N10-009 Network Security — 20 Questions

Question 1

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DHCP starvation. The described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 2

A company is implementing 802.1X port-based authentication on its wired network to control access. The network uses Active Directory for user accounts. Which type of server must be deployed to authenticate clients connecting to the switch ports?

Accepted Answer

A RADIUS server. 802.1X port-based authentication requires a RADIUS server to act as the authentication server that validates client credentials against the identity store (Active Directory). The switch (authenticator) forwards EAP frames from the client (supplicant) to the RADIUS server, which checks the credentials and instructs the switch to grant or deny port access.

Answer

A DNS server

Answer

A DHCP server

Answer

A Kerberos server

Question 3

A company is deploying a wireless network that requires the highest level of security for client authentication. The network must use a RADIUS server. Which wireless security standard should be implemented?

Accepted Answer

WPA3-Enterprise. WPA3-Enterprise (option B) is correct because it mandates the use of a RADIUS server for 802.1X/EAP authentication and provides the highest level of wireless security. It supports a mandatory 192-bit minimum-strength security suite (CNSA Suite), making it the strongest choice among the listed options.

Answer

WPA2-Personal

Answer

WPA2-Enterprise

Answer

WPA3-Personal

Question 4

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 5

A company wants to allow external users to access a web server located in the DMZ. The firewall has three interfaces: inside, outside, and DMZ. Which firewall rule is necessary?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on ports 80 and 443.. It allows traffic from the outside (external users) to the DMZ web server while keeping the inside network protected. In a three-legged firewall setup, the necessary rule permits inbound HTTP/HTTPS traffic from the outside interface to the DMZ interface, typically with a destination IP of the web server and port 80/443. This ensures external access is isolated from the internal network, adhering to the principle of least privilege.

Answer

Allow traffic from the inside interface to the DMZ interface.

Answer

Allow traffic from the DMZ interface to the inside interface.

Answer

Allow traffic from the outside interface to the inside interface.

Question 6

A security analyst is configuring a firewall to allow HTTPS traffic from the internet to an internal web server with a private IP address. The firewall must translate the destination IP address of incoming packets to the private server IP. Which type of NAT should be configured?

Accepted Answer

Destination NAT (DNAT). Destination NAT (DNAT) is used to translate the destination IP address of incoming packets from a public IP (the firewall's public IP or a public IP assigned to the server) to a private IP (the internal web server's actual IP address). This allows external clients to initiate connections to a service hosted on an internal server that uses a private IP address, even though the external clients only know the public IP. This is exactly what the scenario requires: the firewall must rewrite the destination address of packets arriving from the internet to the private server IP.

Answer

Source NAT (SNAT)

Answer

Static NAT

Answer

Port Address Translation (PAT)

Question 7

A network administrator wants to ensure that only authorized devices can access the network on a switch port. The administrator has a list of allowed MAC addresses. Which security feature should be enabled on the switch port?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to specify a list of allowed MAC addresses per switch port. When a device with an unauthorized MAC address attempts to connect, the switch can either block the traffic, generate an alert, or disable the port (errdisable state). This directly enforces access control based on the MAC address list provided.

Answer

802.1X

Answer

MAC address filtering

Answer

VLAN hopping prevention

Question 8

Match each network topology to its characteristic. Select all that apply.

Accepted Answer

Star: All devices connect to a central hub/switch. Common network topologies include star, mesh, bus, and ring. Each has distinct characteristics: star uses a central hub, mesh provides full connectivity, bus shares a single line, and ring forms a closed loop. Distractors swap definitions to test understanding.

Answer

Star: Each device connects to two others, forming a circle

Answer

Bus: All devices connect to a central hub/switch

Question 9

A security analyst notices that an attacker is sending crafted packets with overlapping IP fragments to a target server, causing the server to crash. Which type of attack is described?

Accepted Answer

Teardrop attack. This is a Teardrop attack, which exploits a vulnerability in the IP fragmentation reassembly process. The attacker sends a series of fragmented IP packets with intentionally overlapping fragment offsets, causing the target system to miscalculate the size of the reassembled packet, leading to a buffer overflow and system crash. This attack specifically targets the IP stack's handling of fragment offset fields in the IP header.

Answer

Smurf attack

Answer

Ping flood

Answer

SYN flood

Question 10

A company wants to implement network access control that requires users to authenticate before gaining access to the network. The NAC solution uses a policy that checks for antivirus updates and OS patches. Which component enforces the policy?

Accepted Answer

Authenticator. The Authenticator (typically a switch or wireless access point) is the component that enforces the NAC policy by controlling access to the network port or SSID. It receives the authentication result from the Authentication Server and applies the policy (e.g., placing the endpoint in a quarantine VLAN if antivirus or OS patch checks fail). This enforcement is defined in IEEE 802.1X, where the Authenticator acts as the gatekeeper between the Supplicant and the network.

Answer

Supplicant

Answer

Authentication server

Answer

Policy server

Question 11

A security auditor is reviewing firewall logs and notices repeated login attempts from a single external IP address to the company's SSH server. Which type of attack is likely occurring?

Accepted Answer

Brute force attack. Repeated login attempts from a single external IP to an SSH server are characteristic of a brute force attack, where an attacker systematically tries many username/password combinations to gain unauthorized access. SSH (port 22) is a common target because it provides remote shell access, and automated tools like Hydra or Medusa can rapidly test credentials. The firewall logs show multiple failed authentication attempts from the same source, which is the hallmark of this attack type.

Answer

Man-in-the-middle attack

Answer

ARP poisoning

Answer

DDoS attack

Question 12

A network administrator wants to prevent unauthorized devices from connecting to the company's Ethernet ports. The company uses a centralized authentication server. Which IEEE standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based Network Access Control (NAC) that authenticates devices before granting access to an Ethernet port. It uses a centralized authentication server (typically RADIUS) to verify credentials, preventing unauthorized devices from connecting to the network. This directly matches the requirement of controlling access at the port level with a centralized server.

Answer

802.11i

Answer

802.3af

Answer

802.1Q

Question 13

A security analyst notices that a web server is receiving a large number of ICMP echo reply packets from many different external hosts. The server did not send any echo requests. Which type of attack is most likely occurring?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large number of ICMP echo request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All hosts on that network then send ICMP echo reply packets to the victim, overwhelming it with traffic. Since the server never sent any echo requests, the unsolicited flood of echo replies is the hallmark of a Smurf attack.

Answer

Ping flood

Answer

ICMP tunneling

Answer

Fraggle attack

Question 14

A company wants to ensure that only authorized employee computers can connect to the wired network. Each computer must be authenticated before it is granted access to the network. Which technology is designed to provide this port-based authentication?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based Network Access Control (NAC). It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to authenticate a device at the switch port before granting full network access. Only after successful authentication does the switch open the port, ensuring that unauthorized computers cannot connect.

Answer

WPA2

Answer

MAC filtering

Answer

VPN

Question 15

A security analyst notices that the company's web server is receiving a high volume of TCP SYN packets from a single source IP address, but the server is not completing the three-way handshake. Which type of attack is most likely occurring?

Accepted Answer

A) SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets from a spoofed or single source IP without completing the handshake. The server allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate users. This matches the scenario where the server receives many SYN packets but never completes the handshake.

Answer

B) Smurf attack

Answer

C) Ping of death

Answer

D) ARP poisoning

Question 16

A security administrator is configuring a firewall to allow remote employees to access the company's internal web server (port 443) from the internet. The web server has an internal IP address of 10.0.0.5. The firewall has a public IP of 203.0.113.10. Which type of firewall rule should be created?

Accepted Answer

A) Port forwarding (DNAT) rule. A port forwarding (DNAT) rule is required because the web server uses a private RFC 1918 IP address (10.0.0.5), which is not routable on the public internet. The firewall must translate the destination IP from its public address (203.0.113.10) to the internal server's private address, allowing inbound traffic on port 443 to reach the correct internal host.

Answer

B) Allow rule with source any, destination 10.0.0.5, port 443

Answer

C) Access control list on the internal interface

Answer

D) VPN rule to require remote access VPN

Question 17

A security analyst is reviewing firewall logs and sees many incoming packets with a source IP address that matches the internal IP range of the company (10.0.0.0/8) arriving on the external interface. Which type of attack is likely being attempted?

Accepted Answer

IP spoofing attack. Packets arriving on the external interface with a source IP address from the internal 10.0.0.0/8 range indicate that the attacker is forging (spoofing) the source address to impersonate an internal host. This is a classic IP spoofing attack, often used to bypass access control lists or to launch further attacks that rely on trust relationships based on source IP.

Answer

Smurf attack

Answer

SYN flood

Answer

DNS amplification

Question 18

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

Accepted Answer

RADIUS. WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Answer

LDAP

Answer

TACACS+

Answer

Kerberos

Question 19

A security analyst is reviewing DHCP server logs and notices that a single MAC address is sending an extremely high number of DHCP discover packets. The DHCP server is responding, but the client never sends a DHCP request. Which type of attack is most likely occurring?

Accepted Answer

A) DHCP starvation. A DHCP starvation attack works by flooding the DHCP server with DHCPDISCOVER packets from spoofed MAC addresses, exhausting the server's IP address pool. In this scenario, a single MAC address sending excessive DHCPDISCOVER packets without completing the DORA handshake (no DHCPREQUEST) is a classic indicator of a starvation attack, as the attacker aims to consume all available leases and cause a denial of service for legitimate clients.

Answer

B) ARP poisoning

Answer

C) MAC flooding

Answer

D) DNS spoofing

Question 20

A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?

Accepted Answer

A) RADIUS server. 802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.

Answer

B) Syslog server

Answer

C) TACACS+ server

Answer

D) NTP server