N10-009 Network Security Practice Test 6 — 15 Questions

Question 1

A security analyst discovers that users on the network are receiving ARP replies that map the default gateway IP address to an unknown MAC address. This is causing intermittent connectivity issues. Which type of attack is occurring, and what security feature should be implemented to prevent it?

Accepted Answer

ARP poisoning; Dynamic ARP Inspection (DAI). This attack is ARP poisoning (also called ARP spoofing), where an attacker sends forged ARP replies to associate the default gateway's IP address with the attacker's MAC address. This allows the attacker to intercept, modify, or drop traffic intended for the gateway. Dynamic ARP Inspection (DAI) prevents this by validating ARP packets against a trusted DHCP snooping binding table, dropping any ARP reply that contains an IP-to-MAC mapping not present in the table.

Answer

MAC flooding; port security

Answer

DHCP starvation; DHCP snooping

Answer

DNS poisoning; DNSSEC

Question 2

A security engineer is configuring a firewall to protect an internal network. The requirement is that internal users can initiate connections to the internet, but external hosts should not be able to initiate connections to internal hosts unless the internal host first requested the connection. Which firewall technology should be used?

Accepted Answer

Stateful inspection. Stateful inspection (B) tracks the state of active connections by maintaining a state table that records source/destination IPs, ports, and sequence numbers. It allows return traffic for connections initiated from the internal network while blocking unsolicited inbound traffic, which directly matches the requirement that external hosts cannot initiate connections unless the internal host requested them first.

Answer

Stateless packet filtering

Answer

Application proxy

Answer

Packet filtering based on ACL only

Question 3

A security analyst discovers that an attacker is sending large numbers of incomplete TCP connection requests to a server, causing the server to run out of resources and stop responding to legitimate requests. Which type of attack is this, and which mitigation should be implemented?

Accepted Answer

SYN flood; enable TCP intercept or SYN cookies. This is a SYN flood attack, where the attacker sends a high volume of TCP SYN packets without completing the three-way handshake, exhausting the server's connection queue. Enabling TCP intercept (on Cisco devices) or SYN cookies (RFC 4987) allows the server to validate handshakes before allocating resources, mitigating the attack.

Answer

Ping flood; implement rate limiting

Answer

Smurf attack; disable IP-directed broadcasts

Answer

ARP poisoning; enable dynamic ARP inspection

Question 4

A small business uses a wireless network for employees and guests. The owner wants to ensure that guest devices cannot access internal resources such as file servers and printers. Which network security technique should be implemented?

Accepted Answer

VLAN segmentation with separate SSID for guests. VLAN segmentation with a separate SSID for guests is the correct approach because it creates a logical network boundary that isolates guest traffic from internal resources. By assigning the guest SSID to a distinct VLAN, the network can enforce access control lists (ACLs) at the Layer 3 switch or firewall, preventing guest devices from reaching file servers, printers, or other internal subnets while still allowing internet access.

Answer

MAC address filtering

Answer

WPA2 encryption

Answer

Disabling SSID broadcast

Question 5

A security analyst discovers that an unauthorized device is sending forged ARP replies to poison the ARP caches of other devices on the network. Which security feature should be implemented on the switches to prevent this?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis by intercepting all ARP requests and replies and verifying that they match entries in the DHCP snooping binding table. If an ARP reply contains a forged IP-to-MAC mapping, DAI drops the packet, preventing ARP cache poisoning. This directly stops the described attack where an unauthorized device sends forged ARP replies.

Answer

Port security

Answer

DHCP snooping

Answer

STP BPDU guard

Question 6

A company wants to ensure that only devices with known MAC addresses can connect to the guest Wi-Fi network. Which security feature should be configured on the wireless controller?

Accepted Answer

MAC filtering. MAC filtering allows the wireless controller to maintain an allowlist of known MAC addresses, so only devices with those addresses can associate with the guest SSID. This directly meets the requirement to restrict access based on MAC addresses without requiring authentication credentials from users.

Answer

WPA2-Enterprise

Answer

802.1X

Answer

WPA3-Personal

Question 7

A security administrator discovers that an attacker has intercepted data between two legitimate hosts by redirecting traffic through a rogue device. Which type of attack is this?

Accepted Answer

Man-in-the-middle. This is a classic man-in-the-middle (MITM) attack, where the attacker intercepts and potentially alters communication between two legitimate hosts by inserting a rogue device into the data path. The key characteristic is the redirection of traffic through the attacker's device, which allows them to capture, inspect, or modify packets in transit.

Answer

ARP poisoning

Answer

DNS poisoning

Answer

Replay attack

Question 8

A network administrator needs to ensure that only authorized devices can connect to the wired network. Each user must authenticate using their domain credentials. Which of the following should be implemented?

Accepted Answer

802.1X with EAP-TLS. 802.1X with EAP-TLS is correct because it provides port-based network access control that requires each user to authenticate using their domain credentials (via a RADIUS server) before the switch port is opened for traffic. EAP-TLS uses mutual authentication with digital certificates, ensuring only authorized devices and users gain access to the wired network.

Answer

MAC filtering

Answer

WPA2-PSK

Answer

Port security

Question 9

A security analyst discovers that an unauthorized device is sending forged ARP replies, causing other devices to map the default gateway IP address to the attacker's MAC address. Which security feature should be implemented on the switches to prevent this attack?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the correct choice because it validates ARP packets on a per-port basis, ensuring that only legitimate ARP replies with correct IP-to-MAC bindings are forwarded. DAI uses a DHCP snooping binding table (or static ARP ACLs) to intercept and verify ARP packets, dropping forged replies that attempt to poison the ARP cache of other devices.

Answer

Port security

Answer

DHCP snooping

Answer

BPDU guard

Question 10

A company wants to prevent unauthorized personal devices from connecting to the corporate wired network. Employees must authenticate using their domain credentials before gaining full network access. Which security measure should be implemented on the switch ports?

Accepted Answer

802.1X. 802.1X is the correct choice because it provides port-based network access control (PNAC) that requires end devices to authenticate using domain credentials (e.g., via RADIUS) before being granted full network access. This ensures that only authorized users, not just authorized devices, can connect to the corporate wired network, meeting the requirement to prevent unauthorized personal devices.

Answer

MAC filtering

Answer

Port security with sticky MAC

Answer

VLAN hopping prevention

Question 11

An attacker sends ICMP echo request packets to the broadcast address of a network, with the source IP address spoofed to be the target's IP address. This causes all hosts on the network to send ICMP echo replies to the target, overwhelming it. Which type of attack is this?

Accepted Answer

Smurf attack. This is a classic Smurf attack, which exploits ICMP by sending echo request packets to the network's broadcast address with the source IP spoofed as the target. All hosts on the network receive the request and reply to the spoofed source, flooding the target with ICMP echo replies and consuming its bandwidth or resources.

Answer

Fraggle attack

Answer

Ping flood

Answer

ARP poisoning

Question 12

A security auditor discovers that several unused switch ports are in default configuration. The auditor recommends implementing a security measure that will disable the port if an unauthorized device is connected, and then automatically re-enable the port after a specified time period. Which feature should be configured on the switch ports?

Accepted Answer

Port security with violation mode 'shutdown' and errdisable recovery interval. Port security with violation mode 'shutdown' disables the port when an unauthorized device is detected, and the errdisable recovery interval automatically re-enables the port after a specified time period. This directly matches the auditor's requirement to disable on unauthorized connection and auto-re-enable after a timeout.

Answer

802.1X with RADIUS authentication and guest VLAN

Answer

DHCP snooping and dynamic ARP inspection

Answer

Storm control and broadcast suppression

Question 13

A security analyst notices that a network switch is receiving DHCP discover messages from a rogue device offering IP addresses. The rogue device is causing clients to obtain invalid IP addresses and lose network connectivity. Which security feature should be implemented on the switch to prevent this type of attack?

Accepted Answer

DHCP snooping. B is correct because DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports (connected to clients or rogue devices). When a rogue device sends DHCP discover messages offering IP addresses, DHCP snooping on untrusted ports drops those messages, preventing the rogue server from assigning invalid IP addresses.

Answer

Dynamic ARP inspection (DAI)

Answer

Port security

Answer

802.1X authentication

Question 14

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 15

Which attack technique involves an attacker intercepting and potentially modifying the communication between two parties without their knowledge?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack is correct because it specifically involves an attacker secretly intercepting and potentially altering communications between two parties who believe they are directly communicating with each other. This is achieved by the attacker inserting themselves into the communication path, often by ARP spoofing, DNS spoofing, or rogue access points, allowing them to capture, decrypt, or modify packets in transit.

Answer

Replay attack

Answer

Smurf attack

Answer

Phishing