to capture the Pairwise Master Key Identifier from a single EAPOL frame sent by the access point during the WPA2 4-way handshake, without needing a client to be present or deauthenticated. The captured PMKID can then be cracked offline against a dictionary to recover the PSK. It requires no interaction with the AP beyond receiving one frame, which matches the question's constraint exactly.

Answer

Deauthentication attack

Answer

KRACK attack

Answer

Evil twin attack

Question 8

A security administrator is hardening a wireless network. Which TWO of the following should be avoided due to known vulnerabilities?

Accepted Answer

WEP. WEP (option C) must be avoided because its RC4-based encryption with static, short IVs and weak key scheduling makes it trivially crackable in minutes with tools like aircrack-ng, and it provides no meaningful protection. WPA2-PSK (option D) should also be avoided because its pre-shared key mode is vulnerable to offline dictionary and brute-force attacks against the captured 4-way handshake, and it is additionally exposed to the KRACK key-reinstallation flaw and PMKID-based attacks; WPA3-Personal's SAE and WPA2/WPA3-Enterprise's 802.1X/EAP with per-session keys do not share these weaknesses. WPA3-Enterprise (option A), WPA3-Personal (option B), and WPA2-Enterprise (option E) are not the intended answers since they use stronger authentication and key management mechanisms (SAE, 802.1X/EAP, AES-CCMP/GCMP) that mitigate the known flaws of WEP and WPA2-PSK.

Answer

WPA3-Enterprise

Answer

WPA3-Personal

Answer

WPA2-Enterprise

Question 9

A security analyst is investigating a potential ARP spoofing attack on a local network segment. Which TWO network security controls would be most effective in preventing or detecting such an attack at Layer 2?

Accepted Answer

Implement Port Security with MAC address binding. Option C is correct because Port Security with MAC address binding restricts which source MAC addresses can appear on a switch port, so an attacker cannot flood the CAM table or send forged ARP replies claiming another host's MAC, directly mitigating ARP spoofing at Layer 2. Option E is correct because Dynamic ARP Inspection (DAI) on switches validates ARP packets against the trusted DHCP snooping binding table and drops ARP replies with invalid IP-to-MAC mappings, which is the standard Layer 2 defense against ARP spoofing. Option A is not the best answer here because DHCP snooping only builds the trusted binding database used by DAI and filters rogue DHCP servers; by itself it does not inspect or block forged ARP packets. Option B is incorrect because IPsec transport mode protects IP payloads at Layer 3 and does not prevent or detect ARP spoofing on the local segment. Option D is not the most effective control because a network-based IDS can only monitor and alert on suspicious ARP traffic, not prevent the attack, and it is a detection rather than a Layer 2 prevention mechanism.

Answer

Configure DHCP snooping on switches

Answer

Use IPsec transport mode between hosts

Answer

Deploy a network-based IDS monitoring ARP traffic

Question 10

During a security assessment, a penetration tester successfully performs a DHCP starvation attack followed by a DHCP spoofing attack. Which TWO outcomes are the most likely consequences of this combined attack?

Accepted Answer

Clients' default gateway and DNS servers are set to attacker-controlled addresses. Option B is correct because the DHCP starvation attack exhausts the legitimate DHCP server's address pool, forcing clients to obtain leases from the attacker's rogue DHCP server. Option A is correct because a rogue DHCP server can supply malicious DHCP options, including the default gateway (option 3) and DNS servers (option 6), redirecting client traffic through attacker-controlled systems. Option C is not a direct consequence of DHCP spoofing itself; ARP spoofing is a separate Layer 2 attack that does not require DHCP manipulation. Option D is incorrect because DHCP spoofing does not grant administrative access to domain controllers. Option E is incorrect because DHCP spoofing does not encrypt traffic with TLS; it can enable man-in-the-middle interception, not encryption.

Answer

The attacker can perform ARP spoofing on the network

Answer

The attacker gains administrative access to domain controllers

Answer

All network traffic is encrypted using TLS

Question 11

A security engineer is configuring a site-to-site VPN between two data centers using IPsec in tunnel mode. The engineer must ensure that the VPN provides data origin authentication and integrity for each packet without relying solely on the encryption algorithm. Which two components of the IPsec suite should be used together to meet these requirements? (Choose two.)

Accepted Answer

Encapsulating Security Payload (ESP) with a strong encryption algorithm. The Authentication Header (AH) is designed to provide data origin authentication and integrity for IP packets, including the IP header. The Encapsulating Security Payload (ESP) with a strong encryption algorithm provides confidentiality and can also offer authentication and integrity. Together, AH and ESP deliver the required security services for a site-to-site IPsec tunnel. IKEv2 is used for key exchange but does not protect individual packets, and SSL/TLS is not part of IPsec.

Answer

Encapsulating Security Payload (ESP) with NULL encryption

Answer

Secure Sockets Layer (SSL) / Transport Layer Security (TLS)

Answer

Internet Key Exchange (IKE) version 2

Question 12

A security administrator is configuring a new IPsec VPN tunnel between two branch offices. The requirement is to ensure that each packet's payload is encrypted but the original IP header is preserved so that routing across the public internet works without additional encapsulation. Which IPsec mode should be used?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encapsulates the entire original IP packet within a new IP packet, allowing private addresses to traverse a public network while keeping the payload encrypted. This is essential for site-to-site VPNs where gateways must route traffic between private networks. Transport mode would leave the original header exposed and is intended for host-to-host communications. IKE modes are negotiation phases, not encapsulation methods.

Answer

Main mode

Answer

Aggressive mode

Answer

Transport mode

Question 13

A security administrator is reviewing a network diagram and notices that a legacy application server communicates with a database server over an unencrypted connection. To protect this traffic without modifying the application, the administrator decides to implement a solution that operates at the transport layer and can provide confidentiality and integrity for the data in transit. Which technology should be used?

Accepted Answer

TLS/SSL. TLS/SSL is designed to secure transport-layer communications and can be inserted transparently between a legacy application and its database without altering the application code. It provides encryption, integrity, and authentication, meeting the requirement to protect data in transit. The other options either operate at different layers or require application modifications, making them less suitable for this scenario.

Answer

HTTPS

Answer

IPsec in transport mode

Answer

SSH tunneling

Question 14

A security engineer is evaluating a network protocol that uses a 32-bit sequence number and a 16-bit checksum. The engineer is concerned about an attacker injecting spoofed packets into an established TCP session. Which of the following is the MOST effective mitigation to prevent this type of attack?

Accepted Answer

Implementing IPsec ESP with confidentiality. IPsec ESP with confidentiality encrypts the TCP payload and headers, preventing an attacker from reading or modifying the sequence numbers needed to inject spoofed packets. Without the encryption keys, the attacker cannot craft valid packets that the receiver will accept. This provides a robust defense against TCP session hijacking, unlike the other options which offer weaker or incomplete protection.

Answer

Enabling TCP MD5 signatures

Answer

Using a random initial sequence number (ISN)

Answer

Deploying a stateful firewall

Question 15

A security engineer is reviewing a packet capture and sees that an internal host is sending TCP segments with the SYN flag set, a spoofed source address of a server on the same subnet, and a destination of another internal host. The two internal hosts then exchange no further traffic. Which type of activity does this pattern most likely represent?

Accepted Answer

A TCP SYN reflection in which the attacker spoofs a server's address to make the victim send SYN-ACK replies to that server. Forging the source address of one internal server while sending SYNs to another causes the victim to send its SYN-ACK replies to the spoofed server, reflecting traffic onto a third party. The lack of subsequent packets fits an attacker who is not in the return path and does not need the handshake to complete. This is a reflection behavior rather than a resource-exhaustion flood or session takeover.

Answer

A session hijack in which the attacker predicts sequence numbers to take over an established connection

Answer

A SYN flood used to exhaust the connection table of the target host

Answer

A land attack in which the source and destination addresses are both set to the victim

Question 16

An organization must protect the integrity and confidentiality of email in transit between two sites, and it also wants to ensure that the sending server's identity is validated by the receiving server before mail is accepted. Which combination of controls best meets these goals?

Accepted Answer

Enforce TLS with certificate validation between the mail servers and publish a DKIM key so messages carry a verifiable signature. Enforced TLS with certificate validation provides encrypted transport and mutual proof of server identity, closing the fallback-to-cleartext gap of opportunistic TLS. DKIM supplies a signed digest that lets the receiving side confirm the message content and key headers were not modified after signing. Together they cover confidentiality, server authentication, and message integrity for inter-site mail.

Answer

Deploy an S/MIME gateway that signs and encrypts messages, and rely on the existing MX records for routing

Answer

Publish an SPF record for the sending domain and enable opportunistic TLS on the mail servers

Answer

Enable DMARC in monitor mode and allow cleartext SMTP between the sites with IP allow listing

Question 17

Which protocol and port combination is commonly used for secure remote administration of a server?

Accepted Answer

SSH on TCP 22. SSH on TCP port 22 is the standard protocol for secure remote administration of Linux/Unix servers, providing encrypted authentication and session traffic. It replaces insecure protocols like Telnet and rlogin by encrypting the entire session, including credentials, using strong ciphers and key exchange.

Answer

HTTPS on TCP 443

Answer

Telnet on TCP 23

Answer

RDP on TCP 3389

Question 18

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with multiple IP addresses, causing traffic intended for those IPs to be redirected to the attacker. This matches the scenario where one MAC address claims to be multiple IP addresses. The goal is often to intercept, modify, or block network traffic (man-in-the-middle).

Answer

SYN flood

Answer

DNS poisoning

Answer

DHCP starvation

Question 19

A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?

Accepted Answer

Stateful firewall. A stateful firewall tracks the state of active connections using a state table, so it can allow return traffic for an established session without an explicit inbound rule. This context-aware decision-making — matching packets to existing flows — is exactly what the requirement describes.

Answer

Stateless packet filter

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 20

Which protocol is used for secure web browsing and operates on TCP port 443?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Answer

HTTP

Answer

SSH

Answer

FTP