Network Security Controls Protocols And Devices practice questions

Security Association Database (SAD)

Why it fails: The SAD stores the parameters of security associations, but it is a database of states rather than the transport protocol component itself.

Authentication Header (AH)

Why it fails: AH provides integrity and authentication for IP packets, but it does not provide encryption, which matches the decryption failure symptom.

Internet Key Exchange (IKE)

Why it fails: IKE is used for setting up a security association (SA) between two parties; it is not the protocol that handles data packet decryption during ongoing transmission.

Transport Mode

Why it fails: Transport mode is an IPsec security protocol mode (used in both AH and ESP), not an IKEv1 Phase 1 negotiation mode.

Aggressive Mode

Why it fails: Aggressive Mode compresses the exchange into fewer packets for speed but compromises identity protection and does not provide robust PFS for the initial exchange.

Quick Mode

Why it fails: Quick Mode is used for IKEv1 Phase 2 negotiations to establish the actual data-transfer security associations, not Phase 1.

The firewall must permanently open all ports above 1024 to allow inbound FTP file transfers.

Why it fails: Permanently opening all high ports creates a massive security risk; firewalls use dynamic pinholing via ALGs instead.

Passive FTP encrypts the control channel by default, preventing the firewall from inspecting port numbers.

Why it fails: Standard FTP control and data channels are unencrypted unless explicit or implicit FTPS is used.

The client uses UDP port 69, which requires disabling stateful inspection for TFTP traffic.

Why it fails: TFTP uses UDP port 69, but FTP uses TCP ports 21 and dynamic ports, not TFTP.

Disable certificate validation checks on all user web browsers via group policy.

Why it fails: Disabling browser certificate validation completely destroys web browsing security and exposes users to active man-in-the-middle attacks.

Configure the firewall in passive tap mode using asymmetric decryption keys derived from the public web server's private key.

Why it fails: Passive decryption using server private keys is deprecated in modern TLS 1.3 due to Perfect Forward Secrecy; forward proxy re-signing is required.

Install a self-signed certificate generated by the firewall onto the firewall itself.

Why it fails: Installing the certificate only on the firewall does not resolve client browser trust issues; the certificate must be trusted by the endpoints.

Enable dynamic trunking protocol (DTP) on all ports and set the native VLAN to VLAN 1

Why it fails: Enabling DTP allows switches to negotiate trunking automatically, which is precisely how attackers exploit switch spoofing VLAN hopping.

Enable spanning-tree portfast and BPDU guard on all trunk ports

Why it fails: Portfast and BPDU guard are used on access ports to speed up convergence and prevent unauthorized switches, not for VLAN hopping.

Configure port security with sticky MAC addresses and maximum limit of one

Why it fails: Port security limits MAC address counts, but it does not prevent 802.1Q double-tagging or DTP trunk negotiation attacks.

ARP cache poisoning spoofing attack

Why it fails: ARP spoofing occurs entirely at Layer 2 on the local broadcast domain, not via external UDP packet transmissions.

TCP SYN flood attack against internal servers

Why it fails: SYN floods involve TCP packets with the SYN flag set, targeting TCP handshake states, not random UDP packets.

DNS zone transfer enumeration (AXFR)

Why it fails: DNS zone transfers typically use TCP port 53, not arbitrary external UDP ephemeral ports.

It extends the corporate VLAN directly to the user's laptop via an encrypted tunnel.

Why it fails: Extending VLANs is a legacy VPN behavior that violates Zero Trust micro-segmentation principles.

It relies on static firewall access control lists pre-configured with the user's home IP address.

Why it fails: Home IP addresses are dynamic, and static ACLs do not provide dynamic identity-based Zero Trust enforcement.

It assigns a private IP address from a DHCP pool managed by the internal core router.

Why it fails: Assigning a private subnet IP address grants broad network-layer access, which contradicts Zero Trust architecture.

WPA2-Personal with a shared pre-shared key (PSK) written on the office whiteboard

Why it fails: PSK sharing lacks individual accountability and is vulnerable to offline dictionary attacks if weak passphrases are used.

Open authentication with a captive portal for guest acceptance of terms

Why it fails: Open authentication provides no encryption for wireless airframes, exposing data to sniffing.

Legacy WEP encryption with static 128-bit shared keys

Why it fails: WEP is cryptographically broken and easily cracked in minutes.

Authentication server

Why it fails: The authentication server (typically RADIUS, such as Cisco ISE or Windows NPS) validates credentials against Active Directory and returns authorization attributes including VLAN assignment. However, the question asks which component must be configured on the switches. The authentication server is a separate system, not a switch component, so it cannot be configured on the Catalyst switches themselves.

Authenticator

Why it fails: The authenticator is the switch port itself, which relays EAP frames between the supplicant and the authentication server. While the switch must be configured as an authenticator, it does not itself validate credentials against Active Directory or decide the VLAN; it merely passes RADIUS attributes. Therefore, it does not satisfy the requirement of performing credential validation and role-based VLAN assignment.

Supplicant

Why it fails: The supplicant is the client-side software (e.g., Windows native 802.1X or Cisco AnyConnect NAM) running on the employee laptop that responds to authentication requests. It does not reside on the switch, cannot query Active Directory, and cannot assign VLANs. Configuring a supplicant on the switch is technically impossible because the switch acts as the network access point, not the endpoint requesting access.

Permit outside to DMZ TCP 443; deny DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Why it fails: This rule set allows external access and blocks DMZ-to-inside, but it also denies all inside-to-DMZ traffic, which would prevent internal administrators from managing or updating the web server. While it satisfies the external access and containment requirements, the blanket denial of inside-to-DMZ is overly restrictive and not aligned with typical operational needs, making it a less accurate policy match than the option that permits necessary management while still blocking DMZ-initiated sessions.

Permit outside to DMZ TCP 443; permit DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Why it fails: Permitting DMZ to inside any directly violates the requirement that the web server must never initiate connections to the internal network. This rule would allow a compromised web server to pivot into the internal network, which is exactly what the policy prohibits. Although external access is permitted, the DMZ-to-inside allowance is a critical misconfiguration in this scenario.

Permit outside to DMZ TCP 443; deny DMZ to inside any; permit inside to DMZ any; permit inside to outside any

Why it fails: This rule set blocks DMZ-initiated connections to the inside network and allows external web access, but it permits any inside-to-DMZ traffic rather than limiting it to necessary management ports. That broader permission increases the attack surface and does not reflect least privilege. While it meets the containment requirement, the unrestricted inside-to-DMZ rule makes it a weaker policy match than the option that restricts management access to specific ports.

Upgrade the IDS hardware to process higher bandwidth capacity

Why it fails: Higher bandwidth capacity addresses throughput bottlenecks and dropped packets, not the volume of alerts generated by internal vulnerability scanning. The signatures still match scan traffic regardless of processing power. Capacity upgrades suit saturated SPAN links where the sensor cannot inspect full traffic volume.

Convert the IDS into an inline IPS

Why it fails: Converting to inline IPS adds drop capability but does not suppress alerts triggered by legitimate internal vulnerability scans; the same signatures still match and generate events. Inline IPS suits deployments where active prevention of malicious traffic is required, not passive monitoring needing alert tuning.

Move the IDS from a switch SPAN port to an inline routing position

Why it fails: Inline placement lets the device drop malicious packets, but the scenario requires only alert reduction, not prevention. It also cannot distinguish authorised internal scans from attacks, so the same signatures still fire. Inline routing suits environments needing active blocking, not passive monitoring with tuned suppression.

Clientless SSL VPN

Why it fails: A clientless SSL VPN gives browser-based access to specific internal web apps; it does not install a tunnel client or route all internet traffic through the data centre. It is tempting because it needs no endpoint software, and it would be correct for contractors needing only web portal access to a few internal applications.

Split-tunnel VPN

Why it fails: A split-tunnel VPN sends only corporate-destined traffic through the tunnel, while internet traffic bypasses the VPN and goes directly out the local ISP.

Transport mode IPsec VPN

Why it fails: Transport mode encrypts only the payload, leaving original IP headers intact, and is used for host-to-host or endpoint-to-gateway traffic rather than tunnelling all client internet traffic. It is tempting because it is an IPsec mode, but tunnel mode is what encapsulates full packets through the data centre.

At the perimeter boundary directly connected to the ISP modem

Why it fails: An ISP-facing perimeter device sees north-south traffic entering and leaving the organisation, not east-west flows between internal Finance and Guest subnets. It is tempting because perimeter firewalls are the classic ACL enforcement point, and would be correct for filtering inbound internet traffic.

On the local loopback interface of each end-user workstation

Why it fails: A loopback interface carries only a host's own traffic, so it cannot inspect inter-subnet flows between Finance and Guest. It is tempting because host firewalls do enforce ACLs, and would be correct if the policy governed traffic originating from a single workstation.

Inside the ISP core routing infrastructure

Why it fails: The ISP core routes public internet traffic and lies outside the organisation's administrative control, so internal zone-to-zone ACLs cannot be enforced there. It is tempting because ISP filtering exists for DDoS mitigation, and would be correct if the requirement were blocking external attack traffic upstream.

Placing all web and database servers on the same internal VLAN protected by host firewalls

Why it fails: Placing public-facing web servers on the same VLAN as internal database servers violates defense-in-depth principles by lacking network-level isolation.

Single-firewall dual-homed architecture with a software loopback filter

Why it fails: A single firewall with only two interfaces does not provide a true isolated DMZ segment without relying on complex internal VLAN tagging and vulnerability to a single point of failure.

Direct flat bridging between the external router and the internal core switch

Why it fails: A flat bridged network exposes internal servers directly to external traffic without any intervening firewall or inspection layer.

TLS 1.3 eliminates symmetric encryption in favor of asynchronous cryptographic operations for all data payloads

Why it fails: TLS 1.3 retains symmetric AEAD ciphers such as AES-GCM for payload encryption; only the key-exchange and authentication portions were separated from the cipher suite name. It is tempting because TLS 1.3 does rely on asymmetric cryptography, but only during the handshake.

TLS 1.3 requires all connections to use legacy RSA key transport mechanisms

Why it fails: TLS 1.3 removed static RSA key transport entirely, permitting only ephemeral (EC)DHE key agreement for forward secrecy. It is tempting because RSA certificates remain valid for authentication, but that is distinct from RSA key transport, which is what the option claims.

TLS 1.3 mandates the use of pre-shared keys (PSKs) exclusively for all sessions

Why it fails: Pre-shared keys are one optional TLS 1.3 authentication mode, not a mandate; certificate-based handshakes remain fully supported. It is tempting because PSKs do appear in TLS 1.3, but they are used for session resumption and constrained environments, not all sessions.

Network Intrusion Prevention System (NIPS)

Why it fails: A NIPS detects and blocks malicious traffic by matching signatures, but it operates on network flows rather than terminating TLS, so encrypted HTTPS requests cannot be inspected without decryption. It is tempting because signature-based blocking is its core function, and it would be correct for cleartext protocols or with TLS termination configured.

Packet filtering router

Why it fails: A packet filtering router inspects headers only at layers 3 and 4, so it cannot parse HTTP payloads or match SQL injection signatures. It is tempting because it filters traffic cheaply at the perimeter, and would suffice for blocking specific IP addresses or ports, but not application-layer content.

Traditional Stateful Packet Inspection Firewall

Why it fails: Stateful inspection tracks TCP connection state and port-level rules, not HTTP request bodies, so SQL injection strings inside payloads pass through unmatched. It is tempting as a general perimeter firewall, and would be correct for enforcing connection-state and port policies, but it lacks application-layer signature parsing.

Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

Why it fails: 802.1X trunk ports carry tagged VLAN traffic and expect a supplicant; there is no automatic fallback mechanism, so the camera stays unauthenticated and the port never isolates it. Trunk configuration suits uplinks between switches, where tagged multi-VLAN transport is required.

Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

Why it fails: Open guest VLANs grant unauthenticated access with no RADIUS lookup, so the camera receives no identity verification and no quarantine enforcement. Guest VLANs suit visitor devices where restricted internet-only access is acceptable, not security cameras needing authenticated isolation.

Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.

Why it fails: Disabling STP removes loop protection without performing any authentication, leaving the camera on the access VLAN unverified. STP tuning addresses Layer 2 topology loops; it would be relevant when a port must forward without participating in spanning-tree topology calculations.

By modifying the DNS records of the database server to point to a sinkhole

Why it fails: DNS sinkholing redirects name resolution, so it cannot filter TCP port 1433 traffic between VLANs; the database remains reachable by IP. It is tempting because sinkholing does block access to known malicious domains, which is its actual purpose in threat-intelligence or DNS-security scenarios.

On the core router's default gateway interface for the entire data center

Why it fails: A core router's default gateway interface routes between subnets but does not inspect individual virtual switch ports, so VLAN-level micro-segmentation on TCP port 1433 is not enforced there. It is tempting because routers do apply ACLs, which is correct for coarse inter-subnet filtering rather than hypervisor-level micro-segmentation.

On the perimeter firewall facing the internet gateway

Why it fails: The perimeter firewall inspects north-south traffic at the internet gateway, so it never sees east-west frames between internal VLANs on the hypervisor switch. It is tempting because perimeter firewalls do enforce zone-based rules, which is correct when filtering traffic entering or leaving the data centre.

DNSSEC zone signing across all authoritative name servers

Why it fails: DNSSEC signs DNS zone data to authenticate name resolution answers; it has no bearing on BGP UPDATE messages or autonomous system origin. It is correct for preventing DNS cache poisoning and spoofed domain responses, not for validating route origin.

OSPFv3 authentication trailers using HMAC-SHA-256

Why it fails: OSPFv3 authentication protects only OSPFv3 link-state advertisements between interior routers; it cannot validate BGP prefix origin across autonomous systems. It is the right choice for securing an OSPFv3 interior routing domain, not inter-domain prefix origin verification.

IPsec Transport Mode with pre-shared keys

Why it fails: IPsec transport mode encrypts and authenticates packets between two configured peers, so it cannot validate BGP UPDATE messages received from many unrelated autonomous systems. It suits site-to-site tunnel protection, not cryptographic attestation of prefix origin across the internet routing table.

HTTP

Why it fails: HTTP carries web traffic and provides no interactive shell or command execution on a Linux host, so it cannot deliver remote management at all. It is tempting because HTTPS is often chosen to secure browser-based administrative consoles, but that scenario involves a web interface, not the command-line remote shell the policy requires.

SNMPv1

Why it fails: SNMPv1 monitors and polls network devices; it neither provides interactive shell access nor encrypts credentials, so it cannot replace Telnet for remote administration. It is tempting because SNMP is a management protocol, and it would be the right choice for collecting interface statistics, CPU metrics or trap alerts from those Linux servers.

FTP

Why it fails: FTP transfers files and provides no interactive shell or command execution, so it cannot deliver remote management of Linux servers. FTP is the right choice for moving files between hosts, not for secure administrative sessions.