Network Security practice questions

ARP poisoning

Why it fails: ARP poisoning involves sending forged ARP messages to associate the attacker's MAC with a legitimate IP address. This does not directly target DHCP.

DNS amplification

Why it fails: DNS amplification is a type of DDoS attack that uses misconfigured DNS servers to flood a target with traffic. It is not related to DHCP.

Rogue DHCP server

Why it fails: A rogue DHCP server attack involves an unauthorized server offering IP addresses to clients, potentially intercepting traffic. Here, the legitimate server is being flooded, not spoofed.

A DNS server

Why it fails: DNS resolves domain names to IP addresses but does not authenticate users or devices. It is not part of the 802.1X process.

A DHCP server

Why it fails: DHCP assigns IP addresses to clients, but it does not perform authentication. 802.1X typically works before DHCP to ensure only authenticated devices get network access.

A Kerberos server

Why it fails: Kerberos is used for authentication in Windows domains but operates at the application layer. 802.1X uses EAP (Extensible Authentication Protocol) over RADIUS, not directly Kerberos. While Active Directory uses Kerberos for domain authentication, the network-level 802.1X authentication is mediated by RADIUS.

WPA2-Personal

Why it fails: WPA2-Personal relies on a single Pre-Shared Key (PSK) for all network users, which is highly vulnerable to brute-force and dictionary attacks if the key is weak or compromised. This mode lacks any form of individual user authentication, dynamic key management, or centralized access control, making it fundamentally less secure and unsuitable for any environment requiring the highest level of network protection or user accountability.

WPA2-Enterprise

Why it fails: WPA2-Enterprise offers strong security by utilizing 802.1X/EAP and a RADIUS server for centralized authentication, assigning unique encryption keys per session. While significantly more secure than personal modes, it lacks the advanced cryptographic protections and Perfect Forward Secrecy inherent in WPA3, and it was historically susceptible to certain vulnerabilities like the KRACK attack, making it not the absolute highest standard today.

WPA3-Personal

Why it fails: WPA3-Personal significantly enhances security over its WPA2 predecessor by implementing Simultaneous Authentication of Equals (SAE) for stronger password-based authentication, which effectively mitigates offline dictionary attacks. However, it still operates on a Pre-Shared Key (PSK) model, meaning all users share a single password, and it does not provide the individual user authentication, dynamic key management, or centralized control offered by a RADIUS server in enterprise deployments.

MAC flooding attack

Why it fails: MAC flooding attacks target the switch's MAC address table, not DHCP servers.

ARP spoofing

Why it fails: ARP spoofing involves sending fake ARP replies to associate an attacker's MAC with an IP address, not DHCP exhaustion.

DNS poisoning

Why it fails: DNS poisoning corrupts DNS cache to redirect traffic, unrelated to DHCP exhaustion.

Allow traffic from the inside interface to the DMZ interface.

Why it fails: A firewall rule allowing traffic from the 'inside' network to the DMZ would enable internal users or systems to initiate connections to resources hosted within the DMZ. While this might be necessary for internal management or access to certain DMZ services, it does not facilitate external users connecting to the web server. This rule governs internal-to-DMZ communication, which is distinct from the requirement for external internet users to access the web server.

Allow traffic from the DMZ interface to the inside interface.

Why it fails: Allowing traffic from the DMZ to the 'inside' network is generally considered a significant security risk and is not required for external users to access a web server in the DMZ. Such a rule would permit systems within the DMZ, which are inherently more exposed to external threats, to initiate connections into the more secure internal network. This creates a potential attack vector where a compromised DMZ server could be used to launch attacks against internal network resources, undermining the DMZ's isolation purpose.

Allow traffic from the outside interface to the inside interface.

Why it fails: A deny rule from the 'outside' to the 'inside' network is a standard and crucial security measure designed to prevent any unauthorized external access directly into the internal network. While this rule is essential for protecting internal resources, it does not directly address the specific requirement to allow external users to access a web server located in the DMZ. This deny rule protects the internal network, but a separate, explicit allow rule from outside to the DMZ is still necessary and compatible with it to achieve the stated objective.

Source NAT (SNAT)

Why it fails: Source Network Address Translation (SNAT) is used to change the source IP address of packets as they leave a private network and head towards a public network. Its primary purpose is to hide the internal network's private IP addresses from external entities and to allow internal hosts to access external resources using a public IP. SNAT does not modify the destination IP address of incoming packets, which is required for directing external requests to an internal server.

Static NAT

Why it fails: Static NAT establishes a persistent one-to-one mapping between a single private IP address and a single public IP address. This means that for every incoming packet destined for the public IP, its destination is translated to the corresponding private IP, and for every outgoing packet from the private IP, its source is translated to the public IP. While it facilitates inbound access, it is a bidirectional, fixed mapping for both source and destination, rather than exclusively focusing on modifying the destination for incoming traffic like DNAT.

Port Address Translation (PAT)

Why it fails: Port Address Translation (PAT) is a specific type of Source NAT (SNAT) that allows multiple internal private IP addresses to share a single public IP address for outbound internet access. It achieves this by modifying both the source IP address and the source port number of outgoing packets. PAT is primarily used for enabling many internal hosts to initiate connections to external networks, not for directing incoming traffic to a specific internal destination server.

802.1X

Why it fails: 802.1X is an authentication protocol that requires user credentials, not just MAC address filtering.

MAC address filtering

Why it fails: MAC address filtering is a general term; on switches it is implemented via port security.

VLAN hopping prevention

Why it fails: VLAN hopping prevention protects against VLAN attacks, not device authorization.

Star: Each device connects to two others, forming a circle

Why it fails: This statement incorrectly describes a star topology. A star topology is characterized by all devices connecting individually to a central hub or switch, not by devices connecting to only two others in a circular fashion. The description provided, where each device connects to two others forming a circle, accurately defines a ring topology, not a star.

Bus: All devices connect to a central hub/switch

Why it fails: This statement incorrectly describes a bus topology. A bus topology relies on a single, shared backbone cable to which all devices are connected, broadcasting data across this common medium. The characteristic of all devices connecting to a central hub or switch is the defining feature of a star topology, where the central device acts as the concentration point for all network traffic.

Smurf attack

Why it fails: The Smurf attack is a distributed denial-of-service (DDoS) technique that leverages ICMP Echo Request packets with a spoofed source IP address, targeting a victim. These requests are sent to an IP broadcast address within a large network, causing all hosts on that network to reply to the spoofed source IP, thereby flooding the actual target with amplified ICMP Echo Reply traffic. This amplification effect can quickly overwhelm the victim's network capacity, but it does not involve overlapping IP fragments.

Ping flood

Why it fails: A Ping flood is a straightforward denial-of-service (DoS) attack where the attacker overwhelms a target with a massive volume of Internet Control Message Protocol (ICMP) Echo Request packets. This high-bandwidth attack aims to saturate the victim's network connection or exhaust its processing resources by forcing it to respond to an excessive number of ICMP requests. Unlike fragmentation-based attacks, it relies purely on volumetric traffic and does not involve manipulating IP fragment offsets.

SYN flood

Why it fails: A SYN flood is a denial-of-service (DoS) attack that exploits the TCP three-way handshake mechanism. The attacker sends a large number of TCP SYN requests to a target server but never completes the handshake by sending the final ACK packet. This leaves numerous half-open connections in the server's memory, exhausting its connection table and preventing legitimate clients from establishing new connections. This attack targets TCP connection states, not IP fragmentation.

Supplicant

Why it fails: The supplicant is the client software on the endpoint that responds to authentication requests; it does not enforce policy on the network. It is tempting because it participates in the 802.1X exchange, and it would be correct when describing the component installed on the device requesting access.

Authentication server

Why it fails: The authentication server validates credentials via RADIUS or similar, but posture checks such as antivirus and patch status are evaluated and enforced by the policy component. It is tempting because authentication precedes access, and it would be correct when the requirement is verifying user identity rather than endpoint compliance.

Policy server

Why it fails: The policy server defines the posture rules and remediation requirements, but enforcement at the point of connection is performed by the network access device, such as a switch or wireless controller. It is tempting because policy decisions drive NAC, and it would be correct when authoring the compliance criteria themselves.

Man-in-the-middle attack

Why it fails: A man-in-the-middle (MiTM) attack involves an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating with each other. This type of attack focuses on intercepting established sessions or data streams, not on initiating repeated failed login attempts from a single source. Firewall logs would typically show unusual traffic patterns or session hijacking, rather than a high volume of authentication failures.

ARP poisoning

Why it fails: ARP poisoning sends fake ARP replies to associate the attacker's MAC address with the IP of a legitimate device, enabling traffic interception. It occurs on the local network and would not appear as repeated SSH attempts from an external IP.

DDoS attack

Why it fails: A Distributed Denial-of-Service (DDoS) attack aims to overwhelm a target system or network resource with a flood of traffic originating from multiple compromised systems, known as a botnet. The objective is to exhaust resources and make the service unavailable to legitimate users, not to gain unauthorized access through login attempts. The scenario describes repeated attempts from a *single* IP, which fundamentally contradicts the 'distributed' nature and typical traffic volume of a DDoS attack.

802.11i

Why it fails: IEEE 802.11i is a robust wireless security standard that specifies the security mechanisms for Wi-Fi networks, most notably defining Wi-Fi Protected Access 2 (WPA2). It provides strong encryption using AES-CCMP and robust authentication methods, including 802.1X/EAP for enterprise environments or pre-shared keys for personal use, to secure wireless communications. However, 802.11i is exclusively designed for wireless local area networks (WLANs) and is not applicable for securing or authenticating devices connected to wired Ethernet ports.

802.3af

Why it fails: IEEE 802.3af defines the Power over Ethernet (PoE) standard, which allows electrical power to be delivered to network devices over the same Ethernet cable that carries data. This standard is specifically designed to power devices such as IP phones, wireless access points, and security cameras without requiring separate power outlets. 802.3af is solely concerned with power delivery and does not incorporate any features for authenticating devices or controlling network access based on security policies.

802.1Q

Why it fails: IEEE 802.1Q is the standard for Virtual Local Area Network (VLAN) tagging, which enables a single physical network infrastructure to support multiple logical broadcast domains. Its primary function is to insert a tag into Ethernet frames, identifying which VLAN the frame belongs to, allowing switches to properly forward traffic across trunk links. While it provides network segmentation and traffic isolation, 802.1Q does not offer any mechanism for device authentication or access control to prevent unauthorized connections.

Ping flood

Why it fails: A ping flood is a basic denial-of-service (DoS) attack where an attacker directly sends an overwhelming number of ICMP echo request packets to a target server. The goal is to consume the target's bandwidth and processing resources by forcing it to respond to each request, thereby making it unavailable to legitimate users. Crucially, this attack involves the victim receiving requests directly from the attacker, not a flood of replies from numerous intermediary sources.

ICMP tunneling

Why it fails: ICMP tunneling is a technique used for covert communication, where data is encapsulated within the payload of ICMP echo request and reply packets. This method allows attackers to establish a hidden communication channel, often for data exfiltration or command and control, bypassing some firewall rules that permit ICMP traffic. Unlike a flood attack, ICMP tunneling focuses on discreet data transfer rather than overwhelming a target with a high volume of traffic.

Fraggle attack

Why it fails: A Fraggle attack is a denial-of-service (DoS) attack that operates on principles similar to a Smurf attack but utilizes UDP echo packets instead of ICMP. The attacker sends UDP packets to a broadcast address, spoofing the victim's IP address as the source. Devices on the broadcast network then send UDP echo replies to the victim, creating a flood of UDP traffic that can overwhelm the target server's network capacity and processing capabilities.

WPA2

Why it fails: Wi-Fi Protected Access 2 (WPA2) is a security protocol specifically designed to secure wireless local area networks (WLANs) by providing strong encryption (AES) and authentication. It protects Wi-Fi communications from eavesdropping and unauthorized access. However, WPA2 is exclusively for wireless networks and has no mechanism or applicability for authenticating devices connecting via a wired Ethernet port.

MAC filtering

Why it fails: MAC filtering attempts to control network access by maintaining a list of permitted or denied Media Access Control (MAC) addresses. While it can prevent unknown devices from easily connecting, it is a weak security measure because MAC addresses are easily discoverable and can be spoofed by unauthorized users. It also lacks robust user or device authentication, making it unsuitable for ensuring only *authorized employee computers* connect securely.

VPN

Why it fails: A Virtual Private Network (VPN) establishes an encrypted tunnel over an untrusted network, primarily for secure remote access to private resources. Its function is to protect data in transit and provide secure connectivity for users *outside* the local network perimeter. A VPN does not provide port-based authentication for devices physically connecting to a local area network switch port.

B) Smurf attack

Why it fails: A Smurf attack is a distributed Denial-of-Service (DoS) attack leveraging ICMP echo requests and IP broadcast addresses. An attacker sends ICMP echo requests with the victim's spoofed IP address as the source to an IP broadcast address on a network. All hosts on that network then reply to the victim, flooding it with ICMP echo replies and overwhelming its network capacity. This attack does not involve TCP SYN packets.

C) Ping of death

Why it fails: The Ping of death is an older Denial-of-Service (DoS) attack that exploits vulnerabilities in IP fragmentation and reassembly. An attacker sends an ICMP echo request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after fragmentation. When the target system attempts to reassemble this oversized, malformed packet, it can lead to a buffer overflow, system crash, or reboot, rendering the service unavailable. This attack relies on ICMP, not TCP SYN packets.

D) ARP poisoning

Why it fails: ARP poisoning, also known as ARP spoofing, is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages onto a local area network. The goal is to associate the attacker's MAC address with the IP address of another host, such as the default gateway or another victim. This allows the attacker to intercept, modify, or drop traffic intended for the legitimate host, effectively performing a Man-in-the-Middle attack. It does not involve sending TCP SYN packets to a server.

B) Allow rule with source any, destination 10.0.0.5, port 443

Why it fails: An allow rule with a destination of 10.0.0.5 would permit traffic *if* the packet's destination IP was already 10.0.0.5. However, incoming traffic from the internet is addressed to the firewall's public IP (e.g., 203.0.113.10), not the internal private IP. Without an accompanying address translation mechanism like DNAT, the firewall would simply drop or reject packets whose destination IP does not match an interface or a routing entry, as the internal server's private IP is not directly reachable from the internet.

C) Access control list on the internal interface

Why it fails: An Access Control List (ACL) applied to an internal interface primarily governs traffic flow *within* the private network or traffic attempting to *exit* the private network through that interface. While an ACL can filter traffic based on source, destination, and port, it does not perform the crucial function of translating public IP addresses to private ones for incoming external connections. Therefore, an internal ACL cannot enable remote employees to initiate connections to an internal server from the internet.

D) VPN rule to require remote access VPN

Why it fails: A VPN rule would mandate that remote employees establish a Virtual Private Network tunnel to the corporate network before accessing any internal resources. While VPNs provide secure remote access, the question implies a direct internet-based access method for a service, not a requirement for users to connect via a VPN client. Implementing a VPN rule would prevent direct public access to the service and instead force all remote connections through a secure, encrypted tunnel, which is not the stated goal.

Smurf attack

Why it fails: A Smurf attack spoofs the victim's address and pings a broadcast address, so replies come from many hosts, not from private 10.0.0.0/8 sources arriving externally. It is tempting because Smurf uses spoofed source addresses, making it correct when logs show ICMP echo replies flooding from a subnet's broadcast range.

SYN flood

Why it fails: A SYN flood sends TCP SYN packets with spoofed sources, but the tell-tale is half-open connections and SYN flags, not private-range source addresses on the external interface. It is tempting because SYN floods are volumetric denial-of-service attacks, making them correct when logs show many incomplete TCP handshakes.

DNS amplification

Why it fails: DNS amplification spoofs the victim's address as the query source, so packets arrive from DNS resolvers, not with private 10.0.0.0/8 sources on the external interface. It is tempting because amplification floods a target with reflected traffic, which is the correct answer when logs show huge responses from public resolvers.

LDAP

Why it fails: LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information services, commonly used to store user accounts, groups, and other network resources. While an LDAP directory can serve as the backend database for user credentials, it does not perform the actual 802.1X authentication process itself. A RADIUS server is still necessary to handle the EAP (Extensible Authentication Protocol) negotiation and communicate with the LDAP directory to verify user identities for WPA3-Enterprise.

TACACS+

Why it fails: TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-proprietary AAA protocol primarily used for authenticating and authorizing administrators accessing network devices like routers and switches. Unlike RADIUS, which combines authentication and authorization into a single packet, TACACS+ separates these functions, offering more granular control over command authorization. However, it is not the standard or preferred protocol for authenticating end-user devices connecting to 802.1X-secured wireless networks such as WPA3-Enterprise.

Kerberos

Why it fails: Kerberos is a network authentication protocol primarily designed for client-server applications within a Windows Active Directory domain, providing strong authentication through secret-key cryptography. While it secures access to many network services, Kerberos does not directly integrate as the authentication backend for 802.1X-based wireless networks like WPA3-Enterprise. Instead, a RADIUS server is required to handle the 802.1X authentication process, even if that RADIUS server might, in turn, query an Active Directory for user credentials.

B) ARP poisoning

Why it fails: ARP poisoning, also known as ARP spoofing, is a technique where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. These malicious messages associate the attacker's MAC address with the IP address of another legitimate host, such as the default gateway, in the ARP caches of other devices. This allows the attacker to intercept, modify, or drop traffic between the two poisoned hosts, creating a man-in-the-middle scenario, but it is not detectable through DHCP server logs.

C) MAC flooding

Why it fails: MAC flooding is a Layer 2 attack designed to overwhelm a network switch's MAC address table, also known as the CAM table, with a multitude of fake MAC-to-port mappings. When the table becomes full, the switch may enter a fail-open mode, behaving like a hub by broadcasting all incoming traffic to every port. This allows the attacker to capture traffic not intended for them, but it does not directly involve DHCP server logs or IP address assignment processes.

D) DNS spoofing

Why it fails: DNS spoofing, or DNS cache poisoning, involves an attacker injecting fraudulent DNS records into a DNS resolver's cache or directly responding with malicious information to a client's DNS query. The objective is to redirect users attempting to access legitimate websites to attacker-controlled sites, often for phishing or malware distribution. This attack operates at the application layer and manipulates name resolution, which is distinct from the network layer functions of DHCP.

B) Syslog server

Why it fails: Syslog servers collect log messages but do not perform authentication.

C) TACACS+ server

Why it fails: TACACS+ can be used for authentication, but RADIUS is the standard for 802.1X. Additionally, TACACS+ is proprietary to Cisco.

D) NTP server

Why it fails: NTP provides time synchronization, not authentication.