N10-009 Network Security Practice Test 2 — 15 Questions

Question 1

A security administrator is configuring a wireless network to use WPA3-Enterprise. Which authentication server protocol is required for WPA3-Enterprise?

Accepted Answer

RADIUS. WPA3-Enterprise requires 802.1X/EAP authentication, which uses RADIUS as the backend authentication server protocol. RADIUS handles the exchange of EAP frames between the authenticator (access point) and the authentication server, enforcing per-user credentials and supporting the mandatory 192-bit security suite for WPA3-Enterprise. Without RADIUS, the 802.1X framework cannot operate, making it the only required protocol for this deployment.

Answer

LDAP

Answer

TACACS+

Answer

Kerberos

Question 2

A security analyst is reviewing DHCP server logs and notices that a single MAC address is sending an extremely high number of DHCP discover packets. The DHCP server is responding, but the client never sends a DHCP request. Which type of attack is most likely occurring?

Accepted Answer

A) DHCP starvation. A DHCP starvation attack works by flooding the DHCP server with DHCPDISCOVER packets from spoofed MAC addresses, exhausting the server's IP address pool. In this scenario, a single MAC address sending excessive DHCPDISCOVER packets without completing the DORA handshake (no DHCPREQUEST) is a classic indicator of a starvation attack, as the attacker aims to consume all available leases and cause a denial of service for legitimate clients.

Answer

B) ARP poisoning

Answer

C) MAC flooding

Answer

D) DNS spoofing

Question 3

A company is implementing 802.1X port-based authentication on its wired network to ensure only authorized devices can connect. Which of the following servers is required to authenticate users and devices?

Accepted Answer

A) RADIUS server. 802.1X port-based authentication relies on the Extensible Authentication Protocol (EAP) over LAN (EAPoL) between the supplicant (device) and the authenticator (switch), which then forwards authentication requests to a central authentication server. A RADIUS server is the required backend because it validates credentials (e.g., username/password or certificates) and returns an Accept/Reject decision to the switch, enabling or disabling the port. RADIUS is the standard protocol defined in IEEE 802.1X for this purpose, supporting EAP methods like PEAP, EAP-TLS, and EAP-FAST.

Answer

B) Syslog server

Answer

C) TACACS+ server

Answer

D) NTP server

Question 4

A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?

Accepted Answer

DHCP starvation. The described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.

Answer

ARP poisoning

Answer

DNS amplification

Answer

Rogue DHCP server

Question 5

A security analyst is investigating a potential breach. A network device shows logs indicating that it received packets with a source IP address belonging to the internal network range on its external (internet-facing) interface. This is a classic indication of which type of attack?

Accepted Answer

IP spoofing. B is correct because receiving packets with a source IP address from the internal network range on an external (internet-facing) interface is a classic sign of IP spoofing. In IP spoofing, an attacker forges the source IP address in packet headers to impersonate a trusted internal host, often to bypass access controls or launch reflection attacks. This violates the expected behavior of ingress filtering, where external interfaces should never see internal source addresses.

Answer

Denial-of-service (DoS) attack

Answer

Man-in-the-middle (MITM) attack

Answer

ARP poisoning

Question 6

A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?

Accepted Answer

DHCP starvation attack. A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.

Answer

MAC flooding attack

Answer

ARP spoofing

Answer

DNS poisoning

Question 7

A network administrator is configuring a firewall to allow external users to securely access an internal web server. Which security technique should be used to place the web server in a separate, isolated network segment that is still accessible from the internet?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a separate, isolated network segment that exposes internal services, such as a web server, to external users while keeping the internal LAN secure. By placing the web server in the DMZ, the firewall can allow inbound traffic from the internet to the DMZ while blocking direct access to the internal network, enforcing strict access control policies.

Answer

VLAN

Answer

VPN

Answer

NAT

Question 8

A network security analyst notices that the firewall is logging traffic on the external interface that has a source IP address of 10.0.1.5, which is within the internal network range. This is most likely the result of which type of attack?

Accepted Answer

IP spoofing. The firewall is logging traffic on its external interface with a source IP address from the internal RFC 1918 range (10.0.1.5). This indicates the source IP has been forged, because private IP addresses should never appear as source addresses on a public-facing interface. This is the classic signature of an IP spoofing attack, where the attacker modifies the source IP in the packet header to impersonate an internal host.

Answer

DNS poisoning

Answer

ARP poisoning

Answer

VLAN hopping

Question 9

An organization wants to implement a security solution that uses a cloud-based service to inspect all incoming web traffic for malware and policy violations before it reaches the internal network. This type of solution is known as a:

Accepted Answer

Secure web gateway (SWG). A Secure Web Gateway (SWG) is a cloud-based security solution that inspects all outbound and inbound web traffic for malware, policy violations, and data loss. It operates at the application layer, typically using proxy-based or API-based inspection to enforce security policies before traffic reaches the internal network. This matches the requirement for a cloud service that inspects incoming web traffic for malware and policy violations.

Answer

Web application firewall (WAF)

Answer

Intrusion detection system (IDS)

Answer

VPN concentrator

Question 10

A company wants to deploy a wireless network with the highest level of security for client authentication. The network will use a RADIUS server. Which authentication method should be used?

Accepted Answer

802.1X with EAP-TLS. 802.1X with EAP-TLS provides certificate-based mutual authentication, eliminating the risk of credential theft or dictionary attacks. This is the strongest authentication method for enterprise wireless networks, as it requires both the client and the RADIUS server to present valid X.509 certificates, ensuring a cryptographically verified identity on both sides.

Answer

WPA2-PSK

Answer

WPA3-SAE

Answer

802.1X with PEAP

Question 11

A network administrator reviews firewall logs and sees thousands of SYN packets coming from various source IP addresses to a single internal web server. No ACK or RST packets are observed from these sources. Which type of attack is most likely occurring?

Accepted Answer

SYN flood attack. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (no ACK or RST). This exhausts the server's connection table resources, preventing legitimate connections. The observed pattern of many SYN packets from various sources with no subsequent ACK or RST is the hallmark of a SYN flood.

Answer

DNS amplification attack

Answer

ARP spoofing attack

Answer

Man-in-the-middle attack

Question 12

A company hosts a web server in a DMZ. The firewall has three interfaces: inside (corporate network), outside (Internet), and DMZ. Which firewall rule is necessary to allow external users to access the web server?

Accepted Answer

Allow traffic from the outside interface to the DMZ interface on port 80. External users on the Internet (outside interface) need to reach the web server located in the DMZ. The firewall must permit inbound traffic from the outside zone to the DMZ zone on TCP port 80 (HTTP) to allow web requests while keeping the corporate network (inside) isolated from direct external access.

Answer

Allow traffic from the inside interface to the DMZ interface on port 80

Answer

Allow traffic from the outside interface to the inside interface on port 80

Answer

Deny all traffic by default and create no specific rules

Question 13

A network administrator notices that a large number of ICMP echo request packets are being sent to the broadcast address of the network from a single host. This is causing performance degradation. Which type of attack is this?

Accepted Answer

Smurf attack. The smurf attack exploits ICMP by sending echo request packets to a network's broadcast address with a spoofed source IP of the victim. All hosts on the network then reply to the victim, overwhelming it with traffic and causing performance degradation. This matches the scenario of a single host sending ICMP echo requests to the broadcast address.

Answer

ARP spoofing

Answer

MAC flooding

Answer

DNS amplification

Question 14

A security analyst detects a large number of DNS queries for the same domain from multiple internal hosts. The responses contain large payloads. Which type of attack is likely occurring?

Accepted Answer

DNS amplification. DNS amplification is a type of reflection-based DDoS attack where an attacker sends a small query (e.g., ANY or DNSSEC-signed record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a large payload (often 50–100x larger than the query), flooding the victim's network. The scenario describes many internal hosts making queries to the same domain and receiving large responses, which matches the amplification effect from a compromised or misconfigured internal resolver.

Answer

DNS cache poisoning

Answer

DNS tunneling

Answer

DNS zone transfer

Question 15

A company wants to allow inbound HTTPS traffic to a web server located in the DMZ from the Internet. The firewall has three interfaces: Inside (corporate network), Outside (Internet), and DMZ (web server). Which of the following firewall rules is required?

Accepted Answer

Allow traffic from Outside to DMZ on port 443. The correct rule is to allow traffic from the Outside (Internet) interface to the DMZ interface on TCP port 443 (HTTPS). This permits inbound web requests to reach the web server while keeping the corporate Inside network isolated. The firewall must explicitly permit this traffic because the default implicit deny rule would otherwise block all inbound connections from the Outside zone.

Answer

Allow traffic from DMZ to Outside on port 443

Answer

Allow traffic from Inside to DMZ on port 443

Answer

Allow traffic from Outside to Inside on port 443