SSCP Network and Communications Security Practice Test 6 — 15 Questions

Question 1

A network administrator wants to prevent unauthorized devices from connecting to the wired network. Which technology can be used to enforce authentication at the switch port level before granting network access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

802.1X. 802.1X is an IEEE standard for port-based network access control that authenticates devices before granting access to the wired network. It uses EAP over LAN to communicate with a RADIUS server, ensuring only authorized devices can connect. This directly enforces authentication at the switch port level.

Answer

MAC address filtering

Answer

WPA2-Enterprise

Answer

VLAN segmentation

Question 2

Which UDP port is used by the Domain Name System (DNS) for name resolution queries?

Accepted Answer

UDP 53. DNS uses UDP port 53 for standard name resolution queries because the request and response are small and UDP's low overhead is ideal for the query-response pattern. TCP port 53 is used only for zone transfers (AXFR/IXFR), DNSSEC responses exceeding 512 bytes, or when the TC (truncated) bit forces a TCP retry.

Answer

UDP 161

Answer

UDP 67

Answer

UDP 123

Question 3

An attacker is performing a man-in-the-middle attack at Layer 2 by sending forged ARP messages to associate their MAC address with the IP address of a legitimate host on the same subnet. This attack is known as:

Accepted Answer

ARP spoofing. ARP spoofing (also called ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with the IP address of a legitimate host, causing traffic intended for that host to be sent to the attacker. This enables man-in-the-middle attacks at Layer 2. The scenario described exactly matches ARP spoofing.

Answer

DNS poisoning

Answer

DHCP spoofing

Answer

MAC flooding

Question 4

A security analyst is reviewing firewall logs and notices a high rate of TCP SYN packets to multiple ports on a server, but no corresponding ACK or RST packets. This is characteristic of which type of attack?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed source addresses, so the server allocates half-open connection state and replies with SYN-ACK but never receives the final ACK. The absence of ACK or RST responses in the logs is the signature of this half-open connection exhaustion attack.

Answer

UDP flood

Answer

Smurf attack

Answer

Ping of death

Question 5

Which of the following is a secure remote access VPN protocol that uses TLS for encryption and is commonly used with Cisco AnyConnect?

Accepted Answer

SSL/TLS VPN. An SSL/TLS VPN uses TLS (typically over TCP port 443) to encrypt traffic and is the protocol underlying Cisco AnyConnect, which is a classic example of a client-based SSL VPN. It provides secure remote access without requiring IPsec's UDP ports, making it firewall-friendly.

Answer

IPsec

Answer

L2TP/IPsec

Answer

PPTP

Question 6

A company wants to deploy a network IDS that can analyze traffic patterns and detect anomalies. Where should the IDS sensor be placed to monitor all traffic on a network segment without introducing latency?

Accepted Answer

Connected to a switch SPAN port. A SPAN (Switched Port Analyzer) port mirrors traffic from one or more switch ports or VLANs to a dedicated monitoring port, allowing the IDS sensor to receive a copy of the traffic passively. Because the sensor is not in the forwarding path, it introduces zero latency to production traffic while still seeing all frames on the monitored segment. This is the canonical out-of-band IDS deployment.

Answer

Inline between the router and the switch

Answer

At the core switch as a transparent bridge

Answer

On the same segment as the router

Question 7

A security analyst is reviewing a TLS 1.3 deployment. Which THREE of the following are features of TLS 1.3?

Accepted Answer

Mandatory forward secrecy. Option B is correct because TLS 1.3 mandates forward secrecy by eliminating static RSA and static Diffie-Hellman key exchange, requiring ephemeral key exchanges (ECDHE or DHE) so that compromise of long-term keys cannot decrypt past sessions. Option C is correct because TLS 1.3 introduces a 0-RTT (early data) mode using PSK resumption, allowing the client to send application data in the first flight, though it carries replay risk. Option D is correct because TLS 1.3 removes all legacy cipher suites based on RC4, DES/3DES, CBC-mode, and MD5/SHA-1, restricting the protocol to AEAD ciphers such as AES-GCM, ChaCha20-Poly1305, and AES-CCM. Option A is not correct because static RSA key exchange was explicitly removed in TLS 1.3, since it lacks forward secrecy. Option E is not correct because TLS 1.3 does not support SSL 3.0 compatibility; SSL 3.0 was already deprecated and TLS 1.3 removed backward compatibility with such legacy protocols.

Answer

Use of static RSA key exchange

Answer

Support for SSL 3.0 compatibility

Question 8

An organization is designing network segmentation to protect sensitive data. Which TWO of the following are effective methods for implementing network segmentation?

Accepted Answer

Firewalls. Firewalls (C) are a core segmentation control because they enforce policy between zones—filtering traffic by IP address, port, and protocol (e.g., allowing only TCP 443 from a DMZ to an internal subnet)—thereby restricting lateral movement toward sensitive data. VLANs (E) segment a switched network at Layer 2 by logically isolating broadcast domains, so hosts in different VLANs cannot communicate directly without a Layer 3 device, which is a standard way to separate sensitive systems from general user traffic. Honeypots (A) are deception/detection decoys, not segmentation mechanisms, since they attract and log attackers rather than partition traffic. NAT (B) translates addresses (e.g., private RFC 1918 to public) for connectivity and concealment, but it does not by itself enforce segmentation between internal zones. Port security (D) limits which MAC addresses may use a switch port to prevent unauthorized devices or MAC flooding, but it does not create separate network segments or control inter-zone traffic.

Answer

Honeypots

Answer

NAT

Answer

Port security

Question 9

A network administrator is designing a secure remote access solution for employees using company laptops. The solution must support strong authentication, encryption, and be resistant to man-in-the-middle attacks. Which THREE components should be included?

Accepted Answer

EAP-TLS for authentication. EAP-TLS (B) is correct because it uses digital certificates on both client and server to perform mutual authentication, providing strong identity verification and enabling the certificate-based trust needed to resist impersonation. IPsec in tunnel mode (C) is correct because it encrypts and authenticates the entire original IP packet between endpoints, protecting confidentiality and integrity of the traffic across an untrusted network. IKEv2 (E) is correct because it securely negotiates and rekeys IPsec security associations using strong cryptographic exchanges, and its support for MOBIKE helps maintain secure sessions while resisting man-in-the-middle interception. L2TP (A) is not correct here because by itself it provides tunneling but no encryption or strong authentication, so it must be paired with IPsec rather than being the security component. PPTP with MPPE (D) is not correct because PPTP is obsolete and its MS-CHAPv2 authentication and MPPE encryption have well-known weaknesses that make it vulnerable to credential cracking and MITM attacks.

Answer

L2TP tunneling protocol

Answer

PPTP with MPPE encryption

Question 10

A company is migrating from WPA2-PSK to WPA3 for its wireless network. Which THREE benefits does WPA3 provide compared to WPA2?

Accepted Answer

Mandatory use of Protected Management Frames (PMF). Option A is correct because WPA3 mandates Protected Management Frames (PMF, defined in 802.11w), which cryptographically protects management frames such as deauthentication and disassociation, preventing spoofing and denial-of-service attacks that remain possible under WPA2 where PMF is optional. Option C is correct because WPA3-Enterprise offers an optional 192-bit security mode based on CNSA Suite algorithms (GCMP-256, HMAC-SHA-384, ECDHE and ECDSA with 384-bit curves), providing stronger cryptographic protection than the standard WPA2-Enterprise 128-bit suite. Option D is correct because WPA3 replaces the WPA2-PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks by requiring live interaction with the AP for each guess. Option B is incorrect because TKIP is a deprecated, legacy encryption protocol; WPA3 requires CCMP-128 at minimum and does not mandate TKIP. Option E is incorrect because WPA3 does not provide backward compatibility with WEP devices, which use the obsolete RC4-based WEP cipher and cannot negotiate WPA3 security.

Answer

Use of TKIP as the mandatory encryption protocol

Answer

Backward compatibility with WEP devices

Question 11

A security engineer is reviewing a network architecture that uses IPsec in tunnel mode between two site gateways. The engineer must verify that the design provides confidentiality for the entire original IP packet. Which component of the IPsec architecture is responsible for encrypting the payload and providing confidentiality?

Accepted Answer

Encapsulating Security Payload (ESP). In IPsec, ESP is the protocol that provides confidentiality by encrypting the payload. In tunnel mode, it encrypts the entire original IP packet, ensuring that the contents are protected. AH only provides integrity and authentication without encryption, while IKE and SAs are supporting components that establish and define security parameters but do not perform encryption.

Answer

Security Association (SA)

Answer

Internet Key Exchange (IKE)

Answer

Authentication Header (AH)

Question 12

A network administrator is configuring a switch to prevent unauthorized devices from connecting to a specific switch port. The administrator wants to restrict access based on the device's MAC address. Which feature should be implemented?

Accepted Answer

Port security. Port security is the switch feature that restricts access to a port based on MAC addresses. It can be configured to allow only specific MAC addresses or a maximum number of addresses. When a violation occurs, the switch can drop packets, send an alert, or shut down the port. This effectively prevents unauthorized devices from connecting.

Answer

Dynamic ARP Inspection (DAI)

Answer

VLAN pruning

Answer

Spanning Tree Protocol (STP)

Question 13

A security analyst is investigating a potential attack on a network. The analyst observes a large number of ICMP echo request packets with spoofed source IP addresses being sent to a subnet's broadcast address. Many hosts on the subnet are replying, causing network congestion. Which type of attack is this?

Accepted Answer

Smurf attack. The Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP. All hosts on the subnet reply to the spoofed victim, amplifying traffic and causing a denial of service. The scenario describes exactly this: ICMP echo requests to a broadcast address with spoofed source, causing many replies and congestion.

Answer

Ping of death

Answer

Fraggle attack

Answer

SYN flood

Question 14

A security analyst notices that an attacker on the same VLAN is able to capture traffic from other hosts, including sensitive data. The attacker has not compromised any switch or router. Which network attack is most likely being used?

Accepted Answer

ARP spoofing. ARP spoofing, also called ARP poisoning, allows an attacker on the same subnet to intercept traffic by sending forged ARP messages. The attacker can then forward traffic to the real destination while capturing it, achieving a man-in-the-middle attack without compromising network devices.

Answer

MAC flooding

Answer

VLAN hopping

Answer

DHCP starvation

Question 15

A security engineer is hardening a data center network against VLAN hopping attacks. The core switches currently use 802.1Q trunking on all inter-switch links, and unused access ports are left in the default VLAN. Which configuration change best mitigates VLAN hopping while preserving legitimate trunk operation?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports and place unused ports in an unused VLAN.. VLAN hopping typically relies on DTP negotiation on an access port or on double tagging through the native VLAN. Disabling DTP on access ports stops an attacker from forming a trunk, and moving unused ports to an unused VLAN removes an easy double-tagging target. Legitimate trunks remain functional on trusted inter-switch links, so segmentation is preserved while the attack surface is reduced.

Answer

Change all access ports to trunk ports and enable Dynamic Trunking Protocol (DTP) negotiation.

Answer

Enable BPDU Guard and Root Guard on all trunk ports to block VLAN hopping frames.

Answer

Configure all inter-switch links as access ports in VLAN 1 to simplify the topology.