N10-009 Network Security Practice Test 4 — 15 Questions

Question 1

A network engineer is deploying 802.1X authentication for a wireless network. The security policy requires mutual authentication between the client and the network using certificates on both ends. Which EAP method should the engineer select?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides mutual authentication using certificates on both the client and the server, satisfying the security policy requirement. Unlike other EAP methods, EAP-TLS requires a PKI with certificates installed on both endpoints, ensuring that each side validates the other's identity before establishing the connection.

Answer

EAP-MD5

Answer

PEAP

Answer

EAP-FAST

Question 2

An employee plugs a personal laptop into a network jack and then the laptop is infected with malware that spreads to other devices on the network. Which security control would have most effectively prevented this scenario?

Accepted Answer

802.1X authentication. 802.1X authentication requires devices to authenticate before gaining network access, typically via EAP (Extensible Authentication Protocol) over RADIUS. In this scenario, the employee's personal laptop would be blocked at the port level because it lacks valid credentials, preventing the malware from ever reaching the internal network and spreading to other devices.

Answer

MAC filtering on the switch

Answer

VLAN segmentation

Answer

Access control lists on the router

Question 3

During a security audit, a consultant discovers that encrypted traffic between a client and a web server is being decrypted and re-encrypted by an intermediate device on the network path. Which type of attack best describes this scenario?

Accepted Answer

Man-in-the-middle. Option C is correct because the scenario describes a classic man-in-the-middle (MITM) attack where an intermediary intercepts, decrypts, and re-encrypts traffic between the client and server. This allows the attacker to read or modify the data while both endpoints believe they have a secure TLS session. The key indicator is the decryption and re-encryption step, which is the hallmark of an active MITM proxy.

Answer

ARP poisoning

Answer

SSL stripping

Answer

Rogue DHCP

Question 4

A security analyst notices that the network has been flooded with packets that have the same source IP address as the company's internal DNS server. This is likely an example of which type of attack?

Accepted Answer

IP spoofing. IP spoofing is the correct answer because the attacker is forging the source IP address of packets to impersonate the company's internal DNS server. By flooding the network with packets that appear to originate from a trusted internal server, the attacker can bypass security controls, launch reflection attacks, or cause denial of service. This directly matches the scenario where the source IP is falsified to match a legitimate internal host.

Answer

Smurf attack

Answer

Man-in-the-middle

Answer

ARP poisoning

Question 5

A company wants to ensure that only authorized users can access the internal network by requiring both a password and a one-time code from a mobile app. This is an example of:

Accepted Answer

Two-factor authentication. Two-factor authentication (2FA) requires exactly two distinct authentication factors from different categories: something you know (password) and something you have (one-time code from a mobile app). This matches the scenario precisely, as the password is a knowledge factor and the mobile app-generated code is a possession factor, satisfying the definition of 2FA.

Answer

Single sign-on

Answer

Biometric authentication

Answer

Multifactor authentication with three factors

Question 6

A company wants to protect its internal network by placing web servers that need to be accessible from the internet in a separate network segment. Which security architecture best describes this setup?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a network segment that sits between the internal trusted network and the external untrusted internet. By placing web servers in the DMZ, the company ensures that external users can access the servers without directly exposing the internal network, as traffic must pass through a firewall that enforces strict access control policies. This architecture is specifically designed to isolate public-facing services from internal assets, reducing the attack surface.

Answer

Intranet

Answer

VPN

Answer

Extranet

Question 7

A network security administrator is configuring authentication for network devices and wants to use a protocol that supports separate encryption of the entire authentication packet. Which of the following protocols is designed to encrypt the entire authentication packet and is commonly used with AAA services?

Accepted Answer

TACACS+. TACACS+ is the correct answer because it encrypts the entire authentication packet, including the username, password, and all other fields, using a shared secret key. This full-packet encryption is a key differentiator from RADIUS, which only encrypts the password field. TACACS+ is commonly used with AAA services to provide separate authentication, authorization, and accounting processes.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 8

A security analyst observes that an internal server is sending a large volume of TCP SYN packets to various external IP addresses, but never completing the three-way handshake. This behavior is indicative of which type of attack?

Accepted Answer

SYN flood attack. The correct answer is B. A SYN flood attack occurs when an attacker sends a high volume of TCP SYN packets to a target but never completes the three-way handshake by sending the final ACK. This leaves the target's connection table half-open, consuming resources and potentially exhausting its ability to accept legitimate connections. The observed behavior—internal server sending many SYN packets without completing the handshake—matches the classic signature of a SYN flood, though typically the attacker spoofs the source IP to avoid response traffic.

Answer

Man-in-the-middle attack

Answer

DDoS amplification attack

Answer

Smurf attack

Question 9

A company wants to prevent unauthorized devices from connecting to the corporate network. The policy requires that only specific MAC addresses are permitted on switch ports. Which security feature should be implemented on the switches?

Accepted Answer

MAC filtering / Port security. MAC filtering, also known as port security, is the correct feature because it allows the switch to restrict access to a port based on the source MAC address of incoming frames. By configuring a list of allowed MAC addresses, the switch will drop traffic from any unauthorized device, directly enforcing the policy that only specific MAC addresses are permitted on switch ports.

Answer

802.1X authentication

Answer

VLAN hopping prevention

Answer

DHCP snooping

Question 10

A security analyst is investigating a network anomaly. The analyst notices that the company's web server is receiving a large number of TCP SYN packets from random source IP addresses, all destined for port 80. The web server is responding with SYN-ACK packets, but the connections are never completed. This is causing the server's connection table to fill up, degrading performance for legitimate users. Which type of attack is being described?

Accepted Answer

SYN flood. The attack described is a SYN flood, a type of denial-of-service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a high volume of TCP SYN packets with spoofed source IP addresses to the server's port 80. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server's half-open connection table (backlog queue) to fill up and exhaust resources, degrading performance for legitimate users.

Answer

Ping of death

Answer

Smurf attack

Answer

DNS amplification

Question 11

A company wants to allow employees to securely access internal resources (email, file servers) when working from home over the internet. Which technology should be implemented to create an encrypted tunnel between the employee's remote computer and the corporate network?

Accepted Answer

VPN concentrator. A VPN concentrator is the correct technology because it terminates VPN tunnels from remote users, creating an encrypted tunnel (using protocols like IPsec or TLS) between the employee's remote computer and the corporate network. This ensures that all traffic to internal resources such as email and file servers is securely encapsulated and protected from interception over the internet.

Answer

Firewall

Answer

DMZ

Answer

Intrusion detection system (IDS)

Question 12

A security analyst notices that a user's workstation is sending encrypted DNS queries to an external IP address over TCP port 853. This traffic is being used to establish a covert communication channel to bypass the company's security controls. Which technique is being employed?

Accepted Answer

DNS tunneling. DNS tunneling is the correct answer because the analyst observed encrypted DNS queries over TCP port 853 (DNS over TLS) being used to establish a covert communication channel. This technique encapsulates non-DNS data (e.g., command-and-control traffic) within DNS query and response packets, allowing the attacker to bypass security controls by hiding malicious traffic inside legitimate DNS traffic.

Answer

DNS poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 13

A security team is deploying a new intrusion detection system (IDS) and wants to analyze all traffic entering and exiting the network without introducing latency or a single point of failure. How should the IDS be connected to the network?

Accepted Answer

Connected to a network tap or spanned port on the core switch. Connecting the IDS to a network tap or a spanned port (SPAN/mirror port) on the core switch allows it to receive a copy of all traffic entering and exiting the network without being in the data path. This passive deployment introduces zero latency because the IDS never forwards or blocks traffic, and it eliminates a single point of failure since the network continues to operate if the IDS fails or is taken offline.

Answer

Inline between the firewall and the core switch

Answer

Directly connected to the internet router

Answer

Connected to the management network

Question 14

An organization uses a AAA server for network device authentication. The security team requires that all authentication traffic be fully encrypted and that authorization commands be logged per user. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the best choice because it encrypts the entire authentication packet (including username, password, and all other fields) and supports per-user command authorization logging. This meets the requirement for fully encrypted authentication traffic and detailed audit trails for each user's commands.

Answer

RADIUS with EAP-TLS

Answer

LDAP over SSL

Answer

Kerberos

Question 15

A network administrator wants to prevent unauthorized devices from being plugged into switch ports. Only devices with specific MAC addresses should be allowed on each port. Which switch security feature should be enabled?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to restrict which MAC addresses can communicate through a switch port. By configuring allowed MAC addresses (sticky or static), any device with an unknown MAC address attempting to send traffic will trigger a security violation (shutdown, restrict, or protect). This directly addresses the requirement to prevent unauthorized devices from being plugged into switch ports.

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Answer

802.1X