SSCP Network and Communications Security Practice Test 2 — 15 Questions

Question 1

Which of the following network protocols operates on TCP port 22 and provides secure remote administration of network devices?

Accepted Answer

SSH. SSH (Secure Shell) uses TCP port 22 for encrypted remote administration, replacing insecure Telnet.

Answer

Telnet

Answer

RDP

Answer

FTP

Question 2

An attacker sends a flood of DHCP request packets with spoofed MAC addresses to exhaust the DHCP server's IP address pool, preventing legitimate clients from obtaining IP addresses. This attack is known as:

Accepted Answer

DHCP starvation. DHCP starvation exhausts the IP pool by sending many fake DHCP requests, leading to denial of service.

Answer

ARP poisoning

Answer

MAC flooding

Answer

DHCP spoofing

Question 3

During a penetration test, a security analyst captures a packet containing a gratuitous ARP reply that associates the attacker's MAC address with the default gateway's IP address. This is a classic indicator of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) sends gratuitous ARP replies to redirect traffic, enabling man-in-the-middle attacks.

Answer

DHCP spoofing

Answer

MAC cloning

Answer

DNS poisoning

Question 4

Which of the following wireless security protocols uses AES-CCMP and is based on the 802.11i standard?

Accepted Answer

WPA2. WPA2 (Wi-Fi Protected Access 2) uses AES-CCMP encryption, as defined in 802.11i.

Answer

WEP

Answer

WPA

Answer

WPA3

Question 5

A security administrator is configuring a VPN between two branch offices. The requirement is to encrypt the entire original IP packet and add a new IP header for routing over the internet. Which IPsec mode should be used?

Accepted Answer

Tunnel mode. In tunnel mode, the entire original IP packet is encapsulated and encrypted, with a new IP header added, suitable for site-to-site VPNs.

Answer

Aggressive mode

Answer

Transport mode

Answer

Main mode

Question 6

An organization wants to deploy a firewall that can inspect the payload of application-layer protocols such as HTTP and FTP, and make access decisions based on application data. Which type of firewall best meets this requirement?

Accepted Answer

Application proxy firewall. An application proxy firewall (or application-layer gateway) performs deep inspection of application payloads, unlike stateless or stateful packet filters.

Answer

Stateless packet filter

Answer

Next-generation firewall

Answer

Stateful packet filter

Question 7

Which attack exploits the lack of IV (Initialization Vector) randomness in the RC4 algorithm to recover the Wi-Fi password, and is considered completely broken?

Accepted Answer

WEP IV attack. WEP uses RC4 with weak IVs that can be captured and analyzed to recover the key, making WEP completely insecure.

Answer

PMKID attack

Answer

Evil twin attack

Answer

KRACK attack

Question 8

Which of the following is a connectionless transport layer protocol primarily used for services like DNS and DHCP?

Accepted Answer

UDP. UDP is connectionless and used by DNS (port 53) and DHCP (ports 67-68).

Answer

IP

Answer

TCP

Answer

ICMP

Question 9

A security team is implementing Network Access Control (NAC) to enforce endpoint compliance before granting network access. Which technology allows port-based authentication on wired networks?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control, commonly used with RADIUS for authentication.

Answer

RADIUS

Answer

WPA2-Enterprise

Answer

MAC filtering

Question 10

Which of the following best describes the function of SYN cookies in mitigating SYN flood attacks?

Accepted Answer

They encode connection state in the SYN-ACK sequence number, allowing the server to avoid storing state until the ACK is received.. SYN cookies allow the server to avoid allocating resources for half-open connections until the handshake completes, preventing resource exhaustion.

Answer

They block all incoming SYN packets from suspicious sources.

Answer

They increase the backlog queue size to accommodate more half-open connections.

Answer

They require clients to solve a computational puzzle before completing the handshake.

Question 11

An organization is planning to deploy a remote access VPN for employees. The solution must support strong encryption, mutual authentication, and work through firewalls without requiring additional ports. Which technology is most suitable?

Accepted Answer

SSL/TLS VPN. SSL/TLS VPNs (e.g., Cisco AnyConnect) operate over port 443 (HTTPS), which is commonly allowed through firewalls, and provide strong encryption and authentication.

Answer

L2TP/IPsec

Answer

PPTP

Answer

IPsec tunnel mode

Question 12

Which of the following is a common defense against ARP spoofing attacks on a local area network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets against a trusted database (DHCP snooping binding), preventing spoofed ARP messages.

Answer

DHCP snooping

Answer

Port security

Answer

MAC filtering

Question 13

A security analyst is investigating a network incident. Which TWO of the following are indicators of a man-in-the-middle attack using ARP spoofing? (Select TWO)

Accepted Answer

An ARP entry for the default gateway points to an unknown MAC address.. Duplicate MAC addresses for the same IP (since attacker claims the IP) and an entry matching the attacker's MAC with the gateway IP indicate ARP spoofing.

Answer

High number of TCP retransmissions from a single host.

Answer

The switch's CAM table has multiple MAC entries on the same port.

Answer

Multiple IP addresses resolve to the same MAC address in the ARP cache.

Question 14

Which THREE of the following are security features of WPA3 compared to WPA2? (Select THREE)

Accepted Answer

Protected Management Frames (PMF) mandatory. WPA3 introduces SAE (Simultaneous Authentication of Equals) to replace PSK, provides 192-bit security in Enterprise mode, and mandates PMF (Protected Management Frames).

Answer

Backward compatibility with WEP

Answer

Use of TKIP encryption

Question 15

A company is designing a network with multiple security zones. Which TWO of the following are best practices for network segmentation? (Select TWO)

Accepted Answer

Place a firewall between each security zone to enforce traffic filtering.. Placing firewalls between zones and using VLANs for logical separation are key segmentation practices. DMZ is a specific zone, not a universal practice.

Answer

Use a single flat network to reduce complexity.

Answer

Disable logging on inter-zone firewalls to improve performance.

Answer

Place all servers in the same broadcast domain for easier management.