Troubleshooting practice questions

A security engineer is troubleshooting a site-to-site IPsec VPN between two firewalls. The tunnel status shows Phase 1 is up but Phase 2 is not. Which of the following is the most likely cause?

Trap 1: Incorrect pre-shared key

Incorrect pre-shared key would cause Phase 1 to fail, not Phase 2.

Trap 2: Mismatched authentication algorithm

Mismatched authentication algorithm would also cause Phase 1 to fail.

Trap 3: Firewall rule blocking IKE traffic

If IKE were blocked, Phase 1 would not establish.

A
Incorrect pre-shared key
Why wrong: Incorrect pre-shared key would cause Phase 1 to fail, not Phase 2.
B
Mismatched authentication algorithm
Why wrong: Mismatched authentication algorithm would also cause Phase 1 to fail.
C
Firewall rule blocking IKE traffic
Why wrong: If IKE were blocked, Phase 1 would not establish.
D
Mismatched proxy IDs (traffic selectors)
Proxy IDs define which traffic should be encrypted; if they don't match, Phase 2 fails.

Question 2hardmultiple choice

In a software-defined network (SDN) architecture, the control plane is separated from the data plane. A network administrator is troubleshooting packet forwarding delays. Which plane is directly responsible for forwarding packets?

Trap 1: Application plane

Delivers network services, not packet forwarding.

Trap 2: Control plane

Makes forwarding decisions but does not forward packets.

Trap 3: Management plane

Handles monitoring and configuration, not forwarding.

A
Data plane
Directly responsible for forwarding packets based on flow tables.
B
Application plane
Why wrong: Delivers network services, not packet forwarding.
C
Control plane
Why wrong: Makes forwarding decisions but does not forward packets.
D
Management plane
Why wrong: Handles monitoring and configuration, not forwarding.

Question 3mediummultiple choice

A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?

Trap 1: The VPN server is using TCP port 443 instead of UDP 500.

The server is expected to use UDP 500 for IKE.

Trap 2: The firewall rule is applied to the wrong interface.

The rule is correctly configured per the question.

Trap 3: The firewall is stateful and blocking the return traffic.

Stateful firewalls allow return traffic for established sessions.

A
The VPN server is using TCP port 443 instead of UDP 500.
Why wrong: The server is expected to use UDP 500 for IKE.
B
The firewall rule is applied to the wrong interface.
Why wrong: The rule is correctly configured per the question.
C
The firewall is stateful and blocking the return traffic.
Why wrong: Stateful firewalls allow return traffic for established sessions.
D
The VPN server is not listening on UDP port 500.
If the server does not have the VPN service running, it won't respond, causing the client to time out.

Question 4mediummultiple choice

A security engineer is troubleshooting an issue where users are unable to access a web application after being authenticated via OAuth 2.0. The users receive a 403 Forbidden error. The application logs show that the access token is valid but does not contain the required scope. What is the most likely cause?

Trap 1: The resource server is configured to expect a different token type.

This would likely result in an unsupported token type error.

Trap 2: The client application is not using HTTPS to transmit the token.

This is a security concern but not directly causing 403.

Trap 3: The access token expired before being presented to the resource…

Expired tokens typically result in 401 Unauthorized, not 403.

A
The resource server is configured to expect a different token type.
Why wrong: This would likely result in an unsupported token type error.
B
The client application is not using HTTPS to transmit the token.
Why wrong: This is a security concern but not directly causing 403.
C
The access token expired before being presented to the resource server.
Why wrong: Expired tokens typically result in 401 Unauthorized, not 403.
D
The authorization server did not grant the requested scope due to user consent settings.
The token lacks the required scope, so the resource server denies access.

Question 5hardmultiple choice

A security engineer is troubleshooting an authentication failure for a Windows domain user. The user receives 'Access denied' when trying to access a file server. The Kerberos ticket-granting ticket was successfully obtained. What is the most likely issue?

Trap 1: The file server is not trusted for delegation

Delegation settings affect double-hop, not basic file access.

Trap 2: The user account is locked out

A locked account cannot obtain a TGT; the TGT was obtained, so account is not locked.

Trap 3: Time skew between client and domain controller

Time skew prevents TGT issuance, but TGT was successfully obtained, so time is synchronized.

A
The file server is not trusted for delegation
Why wrong: Delegation settings affect double-hop, not basic file access.
B
The user does not have permission to the file server resource
After getting a service ticket, the file server checks ACLs; if denied, it returns 'Access denied'.
C
The user account is locked out
Why wrong: A locked account cannot obtain a TGT; the TGT was obtained, so account is not locked.
D
Time skew between client and domain controller
Why wrong: Time skew prevents TGT issuance, but TGT was successfully obtained, so time is synchronized.

Question 6mediummultiple choice

A network engineer is troubleshooting a slow VPN connection between two sites. The link is symmetric 100 Mbps, but throughput tests show only 20 Mbps. The VPN uses AES-256 encryption. What is the most likely cause?

Trap 1: Packet loss due to link congestion

Congestion would cause variable throughput and packet loss, not a stable 20 Mbps.

Trap 2: MTU mismatch causing fragmentation

MTU issues cause packet drops and retransmissions, not a steady 20 Mbps throughput.

Trap 3: Incorrect TCP window scaling

TCP window scaling affects throughput but is less likely to cause such a drastic and consistent reduction.

A
Packet loss due to link congestion
Why wrong: Congestion would cause variable throughput and packet loss, not a stable 20 Mbps.
B
CPU bottleneck on the VPN endpoints
AES-256 encryption consumes CPU resources; if the devices are underpowered, throughput will be severely limited.
C
MTU mismatch causing fragmentation
Why wrong: MTU issues cause packet drops and retransmissions, not a steady 20 Mbps throughput.
D
Incorrect TCP window scaling
Why wrong: TCP window scaling affects throughput but is less likely to cause such a drastic and consistent reduction.

Question 7mediummultiple choice

A network engineer is troubleshooting an IPsec VPN tunnel between two sites. The tunnel is established but no traffic is passing. Which command should the engineer use to verify the phase 2 security associations?

Trap 1: Traceroute between site gateways

Traceroute shows path but doesn't verify IPsec SAs.

Trap 2: Ping between site gateways

Ping checks connectivity but not VPN tunnel state.

Trap 3: show crypto isakmp sa

This shows phase 1 SAs, not phase 2.

A
Traceroute between site gateways
Why wrong: Traceroute shows path but doesn't verify IPsec SAs.
B
show crypto ipsec sa
This command displays phase 2 SAs.
C
Ping between site gateways
Why wrong: Ping checks connectivity but not VPN tunnel state.
D
show crypto isakmp sa
Why wrong: This shows phase 1 SAs, not phase 2.

Question 8hardmultiple choice

A security analyst is troubleshooting a web application that is incorrectly blocking valid login requests. The WAF rule in the exhibit is the only rule configured. What is the probable issue?

Exhibit

SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_URI "/login" "phase:2,deny,msg:'Login attempt detected'"

Trap 1: The rule uses outdated syntax

Incorrect. The syntax is standard for ModSecurity.

Trap 2: The rule is in the wrong phase

Incorrect. Phase 2 is appropriate for request URI inspection.

Trap 3: The rule does not specify a status code

Incorrect. The rule will still deny with default status.

A
The rule uses outdated syntax
Why wrong: Incorrect. The syntax is standard for ModSecurity.
B
The rule is in the wrong phase
Why wrong: Incorrect. Phase 2 is appropriate for request URI inspection.
C
The rule is too generic and matches all login requests
Correct. The rule denies all requests to '/login' without any additional conditions.
D
The rule does not specify a status code
Why wrong: Incorrect. The rule will still deny with default status.

Question 9hardmultiple choice

Refer to the exhibit. A security analyst observes the audit log entry while troubleshooting a file access issue. The application is running under the myapp_t domain. Which action should the analyst take to resolve the issue while adhering to the principle of least privilege?

Exhibit

// Security-constrained model in SELinux policy
policy_module(myapp, 1.0.0)

type myapp_t;
type myapp_exec_t;
init_daemon_domain(myapp_t, myapp_exec_t)

allow myapp_t self:capability { dac_override };
allow myapp_t self:process { fork };
allow myapp_t myapp_data_t:file { read write create open };

// Audit log snippet
AUDIT: type=AVC msg=audit(1633028000.123:456): avc:  denied  { read } for  pid=1234 comm="myapp" name="shadow" dev="dm-0" ino=789 scontext=system_u:system_r:myapp_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file

Trap 1: Add rule: allow myapp_t shadow_t:file { read write };

Allows write, which is a privilege escalation not required.

Trap 2: Change the file context of /etc/shadow to myapp_data_t

This would expose sensitive password data to all myapp_data_t processes.

Trap 3: Set the application to run in unconfined_t domain

Removes all SELinux protections, violating least privilege.

A
Add rule: allow myapp_t shadow_t:file { read write };
Why wrong: Allows write, which is a privilege escalation not required.
B
Change the file context of /etc/shadow to myapp_data_t
Why wrong: This would expose sensitive password data to all myapp_data_t processes.
C
Add rule: allow myapp_t shadow_t:file read;
This grants only the needed read access to the shadow file.
D
Set the application to run in unconfined_t domain
Why wrong: Removes all SELinux protections, violating least privilege.