SSCP Network and Communications Security Practice Test 4 — 15 Questions

Question 1

Which transport layer protocol is used by DNS for its queries and responses, and why is it appropriate?

Accepted Answer

UDP, because it is connectionless and fast, suitable for short exchanges.. DNS primarily uses UDP for its fast, low-overhead queries. TCP is used for zone transfers or when responses exceed 512 bytes.

Answer

UDP, because it guarantees packet ordering.

Answer

TCP, because it provides error checking and retransmission.

Answer

TCP, because reliability is critical for DNS resolution.

Question 2

An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?

Accepted Answer

ARP spoofing; risk is man-in-the-middle traffic interception.. ARP spoofing allows the attacker to intercept traffic meant for the gateway, performing a man-in-the-middle attack.

Answer

DNS poisoning; risk is traffic redirection to malicious sites.

Answer

DHCP starvation; risk is denial of service.

Answer

SYN flood; risk is resource exhaustion.

Question 3

A security administrator is configuring a firewall to allow outbound web traffic from internal users. The firewall must inspect the application layer data to block malicious URLs. Which type of firewall should be used?

Accepted Answer

Application proxy firewall. An application proxy firewall can examine application layer content, such as HTTP requests, to enforce URL filtering.

Answer

Stateless packet filter

Answer

Stateful firewall

Answer

Network Access Control (NAC) system

Question 4

Which wireless security standard replaces WPA2 and mandates Protected Management Frames (PMF) to prevent certain types of attacks?

Accepted Answer

WPA3. WPA3 mandates PMF, making it resistant to offline dictionary attacks and key recovery attacks like KRACK.

Answer

802.1X

Answer

WEP

Answer

WPA2

Question 5

During a security assessment, a penetration tester discovers that the network uses WPA2-PSK. Which attack could be used to recover the pre-shared key without interacting with the access point after capturing a single handshake?

Accepted Answer

PMKID attack. The PMKID attack allows offline cracking of the PSK using information from the first frame of the 4-way handshake, even without a full handshake.

Answer

Deauthentication attack

Answer

KRACK attack

Answer

Evil twin attack

Question 6

A security engineer is configuring a site-to-site VPN between two branch offices using IPsec in tunnel mode. Which protocol provides both authentication and encryption of the entire original IP packet?

Accepted Answer

ESP (Encapsulating Security Payload) in tunnel mode. ESP in tunnel mode encrypts and authenticates the entire original IP packet, while AH only authenticates.

Answer

IKEv2 in transport mode

Answer

L2TP in tunnel mode

Answer

AH (Authentication Header) in tunnel mode

Question 7

An organization wants to ensure that only corporate-managed devices can connect to the internal network. Non-compliant devices should be placed in a restricted VLAN with limited access. Which technology should be deployed?

Accepted Answer

Network Access Control (NAC). Network Access Control (NAC) with 802.1X can enforce policies, quarantine non-compliant devices, and assign appropriate VLANs.

Answer

Virtual Private Network (VPN)

Answer

Stateful firewall

Answer

Intrusion Prevention System (IPS)

Question 8

Which TCP port is commonly used for secure web traffic (HTTPS) and is often allowed through firewalls for web browsing?

Accepted Answer

443. HTTPS operates over TCP port 443, which is commonly open for secure web traffic.

Answer

22

Answer

80

Answer

3389

Question 9

A system administrator notices a high number of half-open TCP connections to the company's web server. The server is becoming unresponsive. Which attack is likely occurring, and which mitigation is effective?

Accepted Answer

SYN flood; mitigation: enable SYN cookies.. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake. SYN cookies allow the server to avoid allocating resources until the handshake completes.

Answer

ARP spoofing; mitigation: static ARP entries.

Answer

Smurf attack; mitigation: disable IP broadcasts.

Answer

Ping of death; mitigation: block fragmented ICMP packets.

Question 10

A security analyst discovers that an internal DNS server is returning incorrect IP addresses for legitimate domains. The analyst suspects that an attacker has compromised the DNS resolver's cache. Which type of attack has likely occurred?

Accepted Answer

DNS poisoning. DNS poisoning involves inserting false DNS records into a resolver's cache, redirecting users to malicious sites.

Answer

DNS amplification attack

Answer

SYN flood

Answer

DNS tunneling

Question 11

Which protocol is used to securely transfer files between a client and server, typically over TCP port 22?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted file transfer capabilities via SCP or SFTP, using port 22.

Answer

SMTP

Answer

TFTP

Answer

FTP

Question 12

A network administrator is tasked with segmenting the network to isolate a DMZ containing public-facing web servers from the internal corporate network. Which device should be placed between the DMZ and internal network, and what type of traffic should it allow?

Accepted Answer

Firewall; allow only specific traffic from internal to DMZ and block DMZ-initiated connections to internal.. A firewall should be used to control traffic; it should allow only necessary inbound and outbound traffic while blocking direct access from DMZ to internal network.

Answer

Router; allow all traffic but use NAT.

Answer

IDS; monitor traffic but do not block.

Answer

Switch; allow all traffic between DMZ and internal network.

Question 13

A security auditor is reviewing the configuration of a remote access VPN. Which TWO features are considered best practices for securing the VPN connection?

Accepted Answer

Implementing multi-factor authentication (MFA). Multi-factor authentication (MFA) adds an extra layer of security beyond passwords, reducing the risk of unauthorized access. TLS 1.3 with mandatory forward secrecy ensures that session keys are not compromised even if the server's private key is later exposed, providing strong encryption. Both are established best practices for securing remote access VPNs.

Answer

Using IKEv2 with pre-shared keys only

Answer

Disabling encryption to reduce latency

Answer

Enabling split tunneling for all traffic to improve performance

Question 14

An organization is deploying a network-based intrusion detection system (NIDS). The security team must decide on placement and configuration. Which THREE considerations are critical for effective NIDS deployment?

Accepted Answer

Using a network tap or SPAN port to monitor traffic without introducing latency. Using a network tap or SPAN port ensures full visibility without introducing latency (A). Placing the NIDS on the internal network behind the firewall allows it to detect insider threats that have already passed perimeter defenses (D). Tuning signatures to match the environment reduces false positives, making alerts more actionable (E).

Answer

Placing the NIDS inline to block malicious traffic immediately

Answer

Configuring the NIDS to drop packets that match attack signatures

Question 15

During a wireless site survey, a security engineer identifies several security weaknesses. Which TWO measures should be implemented to improve wireless security for a corporate network using WPA2-Enterprise?

Accepted Answer

Use 802.1X authentication with EAP-TLS and certificate-based authentication. Using 802.1X with EAP-TLS and disabling WPS are key improvements. WPA2-PSK is weaker than Enterprise, and MAC filtering is ineffective against determined attackers.

Answer

Implement MAC address filtering to allow only known devices

Answer

Disable SSID broadcast to hide the network

Answer

Enable WPS for easy client configuration