SSCP Network and Communications Security Practice Test 2 — 15 Questions

Question 1

An organization must protect the integrity and confidentiality of email in transit between two sites, and it also wants to ensure that the sending server's identity is validated by the receiving server before mail is accepted. Which combination of controls best meets these goals?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce TLS with certificate validation between the mail servers and publish a DKIM key so messages carry a verifiable signature. Enforced TLS with certificate validation provides encrypted transport and mutual proof of server identity, closing the fallback-to-cleartext gap of opportunistic TLS. DKIM supplies a signed digest that lets the receiving side confirm the message content and key headers were not modified after signing. Together they cover confidentiality, server authentication, and message integrity for inter-site mail.

Answer

Deploy an S/MIME gateway that signs and encrypts messages, and rely on the existing MX records for routing

Answer

Publish an SPF record for the sending domain and enable opportunistic TLS on the mail servers

Answer

Enable DMARC in monitor mode and allow cleartext SMTP between the sites with IP allow listing

Question 2

Which protocol and port combination is commonly used for secure remote administration of a server?

Accepted Answer

SSH on TCP 22. SSH on TCP port 22 is the standard protocol for secure remote administration of Linux/Unix servers, providing encrypted authentication and session traffic. It replaces insecure protocols like Telnet and rlogin by encrypting the entire session, including credentials, using strong ciphers and key exchange.

Answer

HTTPS on TCP 443

Answer

Telnet on TCP 23

Answer

RDP on TCP 3389

Question 3

A security analyst notices an unusual number of ARP replies on the network where one MAC address is claiming to be multiple IP addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with multiple IP addresses, causing traffic intended for those IPs to be redirected to the attacker. This matches the scenario where one MAC address claims to be multiple IP addresses. The goal is often to intercept, modify, or block network traffic (man-in-the-middle).

Answer

SYN flood

Answer

DNS poisoning

Answer

DHCP starvation

Question 4

A company wants to deploy a firewall that can track the state of active connections and make decisions based on the context of traffic flows. Which firewall type should they choose?

Accepted Answer

Stateful firewall. A stateful firewall tracks the state of active connections using a state table, so it can allow return traffic for an established session without an explicit inbound rule. This context-aware decision-making — matching packets to existing flows — is exactly what the requirement describes.

Answer

Stateless packet filter

Answer

Application proxy firewall

Answer

Next-generation firewall

Question 5

Which protocol is used for secure web browsing and operates on TCP port 443?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS) uses TCP port 443 and provides encrypted communication for websites.

Answer

HTTP

Answer

SSH

Answer

FTP

Question 6

An organization wants to ensure that only authorized devices can connect to the corporate wired network. Which technology should they implement to enforce this?

Accepted Answer

Network Access Control (NAC) with 802.1X. Network Access Control (NAC) with 802.1X authenticates devices before granting network access, enforcing compliance and authorization.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Firewall rules

Question 7

A network administrator wants to block all inbound traffic except for web and email services. Which firewall rule configuration would achieve this?

Accepted Answer

Default-deny with allow rules for HTTP, HTTPS, and SMTP. A default-deny with allow rules for HTTP, HTTPS, and SMTP is the correct approach because it blocks all inbound traffic except the specified services. This follows the principle of least privilege and ensures only necessary traffic is permitted.

Answer

Stateful inspection without default policy

Answer

Stateless packet filtering with a rule per service

Answer

Default-allow with deny rules for unwanted services

Question 8

Which of the following is a characteristic of TLS 1.3 that improves security over previous versions?

Accepted Answer

Mandatory forward secrecy. TLS 1.3 mandates forward secrecy by removing static RSA and static Diffie-Hellman key exchange, requiring ephemeral key exchange (ECDHE) for every session. This means a compromised long-term private key cannot decrypt previously recorded sessions, which is a major security improvement over TLS 1.2 where static RSA was optional but allowed. This is codified in RFC 8446.

Answer

Reduced cipher suite options including CBC mode

Answer

Use of RC4 cipher

Answer

Support for static RSA key exchange

Question 9

Which attack sends a flood of forged ICMP echo requests to a network's broadcast address to overwhelm a target?

Accepted Answer

Smurf attack. A Smurf attack sends a flood of forged ICMP echo requests to a network's broadcast address with the source IP spoofed as the target's IP. All hosts on the network respond to the broadcast, overwhelming the target with ICMP echo replies. This is a classic amplification attack. Therefore, Smurf attack is correct.

Answer

Ping of death

Answer

SYN flood

Answer

DNS amplification

Question 10

A company is deploying a VPN for remote employees. They require strong encryption and authentication, and the solution must be compatible with native OS clients without additional software. Which VPN protocol is most appropriate?

Accepted Answer

IPsec with IKEv2. IPsec with IKEv2 is a modern VPN protocol that provides strong encryption and authentication, and it is natively supported by most operating systems (Windows, macOS, iOS, Android) without requiring additional client software. It supports flexible authentication methods including certificates and EAP, making it suitable for remote access.

Answer

PPTP

Answer

SSL VPN with proprietary client

Answer

L2TP/IPsec with pre-shared keys

Question 11

During a security audit, a penetration tester successfully extracts the PMKID from a wireless beacon. What information can be derived from this attack?

Accepted Answer

The ability to crack the passphrase offline. The PMKID attack captures the PMKID from a wireless beacon or association frame, which is derived from the PMK and other values. This PMKID can be used to perform an offline brute-force or dictionary attack against the passphrase (PSK). The attacker cannot directly derive the PMK or PSK from the PMKID, but can attempt to crack the passphrase offline.

Answer

The PMK (pairwise master key) directly

Answer

The encryption keys used in the session

Answer

The PSK (pre-shared key) directly

Question 12

Which UDP port is used by the Simple Network Management Protocol (SNMP) for receiving traps?

Accepted Answer

UDP 162. SNMP agents listen for requests on UDP port 161, but SNMP traps (and inform requests) are sent by the agent to the manager on UDP port 162. The manager must listen on UDP 162 to receive unsolicited notifications. This separation of ports lets the manager distinguish inbound trap traffic from its own outbound polling.

Answer

UDP 161

Answer

UDP 123

Answer

UDP 514

Question 13

A security engineer is designing a network segmentation strategy to isolate a DMZ containing public-facing web servers from the internal corporate network. Which TWO controls should be implemented? (Select two)

Accepted Answer

Separate VLANs for DMZ and internal networks. Option A is correct because placing the DMZ and internal network in separate VLANs provides Layer 2 segmentation, preventing broadcast traffic and direct frame-level communication between the two zones unless explicitly routed through a Layer 3 device. Option B is correct because a firewall enforcing least privilege between zones is the core segmentation control: it allows only required inbound traffic (e.g., TCP 443 to the web servers) into the DMZ and restricts outbound DMZ-to-internal traffic, blocking lateral movement if a public-facing server is compromised. Option D is not sufficient on its own because a separate IP subnet alone does not enforce traffic filtering; routing between subnets can still occur without a firewall policy. Option C does not belong because NAC controls endpoint admission to the network and does not segment an existing DMZ from the internal network. Option E does not belong because an IDS only monitors and alerts on traffic; it does not enforce segmentation or block unauthorized flows.

Answer

Network Access Control (NAC) on all endpoints

Answer

A separate IP subnet for the DMZ

Answer

An intrusion detection system (IDS) monitoring traffic between segments

Question 14

A company is migrating from WPA2 to WPA3 for wireless security. Which THREE features does WPA3 introduce? (Select three)

Accepted Answer

192-bit security suite for Enterprise networks. WPA3 introduces the 192-bit security suite for Enterprise networks (option A), which is based on CNSA Suite algorithms and provides stronger cryptographic protection for government, defense, and high-security enterprise environments. Simultaneous Authentication of Equals (SAE) (option C) is the new WPA3-Personal handshake that replaces WPA2's PSK method, providing forward secrecy and resistance to offline dictionary attacks. Protected Management Frames (PMF) mandatory (option D) is correct because WPA3 requires PMF (802.11w) to protect management frames from forging and eavesdropping attacks, whereas it was optional in WPA2. Wi-Fi Protected Setup (WPS) (option B) is not a WPA3-introduced feature; it predates WPA3 and is actually discouraged due to security weaknesses. CCMP encryption as mandatory (option E) is incorrect because CCMP is the WPA2 mandatory cipher, while WPA3-Personal still uses CCMP-128 but also introduces GCMP-256 in the 192-bit suite, so CCMP being 'mandatory' is not a new WPA3 feature.

Answer

Wi-Fi Protected Setup (WPS)

Answer

CCMP encryption as mandatory

Question 15

A network administrator is troubleshooting a DNS poisoning attack. Which TWO countermeasures can help prevent such attacks? (Select two)

Accepted Answer

Implement DNSSEC to validate DNS responses. Option A (Implement DNSSEC to validate DNS responses) is correct because DNSSEC adds cryptographic signatures (RRSIG) to DNS records so a resolver can verify authenticity and integrity, preventing forged or spoofed records from being accepted during a poisoning attack. Option D (Use secure DNS resolvers that enforce DNSSEC validation) is correct because even with DNSSEC deployed, the resolver must actually perform validation of the chain of trust (via DS/DNSKEY records) to reject bogus answers; resolvers that enforce validation stop poisoned data from reaching clients. Option B is wrong because blocking UDP port 53 would break legitimate DNS resolution entirely rather than prevent poisoning. Option C is wrong because disabling recursion on authoritative servers is a general hardening practice but does not by itself prevent cache poisoning of recursive resolvers. Option E is wrong because DHCP snooping protects against rogue DHCP servers and Layer 2 attacks, not DNS cache poisoning.

Answer

Configure firewall rules to block UDP port 53

Answer

Disable DNS recursion on authoritative servers

Answer

Enable DHCP snooping on switches