SSCP Network and Communications Security Practice Test 7 — 15 Questions

Question 1

A financial services firm needs to detect unauthorized changes to its public DNS records that could redirect customers to a phishing site. The security team wants a control that validates DNS responses cryptographically so that a resolver can verify the data originated from the authoritative zone. Which technology should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNSSEC (Domain Name System Security Extensions). DNSSEC is the only listed control that signs DNS records and lets a validating resolver verify their origin and integrity through a chain of trust. Encryption options such as DoH protect the query path but not the data's authenticity, while sinkholing and split-horizon DNS address different problems. For detecting tampering with public records, DNSSEC provides the required cryptographic assurance.

Answer

DNS over HTTPS (DoH)

Answer

DNS sinkholing

Answer

Split-horizon DNS

Question 2

A security administrator is configuring a network tap to monitor traffic between two switches. The tap is placed inline and must not disrupt network connectivity if it loses power. Which type of tap should be used?

Accepted Answer

Fail-to-wire tap. A fail-to-wire tap ensures that if the tap loses power, the connection between the two network segments is physically closed, allowing traffic to continue flowing. This maintains network availability. Other options like aggregating taps, SPAN ports, or hubs do not provide this fail-safe inline capability. The requirement for non-disruption on power loss is specifically addressed by fail-to-wire functionality.

Answer

Span port

Answer

Aggregating tap

Answer

Network hub

Question 3

A security engineer is deploying a Network Intrusion Detection System (NIDS) on a switched network. The engineer needs to ensure the NIDS can monitor all traffic passing through a critical switch port that connects to a server. Which technology should be configured on the switch to copy traffic from the server port to the NIDS monitoring port?

Accepted Answer

Port mirroring (SPAN). Port mirroring (SPAN) is the correct technology because it copies traffic from a source port to a destination port, allowing a NIDS to monitor all traffic without being inline. STP, VLAN trunking, and LACP serve different purposes: loop prevention, carrying multiple VLANs, and link aggregation, respectively. None of them replicate traffic to a monitoring port. Port mirroring is essential for passive monitoring in switched environments.

Answer

Link Aggregation Control Protocol (LACP)

Answer

Spanning Tree Protocol (STP)

Answer

Virtual LAN (VLAN) trunking

Question 4

A security engineer is configuring an IPsec VPN between two offices to protect data in transit. The requirement is to ensure that packets cannot be modified or replayed by an attacker. Which security service should be enabled in the IPsec configuration?

Accepted Answer

Authentication Header (AH). The Authentication Header (AH) provides data integrity and authentication, and includes a sequence number to prevent replay attacks. In an IPsec VPN, AH ensures that packets cannot be altered in transit without detection. While ESP can also provide integrity and replay protection when configured with authentication, the scenario specifically asks for a service to prevent modification and replay, and AH is the dedicated protocol for that purpose. ESP is more commonly used because it also offers confidentiality, but AH alone meets the stated requirement.

Answer

Secure Hash Algorithm 2 (SHA-2) in tunnel mode

Answer

Internet Key Exchange (IKE) version 2

Answer

Encapsulating Security Payload (ESP) with confidentiality only

Question 5

A company wants to protect its web servers from common web application attacks such as SQL injection and cross-site scripting. The security team decides to deploy a device that inspects HTTP traffic and blocks malicious requests. Which technology should they implement?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is purpose-built to inspect HTTP/HTTPS traffic and block application-layer attacks such as SQL injection and cross-site scripting. It understands web protocols and can apply rules to detect and mitigate these threats. Other options like IPS, stateful firewalls, or UTM appliances may offer some protection but are not as specialized or effective for web application security.

Answer

Unified Threat Management (UTM) appliance

Answer

Stateful firewall

Answer

Intrusion Prevention System (IPS)

Question 6

A network architect is evaluating a remote access design where users must authenticate with a hardware token and the session must be resistant to replay even if an attacker captures the encrypted traffic. Which protocol property should the architect prioritize?

Accepted Answer

Per-session ephemeral keys established through a Diffie-Hellman exchange.. Replay resistance and forward secrecy depend on fresh, per-session cryptographic material. Ephemeral Diffie-Hellman generates a unique key for each session, so a recorded handshake cannot be replayed against a new session and compromise of one key does not expose others. Static keys and strong bulk encryption alone do not provide these properties, and split tunneling is unrelated to the authentication exchange.

Answer

Use of a shared static key for all sessions to simplify key management.

Answer

Split tunneling so only corporate traffic traverses the encrypted tunnel.

Answer

Pre-shared key authentication with AES-256 encryption in tunnel mode.

Question 7

A network architect is designing a demilitarized zone (DMZ) for a company that hosts a public web server and an internal database. The architect must ensure that if the web server is compromised, the attacker cannot directly access the internal database. Which DMZ design principle should be applied?

Accepted Answer

Use a screened subnet with two firewalls: an external firewall between the internet and DMZ, and an internal firewall between DMZ and internal network.. Using a screened subnet with two firewalls provides defense in depth: the external firewall protects the DMZ from the internet, and the internal firewall protects the internal network from the DMZ. If the web server is compromised, the attacker still faces the internal firewall, which should only allow specific traffic to the database. Placing the database in the DMZ or allowing unrestricted DMZ-to-internal traffic would eliminate this protection.

Answer

Implement a single firewall with three interfaces: internet, DMZ, and internal network, with rules allowing any traffic between DMZ and internal.

Answer

Allow all traffic from the DMZ to the internal network to ensure the web server can retrieve data from the database.

Answer

Place the database in the same DMZ as the web server to simplify firewall rules.

Question 8

A security administrator is reviewing network traffic logs and notices a large number of TCP SYN packets from various source IP addresses to a single destination IP address on port 443. The destination server is unresponsive. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. The scenario describes a large volume of TCP SYN packets from various sources to a single destination, resulting in an unresponsive server. This is indicative of a SYN flood attack, where the attacker sends numerous SYN requests but does not complete the TCP handshake, causing the server to exhaust its resources on half-open connections. Other attacks like Smurf, ping flood, or Teardrop involve different protocols or mechanisms and do not match the described traffic pattern.

Answer

Teardrop attack

Answer

Ping flood

Answer

Smurf attack

Question 9

A security analyst is reviewing network traffic and notices that an attacker is sending forged ARP replies to a host, attempting to associate the attacker's MAC address with the IP address of the default gateway. Which security feature should be implemented on the switch to prevent this attack?

Accepted Answer

Dynamic ARP Inspection (DAI). Dynamic ARP Inspection (DAI) is the switch feature designed to prevent ARP spoofing by validating ARP packets against a trusted binding table. It drops ARP packets that contain invalid IP-to-MAC mappings, thereby blocking the attacker's attempt to associate their MAC with the gateway's IP. Other features like port security, DHCP snooping, or 802.1X do not provide this specific ARP validation.

Answer

Port security

Answer

DHCP snooping

Answer

802.1X authentication

Question 10

A security administrator is hardening a data center switch. Management requires that only the switch's configured management station can initiate a remote CLI session, and that the switch never accept an inbound management connection from any other host. Which control should the administrator implement on the switch to meet this requirement?

Accepted Answer

An inbound access control list applied to the management VLAN interface that permits only the management station's IP address to reach TCP port 22. Restricting the management plane by source address is the only control listed that limits who may initiate an administrative session. An inbound ACL bound to the management interface permits the approved management station and denies everything else, directly matching the stated policy. Authentication, port security, and loop-prevention features address different problems and leave the management service reachable from any host on the network.

Answer

BPDU Guard enabled on all access ports to prevent rogue spanning-tree devices

Answer

Port security configured on every access port with a maximum of one learned MAC address

Answer

A TACACS+ or RADIUS server that authenticates all administrative logins with individual accounts

Question 11

A company needs to provide secure remote access for employees working from home. The security team wants to ensure the solution provides strong authentication and encryption, and supports a wide range of client devices without requiring proprietary software. Which technology should they implement?

Accepted Answer

IPsec VPN with IKEv2. IKEv2 is a modern VPN protocol that offers strong security and is widely supported across devices without proprietary clients. It supports various authentication methods and is efficient in reconnecting after network changes, making it ideal for mobile workers. The other options are either not full VPN solutions or are limited in scope. Therefore, IKEv2 IPsec VPN is the correct choice.

Answer

Secure Shell (SSH) tunneling

Answer

Remote Desktop Protocol (RDP) with TLS

Answer

File Transfer Protocol Secure (FTPS)

Question 12

A security analyst is hardening a wireless network that uses WPA2-Enterprise with a RADIUS server. The analyst wants to mitigate the risk of an attacker setting up a rogue access point to capture user credentials. Which TWO measures should be implemented? (Choose two.)

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS) to detect and contain rogue access points.. Deploying a WIPS detects and contains rogue access points, directly addressing the threat. Configuring 802.1X with EAP-TLS ensures mutual authentication, so clients verify the server's certificate and will not connect to a rogue AP. Together, these measures prevent credential harvesting. PMF, hidden SSIDs, and PSKs do not adequately mitigate the risk of a rogue AP capturing credentials.

Answer

Enable Protected Management Frames (PMF) to prevent deauthentication attacks.

Answer

Use a preshared key (PSK) instead of 802.1X to simplify authentication.

Answer

Disable SSID broadcasting to hide the network name.

Question 13

A small business wants to prevent employees from accessing known malicious websites without deploying a full next-generation firewall. The IT consultant recommends a service that filters DNS queries before they reach the public internet. Which technology is being described?

Accepted Answer

A DNS filtering service that blocks resolution of known malicious domains.. DNS filtering works by checking each name resolution request against a threat intelligence feed and returning a block response for known malicious domains. It requires no inline firewall, covers all applications that use DNS, and is simple to deploy for a small business. The other options address different layers or purposes and would not deliver the same lightweight outbound protection.

Answer

A web application firewall (WAF) placed in front of the company's public website.

Answer

An intrusion prevention system (IPS) deployed inline at the network perimeter.

Answer

A forward proxy that caches frequently visited web content.

Question 14

A security engineer is implementing a Network Access Control (NAC) solution to enforce endpoint compliance before allowing devices onto the corporate network. Which TWO of the following are common NAC enforcement methods? (Choose two.)

Accepted Answer

802.1X with RADIUS authentication. Common NAC enforcement methods include 802.1X with RADIUS authentication and captive portals with posture assessment. 802.1X provides port-based access control using authentication, while captive portals redirect users to a web page for authentication and compliance checks. Both methods can enforce endpoint compliance before granting network access. DHCP snooping, VLAN hopping prevention, and MAC filtering are security features but do not provide the identity and posture assessment typical of NAC.

Answer

VLAN hopping prevention

Answer

MAC address filtering

Answer

DHCP snooping with IP source guard

Question 15

A security team is reviewing how their organization's DNS infrastructure could be abused. They want to reduce the risk of DNS cache poisoning and of data being smuggled out of the network through DNS queries. Which two measures best address these risks? (Choose two.)

Accepted Answer

Deploy DNSSEC validation on the recursive resolvers so that responses can be cryptographically verified against the authoritative zone. DNSSEC validation gives resolvers cryptographic proof that answers are authentic, which neutralizes forged responses used in cache poisoning. Constraining clients to internal resolvers and blocking outbound DNS to arbitrary servers keeps all resolution inside a monitored path, enabling detection of tunneling and preventing bypass of the validating resolver. Together they cover both integrity of answers and visibility into query behavior.

Answer

Increase the default TTL on all internal DNS records so that cached entries remain valid longer

Answer

Enable EDNS0 Client Subnet on the authoritative servers to return geographically accurate answers

Answer

Configure the internal resolvers to forward all queries to a public open resolver such as a large third-party service