N10-009 Network Security Practice Questions

Question 1

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Accepted Answer

DHCP starvation. The described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 2

A company is implementing 802.1X port-based authentication on its wired network to control access. The network uses Active Directory for user accounts. Which type of server must be deployed to authenticate clients connecting to the switch ports?

Accepted Answer

A RADIUS server. 802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.

Answer

A DNS server

Answer

A DHCP server

Answer

A Kerberos server

Question 3

A company is deploying a wireless network that requires the highest level of security for client authentication. The network must use a RADIUS server. Which wireless security standard should be implemented?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise (option B) is correct because it mandates the use of a RADIUS server for 802.1X/EAP authentication and provides the highest level of wireless security. It supports a mandatory 192-bit minimum-strength security suite (CNSA Suite), making it the strongest choice among the listed options.

Answer

WPA2-Personal

Answer

WPA2-Enterprise

Answer

WPA3-Personal

Question 4

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 5

A company wants to allow external users to access a web server located in the DMZ. The firewall has three interfaces: inside, outside, and DMZ. Which firewall rule is necessary?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on ports 80 and 443.. It allows traffic from the outside (external users) to the DMZ web server while keeping the inside network protected. In a three-legged firewall setup, the necessary rule permits inbound HTTP/HTTPS traffic from the outside interface to the DMZ interface, typically with a destination IP of the web server and port 80/443. This ensures external access is isolated from the internal network, adhering to the principle of least privilege.

Answer

Allow traffic from the inside interface to the DMZ interface.

Answer

Allow traffic from the DMZ interface to the inside interface.

Answer

Allow traffic from the outside interface to the inside interface.

Question 6

A security analyst is configuring a firewall to allow HTTPS traffic from the internet to an internal web server with a private IP address. The firewall must translate the destination IP address of incoming packets to the private server IP. Which type of NAT should be configured?

Accepted Answer

Destination NAT (DNAT). Destination NAT (DNAT) is used to translate the destination IP address of incoming packets from a public IP (the firewall's public IP or a public IP assigned to the server) to a private IP (the internal web server's actual IP address). This allows external clients to initiate connections to a service hosted on an internal server that uses a private IP address, even though the external clients only know the public IP. This is exactly what the scenario requires: the firewall must rewrite the destination address of packets arriving from the internet to the private server IP.

Answer

Source NAT (SNAT)

Answer

Static NAT

Answer

Port Address Translation (PAT)

Question 7

A network administrator wants to ensure that only authorized devices can access the network on a switch port. The administrator has a list of allowed MAC addresses. Which security feature should be enabled on the switch port?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to specify a list of allowed MAC addresses per switch port. When a device with an unauthorized MAC address attempts to connect, the switch can either block the traffic, generate an alert, or disable the port (errdisable state). This directly enforces access control based on the MAC address list provided.

Answer

802.1X

Answer

MAC address filtering

Answer

VLAN hopping prevention

Question 8

Match each network topology to its characteristic. Select all that apply.

Accepted Answer

Star: All devices connect to a central hub/switch. Common network topologies include star, mesh, bus, and ring. Each has distinct characteristics: star uses a central hub, mesh provides full connectivity, bus shares a single line, and ring forms a closed loop. Distractors swap definitions to test understanding.

Answer

Star: Each device connects to two others, forming a circle

Answer

Bus: All devices connect to a central hub/switch

Question 9

A security analyst notices that an attacker is sending crafted packets with overlapping IP fragments to a target server, causing the server to crash. Which type of attack is described?

Accepted Answer

Teardrop attack. This is a Teardrop attack, which exploits a vulnerability in the IP fragmentation reassembly process. The attacker sends a series of fragmented IP packets with intentionally overlapping fragment offsets, causing the target system to miscalculate the size of the reassembled packet, leading to a buffer overflow and system crash. This attack specifically targets the IP stack's handling of fragment offset fields in the IP header.

Answer

Smurf attack

Answer

Ping flood

Answer

SYN flood

Question 10

A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?

Accepted Answer

Authenticator. The Authenticator (typically a switch or wireless access point) is the component that enforces the NAC policy by controlling access to the network port or SSID. It receives the authentication result from the Authentication Server and applies the policy (e.g., placing the endpoint in a quarantine VLAN if antivirus or OS patch checks fail). This enforcement is defined in IEEE 802.1X, where the Authenticator acts as the gatekeeper between the Supplicant and the network.

Answer

Supplicant

Answer

Authentication server

Answer

Policy server

Network Security

N10-009 Network Security — Key Topics

Where candidates lose marks on Network Security