N10-009 Network Security Practice Test 5 — 15 Questions

Question 1

An organization's security policy requires that all remote access VPN connections use two-factor authentication and that the VPN clients are compliant with the latest patch levels before gaining network access. Which technology combination provides these capabilities?

Accepted Answer

VPN with RADIUS authentication and posture assessment. Option D is correct because RADIUS authentication can enforce two-factor authentication (e.g., via token or OTP), and posture assessment (often via Network Access Control or a VPN posture plugin) checks the client's patch level before granting network access. This combination directly satisfies the policy requirements for both multi-factor authentication and endpoint compliance verification.

Answer

SSL VPN with client certificate authentication

Answer

IPsec VPN using preshared keys

Answer

NAC integrated with a reverse proxy

Question 2

A security analyst notices a large number of incoming TCP packets to a server with the FIN, PSH, and URG flags set. This pattern is characteristic of which type of network scan?

Accepted Answer

Xmas tree scan. An Xmas tree scan sends TCP packets with the FIN, PSH, and URG flags set (the packet 'lights up' like a Christmas tree). This is a stealth scan technique used to probe open or closed ports based on RFC 793 behavior: closed ports should respond with an RST packet, while open ports may ignore the packet (or respond differently depending on the OS). The pattern described—FIN, PSH, and URG all set—is the definitive signature of an Xmas tree scan.

Answer

SYN scan

Answer

Null scan

Answer

ACK scan

Question 3

A security analyst is investigating a potential data exfiltration. The analyst notices that a server is sending DNS queries to an external IP address on TCP port 53, and the DNS responses are unusually large. The server is not a DNS server. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes non-DNS data (e.g., exfiltrated files) within DNS queries and responses, often using TCP port 53 to bypass firewalls. The unusually large responses are a hallmark of tunneled data being returned in DNS payloads, and the fact that the server is not a DNS server strongly indicates it is being used as a client for covert data transfer.

Answer

DNS amplification attack

Answer

DNS zone transfer

Answer

DNS cache poisoning

Question 4

A security engineer is configuring port security on a switch to prevent unauthorized devices from connecting. The requirement is that only the first device to connect to a port is allowed, and if a different device connects, the port should be disabled. Which port security violation mode should be configured?

Accepted Answer

Shutdown. The 'shutdown' violation mode disables the port entirely when a violation occurs, which meets the requirement that the port be disabled if a different device connects. This is the only mode that physically err-disables the port, preventing any further traffic until manually re-enabled.

Answer

Protect

Answer

Restrict

Answer

Sticky

Question 5

An organization has separate VLANs for the HR and Finance departments. Both VLANs use a single Layer 3 switch to route between them. The HR department needs access to a shared printer located in the Finance VLAN, but all other traffic between the VLANs should be blocked. Which of the following should be configured?

Accepted Answer

Configure an ACL on the Layer 3 switch to permit specific traffic between VLANs. An ACL on the Layer 3 switch can filter inter-VLAN traffic at the routed interface (SVI or routed port). By permitting only the HR subnet’s traffic to the printer’s IP address and denying all other inter-VLAN traffic, you meet the requirement of selective access while blocking everything else. This is the standard method for policy-based segmentation between VLANs.

Answer

Place the printer in the HR VLAN

Answer

Create a separate VLAN for the printer

Answer

Use a wireless access point to bridge the VLANs

Question 6

An organization needs to authenticate network administrators and control which commands each administrator can execute on routers and switches. The solution must support granular per-command authorization and encrypt the entire session. Which protocol is best suited for this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) functions, allowing granular per-command authorization on routers and switches. It encrypts the entire session, including the username, password, and all command traffic, unlike RADIUS which only encrypts the password. This makes TACACS+ ideal for environments requiring strict command-level control and full session encryption.

Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Question 7

A security analyst detects that an attacker is sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. What is this attack called?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker sends forged ARP replies to associate their MAC address with the IP address of the default gateway. This causes the victim's switch to update its ARP cache with the attacker's MAC for the gateway's IP, enabling man-in-the-middle attacks where the attacker intercepts traffic destined for the gateway.

Answer

MAC flooding

Answer

DHCP snooping

Answer

DNS spoofing

Question 8

A security administrator observes that an employee's workstation is sending large amounts of data to an external IP address on TCP port 443. The workstation is not supposed to initiate outbound connections, and there is no business need for it. What is the most likely cause?

Accepted Answer

The workstation is part of a botnet and is communicating with a command-and-control server. The workstation is sending large amounts of data to an external IP on TCP port 443, which is commonly used for HTTPS traffic. Since the workstation is not authorized to initiate outbound connections and has no business need for this traffic, the most likely cause is that it has been compromised and is part of a botnet, using HTTPS to communicate with a command-and-control (C2) server to evade detection by blending in with legitimate encrypted web traffic.

Answer

A legitimate software update is being downloaded

Answer

The workstation is acting as a VPN client connecting to a corporate VPN server

Answer

The workstation is hosting a web server that is being accessed externally

Question 9

A security engineer notices that the company's web server is receiving an overwhelming number of HTTP GET requests from thousands of different IP addresses around the world. The requests are for legitimate pages and are well-formed. The server is becoming unresponsive. Which type of attack is most likely occurring?

Accepted Answer

DDoS attack. The attack involves a high volume of legitimate HTTP GET requests from many distinct IP addresses, overwhelming the web server. This is a classic distributed denial-of-service (DDoS) attack, where multiple compromised systems (a botnet) coordinate to flood the target with traffic, exhausting server resources and causing unresponsiveness. The key indicators are the distributed source IPs and the use of application-layer (HTTP) requests, which distinguishes it from network-layer floods.

Answer

ARP spoofing

Answer

SYN flood

Answer

DNS amplification

Question 10

Which security feature on a switch can prevent an attacker from sending forged ARP messages to redirect traffic?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct answer because it validates ARP packets against a trusted database (the DHCP snooping binding table) to ensure that the MAC-to-IP address mapping is legitimate. By intercepting and verifying all ARP requests and replies on untrusted ports, DAI prevents an attacker from sending forged ARP messages to redirect traffic (ARP spoofing).

Answer

Port security

Answer

DHCP snooping

Answer

VLAN segmentation

Question 11

A security analyst is configuring a firewall to allow HTTPS traffic from the internet to an internal web server with a private IP address. The firewall must translate the destination IP address of incoming packets to the private server IP. Which type of NAT should be configured?

Accepted Answer

Destination NAT (DNAT). Destination NAT (DNAT) is used to translate the destination IP address of incoming packets from a public IP to a private IP, allowing external HTTPS traffic to reach an internal web server. This is exactly what the scenario requires: the firewall must rewrite the destination address of packets arriving from the internet to the private server IP. DNAT is commonly implemented using the 'ip nat inside source static' command in Cisco IOS, where the 'inside' keyword refers to the translation of destination addresses for inbound traffic.

Answer

Source NAT (SNAT)

Answer

Static NAT

Answer

Port Address Translation (PAT)

Question 12

A security engineer is configuring a site-to-site VPN between two branch offices. The requirement is to encrypt all traffic between the two networks using IPsec. Which IPsec mode should be used to encrypt the entire IP packet including the original header?

Accepted Answer

Tunnel mode. Tunnel mode is the correct choice because it encrypts the entire original IP packet, including the original header, and then encapsulates it within a new IP header. This is required for site-to-site VPNs where the original source and destination IP addresses must be hidden or protected, and the new header is used for routing between the two VPN gateways.

Answer

Transport mode

Answer

AH only

Answer

ESP only

Question 13

A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it directly restricts the number of unique MAC addresses that can be learned on a switch port, preventing unauthorized devices from connecting. When the configured limit is exceeded, the switch can take actions such as shutdown, restrict, or protect, effectively blocking the unauthorized device. This is a Layer 2 access control mechanism that operates on the switch port itself.

Answer

802.1X

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 14

A network administrator wants to prevent rogue DHCP servers from offering IP addresses to clients on the network. Which security feature should be enabled on the switches?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages by filtering out responses from unauthorized DHCP servers on untrusted ports, preventing rogue servers from offering IP addresses to clients. This is achieved by building and maintaining a DHCP snooping binding database that tracks valid IP-to-MAC address mappings.

Answer

Dynamic ARP Inspection (DAI)

Answer

Port Security

Answer

IP Source Guard

Question 15

A company is implementing network access control to ensure only authenticated users can connect to the wired network. Users must authenticate using their domain credentials before gaining full network access. Which standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control (PNAC). It uses the Extensible Authentication Protocol (EAP) to authenticate devices attempting to connect to a wired or wireless LAN, requiring valid domain credentials before the switch port grants full network access.

Answer

802.3af

Answer

802.11i

Answer

802.1Q