Network Security practice questions

A security analyst notices that an internal web server is receiving a high volume of TCP SYN packets from a single external IP address, but the server is not sending SYN-ACK replies. The server's CPU and memory usage are normal. What is the most likely cause?

Trap 1: A firewall rule is blocking inbound SYN-ACK packets

Firewalls typically block inbound SYNs, not SYN-ACKs; the issue is the server not sending SYN-ACKs.

Trap 2: The server's TCP/IP stack has crashed

A crash would show abnormal CPU/memory usage, which is normal here.

Trap 3: The server is experiencing a distributed denial-of-service (DDoS)…

A DDoS involves multiple sources, but here only one IP is mentioned.

A
A firewall rule is blocking inbound SYN-ACK packets
Why wrong: Firewalls typically block inbound SYNs, not SYN-ACKs; the issue is the server not sending SYN-ACKs.
B
The server is under a SYN flood attack, filling the connection queue
SYN flood attacks fill the server's half-open connection queue, preventing it from sending SYN-ACKs.
C
The server's TCP/IP stack has crashed
Why wrong: A crash would show abnormal CPU/memory usage, which is normal here.
D
The server is experiencing a distributed denial-of-service (DDoS) attack
Why wrong: A DDoS involves multiple sources, but here only one IP is mentioned.

Question 2mediummultiple choice

A network administrator is designing a DMZ to host a public-facing web server and a database server that should only be accessible from the web server. Which of the following firewall rule sets best achieves this design?

Trap 1: Allow web server to initiate outbound connections to internet;…

This does not allow inbound web traffic from the internet.

Trap 2: Allow inbound HTTP/HTTPS to web server; allow all traffic from web…

Allowing all traffic from web server to database is too broad; only specific ports should be allowed.

Trap 3: Allow inbound HTTP/HTTPS to web server; allow inbound SQL from…

This exposes the database to the internet, which is insecure.

A
Allow inbound HTTP/HTTPS to web server; allow web server to database on port 3306; deny all else
This permits necessary traffic and restricts database access to only the web server.
B
Allow web server to initiate outbound connections to internet; allow database to initiate connections to web server; deny all else
Why wrong: This does not allow inbound web traffic from the internet.
C
Allow inbound HTTP/HTTPS to web server; allow all traffic from web server to database; deny all else
Why wrong: Allowing all traffic from web server to database is too broad; only specific ports should be allowed.
D
Allow inbound HTTP/HTTPS to web server; allow inbound SQL from internet to database; deny all else
Why wrong: This exposes the database to the internet, which is insecure.

Question 3hardmultiple choice

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Trap 1: The switch is not forwarding EAP packets properly due to a firmware…

The error message indicates a certificate issue, not packet forwarding.

Trap 2: The RADIUS shared secret was changed during the firmware update

A shared secret mismatch would cause 'Access-Reject' or 'Authentication failed' without certificate-specific errors.

Trap 3: The authentication server (NPS) is overloaded and dropping requests

Overload would cause timeouts, not certificate errors.

A
The switch is now using a different certificate that is not trusted by the clients
The firmware update may have changed the certificate presented by the switch, and clients do not trust it.
B
The switch is not forwarding EAP packets properly due to a firmware bug
Why wrong: The error message indicates a certificate issue, not packet forwarding.
C
The RADIUS shared secret was changed during the firmware update
Why wrong: A shared secret mismatch would cause 'Access-Reject' or 'Authentication failed' without certificate-specific errors.
D
The authentication server (NPS) is overloaded and dropping requests
Why wrong: Overload would cause timeouts, not certificate errors.

Review the full subnetting walkthrough →

Question 4easymultiple choice

A security engineer is configuring a network intrusion detection system (NIDS) to monitor traffic on a critical subnet. To minimize false positives, which of the following should the engineer baseline first?

Trap 1: The results of a recent vulnerability scan

Vulnerability scans identify weaknesses, not traffic patterns.

Trap 2: The latest attack signatures from the vendor

Signatures detect known attacks but don't establish a baseline.

Trap 3: The firewall logs from the past 24 hours

Firewall logs show blocked traffic, not necessarily normal patterns.

A
The results of a recent vulnerability scan
Why wrong: Vulnerability scans identify weaknesses, not traffic patterns.
B
The normal traffic patterns during peak business hours
Baseline normal traffic to identify anomalies.
C
The latest attack signatures from the vendor
Why wrong: Signatures detect known attacks but don't establish a baseline.
D
The firewall logs from the past 24 hours
Why wrong: Firewall logs show blocked traffic, not necessarily normal patterns.

Read the full VPN explanation →

Question 5mediummultiple choice

A company's remote access VPN uses IPsec with pre-shared keys. Employees report that they cannot connect from home. The VPN server logs show 'IKE authentication failed.' The help desk confirms the pre-shared keys are correct. Which of the following is the most likely cause?

Trap 1: The client is behind a NAT device that blocks IPsec traffic

NAT traversal (NAT-T) is common and would not cause 'IKE authentication failed' if configured correctly.

Trap 2: The VPN server is not responding to IKE requests

If unresponsive, the error would be timeout, not authentication failure.

Trap 3: The client's certificate has expired

Using pre-shared keys, not certificates.

A
The client is behind a NAT device that blocks IPsec traffic
Why wrong: NAT traversal (NAT-T) is common and would not cause 'IKE authentication failed' if configured correctly.
B
The VPN server is not responding to IKE requests
Why wrong: If unresponsive, the error would be timeout, not authentication failure.
C
The client's certificate has expired
Why wrong: Using pre-shared keys, not certificates.
D
The IKE phase 1 parameters (encryption, hash, DH group) do not match
Mismatched parameters cause authentication failure despite correct keys.

Question 6hardmultiple choice

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Trap 1: Spoof the source IP address of the attacker's machine

The attacker's IP is not spoofed; the zombie's IP is used.

Trap 2: Launch a denial-of-service attack against the target

Idle scan is not a DoS; it's a stealth scan.

Trap 3: Evade a firewall by fragmenting packets

DF flag prevents fragmentation.

A
Spoof the source IP address of the attacker's machine
Why wrong: The attacker's IP is not spoofed; the zombie's IP is used.
B
Launch a denial-of-service attack against the target
Why wrong: Idle scan is not a DoS; it's a stealth scan.
C
Perform a stealth scan using a zombie host to hide the attacker's identity
Idle scan uses IP ID to map a zombie's activity and infer port states.
D
Evade a firewall by fragmenting packets
Why wrong: DF flag prevents fragmentation.

Read the full wireless explanation →

Question 7mediummulti select

Which TWO of the following are best practices for securing a wireless network? (Select exactly two.)

Trap 1: Use WEP encryption for compatibility

WEP is deprecated and easily cracked.

Trap 2: Disable SSID broadcast

Disabling SSID broadcast is a weak security measure as attackers can discover the SSID easily.

Trap 3: Disable DHCP and use static IP addressing

Static IP addressing does not prevent unauthorized access and adds administrative burden.

A
Use WEP encryption for compatibility
Why wrong: WEP is deprecated and easily cracked.
B
Disable SSID broadcast
Why wrong: Disabling SSID broadcast is a weak security measure as attackers can discover the SSID easily.
C
Implement MAC address filtering
MAC filtering can restrict which devices can connect, though it can be spoofed.
D
Disable DHCP and use static IP addressing
Why wrong: Static IP addressing does not prevent unauthorized access and adds administrative burden.
E
Enable WPA3 encryption
WPA3 is the latest and most secure Wi-Fi encryption standard.

Question 8hardmulti select

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Trap 1: It inspects application-layer payloads

Application-layer inspection is done by NGFWs, not standard stateful firewalls.

Trap 2: It filters packets based solely on source/destination IP and port

That describes stateless packet filtering.

A
It can automatically allow return traffic for outbound connections
Stateful firewalls permit return traffic for established sessions.
B
It maintains a state table of active connections
Stateful firewalls track the state of connections.
C
It inspects application-layer payloads
Why wrong: Application-layer inspection is done by NGFWs, not standard stateful firewalls.
D
It filters packets based solely on source/destination IP and port
Why wrong: That describes stateless packet filtering.
E
It makes filtering decisions based on the context of traffic flows
Stateful firewalls consider the entire session context.

Study the full ACL explanation →

Question 9mediummultiple choice

Refer to the exhibit. An administrator configures the above ACLs on a router. The goal is to allow internal users (192.168.1.0/24) to browse the web, and to allow SSH management from the internet to a server at 10.0.0.10. However, users report that they cannot browse external websites. What is the most likely reason?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group OUTBOUND out
!
interface GigabitEthernet0/2
 ip address 10.0.0.1 255.255.255.0
 ip access-group INBOUND in
!
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443
access-list 100 deny ip any any
!
access-list 110 permit tcp any host 10.0.0.10 eq 22
access-list 110 permit icmp any host 10.0.0.10 echo-reply
access-list 110 deny ip any any

Trap 1: ACL 100 does not permit DNS traffic, so users cannot resolve domain…

The stem mentions browsing, which could be directly via IP; also DNS is not necessary if using IP addresses.

Trap 2: ACL 110 blocks the return traffic from the internet

ACL 110 is applied inbound on Gi0/2; it permits SSH and ICMP echo replies, but does not block return HTTP traffic.

Trap 3: The implicit deny at the end of ACL 100 blocks established…

ACL 100 permits HTTP/HTTPS and then denies all; established connections are not automatically allowed unless stateful inspection is enabled.

A
ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users
The access-group is applied outbound on Gi0/1; traffic from internal users to the internet exits Gi0/1 inbound, so ACL 100 is not checked.
B
ACL 100 does not permit DNS traffic, so users cannot resolve domain names
Why wrong: The stem mentions browsing, which could be directly via IP; also DNS is not necessary if using IP addresses.
C
ACL 110 blocks the return traffic from the internet
Why wrong: ACL 110 is applied inbound on Gi0/2; it permits SSH and ICMP echo replies, but does not block return HTTP traffic.
D
The implicit deny at the end of ACL 100 blocks established connections
Why wrong: ACL 100 permits HTTP/HTTPS and then denies all; established connections are not automatically allowed unless stateful inspection is enabled.

Question 10hardmultiple choice

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Exhibit

Refer to the exhibit.

[IDS Alert Log]
Timestamp: 2024-03-15 10:23:45
Signature: ET POLICY Outgoing SSLv3 Handshake (Possible SSL Stripping)
Source IP: 10.1.1.50
Destination IP: 203.0.113.10
Protocol: TCP
Port: 443
Payload: [Hex dump of ClientHello with version 3.0]

Trap 1: The server is experiencing a buffer overflow attack

No indication of buffer overflow in the alert.

Trap 2: The server's certificate has expired and the client is falling back…

Certificate expiration typically causes browser warnings, not a protocol downgrade to SSLv3.

Trap 3: The server has been misconfigured to use SSLv3 instead of TLS

While possible, the alert specifically mentions 'SSL Stripping' as a signature, indicating an attack.

A
An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3
The alert signature suggests SSL stripping, and the use of SSLv3 is a red flag.
B
The server is experiencing a buffer overflow attack
Why wrong: No indication of buffer overflow in the alert.
C
The server's certificate has expired and the client is falling back to SSLv3
Why wrong: Certificate expiration typically causes browser warnings, not a protocol downgrade to SSLv3.
D
The server has been misconfigured to use SSLv3 instead of TLS
Why wrong: While possible, the alert specifically mentions 'SSL Stripping' as a signature, indicating an attack.

Open the full VLAN trunking answer →

Question 11hardmultiple choice

A medium-sized company uses a network with three VLANs: VLAN 10 (Users, 192.168.10.0/24), VLAN 20 (Servers, 192.168.20.0/24), and VLAN 30 (DMZ, 192.168.30.0/24). A Layer 3 switch with an ACL is used for inter-VLAN routing. The company has a web server in the DMZ that must be accessible from the internet (via a public IP mapped to 192.168.30.10). Users in VLAN 10 need to access the web server on its private IP (192.168.30.10) for internal testing. The ACL is applied inbound on the VLAN 10 SVI. The ACL currently has the following entries: permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255; deny ip any 192.168.20.0 0.0.0.255; permit ip any any. Recently, the security team noticed that users can access the web server on its private IP, but they cannot access the web server via the public IP (which goes through the firewall and then to the DMZ). The firewall logs show that traffic from the users to the public IP is allowed and reaches the DMZ web server, but the return traffic is blocked. The web server's default gateway is the Layer 3 switch (192.168.30.1). Which of the following is the most likely cause of the problem?

Trap 1: The web server's default gateway should be set to the firewall, not…

The web server's default gateway is the switch, which is correct for reaching other internal subnets; the firewall is for external traffic, but the server can still send reply to the firewall via the switch.

Trap 2: The ACL on the VLAN 10 SVI is blocking the traffic to the public IP…

The ACL permits any any after the deny, so it allows all traffic from VLAN 10 to any destination.

Trap 3: The firewall is blocking the return traffic due to a stateful…

The firewall logs show the traffic is allowed, and the firewall should allow return traffic for established sessions.

A
The web server's default gateway should be set to the firewall, not the Layer 3 switch
Why wrong: The web server's default gateway is the switch, which is correct for reaching other internal subnets; the firewall is for external traffic, but the server can still send reply to the firewall via the switch.
B
The ACL on the DMZ SVI (VLAN 30) is blocking the return traffic from the web server to the firewall
The return traffic from the web server to the firewall must traverse the DMZ SVI. If the ACL on that SVI does not permit the firewall's IP or the traffic, it will be blocked.
C
The ACL on the VLAN 10 SVI is blocking the traffic to the public IP because it only allows private IP ranges
Why wrong: The ACL permits any any after the deny, so it allows all traffic from VLAN 10 to any destination.
D
The firewall is blocking the return traffic due to a stateful inspection rule
Why wrong: The firewall logs show the traffic is allowed, and the firewall should allow return traffic for established sessions.

Question 12easymulti select

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Trap 1: Deploying an intrusion detection system (IDS) on the core switch.

IDS monitors traffic but does not segment the network.

Trap 2: Placing public-facing servers in a DMZ.

DMZ is a result of segmentation, not the control itself.

Trap 3: Using VPN for remote access.

VPN extends the network, it does not segment it.

A
Implementing firewall rules between internal zones.
Firewalls enforce segmentation by controlling traffic between zones.
B
Deploying an intrusion detection system (IDS) on the core switch.
Why wrong: IDS monitors traffic but does not segment the network.
C
Configuring VLANs to separate departmental traffic.
VLANs create separate broadcast domains, segmenting the network.
D
Placing public-facing servers in a DMZ.
Why wrong: DMZ is a result of segmentation, not the control itself.
E
Using VPN for remote access.
Why wrong: VPN extends the network, it does not segment it.

Question 13mediummultiple choice

Based on the exhibit, what is the most likely result of the client's HTTP request?

Exhibit

Refer to the exhibit.

Router# show running-config | section interface GigabitEthernet0/1
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group BLOCK_HTTP in
!
ip access-list extended BLOCK_HTTP
 deny tcp any any eq 80
 permit ip any any

A client at 192.168.1.100 attempts to access a web server at 10.0.0.1. The router's interface IP is 192.168.1.1.

Trap 1: The HTTP request is permitted because the ACL is applied to the…

The ACL is correctly applied inbound on the client's subnet interface; it will filter traffic coming from clients.

Trap 2: The HTTP request is permitted because the ACL only blocks traffic…

The ACL does not filter based on source IP; it blocks TCP port 80 from any source.

Trap 3: The HTTP request is blocked, and all other traffic from the client…

The permit ip any any allows all other traffic.

A
The HTTP request is permitted because the ACL is applied to the wrong interface.
Why wrong: The ACL is correctly applied inbound on the client's subnet interface; it will filter traffic coming from clients.
B
The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.
Why wrong: The ACL does not filter based on source IP; it blocks TCP port 80 from any source.
C
The HTTP request is blocked, and all other traffic from the client is also blocked.
Why wrong: The permit ip any any allows all other traffic.
D
The HTTP request is blocked, but other traffic from the client is allowed.
The ACL denies TCP port 80, then permits all other IP traffic.

Open the full VLAN trunking answer →

Question 14hardmultiple choice

You are the network security lead for a medium-sized financial firm with 500 employees. The network consists of a core switch, distribution switches, and access switches. There are three main VLANs: VLAN 10 (Management - 192.168.10.0/24), VLAN 20 (Finance - 192.168.20.0/24), and VLAN 30 (Guest Wi-Fi - 192.168.30.0/24). The network uses a single firewall with three interfaces: inside (trusted), outside (untrusted), and DMZ. The firewall is configured with default-deny rules. Recently, the helpdesk reported that employees in the Finance VLAN cannot access a web-based accounting application hosted on a server at 10.0.0.5, which is in the DMZ. The server's default gateway is the firewall's DMZ interface (10.0.0.1). The accounting application runs on HTTPS (TCP 443). Employees in the Management VLAN can access the application without issue. You have verified that the Finance VLAN has connectivity to the firewall's inside interface (192.168.20.1). The firewall's inside interface has an IP of 192.168.20.1. There is no ACL on the inside interface. The firewall's DMZ interface has an ACL permitting TCP/443 from any to 10.0.0.5. The firewall's routing table shows a route to 10.0.0.0/24 via DMZ interface. What is the most likely cause of the issue?

Trap 1: The routing table on the firewall does not have a return route to…

Management VLAN can reach the server, so routing is configured correctly.

Trap 2: The DMZ ACL is blocking traffic from the Finance subnet because it…

The DMZ ACL permits TCP/443 from any, so it does not block Finance.

Trap 3: An ACL applied inbound on the inside interface is blocking Finance…

The stem states there is no ACL on the inside interface, and even if there were, it would need to differentiate between VLANs, which is not typical.

A
The routing table on the firewall does not have a return route to the Finance subnet.
Why wrong: Management VLAN can reach the server, so routing is configured correctly.
B
The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.
Firewall policies are zone-based; the inside-to-DMZ policy is missing, blocking Finance traffic.
C
The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.
Why wrong: The DMZ ACL permits TCP/443 from any, so it does not block Finance.
D
An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.
Why wrong: The stem states there is no ACL on the inside interface, and even if there were, it would need to differentiate between VLANs, which is not typical.

Question 15mediumdrag order

Drag and drop the steps for the incident response process according to NIST into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediumdrag order

Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Match each network security concept to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters traffic based on rules

Segments public-facing servers

Maps private to public IPs

Encrypts data over public networks

Monitors for suspicious activity

Question 18mediummatching

Match each risk management term to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Weakness in a system

Potential cause of harm

Likelihood and impact of a threat exploiting a vulnerability

Control to mitigate risk

Question 19easymultiple choice

A network administrator notices unusual traffic from an internal workstation to an external IP address on port 443. The workstation has no business reason for such communication. Which action should the administrator take first?

Trap 1: Disable the workstation's network port.

Disabling the port is drastic; investigation is needed first.

Trap 2: Block all outbound traffic from that workstation immediately.

Blocking immediately may disrupt legitimate processes and does not address the root cause.

Trap 3: Configure a firewall rule to allow the traffic and log it.

Allowing suspicious traffic increases risk; logging is secondary to investigation.

A
Disable the workstation's network port.
Why wrong: Disabling the port is drastic; investigation is needed first.
B
Block all outbound traffic from that workstation immediately.
Why wrong: Blocking immediately may disrupt legitimate processes and does not address the root cause.
C
Investigate the workstation for possible malware.
Investigating helps determine if the traffic is malicious or a false positive.
D
Configure a firewall rule to allow the traffic and log it.
Why wrong: Allowing suspicious traffic increases risk; logging is secondary to investigation.

Question 20mediummultiple choice

A security engineer is designing a DMZ for a web server that must be accessible from the internet. The web server needs to query an internal database server. Which network security approach best limits exposure?

Trap 1: Use a single firewall with rules that allow all traffic from the…

Allowing all inbound traffic is unsafe.

Trap 2: Place both servers in the same subnet with a firewall allowing all…

Lack of segmentation exposes the database to the internet.

Trap 3: Place the database server in the DMZ with the web server.

Exposing the database server increases risk.

A
Use a single firewall with rules that allow all traffic from the internet to the internal network.
Why wrong: Allowing all inbound traffic is unsafe.
B
Place both servers in the same subnet with a firewall allowing all traffic.
Why wrong: Lack of segmentation exposes the database to the internet.
C
Place the database server in the DMZ with the web server.
Why wrong: Exposing the database server increases risk.
D
Place the web server in the DMZ and the database server in the internal network, with a firewall allowing only specific traffic from the web server to the database.
This provides proper segmentation and least privilege.