Network Security practice questions

SYN flood

Why it fails: SYN flood uses TCP SYN packets, not ICMP.

ARP poisoning

Why it fails: ARP poisoning manipulates ARP tables, not ICMP.

DNS amplification

Why it fails: DNS amplification uses DNS queries, not ICMP.

DNS

Why it fails: DNS resolves hostnames to IP addresses via record lookups, not IP-to-MAC mappings. ARP performs that mapping by broadcasting on the local segment. DNS is tempting because it is the ubiquitous name-resolution protocol, and would be correct for translating a fully qualified domain name into an IPv4 or IPv6 address.

DHCP

Why it fails: DHCP assigns IP addresses and other configuration to hosts; it does not map a known IP to a MAC address. It tempts because DHCP operates at the same local-network layer and involves MAC addresses during lease allocation.

ICMP

Why it fails: ICMP carries error and diagnostic messages such as ping; it performs no address resolution. It tempts because ICMP is used constantly when testing local connectivity, so it feels related to how hosts find one another on a network.

Sniffing

Why it fails: Sniffing is passive capture; ARP poisoning is active.

Spoofing

Why it fails: Spoofing is forging identity, but ARP poisoning is a technique for MITM.

DoS

Why it fails: DoS overwhelms resources, not interception.

Next-generation firewall

Why it fails: NGFW also does deep inspection, but the question specifically asks for the type that is application proxy. However, NGFW is a broader category. Given the context, application proxy is the most direct answer.

Stateful inspection firewall

Why it fails: Stateful inspection tracks connection state but does not deeply inspect application data.

Packet filtering firewall

Why it fails: Packet filtering only inspects headers at Layers 3/4.

DNS

Why it fails: DNS queries are typically cleartext, but the question asks for inherently insecure protocols for data transmission; DNS is not primarily for data transfer.

HTTPS

Why it fails: HTTPS encrypts HTTP traffic.

SSH

Why it fails: SSH encrypts all traffic.

DHCP

Why it fails: DHCP dynamically assigns IP addresses, subnet masks, gateways and DNS servers to hosts; it does not map an IP address to a MAC address. It is tempting because DHCP does record client MAC addresses during lease allocation, but that is address assignment, not the ARP resolution the question asks about.

DNS

Why it fails: DNS resolves human-readable hostnames to IP addresses, operating at the application layer across routed networks. It is tempting because both DNS and ARP perform resolution, but DNS maps names to IP addresses, whereas ARP maps IP addresses to MAC addresses on the local segment.

ICMP

Why it fails: ICMP carries diagnostic and error messages such as echo requests, and performs no address translation. It is tempting because ping, an ICMP tool, is used to verify connectivity after resolution, but ARP is the protocol that actually maps a known IPv4 address to its MAC address on the local segment.

Packet filtering (stateless)

Why it fails: Stateless does not track connections.

Application proxy

Why it fails: Proxy can be used but is not the primary for this purpose.

IDS

Why it fails: IDS is passive and does not block traffic.

IP spoofing

Why it fails: IP spoofing forges source IP, not MAC.

VLAN hopping

Why it fails: VLAN hopping exploits switch configuration to access other VLANs.

MAC flooding

Why it fails: MAC flooding overwhelms switch CAM table, not forging MAC.

SYN flood

Why it fails: SYN flood is a DoS attack, not MITM.

Packet sniffing

Why it fails: Sniffing is passive and does not necessarily involve interception/alteration.

IP spoofing

Why it fails: IP spoofing is often used in other attacks; alone it does not enable MITM.

Deploy an IDS in promiscuous mode

Why it fails: IDS only alerts and is not specifically for web attacks.

Use a stateful firewall only

Why it fails: Stateful firewalls do not inspect application-layer payloads.

Enable SNMP on the server

Why it fails: SNMP is for network management, not web security.

Use HTTPS with proper certificate validation

Why it fails: HTTPS with proper certificate validation protects web traffic but does not address other forms of MITM attacks, such as those at the network layer.

Use WPA2 encryption on the Wi-Fi network

Why it fails: WPA2 protects Wi-Fi but not against all MITM attacks (e.g., rogue AP).

A honeypot placed in a dedicated research subnet

Why it fails: A honeypot can detect and distract attackers who reach it, and it may generate useful alerts. It does not enforce traffic restrictions between production workloads, so it cannot prevent a compromised endpoint from moving laterally to other internal systems or reduce the blast radius of that compromise.

A demilitarized zone (DMZ) hosting the public web and email servers

Why it fails: A DMZ isolates internet-facing services from the internal network, which is valuable for external threats. However, it does not control traffic between internal endpoints, so it does nothing to stop an attacker who has already compromised an internal host from moving laterally to other internal systems.

Full-disk encryption on all employee laptops

Why it fails: Full-disk encryption protects data at rest if a device is lost or stolen, but it has no effect on network traffic once the device is running and authenticated. It does not restrict an attacker's ability to move from a compromised endpoint to other internal systems, so it does not address lateral movement.

Deploy a web application firewall (WAF) to inspect incoming login requests for malicious patterns.

Why it fails: A WAF inspects application-layer traffic for attacks like SQL injection or cross-site scripting, but it does not encrypt the transport layer. If the login page is served over HTTP, the WAF cannot prevent an attacker from sniffing credentials on the network. A WAF is not a substitute for transport layer security.

Configure the web server to redirect all HTTP traffic to HTTPS using a 301 redirect.

Why it fails: A 301 redirect from HTTP to HTTPS still allows the initial HTTP request to be sent in cleartext. An attacker on the same network can intercept the credentials before the redirect occurs. While redirects are common, they do not prevent the initial exposure; HSTS is needed to ensure the browser never sends an HTTP request in the first place.

Implement DNSSEC to ensure that DNS responses for the login page are authentic.

Why it fails: DNSSEC provides integrity and authentication for DNS responses, preventing DNS spoofing. However, it does not encrypt the HTTP traffic itself. Even with DNSSEC, the login page could still be served over HTTP, and credentials would be transmitted in cleartext. DNSSEC does not enforce HTTPS or protect the application layer.

Disable the SSID broadcast on all access points

Why it fails: Hiding the SSID does not protect management frames or authentication exchanges; attackers can still observe and replay them because the network name is easily discovered in probe requests and responses. This control provides no protection against the described replay attack and may create operational problems for legitimate users.

Reduce the access point transmit power to limit coverage outside the building

Why it fails: Lowering transmit power may reduce the wireless signal outside the facility, but it does not prevent an attacker who is already within range from capturing and replaying management frames. It is a coverage control, not a cryptographic protection for authentication exchanges, so it fails to address the specific attack.

Implement MAC address filtering on the wireless controller

Why it fails: MAC address filtering only restricts which client hardware addresses may associate. An attacker capturing and replaying authentication frames can spoof an allowed MAC address, and the filter does nothing to protect the management frames used in the attack, so it does not mitigate the rogue access point session-key theft.

TLS for the web-based imaging portal

Why it fails: TLS protects application-layer protocols such as HTTPS and provides confidentiality and integrity for that session. If the imaging transfer uses a web portal, TLS is essential, but the scenario describes a department-to-clinic transmission requirement that may involve DICOM or file shares rather than a browser session. As a general network-layer protection for all traffic between sites, TLS alone does not cover non-web protocols.

SSH tunneling for the file transfer

Why it fails: SSH can forward TCP ports and encrypt specific application sessions, which provides confidentiality and integrity for those sessions. However, it protects only the forwarded connections, not all traffic between the two networks, and it requires an SSH server and client configuration per flow. For a persistent site-to-site requirement covering all imaging traffic, a network-layer VPN such as IPsec tunnel mode is more appropriate and scalable.

IPsec in transport mode

Why it fails: IPsec in transport mode encrypts only the payload of the original IP packet and leaves the original IP header intact. It is typically used for host-to-host or end-to-end protection within an existing IP connection, and it can provide confidentiality and integrity. However, for site-to-site connectivity across the internet between two networks, tunnel mode is the standard choice because it encapsulates the entire original packet, including addresses, inside a new IP packet.

DHCP

Why it fails: DHCP (Dynamic Host Configuration Protocol) is used to automatically assign IP addresses, subnet masks, default gateways, and other network parameters to devices. It does not translate domain names to IP addresses. The issue described is related to name resolution, not IP configuration.

ARP

Why it fails: ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network. It does not translate domain names to IP addresses. The issue is not about local MAC address resolution, but about domain name resolution, so ARP is not the relevant protocol.

ICMP

Why it fails: ICMP (Internet Control Message Protocol) is used for network diagnostics and error reporting, such as ping and traceroute. It does not perform domain name resolution. The problem described is not related to ICMP functionality, so it is not the correct protocol.

Implement 802.1X authentication on all switch ports.

Why it fails: 802.1X provides port-based network access control, requiring devices to authenticate before gaining network access. While it prevents unauthorized devices, it does not directly stop an authenticated attacker from sending spoofed DHCP requests. The attack described uses spoofed MAC addresses, which 802.1X alone does not prevent after authentication.

Enable IP source guard on all access ports.

Why it fails: IP source guard uses the DHCP snooping binding table to filter IP packets based on source IP and MAC address. It prevents IP spoofing, but it does not stop DHCP starvation attacks, which occur at the DHCP layer before IP assignment. Without DHCP snooping, IP source guard has no binding table to reference.

Deploy a second DHCP server for redundancy.

Why it fails: A second DHCP server increases the available address pool and provides failover, but it does not prevent an attacker from exhausting addresses. In fact, it could give the attacker more addresses to consume. Redundancy addresses availability, not security, and is not a mitigation for DHCP starvation.

MACsec encryption

Why it fails: MACsec provides hop-by-hop encryption and integrity on Ethernet links, protecting data in transit. However, it does not prevent an authenticated device from sharing its port with unauthorized devices. It secures the link between the authenticated device and the switch, but a rogue switch could still bridge traffic, so it does not solve the unauthorized device access problem.

Port security with MAC address limiting

Why it fails: Port security limits the number of MAC addresses allowed on a switch port, which can help, but it does not integrate with 802.1X authentication state and may not prevent a rogue switch from authenticating once and then sharing access. It is not the specific 802.1X extension designed to restrict multiple devices behind a single authenticated port.

DHCP snooping

Why it fails: DHCP snooping filters DHCP messages to prevent rogue DHCP servers and mitigate IP spoofing. It does not address the scenario where an authenticated port is shared by a rogue switch and multiple devices. It operates at Layer 2 for DHCP security, not for enforcing single-device access behind an 802.1X-authenticated port.

A web application firewall (WAF) to inspect HTTP traffic

Why it fails: A WAF protects web applications from application-layer attacks and is unrelated to network access control. NAC focuses on authenticating and assessing devices at the network edge, not on inspecting HTTP traffic. A WAF does not contribute to determining device compliance or enforcing network access policies.

A DHCP server for assigning IP addresses to devices

Why it fails: While DHCP is commonly used in networks, it is not essential for NAC to enforce compliance and authentication. NAC can operate with static IP addressing or in environments where DHCP is separate. The core of NAC is policy enforcement based on posture and identity, which does not depend on DHCP for its essential functions.

A protocol for enforcing access decisions, such as 802.1X

Why it fails: While 802.1X is a common enforcement mechanism for NAC, it is not strictly essential in all NAC implementations; some use agent-based or DHCP-based enforcement. The question asks for essential components to achieve authentication and compliance-based access. Authentication (RADIUS) and posture assessment are the core essentials, whereas the enforcement protocol can vary.

Layer 1 - Physical

Why it fails: Layer 1 transmits raw bits as electrical, optical or radio signals across the physical medium; it has no concept of IP addresses or forwarding decisions. Physical is tempting as the foundation carrying all traffic, but it would be correct for cabling, connectors and signalling questions.

Layer 4 - Transport

Why it fails: Layer 4 segments, sequences and delivers data between endpoints using ports and protocols such as TCP and UDP; it never inspects IP addresses to forward packets between networks. Transport is tempting because TCP and UDP carry the traffic, but it would be correct for port-based questions, not routing.

Layer 2 - Data Link

Why it fails: Layer 2 frames data and forwards it using MAC addresses within a single broadcast domain; IP-based path selection between networks occurs above it. Data Link is tempting because switches forward frames, but it would be correct for MAC addressing, VLANs or error detection on a local segment.