CCNA Cc Network Security Questions

A WAF operates at the application layer, terminating and inspecting HTTP and HTTPS requests, applying rule sets such as the OWASP Core Rule Set, and blocking malicious traffic before it reaches the web server. This matches the described inline inspection and blocking requirement.

Restricting internal rules and ACLs so each zone can reach only the services it genuinely needs shrinks the paths available for lateral movement. Combined with segmentation, least privilege ensures that even permitted connections are narrowly scoped, so a single compromised workstation cannot pivot broadly across departments.

Restricting inbound access to only the ports needed for web and email reduces the exposed attack surface and prevents attackers from reaching unnecessary services. This is a core DMZ design principle: the external firewall allows only what the public service requires, such as HTTPS for the web server and the mail relay port. It directly limits what an external attacker can probe or exploit.

Unusually high traffic volume from multiple IP addresses directly satisfies the distributed-source constraint distinguishing DDoS from single-origin DoS. Attackers coordinate botnets so requests flood from many geographically dispersed hosts, exhausting bandwidth or connection tables. This pattern is a primary detection indicator in Microsoft Entra ID and network monitoring tools.

WPA3 introduces SAE, a Dragonfly handshake that provides forward secrecy and resists offline dictionary attacks. Even if an attacker captures the handshake, they cannot perform an offline guessing attack; they must interact with the network for each guess, which is detectable and rate-limited. This directly satisfies the requirement for strong encryption and resistance to offline attacks.

Separate SSIDs mapped to distinct VLANs create logical isolation between guest and staff traffic on shared hardware, and 802.1X authenticates staff against institutional credentials while a guest portal handles visitors. Together these controls enforce the requirement that guests reach only the internet and cannot access internal research servers, while staff retain authenticated access.

A Web Application Firewall inspects HTTP request contents at the application layer, matching signatures and rules against payloads, URLs and headers. This lets it block malicious HTTP requests, which a packet-filtering firewall or traditional IPS cannot do at that layer.

A SYN flood exploits the TCP three-way handshake: spoofed source addresses generate numerous half-open connections, exhausting the server's backlog queue so legitimate clients cannot connect. The never-completed handshake described in the stem is the defining characteristic of this volumetric attack.

Collisions occur when devices on a shared medium transmit simultaneously; Ethernet's CSMA/CD and frame delivery operate at the Data Link layer, so excessive collisions and dropped frames are diagnosed there. Layer 1 handles raw signalling, not collision handling.

VLANs decouple broadcast domains from physical switch ports, so membership follows configuration rather than cabling. This satisfies the stem's benefit of grouping users logically irrespective of physical location, letting a department span floors or buildings while remaining one isolated Layer 2 segment.

A virtual private network (VPN) creates an encrypted tunnel between the remote user and the corporate network, protecting data in transit and hiding internal IP addresses. It allows employees to access internal resources as if they were on-site. This directly satisfies the requirement for encrypted communication and concealment of the internal network topology.

A VLAN creates logically separate broadcast domains on shared physical infrastructure, so guest wireless traffic can be confined to its own segment and blocked from reaching the internal file server through Layer 3 rules. This directly satisfies the requirement to isolate guest users without running new cabling or buying separate switches, and it is the foundational segmentation technology for this scenario.

An explicit deny from the guest subnet to the point-of-sale subnet, paired with a permit for internet-bound traffic, enforces the exact requirement at the boundary between the two networks. Because the firewall already separates them, this rule is the direct and auditable control that prevents guests from initiating sessions to the terminals.

ARP broadcasts a request asking which device holds a given IPv4 address, and the owner replies with its MAC address, which the sender caches. This address-resolution function on the local segment is exactly what the stem asks for.

VLANs logically partition a single physical network into isolated broadcast domains at Layer 2, so sensitive systems exchange traffic only with permitted members. This directly satisfies the stem's segmentation and isolation requirement, restricting lateral movement without additional hardware.

A DMZ on a separate subnet with a firewall that blocks outbound traffic from the DMZ to the internal network prevents a compromised server from pivoting into the internal network. Inbound access from the internet is permitted to the public services, while internal access is strictly controlled. This segmentation enforces the requirement effectively.

Many external hosts simultaneously sending small ICMP echo requests to one internal server is a distributed denial-of-service flood. The volume of echo requests exhausts the target's resources, making it unresponsive, which distinguishes it from a single-source ping flood.

A secure remote access gateway authenticates vendors, terminates their sessions on a hardened appliance, and then proxies only approved connections to the specific monitoring system. This enforces least privilege because vendors never obtain direct network reachability to the clinical VLAN, and the appliance can log, inspect, and restrict each session, satisfying both the isolation and session-termination requirements.

A network tap passively copies frames at the physical layer, delivering a duplicate stream to the capture device without introducing latency, dropping packets or altering traffic. This satisfies the requirement to capture packets for analysis while leaving the original traffic untouched.

Port 443 carries HTTP over TLS, encrypting web traffic between client and server. This directly satisfies the stem's requirement for HTTPS, the secure variant of HTTP. Port 80 serves unencrypted HTTP, while 22 and 21 belong to SSH and FTP respectively, so 443 is the sole match.

A firewall between the DMZ and internal network enforces traffic control, satisfying the requirement to contain compromised DMZ hosts. It restricts inbound access so internet-facing servers cannot freely reach internal resources, applying least privilege and limiting lateral movement if the web, email, or DNS server is breached.

The Network layer (Layer 3) handles logical addressing and path selection between networks, satisfying the stem's routing requirement. IP addresses operate here, letting routers forward packets across disparate networks using routing tables. This distinguishes it from the Data Link layer, which uses physical MAC addressing for local delivery only.

VLANs logically partition one physical switch fabric into isolated broadcast domains, so hosts in different VLANs cannot reach each other without a Layer 3 device. This segmentation satisfies the stem's security benefit by containing reconnaissance and limiting lateral movement between departments.

An IDS passively monitors copies of traffic and raises alerts, leaving response to administrators. An IPS sits inline on the traffic path, so it can drop malicious packets or reset connections in real time. That inline blocking capability, absent from an alert-only IDS, is the defining difference the question asks for.

Each spoofed SYN packet forces the server to allocate a connection table entry and reply with SYN-ACK, then wait for a response that never arrives. These half-open connections accumulate until the backlog queue is exhausted, which is the defining resource-exhaustion symptom of a SYN flood.

A web application firewall inspects HTTP and HTTPS requests, applying signatures and rules to block SQL injection and cross-site scripting. It operates at the application layer, distinguishing it from network firewalls that filter by IP, port, or protocol.

Packet filtering firewalls inspect only Layer 3 and Layer 4 headers, permitting or denying traffic by source and destination IP addresses and port numbers. They perform no application-layer inspection, which matches the stated decision criteria exactly.

VLANs create logically separate broadcast domains on a single Layer 2 switch, satisfying the no-additional-hardware constraint. Each department's traffic stays isolated at Layer 2 through distinct VLAN IDs and 802.1Q tagging, without requiring routers or extra switches.

VLANs deliver logical segmentation by partitioning a single physical switch into isolated broadcast domains, satisfying the stem's benefit requirement without buying extra switches or routers. This reduces hardware cost and administrative overhead, while containing broadcast traffic and enabling policy separation between departments on shared infrastructure.

A stateless firewall inspects each packet in isolation against static rules for source and destination IP addresses and ports, maintaining no connection table. This directly satisfies the stem's constraint of filtering without considering connection state, unlike stateful firewalls that track sessions via a state table.

A DMZ is a screened subnet placed between the internet and the internal LAN. It hosts internet-facing services such as the public web server while firewall rules restrict traffic from the DMZ into the internal network, providing the required isolation.

A default gateway must be an address on the same local subnet as the sending host, so the workstation can ARP for it and hand off off-subnet traffic. A router interface in 10.20.30.0/24 satisfies this, and the router then forwards the packet to the 10.20.40.0/24 network. Pointing to any device outside the local subnet would leave the workstation unable to deliver the frame.

VLANs logically partition one physical switch into isolated Layer 2 broadcast domains, so broadcasts stay within each segment rather than flooding every port. This directly satisfies the stem's requirement for separate broadcast domains on a single switch, unlike subnetting (Layer 3) or physical segmentation, which would need additional hardware.

Layer 3, the Network layer, handles logical addressing and path determination, with IP addresses operating here to identify hosts across networks. Routers forward packets between subnets using these addresses, satisfying the stem's requirement for routing and forwarding, unlike Layer 2's MAC-based switching or Layer 4's port-based delivery.

Telnet sends all session traffic, including login credentials, as unencrypted cleartext across the network, so anyone capturing packets reads them directly. SSH replaces it by encrypting the same terminal access, which is why Telnet should be disabled on managed devices.

A next-generation firewall performs deep packet inspection, examining payload and application-layer data rather than only headers and ports. It also integrates with directory services to enforce rules based on user identity, satisfying both constraints in the stem, unlike packet-filtering or stateful inspection firewalls.

An IPS inspects packet payloads and application-layer data inline, blocking malicious traffic in real time. Its signature-based detection can flag benign activity as malicious, producing false positives that block legitimate traffic — exactly the occasional over-blocking described. A firewall filtering only headers could not inspect payloads, so it fails the stem's inspection constraint.

A remote access VPN authenticates the user and encrypts the entire session between the remote device and the corporate gateway, so file-share traffic is protected in transit without requiring per-application agents. It is well suited to a small business because it uses standard client software or a browser-based portal and centralizes access control at the VPN concentrator, meeting the authentication and encryption goals.

SYN cookies let the server avoid allocating state for half-open connections: it encodes connection details in the sequence number of the SYN-ACK, so the backlog cannot be exhausted by spoofed SYNs. This directly mitigates the resource-exhaustion constraint of a SYN flood.

DNS filtering intercepts domain name resolution requests and blocks those matching a threat intelligence list of malicious domains. It requires no endpoint software, works network-wide, and is easy to update centrally. This directly prevents users from reaching harmful sites by returning a block response before any connection to the malicious IP is made.

Telnet transmits all session data, including login credentials, as unencrypted cleartext across the network, so anyone capturing traffic can read passwords directly. This satisfies the stem's constraint of a protocol deemed insecure precisely because it lacks encryption, unlike SSH, which tunnels the same terminal access within an encrypted channel.

A SYN flood is a type of denial-of-service attack where the attacker sends a large number of TCP SYN packets to a target but does not complete the handshake, exhausting the target's connection resources. In this scenario, the internal host is sending SYN packets to many external IPs on port 443 without completing the handshake, which is characteristic of a SYN flood. The host is likely compromised and participating in a botnet.

A DMZ sits between the internet-facing firewall and the internal network, so public web and email servers are reachable externally while internal hosts stay shielded. This satisfies the stem's requirement to host public services and protect the internal network, since inbound traffic terminates in the DMZ rather than crossing into the trusted zone.

TCP establishes a connection via a three-way handshake and uses sequence numbers, acknowledgements and retransmissions to guarantee ordered, error-free delivery. This connection-oriented reliability at the Transport layer satisfies the stem's requirement, unlike connectionless UDP, which offers no delivery guarantees.

A DMZ is a perimeter subnetwork exposing public-facing services such as web and email servers to the internet while firewall rules block direct access to the internal LAN, limiting exposure if those hosts are compromised.

A Web Application Firewall inspects HTTP and HTTPS request content, applying signatures and rules to detect and block injection, cross-site scripting and similar attacks. Network firewalls filter by port and address only, so they cannot inspect application-layer payloads.

Forging the source IP address to impersonate a trusted host is IP address spoofing. The attacker manipulates the packet header's source field so the receiver believes traffic originates from a legitimate system, enabling masquerade and bypassing trust-based access controls.

WPA2 with AES (also known as WPA2-PSK) provides strong encryption and requires a pre-shared key for authentication. It ensures that only users with the correct key can connect and that traffic between clients is encrypted. AES is a robust encryption standard, making it suitable for a small office environment.

MAC addresses operate at the Data Link layer, uniquely identifying network interfaces within a local segment. Examining them reveals framing, switching and ARP-related faults, directly satisfying the stem's constraint of isolating a Layer 2 connectivity problem.

Cloud-based DDoS mitigation services divert traffic to scrubbing centers that filter malicious packets and forward only clean traffic to the origin server. They have massive bandwidth and can absorb volumetric attacks, making them ideal for distributed attacks. This preserves server availability and scales beyond on-premises capabilities.

A packet-filtering firewall evaluates source and destination addresses and ports, and by reassembling fragments before rule evaluation it prevents attackers from splitting a prohibited packet across fragments to evade the filter. This directly implements the requirement to allow only approved subnets to reach TCP port 7000 while closing the fragmentation bypass, making it the most targeted control.

A NIDS monitors network traffic and generates alerts for suspicious patterns such as port scans without actively blocking traffic. Because it is passive, it will not interrupt clinical communications even if it flags legitimate activity. This matches the requirement to detect probing while avoiding any disruption to patient care.

Phishing is a social engineering attack where an attacker sends a fraudulent communication (often email) that appears to come from a trusted source to trick the recipient into providing sensitive information. This scenario perfectly matches phishing.

UDP is connectionless and provides no acknowledgement, retransmission or sequencing, so delivery is never guaranteed and lost datagrams are not recovered. This directly satisfies the stem's constraint of a transport protocol lacking both guaranteed delivery and error recovery, unlike TCP, which retransmits unacknowledged segments.

Layer 2, the Data Link layer, forwards frames using MAC addresses and supports VLANs through 802.1Q tagging, which inserts a VLAN identifier into the Ethernet frame header. This satisfies the stem's requirement for the layer that both addresses frames by MAC and provides VLAN segmentation.

An IDS receives mirrored traffic via a SPAN port or TAP and analyses it without sitting inline, so it cannot block packets. This passive monitoring is the defining architectural characteristic distinguishing it from an IPS.

ARP spoofing forges gratuitous ARP replies that bind the gateway's IP address to the attacker's MAC address, so victims forward their frames to the attacker. The attacker then relays traffic onward while capturing credentials and session data, or alters payloads in transit, satisfying the eavesdropping and modification goal.

A DMZ (demilitarised zone) sits between the internet-facing perimeter and the internal network, so public-facing servers are reachable from the internet while firewall rules block direct access to internal corporate systems. This satisfies the isolation requirement without exposing the internal network.

Segmenting the database server into its own VLAN isolates it at the network layer, and firewall rules restrict access to only the application server. This combination enforces least privilege and reduces the attack surface. It ensures that even if other systems are compromised, they cannot directly reach the database.

HTTPS traffic uses TCP port 443, where TLS encapsulates HTTP. Permitting TCP 443 satisfies the secure web traffic requirement; port 80 carries unencrypted HTTP, and UDP 443 is used by HTTP/3 rather than standard secure browsing.

DNS cache poisoning inserts false records into a resolver's cache so that legitimate domain names resolve to attacker-controlled addresses. Since the workstation uses the corporate resolver and no local configuration changed, a poisoned cache on that resolver would explain the incorrect answer. This enables redirection to malicious sites and is a classic man-in-the-middle enabler.

An IDS passively copies and analyses network traffic, comparing it against signatures or anomalies to raise alerts. Because it sits out-of-band rather than inline, it detects malicious activity without adding latency or dropping packets, satisfying the no-performance-impact constraint.

TCP operates at the Transport layer, providing connection-oriented, reliable delivery with sequencing, acknowledgements and flow control. Its layer 4 port addressing and segmentation satisfy the question's requirement for protocols operating at the Transport layer of the OSI model.

A remote access VPN authenticates each developer and can integrate a posture or host-check step that evaluates device health before granting network access. The repositories remain on an internal subnet that is not directly reachable from the internet. This satisfies identity verification, device health assessment, and non-exposure of the repositories in one design.

SSH encrypts the entire management session, including credentials and commands, preventing eavesdropping and man-in-the-middle interception. Port 22 is its assigned transport port. Telnet on port 23 sends everything in cleartext, failing the secure remote management constraint.

Port 443 carries HTTPS, which wraps HTTP inside TLS, encrypting credentials and session data in transit. This directly satisfies the stem's requirement for a secure protocol port, unlike cleartext alternatives such as port 80. Microsoft Entra ID authentication traffic and most modern web APIs rely on 443 for this reason.

A DMZ sits between the internal network and the internet, exposing the web server to public traffic while firewalls restrict inbound connections to that segment alone. This satisfies the stem's requirement to isolate the server yet permit controlled access, preventing direct reach from the public internet into internal systems.

An IDS passively inspects network traffic, matching signatures or anomalies to raise alerts without dropping packets. Because the stem specifies the device monitors and alerts but does not block, an Intrusion Detection System satisfies that non-preventive constraint; an IPS would actively block traffic inline.

NGFWs inspect traffic to identify applications regardless of port, then allow, block, or shape them by category. This application-layer control directly addresses advanced threats that tunnel over permitted ports, a capability absent from traditional port-based firewalls.

Segregating public-facing web and email servers into the DMZ keeps them off the internal network, so a compromise cannot directly pivot inward. This satisfies the DMZ design constraint that only externally reachable services reside in that screened subnet.

ARP spoofing lets the attacker position themselves between client and server, silently relaying and altering frames while both endpoints believe they hold a direct connection. That interception and modification of live traffic is precisely the man-in-the-middle condition the scenario describes, satisfying the requirement that communications pass through the attacker.

Stateful inspection tracks connection state in a session table, so it filters on source and destination IP addresses and ports while recognising established flows. Stateless packet filtering cannot track connection state, which the stem explicitly requires.

802.1X authentication requires a supplicant to authenticate against a RADIUS server via EAP before the switch grants port access, satisfying the authorised-devices-only constraint. Unauthenticated devices remain in an uncontrolled state and cannot pass traffic onto the wired network.

SYN floods exploit spoofed source addresses to conceal the attacker's identity while exhausting a server's half-open connection table. Each forged SYN forces the target to allocate resources and await a final ACK that never arrives, directly satisfying the stem's requirement for attacks that commonly employ IP spoofing.

TLS encrypts and integrity-protects application data end to end between the client and the server, so even if an attacker captures or manipulates wireless frames, the payload remains confidential and tampering is detected. This complements link-layer protections by securing the traffic above the wireless hop, directly addressing on-path confidentiality and integrity.