Network Security

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

A security analyst is investigating a potential DDoS attack. Which of the following are common indicators of a DDoS? (Choose TWO)

A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)

A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?

A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Which of the following ports is used by HTTPS for secure web traffic?

A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)

Which OSI layer is responsible for logical addressing and routing?

Which three of the following are benefits of using VLANs in a network? (Choose three.)

What is the primary difference between an IDS and an IPS?

A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)

A company deploys a device that inspects HTTP and HTTPS traffic to block SQL injection and cross-site scripting attacks. This device is best described as a:

An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)

Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?

A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?

Which of the following is a benefit of using VLANs in a network?

A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:

A company's public web server is placed in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this network architecture called?

An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?

Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?

Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?

Which firewall type inspects the entire packet, including application data, and can enforce rules based on user identity?

A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?

Which of the following is a common mitigation technique for a SYN flood attack?

Which protocol is considered insecure because it transmits data in cleartext, including passwords?

A company wants to host a public-facing web server and an email server while protecting the internal network. Which network architecture is best suited for this purpose?

Which of the following protocols operates at the Transport layer and provides reliable, connection-oriented communication?

A company places a web server and an email server in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this segment called?

An organization wants to prevent malicious HTTP requests targeting a web application. Which security device is specifically designed for this purpose?

A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)

An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?

A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?

An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?

A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which ONE transport layer protocol fits this description? (Select ONE)

In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?

A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?

A security analyst detects an ARP spoofing attack on the local network. What is the primary goal of an ARP spoofing attack?

An organization wants to place its public web server, email server, and DNS server in a network that is accessible from the internet but isolated from the internal corporate network. Which network design should be used?

A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?

A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?

Which three ports are commonly used by secure protocols? (Choose THREE.)

An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?

A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?

An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)

A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)

During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?

A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?

An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?

An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)

Which of the following is a connectionless, unreliable transport protocol?

Which layer of the OSI model is responsible for routing packets based on IP addresses?

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Which OSI layer is responsible for routing packets across networks using IP addresses?

Which protocol operates at the Transport layer and provides reliable, connection-oriented data delivery?

A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?

An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

An organization experiences intermittent network outages. The security team notices that the ARP cache on several switches has entries pointing to an unknown MAC address for the default gateway. Which attack is most likely occurring?

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?

An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?

A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)

Which OSI layer is responsible for routing packets based on IP addresses?

A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?

Which protocol is considered insecure because it transmits data, including credentials, in cleartext?

A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)

Which of the following are effective defenses against man-in-the-middle attacks? (Choose THREE)

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Which of the following ports is used by HTTPS?

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Which of the following ports is commonly used for secure web traffic (HTTPS)?

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

During a security assessment, a penetration tester captures network traffic and notices that the source IP address in packets appears to be from a different network. Which technique is the attacker likely using?

An attacker sends a flood of SYN packets to a server, never completing the three-way handshake, exhausting the server's resources and causing it to become unresponsive. What type of attack is this?

A company wants to protect its internal web server from common web application attacks. Which two security measures are most appropriate? (Choose TWO.)

Which TCP segment is sent to initiate the three-way handshake?

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

A security analyst detects a large number of half-open TCP connections targeting a web server. This is most likely indicative of what type of attack?

A security team is investigating a potential man-in-the-middle attack. Which TWO of the following are common techniques used in MITM attacks? (Select TWO.)

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)

Which two of the following are best practices to mitigate man-in-the-middle attacks? (Select TWO.)

A network engineer wants to mitigate ARP spoofing attacks. Which of the following is the most effective technique?

Which THREE of the following are common mitigation techniques against Denial of Service (DoS) attacks?

An organization decides to implement an Intrusion Prevention System (IPS) to protect its network. Which statement about an IPS compared to an IDS is correct?

A security analyst notices unusual traffic from an internal workstation to an external IP address on port 25. Which protocol is most likely being used?

Which of the following is a security concern associated with the Telnet protocol?

An organization wants to securely manage network devices from remote locations. Which of the following protocols should be used for command-line access?

Which firewall type reads packet headers and also tracks the state of active connections to make filtering decisions?

Which firewall type is capable of inspecting the contents of application-layer traffic, such as HTTP requests, to detect malicious patterns?

Which common port is used by DNS and which transport layer protocol does it primarily use?

A security analyst wants to detect and analyze attacker behavior by deploying a decoy system. Which three characteristics apply to a honeypot? (Choose THREE.)

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Which of the following is a characteristic of a stateful firewall that distinguishes it from a stateless firewall?

A security team deploys a passive device that monitors network traffic and generates alerts when it detects suspicious patterns, but it does not take any action. This device is best described as a:

An organization decides to implement a security control that can detect and block attacks in real-time by sitting inline in the network. Which of the following should be chosen to meet these requirements?

A company's network has multiple VLANs. An attacker on VLAN 10 sends a frame with a forged source MAC address to a switch, hoping to intercept traffic intended for the default gateway. Which attack is being executed?

Which port number is associated with HTTPS, and what protocol encrypts the communication?

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Which two of the following are characteristics of a stateful firewall? (Choose TWO.)

A company is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming the network bandwidth. Which THREE mitigation techniques are most effective?

An attacker captures network traffic using Wireshark and reads unencrypted emails. Which security goal is most directly compromised?

An organization deploys a network security device that inspects application-layer payloads, can block malicious HTTP requests, and uses OWASP rules. Which type of device is this?

A security analyst is reviewing network traffic and needs to identify which of the following protocols are inherently insecure because they transmit data in cleartext. (Select TWO.)

An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?

A security engineer is evaluating different firewall architectures. Which firewall type can decrypt SSL/TLS traffic, inspect the contents, and then re-encrypt it?

Which layer of the OSI model is responsible for routing packets across networks?

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?