Network Security practice questions

A DNS server

Why wrong: DNS resolves domain names to IP addresses but does not authenticate users or devices. It is not part of the 802.1X process.

A DHCP server

Why wrong: DHCP assigns IP addresses to clients, but it does not perform authentication. 802.1X typically works before DHCP to ensure only authenticated devices get network access.

A Kerberos server

Why wrong: Kerberos is used for authentication in Windows domains but operates at the application layer. 802.1X uses EAP (Extensible Authentication Protocol) over RADIUS, not directly Kerberos. While Active Directory uses Kerberos for domain authentication, the network-level 802.1X authentication is mediated by RADIUS.

WPA2-Personal

Why wrong: WPA2-Personal relies on a single Pre-Shared Key (PSK) for all network users, which is highly vulnerable to brute-force and dictionary attacks if the key is weak or compromised. This mode lacks any form of individual user authentication, dynamic key management, or centralized access control, making it fundamentally less secure and unsuitable for any environment requiring the highest level of network protection or user accountability.

WPA2-Enterprise

Why wrong: WPA2-Enterprise offers strong security by utilizing 802.1X/EAP and a RADIUS server for centralized authentication, assigning unique encryption keys per session. While significantly more secure than personal modes, it lacks the advanced cryptographic protections and Perfect Forward Secrecy inherent in WPA3, and it was historically susceptible to certain vulnerabilities like the KRACK attack, making it not the absolute highest standard today.

WPA3-Personal

Why wrong: WPA3-Personal significantly enhances security over its WPA2 predecessor by implementing Simultaneous Authentication of Equals (SAE) for stronger password-based authentication, which effectively mitigates offline dictionary attacks. However, it still operates on a Pre-Shared Key (PSK) model, meaning all users share a single password, and it does not provide the individual user authentication, dynamic key management, or centralized control offered by a RADIUS server in enterprise deployments.

Allow traffic from the inside interface to the DMZ interface.

Why wrong: A firewall rule allowing traffic from the 'inside' network to the DMZ would enable internal users or systems to initiate connections to resources hosted within the DMZ. While this might be necessary for internal management or access to certain DMZ services, it does not facilitate external users connecting to the web server. This rule governs internal-to-DMZ communication, which is distinct from the requirement for external internet users to access the web server.

Allow traffic from the DMZ interface to the inside interface.

Why wrong: Allowing traffic from the DMZ to the 'inside' network is generally considered a significant security risk and is not required for external users to access a web server in the DMZ. Such a rule would permit systems within the DMZ, which are inherently more exposed to external threats, to initiate connections into the more secure internal network. This creates a potential attack vector where a compromised DMZ server could be used to launch attacks against internal network resources, undermining the DMZ's isolation purpose.

Allow traffic from the outside interface to the inside interface.

Why wrong: A deny rule from the 'outside' to the 'inside' network is a standard and crucial security measure designed to prevent any unauthorized external access directly into the internal network. While this rule is essential for protecting internal resources, it does not directly address the specific requirement to allow external users to access a web server located in the DMZ. This deny rule protects the internal network, but a separate, explicit allow rule from outside to the DMZ is still necessary and compatible with it to achieve the stated objective.

Port security

Why wrong: Port security restricts the number of allowed MAC addresses but does not authenticate the device; it can be bypassed with MAC spoofing.

MAC filtering

Why wrong: MAC filtering simply allows or denies traffic based on MAC addresses and is not a strong authentication mechanism.

Storm control

Why wrong: Storm control limits broadcast, multicast, or unknown unicast traffic to prevent denial of service, not unauthorized access.

Source NAT (SNAT)

Why wrong: Source Network Address Translation (SNAT) is used to change the source IP address of packets as they leave a private network and head towards a public network. Its primary purpose is to hide the internal network's private IP addresses from external entities and to allow internal hosts to access external resources using a public IP. SNAT does not modify the destination IP address of incoming packets, which is required for directing external requests to an internal server.

Static NAT

Why wrong: Static NAT establishes a persistent one-to-one mapping between a single private IP address and a single public IP address. This means that for every incoming packet destined for the public IP, its destination is translated to the corresponding private IP, and for every outgoing packet from the private IP, its source is translated to the public IP. While it facilitates inbound access, it is a bidirectional, fixed mapping for both source and destination, rather than exclusively focusing on modifying the destination for incoming traffic like DNAT.

Port Address Translation (PAT)

Why wrong: Port Address Translation (PAT) is a specific type of Source NAT (SNAT) that allows multiple internal private IP addresses to share a single public IP address for outbound internet access. It achieves this by modifying both the source IP address and the source port number of outgoing packets. PAT is primarily used for enabling many internal hosts to initiate connections to external networks, not for directing incoming traffic to a specific internal destination server.

Star: Each device connects to two others, forming a circle

Why wrong: This statement incorrectly describes a star topology. A star topology is characterized by all devices connecting individually to a central hub or switch, not by devices connecting to only two others in a circular fashion. The description provided, where each device connects to two others forming a circle, accurately defines a ring topology, not a star.

Bus: All devices connect to a central hub/switch

Why wrong: This statement incorrectly describes a bus topology. A bus topology relies on a single, shared backbone cable to which all devices are connected, broadcasting data across this common medium. The characteristic of all devices connecting to a central hub or switch is the defining feature of a star topology, where the central device acts as the concentration point for all network traffic.

Smurf attack

Why wrong: The Smurf attack is a distributed denial-of-service (DDoS) technique that leverages ICMP Echo Request packets with a spoofed source IP address, targeting a victim. These requests are sent to an IP broadcast address within a large network, causing all hosts on that network to reply to the spoofed source IP, thereby flooding the actual target with amplified ICMP Echo Reply traffic. This amplification effect can quickly overwhelm the victim's network capacity, but it does not involve overlapping IP fragments.

Ping flood

Why wrong: A Ping flood is a straightforward denial-of-service (DoS) attack where the attacker overwhelms a target with a massive volume of Internet Control Message Protocol (ICMP) Echo Request packets. This high-bandwidth attack aims to saturate the victim's network connection or exhaust its processing resources by forcing it to respond to an excessive number of ICMP requests. Unlike fragmentation-based attacks, it relies purely on volumetric traffic and does not involve manipulating IP fragment offsets.

SYN flood

Why wrong: A SYN flood is a denial-of-service (DoS) attack that exploits the TCP three-way handshake mechanism. The attacker sends a large number of TCP SYN requests to a target server but never completes the handshake by sending the final ACK packet. This leaves numerous half-open connections in the server's memory, exhausting its connection table and preventing legitimate clients from establishing new connections. This attack targets TCP connection states, not IP fragmentation.

Supplicant

Why wrong: The supplicant is the client software on the user’s device that requests access, it does not enforce policy.

Authentication server

Why wrong: The authentication server (e.g., RADIUS) validates credentials and sends authorization instructions, but enforcement is done by the authenticator.

Policy server

Why wrong: The policy server defines and manages policies, but does not enforce them at the network level.

Man-in-the-middle attack

Why wrong: A man-in-the-middle (MiTM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. This type of attack focuses on intercepting established sessions or data streams, not on initiating repeated failed login attempts from a single source. Firewall logs would typically show unusual traffic patterns or session hijacking, rather than a high volume of authentication failures.

ARP poisoning

Why wrong: ARP poisoning sends fake ARP replies to associate the attacker's MAC address with the IP of a legitimate device, enabling traffic interception. It occurs on the local network and would not appear as repeated SSH attempts from an external IP.

DDoS attack

Why wrong: A Distributed Denial-of-Service (DDoS) attack aims to overwhelm a target system or network resource with a flood of traffic originating from multiple compromised systems, known as a botnet. The objective is to exhaust resources and make the service unavailable to legitimate users, not to gain unauthorized access through login attempts. The scenario describes repeated attempts from a *single* IP, which fundamentally contradicts the 'distributed' nature and typical traffic volume of a DDoS attack.

802.11i

Why wrong: IEEE 802.11i is a robust wireless security standard that specifies the security mechanisms for Wi-Fi networks, most notably defining Wi-Fi Protected Access 2 (WPA2). It provides strong encryption using AES-CCMP and robust authentication methods, including 802.1X/EAP for enterprise environments or pre-shared keys for personal use, to secure wireless communications. However, 802.11i is exclusively designed for wireless local area networks (WLANs) and is not applicable for securing or authenticating devices connected to wired Ethernet ports.

802.3af

Why wrong: IEEE 802.3af defines the Power over Ethernet (PoE) standard, which allows electrical power to be delivered to network devices over the same Ethernet cable that carries data. This standard is specifically designed to power devices such as IP phones, wireless access points, and security cameras without requiring separate power outlets. 802.3af is solely concerned with power delivery and does not incorporate any features for authenticating devices or controlling network access based on security policies.

802.1Q

Why wrong: IEEE 802.1Q is the standard for Virtual Local Area Network (VLAN) tagging, which enables a single physical network infrastructure to support multiple logical broadcast domains. Its primary function is to insert a tag into Ethernet frames, identifying which VLAN the frame belongs to, allowing switches to properly forward traffic across trunk links. While it provides network segmentation and traffic isolation, 802.1Q does not offer any mechanism for device authentication or access control to prevent unauthorized connections.

Ping flood

Why wrong: A ping flood is a basic denial-of-service (DoS) attack where an attacker directly sends an overwhelming number of ICMP echo request packets to a target server. The goal is to consume the target's bandwidth and processing resources by forcing it to respond to each request, thereby making it unavailable to legitimate users. Crucially, this attack involves the victim receiving requests directly from the attacker, not a flood of replies from numerous intermediary sources.

ICMP tunneling

Why wrong: ICMP tunneling is a technique used for covert communication, where data is encapsulated within the payload of ICMP echo request and reply packets. This method allows attackers to establish a hidden communication channel, often for data exfiltration or command and control, bypassing some firewall rules that permit ICMP traffic. Unlike a flood attack, ICMP tunneling focuses on discreet data transfer rather than overwhelming a target with a high volume of traffic.

Fraggle attack

Why wrong: A Fraggle attack is a denial-of-service (DoS) attack that operates on principles similar to a Smurf attack but utilizes UDP echo packets instead of ICMP. The attacker sends UDP packets to a broadcast address, spoofing the victim's IP address as the source. Devices on the broadcast network then send UDP echo replies to the victim, creating a flood of UDP traffic that can overwhelm the target server's network capacity and processing capabilities.

WPA2

Why wrong: Wi-Fi Protected Access 2 (WPA2) is a security protocol specifically designed to secure wireless local area networks (WLANs) by providing strong encryption (AES) and authentication. It protects Wi-Fi communications from eavesdropping and unauthorized access. However, WPA2 is exclusively for wireless networks and has no mechanism or applicability for authenticating devices connecting via a wired Ethernet port.

MAC filtering

Why wrong: MAC filtering attempts to control network access by maintaining a list of permitted or denied Media Access Control (MAC) addresses. While it can prevent unknown devices from easily connecting, it is a weak security measure because MAC addresses are easily discoverable and can be spoofed by unauthorized users. It also lacks robust user or device authentication, making it unsuitable for ensuring only *authorized employee computers* connect securely.

VPN

Why wrong: A Virtual Private Network (VPN) establishes an encrypted tunnel over an untrusted network, primarily for secure remote access to private resources. Its function is to protect data in transit and provide secure connectivity for users *outside* the local network perimeter. A VPN does not provide port-based authentication for devices physically connecting to a local area network switch port.

B) Smurf attack

Why wrong: A Smurf attack is a distributed Denial-of-Service (DoS) attack leveraging ICMP echo requests and IP broadcast addresses. An attacker sends ICMP echo requests with the victim's spoofed IP address as the source to an IP broadcast address on a network. All hosts on that network then reply to the victim, flooding it with ICMP echo replies and overwhelming its network capacity. This attack does not involve TCP SYN packets.

C) Ping of death

Why wrong: The Ping of death is an older Denial-of-Service (DoS) attack that exploits vulnerabilities in IP fragmentation and reassembly. An attacker sends an ICMP echo request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after fragmentation. When the target system attempts to reassemble this oversized, malformed packet, it can lead to a buffer overflow, system crash, or reboot, rendering the service unavailable. This attack relies on ICMP, not TCP SYN packets.

D) ARP poisoning

Why wrong: ARP poisoning, also known as ARP spoofing, is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway or another victim. This allows the attacker to intercept, modify, or drop traffic intended for the legitimate host, effectively performing a Man-in-the-Middle attack. It does not involve sending TCP SYN packets to a server.

B) Allow rule with source any, destination 10.0.0.5, port 443

Why wrong: An allow rule with a destination of 10.0.0.5 would permit traffic *if* the packet's destination IP was already 10.0.0.5. However, incoming traffic from the internet is addressed to the firewall's public IP (e.g., 203.0.113.10), not the internal private IP. Without an accompanying address translation mechanism like DNAT, the firewall would simply drop or reject packets whose destination IP does not match an interface or a routing entry, as the internal server's private IP is not directly reachable from the internet.

C) Access control list on the internal interface

Why wrong: An Access Control List (ACL) applied to an internal interface primarily governs traffic flow *within* the private network or traffic attempting to *exit* the private network through that interface. While an ACL can filter traffic based on source, destination, and port, it does not perform the crucial function of translating public IP addresses to private ones for incoming external connections. Therefore, an internal ACL cannot enable remote employees to initiate connections to an internal server from the internet.

D) VPN rule to require remote access VPN

Why wrong: A VPN rule would mandate that remote employees establish a Virtual Private Network tunnel to the corporate network before accessing any internal resources. While VPNs provide secure remote access, the question implies a direct internet-based access method for a service, not a requirement for users to connect via a VPN client. Implementing a VPN rule would prevent direct public access to the service and instead force all remote connections through a secure, encrypted tunnel, which is not the stated goal.

Smurf attack

Why wrong: A Smurf attack uses ICMP echo requests with a spoofed source IP to broadcast addresses, causing amplification; the source IP is not necessarily internal.

SYN flood

Why wrong: A SYN flood sends many TCP SYN packets without completing handshakes, but the source IPs are often random, not specifically internal.

DNS amplification

Why wrong: DNS amplification uses open DNS resolvers to flood a target with large DNS responses; the source IPs are the resolvers, not internal addresses.

LDAP

Why wrong: LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information services, commonly used to store user accounts, groups, and other network resources. While an LDAP directory can serve as the backend database for user credentials, it does not perform the actual 802.1X authentication process itself. A RADIUS server is still necessary to handle the EAP (Extensible Authentication Protocol) negotiation and communicate with the LDAP directory to verify user identities for WPA3-Enterprise.

TACACS+

Why wrong: TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-proprietary AAA protocol primarily used for authenticating and authorizing administrators accessing network devices like routers and switches. Unlike RADIUS, which combines authentication and authorization into a single packet, TACACS+ separates these functions, offering more granular control over command authorization. However, it is not the standard or preferred protocol for authenticating end-user devices connecting to 802.1X-secured wireless networks such as WPA3-Enterprise.

Kerberos

Why wrong: Kerberos is a network authentication protocol primarily designed for client-server applications within a Windows Active Directory domain, providing strong authentication through secret-key cryptography. While it secures access to many network services, Kerberos does not directly integrate as the authentication backend for 802.1X-based wireless networks like WPA3-Enterprise. Instead, a RADIUS server is required to handle the 802.1X authentication process, even if that RADIUS server might, in turn, query an Active Directory for user credentials.

B) ARP poisoning

Why wrong: ARP poisoning, also known as ARP spoofing, is a technique where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. These malicious messages associate the attacker's MAC address with the IP address of another legitimate host, such as the default gateway, in the ARP caches of other devices. This allows the attacker to intercept, modify, or drop traffic between the two poisoned hosts, creating a man-in-the-middle scenario, but it is not detectable through DHCP server logs.

C) MAC flooding

Why wrong: MAC flooding is a Layer 2 attack designed to overwhelm a network switch's MAC address table, also known as the CAM table, with a multitude of fake MAC-to-port mappings. When the table becomes full, the switch may enter a fail-open mode, behaving like a hub by broadcasting all incoming traffic to every port. This allows the attacker to capture traffic not intended for them, but it does not directly involve DHCP server logs or IP address assignment processes.

D) DNS spoofing

Why wrong: DNS spoofing, or DNS cache poisoning, involves an attacker injecting fraudulent DNS records into a DNS resolver's cache or directly responding with malicious information to a client's DNS query. The objective is to redirect users attempting to access legitimate websites to attacker-controlled sites, often for phishing or malware distribution. This attack operates at the application layer and manipulates name resolution, which is distinct from the network layer functions of DHCP.

B) Syslog server

Why wrong: Syslog servers collect log messages but do not perform authentication.

C) TACACS+ server

Why wrong: TACACS+ can be used for authentication, but RADIUS is the standard for 802.1X. Additionally, TACACS+ is proprietary to Cisco.

D) NTP server

Why wrong: NTP provides time synchronization, not authentication.

ARP poisoning

Why wrong: ARP poisoning involves sending forged ARP messages to associate the attacker's MAC with a legitimate IP address. This does not directly target DHCP.

DNS amplification

Why wrong: DNS amplification is a type of DDoS attack that uses misconfigured DNS servers to flood a target with traffic. It is not related to DHCP.

Rogue DHCP server

Why wrong: A rogue DHCP server attack involves an unauthorized server offering IP addresses to clients, potentially intercepting traffic. Here, the legitimate server is being flooded, not spoofed.

Denial-of-service (DoS) attack

Why wrong: A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or exploiting a vulnerability. While DoS attacks can sometimes involve IP spoofing to hide the attacker's identity, the primary symptom is resource exhaustion or service disruption, not specifically the appearance of internal source IP addresses on an external network interface. The described observation is a direct indicator of source IP address manipulation, which is a specific technique, not the overarching goal of a DoS attack.

Man-in-the-middle (MITM) attack

Why wrong: A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. While MITM attacks intercept traffic, they typically operate by positioning the attacker between the legitimate endpoints, often within the same local network segment, to eavesdrop or manipulate data. The scenario described, specifically seeing internal source IPs on an external interface, points to source address forgery rather than the interception and relay mechanism characteristic of a MITM attack.

ARP poisoning

Why wrong: ARP poisoning is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. This manipulates the MAC address tables of switches and the ARP caches of hosts, associating the attacker's MAC address with the IP address of a legitimate network device. Since ARP operates strictly within a local broadcast domain and does not traverse routers, it cannot cause internal source IP addresses to appear on an external, routed interface, making it inconsistent with the observed symptom.