CCNA Network and Communications Security Questions

ESP in tunnel mode encapsulates the entire original IP packet and applies both encryption and authentication, satisfying the stem's dual requirement. AH provides authentication only, without confidentiality, so it cannot encrypt payloads. ESP's tunnel encapsulation also hides original source and destination addresses, which transport mode does not.

TLS 1.3 removes static RSA and plain Diffie-Hellman key exchange, leaving only ephemeral (EC)DHE and PSK modes. Every session therefore derives unique keys, so forward secrecy is mandatory rather than optional as in TLS 1.2.

ARP spoofing fits because the attacker forges an ARP reply, binding their MAC address to the gateway's IP. This poisons the victim's ARP cache, redirecting traffic through the attacker for interception. The stem's defining constraint — a falsified ARP reply impersonating the default gateway — is precisely ARP spoofing, not DNS or IP spoofing.

TCP 443 carries HTTPS, using TLS to encrypt web traffic. Firewalls commonly permit it outbound so users can browse securely, satisfying the stem's requirement. Port 80 is unencrypted HTTP, while 22 and 25 serve SSH and SMTP respectively.

802.1X port-based authentication requires a supplicant to authenticate against a RADIUS server before the switch port grants access, and NAC enforces the resulting policy. Together they ensure only authorised, compliant devices can connect to the wired network.

A firewall between the DMZ and internal network enforces stateful rules permitting only specific internal-to-DMZ traffic while blocking DMZ-initiated connections inward. This satisfies the segmentation requirement, containing a compromised public-facing web server so it cannot pivot into the corporate network.

Port security allows the administrator to specify which MAC addresses are allowed on a switch port. It can restrict access to a single MAC address or a limited number, and can take actions like shutting down the port if a violation occurs. This directly meets the requirement to prevent unauthorized devices based on MAC address.

DNSSEC cryptographically signs DNS records, letting resolvers verify responses originated from the authoritative zone and were not altered in transit. This directly defeats cache poisoning, where forged replies redirect users to attacker-controlled addresses, satisfying the stem's requirement to prevent spoofed DNS data from being trusted.

A high rate of SYN packets is a primary indicator of a SYN flood, as the attacker sends many SYN requests to exhaust the target's connection table. Monitoring the rate of SYN packets helps detect the initial phase of the attack. However, it must be correlated with other metrics to avoid false positives from legitimate traffic spikes.

DHCP snooping designates trusted ports and filters server replies on untrusted ones, so a rogue DHCP server cannot hand out a falsified default gateway. This directly satisfies the stem's constraint of preventing incorrect gateway assignment.

A screened subnet with dual firewalls creates two distinct security boundaries. The external firewall controls internet-to-DMZ traffic, while the internal firewall restricts DMZ-to-internal traffic. Even if the web server is compromised, the attacker must bypass the internal firewall to reach the database. This layered defense enforces segmentation and is a best practice for DMZ design.

SYN cookies encode connection state within the SYN-ACK sequence number, so the server holds no state until the client's ACK returns. This removes the half-open connection table exhaustion that defines a SYN flood, satisfying the stem's mitigation requirement.

A Smurf attack spoofs the victim's source address and sends ICMP echo requests to a network broadcast address, so every host replies to the victim, amplifying traffic. This matches the stem's forged ICMP flood against a broadcast address.

ARP spoofing sends forged ARP replies to associate the attacker's MAC address with the IP address of another host, such as the default gateway. This causes traffic to be sent to the attacker, who can then forward it to the legitimate destination while capturing it, enabling man-in-the-middle without switch compromise.

Many SSL/TLS VPN gateways integrate host checks, verifying patch level, antivirus state and device compliance before granting tunnel access. This satisfies the stem's deployment consideration by enforcing endpoint posture at connection time, a control IPsec remote-access deployments typically require separate tooling to achieve.

WPA3 replaces the pre-shared key handshake with Simultaneous Authentication of Equals, a dragonfly-based exchange that resists offline dictionary attacks. This directly satisfies the requirement for a protocol using SAE instead of PSK, unlike WPA2's four-way handshake.

UDP operates without establishing a session, sending datagrams independently with no handshake, acknowledgement, or retransmission. This connectionless design satisfies the stem's requirement, and its low overhead suits DNS and DHCP, which favour speed over guaranteed delivery. TCP, by contrast, is connection-oriented and would add unnecessary latency.

Tunnel mode encapsulates the entire original IP packet, including its header, then prepends a new IP header for routing across the internet. Transport mode encrypts only the payload, so tunnel mode satisfies the stated requirement.

DNS name resolution queries use UDP port 53 for standard lookups, with TCP 53 reserved for zone transfers and responses exceeding 512 bytes. This satisfies the stem's requirement for the specific UDP port used in resolution queries.

SSH on TCP 22 encrypts the entire remote administration session, including credentials and commands, satisfying the requirement for secure remote server management. Unlike Telnet on port 23, which transmits data in cleartext, SSH provides confidentiality and integrity through cryptographic tunnelling, making it the standard choice for hardened administrative access.

A SPAN port mirrors copies of frames from the monitored segment to the sensor, so the IDS analyses traffic passively without sitting inline in the forwarding path. This satisfies the requirement to monitor all segment traffic without introducing latency.

Gratuitous ARP replies let the attacker poison victims' ARP caches, binding the gateway's IP to the attacker's MAC. Traffic destined for the gateway is then redirected through the attacker, enabling man-in-the-middle interception and potential modification of communications.

A stateful firewall maintains a connection state table, tracking each flow's context so return traffic and established sessions are evaluated against recorded states rather than static rules alone. This satisfies the requirement to make decisions based on the context of active traffic flows.

IKEv2 is a robust VPN protocol that supports strong encryption and authentication, and is widely supported on many devices including mobile platforms. It can be used with various authentication methods such as certificates, EAP, and pre-shared keys. It does not require proprietary software, as it is built into most modern operating systems. Therefore, it meets the requirements for secure remote access with broad compatibility.

ESP is the IPsec component that provides confidentiality by encrypting the payload. In tunnel mode, ESP encrypts the entire original IP packet and encapsulates it within a new IP packet. Thus, it meets the requirement to protect the original packet's contents from eavesdropping.

DHCP starvation exhausts the server's address pool by flooding it with requests bearing spoofed MAC addresses, so no leases remain for legitimate clients. This matches the stem's constraint exactly: pool exhaustion via forged MAC addresses denying address assignment. Rogue DHCP servers and scope tampering describe different attacks, not pool depletion.

WPA3 introduced SAE, a dragonfly-based handshake providing forward secrecy and resisting offline dictionary attacks that PSK's four-way handshake permitted. SAE replaces the pre-shared key exchange while remaining compatible with password-based authentication, satisfying the requirement for a PSK replacement.

VLANs logically separate network traffic at Layer 2, and ACLs on routers or Layer 3 switches can control traffic between VLANs. This creates distinct security zones and restricts lateral movement. If one VLAN is compromised, the attacker cannot freely access other VLANs without passing through the ACLs. This provides a strong segmentation strategy that meets the requirement. Therefore, VLAN segmentation with ACLs is the correct choice.

Placing a firewall between each zone enforces traffic filtering at every boundary, satisfying the segmentation requirement by preventing unrestricted lateral movement. Inter-zone traffic is inspected and permitted only per policy, containing breaches within a single zone.

A SYN flood exhausts the connection table with half-open handshakes, matching the observed symptom. SYN cookies remove that state by encoding the handshake in the sequence number, so the server no longer allocates resources before completion.

HTTPS wraps HTTP inside TLS, encrypting web traffic and authenticating the server, and by convention listens on TCP port 443. That combination delivers the confidentiality and integrity required for secure browsing over the specified port.

An evil twin is a rogue access point broadcasting the same SSID as the legitimate corporate network, often with a stronger signal, luring users into connecting so the attacker can intercept their traffic. This matches the stem's fake access point scenario exactly.

Command injection occurs when an application passes unsafe user input to a system shell, allowing an attacker to execute arbitrary commands on the host operating system. The scenario describes crafted requests causing unintended OS command execution, which is the definition of command injection. This vulnerability often arises when applications use functions like system() or exec() without proper input sanitization.

A SYN flood is a type of denial-of-service attack where an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive. The server allocates resources for each half-open connection, and when the attacker never completes the handshake, those resources are exhausted. The scenario describes many SYN packets from spoofed sources to one destination, which is characteristic of a SYN flood.

Tunnel mode encapsulates the entire original IP packet inside a new IPsec packet, encrypting the original header as required. This satisfies the stem's whole-packet encryption constraint, whereas transport mode encrypts only the payload and leaves the original IP header intact.

A fail-to-wire tap, also known as a bypass tap, has a relay that closes and directly connects the two network segments if the tap loses power. This ensures that network traffic continues to flow uninterrupted, maintaining connectivity. This directly meets the requirement that the tap must not disrupt network connectivity if it loses power, making it the correct choice.

A tap or SPAN port copies traffic to the NIDS passively, so monitoring introduces no inline latency or single point of failure. This satisfies the deployment constraint of inspecting traffic without disrupting production forwarding paths.

DHCP servers listen on UDP port 67 for client requests, while clients use port 68 to receive replies. This satisfies the stem's requirement for the server-side communication port, distinguishing the server's listening socket from the client's response socket.

Dynamic ARP Inspection (DAI) validates ARP packets on untrusted ports by comparing the IP-to-MAC binding against a trusted database, typically built by DHCP snooping. It drops ARP packets with invalid mappings, preventing ARP spoofing attacks. DAI is the specific feature designed to protect against ARP spoofing on Layer 2 switches, making it the correct choice for this scenario.

AH provides data integrity and authentication for IP packets, including protection against replay attacks by using a sequence number. It ensures that packets cannot be modified without detection. In this scenario, the requirement is specifically to prevent modification and replay, making AH the appropriate choice. However, AH does not provide confidentiality, so if encryption were also required, ESP would be needed.

Protected Management Frames become mandatory in WPA3, whereas WPA2 left them optional. This closes the deauthentication and disassociation forgery attacks that WPA2 networks remained exposed to, directly satisfying the scenario's requirement for a security improvement over WPA2-PSK.

WPA2 implements the 802.11i amendment, mandating AES-CCMP for confidentiality and integrity, replacing WPA's weaker TKIP. This satisfies the stem's requirement for a protocol using AES-CCMP and based on 802.11i, unlike WEP's RC4 or WPA's TKIP.

Separate VLANs provide Layer 2 isolation, ensuring broadcast traffic and direct frame-level communication cannot pass between the DMZ web servers and internal hosts. This satisfies the segmentation requirement by enforcing distinct logical network boundaries, with inter-VLAN routing then controlled by a firewall applying least-privilege rules.

WPA3 mandates Protected Management Frames, which authenticate and encrypt management frames so attackers cannot forge deauthentication or disassociation frames. WPA2 left these frames unprotected, enabling those denial-of-service and handshake-capture attacks. This mandatory PMF requirement is precisely the constraint the stem specifies.

Default-deny drops all inbound packets unless a rule explicitly permits them, so only HTTP, HTTPS and SMTP traffic reaches the internal network. This satisfies the requirement to block everything else, since any protocol without a matching allow rule is discarded at the perimeter.

IP defragmentation is the process of reassembling fragmented IP packets into complete packets before analysis. Attackers often use fragmentation to evade detection by splitting malicious payloads across multiple fragments. Enabling IP defragmentation on the NIDS allows it to reconstruct the original packet and inspect it for malicious content. This is essential for detecting fragmentation-based attacks, making it the correct choice.

DNS filtering intercepts name resolution requests and refuses to return addresses for domains on a threat intelligence blocklist. Because it operates at the resolution stage, it can prevent connections to malicious sites across all applications without installing a full firewall. This matches the consultant's recommendation and the small business constraint.

802.1X enforces port-based network access control, requiring a supplicant to authenticate via EAP through the switch to a RADIUS server before any traffic passes. Unauthorised devices fail authentication, so the port stays blocked, satisfying the switch-port-level requirement.

IPsec with IKEv2 provides strong encryption and authentication while being natively supported by Windows, macOS, iOS and Android VPN clients, so no third-party software is required. IKEv2 also reconnects quickly after network changes, suiting remote employees on unstable connections.

SFTP is a subsystem of SSH that operates over TCP port 22. It provides strong encryption and authentication for file transfers, protecting data in transit. It supports public key and password authentication and is widely used for secure file transfer. This matches the requirement to use TCP port 22 and ensures confidentiality and integrity.

Microsoft SQL Server listens on TCP port 1433 by default for client connections, satisfying the stem's request for the standard port. Named instances instead use dynamic ports via the SQL Server Browser service on UDP 1434, but a default instance answers on 1433 unless an administrator has reconfigured it.

Ephemeral Diffie-Hellman produces a unique session key for each connection, so capturing one session does not reveal past or future keys and replay of old handshake data fails. Combined with the hardware token's one-time values, this provides the forward secrecy and replay resistance the architect needs. This is the property that directly satisfies the requirement.

WEP's RC4 implementation uses a short, non-random 24-bit IV, and its reuse enables the FMS and PTW statistical attacks to recover the keystream and derive the WEP key. This directly exploits the absent IV randomness named in the stem, making WEP completely broken.

TLS 1.3 mandates ephemeral key exchange for all cipher suites, so forward secrecy is compulsory rather than optional. This prevents an attacker who later obtains the server's long-term private key from decrypting previously captured session traffic.

A WAF is specifically designed to inspect HTTP/HTTPS traffic and block attacks like SQL injection and cross-site scripting. It operates at the application layer and can enforce security policies based on request patterns. Deploying a WAF directly addresses the requirement to protect web servers from these common web application attacks, making it the correct choice.

DHCP starvation exhausts the server's address pool by flooding it with requests bearing spoofed MAC addresses, so each bogus request consumes a lease until no addresses remain for legitimate clients. This matches the stem's constraint exactly: pool exhaustion causing denial of service to genuine hosts.

NAC enforces admission control at the network edge, authenticating and assessing device posture before granting access. Non-compliant devices are dynamically assigned to a restricted VLAN, exactly matching the requirement that only corporate-managed devices reach the internal network.

HTTPS secures HTTP traffic by layering it over TLS, which encrypts the session between browser and web server. It listens on TCP port 443 by default, satisfying both constraints in the stem: the specified port and encrypted communication. Plain HTTP uses port 80 and offers no encryption.

Dynamic ARP Inspection intercepts ARP packets on untrusted switch ports and validates each against the DHCP snooping binding table, discarding forged replies that map an attacker's MAC to another host's IP. This directly satisfies the stem's requirement for a LAN-level defence, preventing the cache poisoning that enables man-in-the-middle interception.

SSL/TLS VPN tunnels traffic over port 443, so it traverses firewalls that block IPsec's ESP and IKE ports. Cisco AnyConnect is Cisco's SSL/TLS VPN client, satisfying the stem's requirement for a TLS-encrypted remote access protocol commonly paired with AnyConnect.

DHCP starvation floods the server with Discover messages using spoofed source MAC addresses, exhausting the available address pool. Legitimate clients then receive no offer, matching the observed high volume of Discover traffic from many different MAC addresses.

A dedicated guest VLAN creates a distinct Layer 2 broadcast domain, and ACLs on the router or firewall restrict that VLAN to internet-bound traffic only. Because guest frames never share a segment with corporate hosts and routing rules deny internal destinations, a compromised visitor device cannot reach internal servers. This directly matches the requirement while keeping employee traffic untouched.

A stateful firewall maintains a connection state table, tracking each session's source, destination and sequence so return packets for established connections are permitted automatically. This context-aware inspection satisfies the requirement, unlike stateless packet filtering, which evaluates each packet in isolation.

802.1X is a port-based network access control standard that uses RADIUS for authentication. It is a common NAC enforcement method, allowing or denying network access based on credentials and endpoint posture. When a device connects, the switch port remains unauthorized until authentication succeeds. This method is widely used in enterprise NAC deployments to enforce compliance and identity-based access.

802.1X is the IEEE standard for port-based network access control, authenticating a supplicant via EAP before the switch port grants access. It satisfies the requirement for wired port-based authentication, unlike MAC filtering or captive portals.

A WIPS monitors the wireless spectrum for unauthorized access points and can automatically contain them by sending deauthentication frames or alerting administrators. This directly mitigates the risk of a rogue AP capturing credentials by identifying and blocking it. It is a proactive measure that addresses the specific threat of rogue access points in the environment.

802.1X with EAP-TLS satisfies WPA2-Enterprise's requirement for per-user authentication against a RADIUS server, using mutual certificate validation rather than shared credentials. This defeats rogue access points and credential-capture attacks, since the client verifies the server's certificate and each session derives unique encryption keys.

ARP spoofing sends forged ARP replies that bind the attacker's MAC address to a legitimate host's IP, redirecting Layer 2 traffic through the attacker. This precisely matches the stem's man-in-the-middle mechanism, poisoning neighbours' ARP caches on the same subnet.

SSH provides an encrypted channel over TCP port 22 and includes SFTP and SCP for secure file transfer. Unlike FTPS, which uses TLS on different ports, SSH natively satisfies the port 22 and encryption requirements stated in the question.

A SYN flood exploits the TCP three-way handshake: the attacker sends numerous SYN packets, often with spoofed source addresses, so the server allocates resources and replies with SYN-ACK but never receives the final ACK. The absence of ACK or RST packets in the logs matches this half-open connection pattern.

DNS poisoning corrupts a resolver's cache with forged records, causing legitimate domain names to resolve to attacker-supplied IP addresses, satisfying the stem's symptom of incorrect addresses for valid domains. Spoofing intercepts a single response; poisoning persists in the cache for the record's TTL.

Dynamic ARP Inspection (DAI) validates ARP packets on untrusted ports by comparing the IP-to-MAC binding against a trusted database, such as the DHCP snooping binding table. It drops ARP packets with invalid bindings, preventing ARP spoofing attacks. This directly addresses the scenario where an attacker is sending forged ARP replies to impersonate the default gateway.

ARP spoofing involves an attacker sending forged ARP replies that bind one MAC address to multiple IP addresses, poisoning neighbours' ARP caches so traffic is redirected to the attacker. This matches the observed pattern of conflicting ARP mappings.

Network Access Control enforces endpoint compliance at connection time, quarantining or denying devices whose antivirus definitions or patches are missing or outdated. It is the only listed control that gates network admission on the device's current security posture.

EAP-TLS authenticates both client and server using X.509 certificates, delivering mutual authentication without shared secrets. This satisfies the stem's strong authentication requirement and, because the server proves its identity, resists man-in-the-middle attacks against the remote access tunnel.