75 of 120 questions · Page 1/2 · Cc Network Security topic · Answers revealed
A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?
Correct. WAF specializes in web traffic and OWASP rules.
A security analyst is investigating a potential DDoS attack. Which of the following are common indicators of a DDoS? (Choose TWO)
DDoS uses distributed sources.
Why this answer
High volume of traffic from many sources and increased latency are signs of DDoS.
A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?
Correct. WAF inspects HTTP/HTTPS application layer traffic.
During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?
Correct. SYN flood exploits the TCP handshake.
Why this answer
A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.
A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?
Frames and collision detection (CSMA/CD) are Layer 2 functions.
Why this answer
Collisions occur at the Data Link layer (Layer 2) where frames are transmitted over shared media. Hubs and CSMA/CD operate at this layer.
A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?
VLANs group devices based on function, not location.
Why this answer
VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.
Which protocol is used to resolve IP addresses to MAC addresses on a local network?
ARP resolves IP to MAC.
Why this answer
ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within the same network.
A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)
Correct. VLANs segment traffic on a switch.
Why this answer
VLANs provide logical segmentation at Layer 2, and subnetting divides IP networks, often used with routing to isolate traffic. DMZ is a specific segment for public servers, not general segmentation. Firewalls and IDS are security devices, not segmentation technologies.
A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?
Smurf attack sends ICMP Echo Requests to a broadcast address with spoofed source, causing many replies to flood the victim.
Why this answer
Unsolicited ICMP replies may indicate a DoS attack using reflected traffic.
A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?
Multiple sources send ICMP echo requests, a common DDoS technique.
Why this answer
A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.
A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?
A network tap provides a passive copy of traffic for analysis.
Which of the following ports is used by HTTPS for secure web traffic?
443 is HTTPS.
Why this answer
HTTPS uses port 443 by default.
A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)
A firewall enforces strict access rules from DMZ to internal.
Why this answer
Proper segmentation and access control are key; placing servers on separate VLANs and restricting inbound/outbound traffic with firewalls are essential.
Which OSI layer is responsible for logical addressing and routing?
Network layer (Layer 3) is responsible for IP addressing and routing.
Why this answer
The Network layer (Layer 3) handles IP addressing and routing decisions.
Which three of the following are benefits of using VLANs in a network? (Choose three.)
VLANs isolate traffic between groups.
Why this answer
VLANs improve security through segmentation, reduce broadcast traffic, and simplify network changes. They do not increase collision domains (switches eliminate collisions) and do not replace routing.
IPS is inline and can take action.
A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)
The server keeps connections in SYN-RECEIVED state.
Why this answer
Option D is correct because a SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake, resulting in a large number of half-open connections that exhaust server resources. These connections remain in a SYN_RECEIVED state, consuming memory and preventing legitimate connections from being established.
Exam trap
Cisco often tests the distinction between the symptom of 'half-open connections' (the server-side resource exhaustion) and the traffic pattern of 'SYN packets with no ACK' (the attacker's behavior), expecting candidates to recognize both as correct indicators of a SYN flood.
A company deploys a device that inspects HTTP and HTTPS traffic to block SQL injection and cross-site scripting attacks. This device is best described as a:
WAF is purpose-built for web traffic and application-layer attacks.
An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)
NGFW includes stateful inspection and provides this capability.
Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?
Packet filtering decisions are based on L3/L4 headers only.
Why this answer
Packet filtering firewalls are stateless and examine packet headers in isolation.
A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?
Correct. VLANs provide logical segmentation on a Layer 2 switch.
Why this answer
VLANs (Virtual Local Area Networks) allow logical segmentation on a switch, separating traffic at Layer 2 without extra hardware.
Which of the following is a benefit of using VLANs in a network?
VLANs segment traffic logically on the same switch.
Why this answer
VLANs allow logical segmentation of a network at Layer 2, improving security and reducing broadcast traffic without requiring additional physical switches.
A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:
Stateless firewalls inspect packets individually.
Why this answer
A stateless (packet-filtering) firewall examines each packet independently and does not track connection state.
A company's public web server is placed in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this network architecture called?
DMZ provides controlled access to public servers while protecting the internal network.
Why this answer
A DMZ (demilitarized zone) is a buffer network for public-facing services.
An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?
VLANs create separate broadcast domains on a switch.
Why this answer
VLANs (Virtual Local Area Networks) logically segment a switch into multiple isolated broadcast domains, improving security and reducing broadcast traffic.
Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?
Correct. IP addresses and routing are at Layer 3.
Why this answer
Layer 3 (Network) handles IP addresses, routing, and packet forwarding.
Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?
Correct. Telnet is cleartext and insecure.
Which firewall type inspects the entire packet, including application data, and can enforce rules based on user identity?
Why this answer
Next-generation firewalls (NGFW) combine deep inspection with application ID and user ID.
A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?
IPS can block, with risk of blocking legitimate traffic.
Why this answer
An Intrusion Prevention System (IPS) sits inline and can block traffic based on deep inspection, but may cause false positives that disrupt legitimate communications.
Which of the following is a common mitigation technique for a SYN flood attack?
SYN cookies encode connection state in the SYN-ACK response.
Why this answer
SYN cookies allow the server to respond to SYN requests without maintaining state until the connection is verified, reducing the impact of SYN floods.
Which protocol is considered insecure because it transmits data in cleartext, including passwords?
Correct. Telnet uses cleartext transmission.
Why this answer
Telnet (port 23) sends all data, including credentials, in plaintext.
A company wants to host a public-facing web server and an email server while protecting the internal network. Which network architecture is best suited for this purpose?
DMZ is designed to host public-facing services securely.
Why this answer
A DMZ (demilitarized zone) is a segmented network that sits between the internet and the internal network, hosting public-facing servers while allowing controlled access from both sides.
Which of the following protocols operates at the Transport layer and provides reliable, connection-oriented communication?
TCP provides reliable, connection-oriented communication.
A company places a web server and an email server in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this segment called?
DMZ is a buffer network for public services.
Why this answer
A DMZ (demilitarized zone) hosts public-facing services with controlled access to internal network.
An organization wants to prevent malicious HTTP requests targeting a web application. Which security device is specifically designed for this purpose?
WAF is designed to protect web applications from attacks like SQL injection and XSS.
A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)
ARP poisoning allows interception by associating attacker's MAC with a legitimate IP.
Why this answer
ARP poisoning and rogue Wi-Fi are common MITM techniques. IP spoofing can be part of MITM but is not a standalone technique; SYN flood is DoS.
An attacker captures network traffic and forges the source IP address to impersonate a trusted host. Which type of network threat is this?
Correct. Forging source IP is IP spoofing.
Why this answer
Spoofing involves falsifying source addresses (IP, ARP, email).
A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?
MAC addresses are used at Layer 2 for frame delivery.
Why this answer
The Data Link layer (Layer 2) uses MAC addresses to identify devices on the same network segment. IP addresses operate at the Network layer (Layer 3), and port numbers at the Transport layer (Layer 4).
An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?
Spoofing refers to falsifying the source address, in this case, email.
Why this answer
Email spoofing involves forging the sender address to deceive the recipient.
A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which TWO transport layer protocols fit this description? (Select TWO)
ICMP does not guarantee delivery.
In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?
Correct. MAC addressing, switching, and VLANs are Layer 2 functions.
Why this answer
Layer 2 (Data Link) uses MAC addresses and switches; VLANs operate at this layer.
A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?
IDS typically uses a SPAN port or tap to monitor traffic passively.
Why this answer
IDS is passive, monitors traffic, and generates alerts but does not block traffic. It can be network-based or host-based.
A security analyst detects an ARP spoofing attack on the local network. What is the primary goal of an ARP spoofing attack?
Correct. ARP spoofing enables man-in-the-middle attacks.
Why this answer
ARP spoofing allows an attacker to intercept traffic by associating their MAC address with the IP address of a legitimate host.
An organization wants to place its public web server, email server, and DNS server in a network that is accessible from the internet but isolated from the internal corporate network. Which network design should be used?
Correct. A DMZ hosts public-facing servers with controlled access.
Why this answer
A DMZ (demilitarized zone) is a buffer network for public-facing servers.
A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?
A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?
IDS passively monitors and alerts without affecting performance.
Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)
Correct. TCP is a Transport layer protocol.
A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?
SSH encrypts all traffic, including authentication.
Which three ports are commonly used by secure protocols? (Choose THREE.)
An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?
Correct. A DMZ isolates public-facing servers from the internal network.
Why this answer
A DMZ (demilitarized zone) is a network segment that hosts public-facing services and is isolated from the internal network.
A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?
Correct. IDS monitors and alerts without blocking.
An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)
NGFW can identify applications regardless of port.
A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)
Internal servers should remain in the internal network.
During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?
ARP poisoning enables MITM by redirecting traffic through the attacker.
Why this answer
ARP poisoning allows an attacker to intercept traffic on a local network, enabling man-in-the-middle attacks.
A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?
Stateful firewalls maintain state tables and filter based on connection context.
Why this answer
Stateful inspection firewalls track connection state and filter based on IP/port.
An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?
802.1X requires device authentication before access.
Why this answer
Port security limits the number of MAC addresses on a switch port, and 802.1X requires authentication before granting network access. VLANs segment but do not authenticate, and firewalls filter traffic but not at the access level.
An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)
Correct. Attackers often spoof source IPs in SYN floods.
Which of the following is a connectionless, unreliable transport protocol?
UDP is connectionless and fast but unreliable.
Why this answer
UDP is connectionless and does not guarantee delivery.
Which layer of the OSI model is responsible for routing packets based on IP addresses?
Correct. The Network layer routes packets using IP addresses.
Why this answer
The Network layer (Layer 3) handles logical addressing and routing of packets.
A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?
Correct. Stateful inspection tracks connection state.
Why this answer
A stateful inspection firewall tracks connections and blocks unsolicited inbound traffic.
Which OSI layer is responsible for routing packets across networks using IP addresses?
Correct. Routing and IP addressing occur at Layer 3.
Why this answer
Exam trap
Cisco often tests the distinction between Layer 2 switching (MAC-based forwarding within a VLAN) and Layer 3 routing (IP-based forwarding between subnets), so the trap here is confusing the Data Link layer's local delivery role with the Network layer's internetwork routing function.
How to eliminate wrong answers
Option A is wrong because Layer 1 (Physical) deals with the physical transmission of raw bits over media (e.g., cables, voltages, frequencies) and has no concept of IP addresses or routing. Option C is wrong because Layer 4 (Transport) provides end-to-end communication, segmentation, and reliability (e.g., TCP/UDP), but it does not perform routing or use IP addresses for path selection. Option D is wrong because Layer 2 (Data Link) handles frame delivery within a single network segment using MAC addresses and protocols like Ethernet, not IP routing across networks.
Which protocol operates at the Transport layer and provides reliable, connection-oriented data delivery?
TCP is reliable and connection-oriented.
Why this answer
TCP (Transmission Control Protocol) uses a three-way handshake, sequencing, and acknowledgments to ensure reliable delivery.
A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?
VLANs provide Layer 2 separation.
Why this answer
VLANs can partition a physical switch into multiple logical segments, isolating traffic between groups.
An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)
VLAN segmentation adds another layer of isolation.
Why this answer
Firewalls on both sides, strict access rules, and separate VLANs are best practices. Direct internal access and single firewall are not recommended.
An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?
The attacker positions between client and server.
Why this answer
A man-in-the-middle (MITM) attack involves an attacker intercepting and relaying messages between two parties.
A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?
A DMZ is specifically designed to host public-facing services with controlled access.
Why this answer
A DMZ (demilitarized zone) is a segmented network that hosts public-facing servers, providing an extra layer of security between the internet and the internal network.
An organization experiences intermittent network outages. The security team notices that the ARP cache on several switches has entries pointing to an unknown MAC address for the default gateway. Which attack is most likely occurring?
ARP spoofing falsifies IP-to-MAC mappings.
Why this answer
ARP spoofing (or ARP poisoning) involves sending forged ARP messages to associate the attacker's MAC with the IP of the default gateway, causing traffic to be misrouted. This can lead to man-in-the-middle attacks or denial of service.
A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?
Correct. SYN flood is a DoS attack that sends many SYN packets to exhaust server resources.
Why this answer
SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.
An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?
ARP poisoning enables interception of communications.
Why this answer
ARP poisoning allows man-in-the-middle attacks by associating attacker's MAC with the victim's IP.
An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?
Forged ARP replies redirect traffic to the attacker.
Why this answer
ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.
A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)
Correct. Web servers are public-facing.
Which OSI layer is responsible for routing packets based on IP addresses?
Network layer routes packets using IP addresses.
Why this answer
Layer 3 (Network) handles packet forwarding and routing using IP addresses.
A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?
SYN flood exploits TCP three-way handshake by sending many SYN packets without completing.
Why this answer
SYN flood is a DoS attack that exhausts server resources by initiating many half-open connections.
Which protocol is considered insecure because it transmits data, including credentials, in cleartext?
Correct. Telnet transmits data in cleartext.
A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)
Correct. VPNs encrypt all traffic between endpoints.
Why this answer
Ready to test yourself?
Try a timed practice session using only Cc Network Security questions.