mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A company recently suffered a data breach where…
A company recently suffered a data breach where an attacker was able to intercept network traffic and read sensitive data. Which network security control should be implemented to prevent this type of attack?
⚠ Common exam trap
ISC2 often tests the misconception that network segmentation (Option B) prevents data interception, but segmentation only limits lateral movement, not the ability to read traffic within the same segment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption at the network layer (e.g., IPsec)
IPsec operates at the network layer (Layer 3) and provides encryption of the entire IP packet, including the payload, ensuring that even if an attacker intercepts the traffic, the data remains unreadable. This directly addresses the scenario where an attacker reads sensitive data from intercepted network traffic, as IPsec can be configured in transport mode for end-to-end encryption or tunnel mode for VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption at the network layer (e.g., IPsec)
Why this is correct
IPsec operates at Layer 3 of the OSI model, encrypting entire IP packets, including the payload and often parts of the header. This ensures that even if an attacker successfully intercepts network traffic, the data remains unintelligible without the correct cryptographic keys. It directly addresses the risk of data exposure from sniffing by rendering the intercepted information useless and confidential.
- ✗
Network segmentation
Why it's wrong here
Network segmentation logically divides a network into smaller, isolated segments, limiting lateral movement and the scope of a breach. While it can contain an attacker's reach by restricting access to certain network zones, it does not inherently encrypt data in transit within a segment. An attacker who gains access to a specific segment can still intercept and read unencrypted traffic flowing within that segment.
- ✗
Intrusion prevention system (IPS)
Why it's wrong here
An Intrusion Prevention System (IPS) actively monitors network traffic for malicious activity, known attack signatures, or anomalous behavior, and can block or drop suspicious packets in real-time. While an IPS can prevent certain active attacks from succeeding or alert administrators to threats, its primary function is not data encryption. It cannot prevent a passive attacker from simply sniffing and capturing unencrypted data that successfully traverses the network.
- ✗
Strong password policies
Why it's wrong here
Strong password policies enforce complexity, length, and regular rotation requirements for user authentication credentials, aiming to prevent unauthorized access to systems and accounts. These policies are crucial for identity and access management, protecting against brute-force or dictionary attacks. However, they do not provide any protection for data once it is transmitted across the network, as they do not encrypt the data itself against interception.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Network security
Network security is the practice of protecting a computer network from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, ensuring the confidentiality, integrity, and availability of data and resources.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.