N10-009 Network Security Practice Test 3 — 15 Questions

Question 1

A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?

Accepted Answer

DHCP snooping. DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.

Answer

BPDU guard

Answer

Dynamic ARP inspection

Answer

Port security

Question 2

A security analyst needs to deploy a device that can perform deep packet inspection and block specific application-layer attacks in real time. Which of the following devices is MOST appropriate for this purpose?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is designed to inspect traffic in real time, perform deep packet inspection (DPI) up to Layer 7, and automatically block malicious traffic, including application-layer attacks such as SQL injection or cross-site scripting. Unlike a passive IDS, an IPS sits inline and can drop or reset sessions based on signature or anomaly detection, making it the most appropriate device for this requirement.

Answer

Stateful firewall

Answer

Proxy server

Answer

VPN concentrator

Question 3

A security analyst receives an alert that an internal user's workstation is sending a high volume of ARP requests for multiple IP addresses on the local subnet. The analyst suspects a man-in-the-middle attack. Which security mechanism is most effective at mitigating this type of attack on a switched network?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets on a switched network, ensuring that only legitimate ARP replies are forwarded. In a man-in-the-middle attack, an attacker sends spoofed ARP replies to associate their MAC address with the IP address of a legitimate host. DAI intercepts all ARP packets and compares them against a trusted binding table (built by DHCP snooping), dropping any that are invalid, thus preventing ARP spoofing.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 4

A network administrator wants to prevent unauthorized devices from connecting to the network through a switch port. Which security feature should be enabled on the switch?

Accepted Answer

802.1X. 802.1X is the correct answer because it provides port-based network access control (PNAC) that authenticates devices before granting network access. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring only authorized users or devices can connect through the switch port. This prevents unauthorized devices from accessing the network at Layer 2, regardless of MAC address or IP configuration.

Answer

Port security

Answer

MAC filtering

Answer

Storm control

Question 5

A network security analyst notices high CPU utilization on the core switch and detects a large volume of ARP replies from a single IP address that claims to be the default gateway for all local subnets. Which type of attack is MOST likely occurring?

Accepted Answer

ARP poisoning. The attack described is ARP poisoning (also known as ARP spoofing), where an attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes all traffic destined for other subnets to be redirected to the attacker's machine, leading to high CPU utilization on the switch as it processes the flood of ARP packets and forwards the intercepted traffic.

Answer

DHCP starvation

Answer

MAC flooding

Answer

DNS amplification

Question 6

Which of the following security mechanisms requires a user to authenticate before gaining access to the wired network at a switch port?

Accepted Answer

802.1X. 802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that requires a user or device to authenticate via an authentication server (e.g., RADIUS) before the switch port transitions from an unauthorized to an authorized state, allowing full network access. It uses Extensible Authentication Protocol (EAP) over LAN (EAPoL) to carry authentication messages between the supplicant (client), authenticator (switch), and authentication server. This ensures that only authenticated users can access the wired network at the switch port level.

Answer

Port security

Answer

ACL

Answer

MAC authentication

Question 7

A security analyst has enabled DHCP snooping on all VLANs of the company's switches to mitigate the risk of rogue DHCP servers. After implementation, the analyst discovers that clients are still receiving IP addresses from an unauthorized DHCP server. The unauthorized server is connected to a switch port that is currently configured as a trusted port. What should the analyst do to stop the rogue DHCP server from offering addresses?

Accepted Answer

Change the port connecting the unauthorized server to an untrusted port.. DHCP snooping operates by designating switch ports as either trusted or untrusted. Trusted ports are allowed to send DHCP server messages (OFFER, ACK), while untrusted ports are blocked from sending such messages. Since the rogue server is connected to a trusted port, it can still offer IP addresses. Changing the port to untrusted will cause the switch to drop all DHCP server messages from that port, stopping the rogue server.

Answer

Enable Dynamic ARP Inspection on the VLAN.

Answer

Configure port security on the unauthorized server's port to limit MAC addresses.

Answer

Increase the rate limit on the unauthorized server's port.

Question 8

A company's public web server is experiencing a flood of TCP SYN packets from multiple external IP addresses. The server's connection table is full, causing new legitimate connections to be dropped. Which of the following mitigation techniques should be implemented to protect the server while still allowing legitimate traffic?

Accepted Answer

Implement SYN cookies on the server.. SYN cookies allow the server to avoid storing connection state in the TCP backlog until the three-way handshake completes. When the SYN flood fills the connection table, the server encodes the initial sequence number (ISN) with cryptographic information about the connection, enabling it to verify the ACK from a legitimate client without consuming table entries. This technique preserves resources for legitimate traffic while dropping spoofed or incomplete handshakes.

Answer

Increase the server's TCP connection backlog.

Answer

Enable bogon filtering on the perimeter firewall.

Answer

Deploy an intrusion prevention system (IPS) with signature detection.

Question 9

A company wants to prevent unauthorized users from plugging into network jacks and gaining access to the wired network. Which of the following security mechanisms should be implemented at the switch level?

Accepted Answer

802.1X. 802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that authenticates devices before granting full network access. When a device plugs into a switch port, the switch (as the authenticator) blocks all traffic except EAPoL (Extensible Authentication Protocol over LAN) frames until the device successfully authenticates via a RADIUS server. This prevents unauthorized users from gaining network access simply by connecting to a live jack.

Answer

MAC address filtering

Answer

Port security

Answer

Dynamic ARP Inspection

Question 10

An IT security analyst is implementing a solution to detect malware on endpoints by monitoring system calls and file integrity. Which of the following types of controls is being deployed?

Accepted Answer

Host-based Intrusion Detection System (HIDS). A Host-based Intrusion Detection System (HIDS) monitors system calls, file integrity, and operating system logs directly on the endpoint. This matches the scenario because the analyst is deploying a solution that detects malware by observing low-level system behavior and verifying file integrity, which are core HIDS functions.

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Firewall

Answer

Virtual Private Network (VPN)

Question 11

A security analyst is investigating a user's complaint that their wireless connection keeps disconnecting. The analyst uses a wireless scanning tool and discovers two access points broadcasting the same SSID 'CorpNet' with different BSSIDs. One is the legitimate company AP on channel 1, and the other is on channel 11 with a strong signal and security set to 'Open'. Which of the following attacks is most likely occurring?

Accepted Answer

Evil twin. The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.

Answer

War driving

Answer

Rogue access point

Answer

Bluesnarfing

Question 12

A company wants to ensure that only authorized devices that comply with security policies (such as updated antivirus and OS patches) are allowed to connect to the internal network. Both wired and wireless connections are used. Which of the following security solutions would best enforce this requirement?

Accepted Answer

Network Access Control (NAC). Network Access Control (NAC) is the correct solution because it enforces security policies by inspecting the health and compliance of devices—such as checking for updated antivirus definitions and OS patches—before granting access to the network. NAC can operate on both wired (e.g., 802.1X) and wireless (e.g., WPA2-Enterprise with RADIUS) connections, blocking or quarantining non-compliant devices. This matches the requirement to ensure only authorized, policy-compliant devices connect.

Answer

VPN

Answer

Access control list (ACL)

Answer

Intrusion prevention system (IPS)

Question 13

A security analyst observes that a workstation on the network is sending unsolicited ARP replies stating that the workstation's MAC address corresponds to the default gateway IP for all subnets. This behavior is causing other devices to send traffic destined for external networks to the workstation instead of the legitimate gateway. Which type of attack is being performed?

Accepted Answer

A: ARP spoofing. The workstation is sending unsolicited ARP replies that map the default gateway IP to its own MAC address. This poisons the ARP caches of other devices on the network, causing them to forward traffic destined for external networks to the attacker's workstation instead of the legitimate gateway. This is the classic behavior of an ARP spoofing (or ARP poisoning) attack, which exploits the lack of authentication in the ARP protocol (RFC 826).

Answer

B: DHCP starvation

Answer

C: DNS poisoning

Answer

D: MAC flooding

Question 14

A company wants to prevent unauthorized devices from connecting to the wired network by authenticating users or devices before granting network access. Which of the following technologies should be implemented on the switch ports to achieve this?

Accepted Answer

A: 802.1X. 802.1X is an IEEE standard (802.1X-2020) for port-based Network Access Control (NAC). It authenticates users or devices via EAP (Extensible Authentication Protocol) before the switch port transitions from the unauthorized (blocking) state to the authorized (forwarding) state, effectively preventing unauthorized devices from accessing the wired network.

Answer

B: Port security with MAC address sticky

Answer

C: Access control lists (ACLs)

Answer

D: DHCP snooping

Question 15

A company wants to ensure that only users who have successfully authenticated Active Directory credentials can access the wired network. The network switches support IEEE 802.1X. Which additional component must be deployed to complete the solution?

Accepted Answer

A RADIUS server. IEEE 802.1X port-based authentication requires a RADIUS server to act as the authentication server. The switch (authenticator) forwards the user's credentials to the RADIUS server, which validates them against Active Directory and returns an accept or reject decision. Without a RADIUS server, the switch has no way to verify the user's credentials against the central identity store.

Answer

A DHCP server

Answer

A certificate authority

Answer

A TACACS+ server