SSCP Network and Communications Security Practice Test 4 — 15 Questions

Question 1

An attacker sends a forged ARP reply associating the attacker's MAC address with the IP address of the default gateway. What type of attack is this?

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP cache poisoning) is the attack in which a malicious host sends forged ARP replies to bind its own MAC address to the IP address of a legitimate host — here, the default gateway. Because ARP has no authentication mechanism, victims update their ARP caches with the attacker's MAC, causing traffic destined for the gateway to flow through the attacker, enabling man-in-the-middle interception.

Answer

MAC flooding

Answer

DHCP starvation

Answer

DNS poisoning

Question 2

A network administrator notices that legitimate clients are unable to obtain IP addresses from the DHCP server. The network logs show a high volume of DHCP Discover messages from different MAC addresses. Which attack is most likely occurring?

Accepted Answer

DHCP starvation. DHCP starvation occurs when an attacker floods the DHCP server with Discover requests using spoofed MAC addresses, exhausting the DHCP address pool. Legitimate clients then cannot obtain leases because the server has no available IPs to offer. The high volume of Discover messages from many different MAC addresses is the signature of this attack.

Answer

DHCP spoofing

Answer

ARP spoofing

Answer

DNS amplification

Question 3

Which security control can prevent a rogue DHCP server from assigning incorrect gateway addresses to clients?

Accepted Answer

DHCP snooping. DHCP snooping is a switch feature that filters DHCP messages based on trusted ports, blocking rogue DHCP servers.

Answer

IP source guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 4

Which wireless security standard introduced the Simultaneous Authentication of Equals (SAE) handshake to replace the pre-shared key (PSK) method?

Accepted Answer

WPA3. WPA3 replaced WPA2's PSK with SAE, which provides forward secrecy and is resistant to offline dictionary attacks.

Answer

802.11i

Answer

WEP

Answer

WPA2

Question 5

A security analyst discovers that an attacker has set up a fake wireless access point with the same SSID as the corporate network. Users are unknowingly connecting to it. What is this attack called?

Accepted Answer

Evil twin. An evil twin is a rogue access point that impersonates a legitimate AP by broadcasting the same SSID (and often cloning the BSSID and security settings) to trick users into associating with it. Because clients auto-connect to known SSIDs, the attacker can harvest credentials, perform on-path (MITM) interception, or serve captive-portal phishing pages. The distinguishing feature is the deliberate imitation of a trusted network, which is exactly what the scenario describes.

Answer

KRACK

Answer

Rogue AP

Answer

PMKID attack

Question 6

What is the default port for Microsoft SQL Server?

Accepted Answer

1433. Microsoft SQL Server's default instance listens on TCP port 1433 for client connections using the Tabular Data Stream (TDS) protocol. This is the well-known port assigned by IANA for SQL Server, and it is what clients use when connecting without specifying a port. Named instances, however, use dynamic ports and rely on the SQL Server Browser service on UDP 1434 to direct clients to the correct port.

Answer

443

Answer

3389

Answer

3306

Question 7

Which network security control can enforce that only authorized devices with current antivirus and patches can connect to the network?

Accepted Answer

Network Access Control. Network Access Control (NAC) is designed to enforce endpoint compliance before granting network access. It checks devices for up-to-date antivirus, patches, and other security posture requirements, and can quarantine or deny access if they fail. This matches the requirement of ensuring only authorized devices with current antivirus and patches can connect.

Answer

Firewall rules

Answer

Intrusion Prevention System

Answer

Port security

Question 8

Which TWO of the following are methods to defend against SYN flood attacks? (Select TWO)

Accepted Answer

Increasing the SYN backlog queue size. Option C (Increasing the SYN backlog queue size) is correct because a SYN flood exhausts the backlog of half-open connections; enlarging the backlog lets the server hold more pending SYNs so legitimate clients can still complete the three-way handshake before the queue overflows. Option D (SYN cookies) is correct because it eliminates the need to store half-open state: the server encodes connection parameters into the SYN-ACK sequence number and only allocates resources when the final ACK returns, so spoofed SYNs cannot exhaust memory. Option A (Enabling IP routing) is unrelated to SYN flood mitigation and would only forward packets between interfaces, potentially worsening exposure. Option B (Using UDP instead of TCP) is not a defense—SYN floods are specific to TCP's handshake, and switching protocols changes the application entirely rather than protecting it. Option E (Disabling TCP timestamps) has no effect on SYN flood resistance; timestamps are an optional TCP extension for RTT measurement and PAWS, not a resource-exhaustion control.

Answer

Enabling IP routing

Answer

Using UDP instead of TCP

Answer

Disabling TCP timestamps

Question 9

Which TWO of the following are characteristics of a Smurf attack? (Select TWO)

Accepted Answer

Uses ICMP echo requests. Smurf attacks send ICMP echo requests to a broadcast address with a spoofed source IP, causing all hosts to reply to the victim, leading to amplification.

Answer

Requires fragmented packets

Answer

Exploits TCP SYN handshake

Answer

Targets DNS resolvers

Question 10

Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)

Accepted Answer

Supports endpoint security posture checks. Option B is correct because SSL/TLS VPNs (such as Cisco AnyConnect or Fortinet SSL VPN) commonly integrate host-scanning or posture-assessment modules that verify antivirus, patch level, and firewall status on the endpoint before granting access. Option C is correct because SSL/TLS VPN clients can be configured for split tunneling, allowing only traffic destined for corporate subnets to go through the tunnel while other traffic (e.g., internet browsing) goes directly out the local gateway. Option D is correct because SSL/TLS VPNs typically operate over TCP port 443 (HTTPS), which is almost universally permitted through firewalls and proxies, whereas IPsec requires UDP 500/4500 and ESP (protocol 50), which are frequently blocked. Option A is incorrect because UDP port 500 is used by IKE for IPsec, not by SSL/TLS VPNs. Option E is incorrect because SSL/TLS VPNs authenticate users via certificates, RADIUS, LDAP, or SAML, and pre-shared keys are characteristic of IPsec, not SSL/TLS VPNs.

Answer

Typically uses UDP port 500

Answer

Requires pre-shared keys for authentication

Question 11

Which transport layer protocol is used by DNS for its queries and responses, and why is it appropriate?

Accepted Answer

UDP, because it is connectionless and fast, suitable for short exchanges.. DNS primarily uses UDP on port 53 because queries and responses are typically small, single-packet exchanges where the low overhead and lack of connection setup make UDP fast and efficient. TCP is used only for large responses (e.g., zone transfers or DNSSEC) or when truncation occurs.

Answer

UDP, because it guarantees packet ordering.

Answer

TCP, because it provides error checking and retransmission.

Answer

TCP, because reliability is critical for DNS resolution.

Question 12

An attacker sends a gratuitous ARP reply associating the attacker's MAC address with the default gateway's IP address. Which attack is being performed, and what is the primary risk?

Accepted Answer

ARP spoofing; risk is man-in-the-middle traffic interception.. A gratuitous ARP reply that binds the attacker's MAC to the gateway's IP is the classic ARP spoofing (ARP poisoning) attack. The victim's ARP cache is poisoned so traffic destined for the gateway is sent to the attacker, enabling man-in-the-middle interception, modification, or denial of service.

Answer

DNS poisoning; risk is traffic redirection to malicious sites.

Answer

DHCP starvation; risk is denial of service.

Answer

SYN flood; risk is resource exhaustion.

Question 13

A security administrator is configuring a firewall to allow outbound web traffic from internal users. The firewall must inspect the application layer data to block malicious URLs. Which type of firewall should be used?

Accepted Answer

Application proxy firewall. An application proxy firewall is correct because it operates at the application layer (Layer 7) and can inspect HTTP/HTTPS traffic to block malicious URLs. It acts as an intermediary, terminating the client connection and initiating a new one to the server, allowing deep inspection of application data. This meets the requirement to inspect application layer data for outbound web traffic.

Answer

Stateless packet filter

Answer

Stateful firewall

Answer

Network Access Control (NAC) system

Question 14

Which wireless security standard replaces WPA2 and mandates Protected Management Frames (PMF) to prevent certain types of attacks?

Accepted Answer

WPA3. WPA3 is the wireless security standard that replaces WPA2 and mandates Protected Management Frames (PMF) to prevent attacks such as deauthentication and disassociation. PMF provides integrity protection for management frames, which WPA2 did not require.

Answer

802.1X

Answer

WEP

Answer

WPA2

Question 15

A security engineer is configuring a site-to-site VPN between two branch offices using IPsec in tunnel mode. Which protocol provides both authentication and encryption of the entire original IP packet?

Accepted Answer

ESP (Encapsulating Security Payload) in tunnel mode. ESP (Encapsulating Security Payload) in tunnel mode encrypts and authenticates the entire original IP packet, then encapsulates it inside a new IP packet with new headers. This provides confidentiality, integrity, and origin authentication for the payload, making it the standard choice for site-to-site VPNs.

Answer

IKEv2 in transport mode

Answer

L2TP in tunnel mode

Answer

AH (Authentication Header) in tunnel mode