How should I use these Network and Communications Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

SSCP · topic practice

Network and Communications Security practice questions

Q: Can I practise just Network and Communications Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network and Communications Security domain.

Practise Systems Security Certified Practitioner SSCP Network and Communications Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network and Communications Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Network and Communications Security

Network and Communications Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network and Communications Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network and Communications Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Network and Communications Security explanation →

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

Trap 1: Disconnect the server from the network.

Disconnecting may be necessary later, but first gather information to understand the threat.

Trap 2: Reboot the server to clear any malware.

Rebooting may destroy volatile evidence needed for forensic analysis.

Trap 3: Block the outbound traffic at the firewall.

Blocking without investigation may hide evidence and disrupt monitoring.

Study all Network and Communications Security common traps →

A
Disconnect the server from the network.
Why wrong: Disconnecting may be necessary later, but first gather information to understand the threat.
B
Reboot the server to clear any malware.
Why wrong: Rebooting may destroy volatile evidence needed for forensic analysis.
C
Check the server's running processes and established connections.
This provides immediate visibility into potential compromise without destroying evidence.
D
Block the outbound traffic at the firewall.
Why wrong: Blocking without investigation may hide evidence and disrupt monitoring.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full VPN explanation →

A network engineer is designing a secure WAN link between two offices using IPsec VPN. The company requires encryption of all traffic, authentication of both endpoints, and protection against replay attacks. Which combination of IPsec protocols and modes should be used?

Trap 1: AH in tunnel mode

AH provides authentication but no encryption, failing the encryption requirement.

Trap 2: AH in transport mode

AH lacks encryption and transport mode is inappropriate for site-to-site.

Trap 3: ESP in transport mode

Transport mode is for end-to-end communication, not for gateway-to-gateway VPNs.

Study all Network and Communications Security common traps →

A
AH in tunnel mode
Why wrong: AH provides authentication but no encryption, failing the encryption requirement.
B
AH in transport mode
Why wrong: AH lacks encryption and transport mode is inappropriate for site-to-site.
C
ESP in tunnel mode
ESP in tunnel mode encrypts and authenticates the entire packet, suitable for site-to-site VPNs.
D
ESP in transport mode
Why wrong: Transport mode is for end-to-end communication, not for gateway-to-gateway VPNs.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Network and Communications Security explanation →

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

Trap 1: Port security with sticky MAC

Port security limits MAC addresses but can be bypassed by spoofing.

Trap 2: MAC address filtering

MAC addresses can be spoofed, providing weak security.

Trap 3: VLAN segmentation

VLANs segment traffic but do not prevent unauthorized connection.

Study all Network and Communications Security common traps →

A
Port security with sticky MAC
Why wrong: Port security limits MAC addresses but can be bypassed by spoofing.
B
MAC address filtering
Why wrong: MAC addresses can be spoofed, providing weak security.
C
VLAN segmentation
Why wrong: VLANs segment traffic but do not prevent unauthorized connection.
D
IEEE 802.1X port-based authentication
802.1X authenticates devices at the port level before allowing network access.

Full breakdown with real-world context →

Question 4mediummultiple choice

Review the full subnetting walkthrough →

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

Trap 1: The default gateway on the internal hosts is incorrect.

If hosts can reach other internal resources, the gateway is likely correct.

Trap 2: DNS resolution is failing for the server name.

The user is accessing by IP, so DNS is not involved.

Trap 3: An ACL is blocking the destination IP.

The rule allows HTTP, so an ACL block is unlikely unless specifically configured.

Study all Network and Communications Security common traps →

A
The default gateway on the internal hosts is incorrect.
Why wrong: If hosts can reach other internal resources, the gateway is likely correct.
B
NAT is not configured for outbound traffic.
Internal private IPs must be translated to a public IP for internet access.
C
DNS resolution is failing for the server name.
Why wrong: The user is accessing by IP, so DNS is not involved.
D
An ACL is blocking the destination IP.
Why wrong: The rule allows HTTP, so an ACL block is unlikely unless specifically configured.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full wireless explanation →

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

Trap 1: WPA2-Enterprise with RADIUS

Legacy devices may not support 802.1X authentication.

Trap 2: WPA3-SAE only

Legacy devices do not support WPA3.

Trap 3: WPA2-PSK with TKIP

TKIP is deprecated and less secure than AES.

Study all Network and Communications Security common traps →

A
WPA2-Enterprise with RADIUS
Why wrong: Legacy devices may not support 802.1X authentication.
B
WPA2-PSK with AES (CCMP)
AES is the strongest encryption available for WPA2 and is supported by most devices.
C
WPA3-SAE only
Why wrong: Legacy devices do not support WPA3.
D
WPA2-PSK with TKIP
Why wrong: TKIP is deprecated and less secure than AES.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full DHCP explanation →

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

Trap 1: Dynamic ARP Inspection

DAI validates ARP packets, not DHCP messages.

Trap 2: Port security

Port security limits MAC addresses, not DHCP servers.

Trap 3: BPDU guard

BPDU guard protects against bridge loops, not DHCP.

Study all Network and Communications Security common traps →

A
DHCP snooping
DHCP snooping blocks unauthorized DHCP server responses.
B
Dynamic ARP Inspection
Why wrong: DAI validates ARP packets, not DHCP messages.
C
Port security
Why wrong: Port security limits MAC addresses, not DHCP servers.
D
BPDU guard
Why wrong: BPDU guard protects against bridge loops, not DHCP.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full VPN explanation →

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

Trap 1: Remote Desktop Gateway

RD Gateway is for RDP connections, not general VPN.

Trap 2: Host-to-host VPN

This is not a common VPN configuration for remote access.

Trap 3: Full tunnel VPN

Full tunnel sends all traffic through the VPN, not just corporate traffic.

Study all Network and Communications Security common traps →

A
Remote Desktop Gateway
Why wrong: RD Gateway is for RDP connections, not general VPN.
B
Split tunnel VPN
Split tunnel allows direct internet access while encrypting corporate-bound traffic.
C
Host-to-host VPN
Why wrong: This is not a common VPN configuration for remote access.
D
Full tunnel VPN
Why wrong: Full tunnel sends all traffic through the VPN, not just corporate traffic.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Network and Communications Security explanation →

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

Trap 1: To change the MAC address of the switch

The attack does not change switch MAC addresses.

Trap 2: To cause a denial of service on the network

While flooding may cause performance issues, the primary goal is traffic interception.

Trap 3: To bypass 802.1X authentication

MAC flooding does not bypass authentication mechanisms.

Study all Network and Communications Security common traps →

A
To change the MAC address of the switch
Why wrong: The attack does not change switch MAC addresses.
B
To cause a denial of service on the network
Why wrong: While flooding may cause performance issues, the primary goal is traffic interception.
C
To force the switch to act like a hub and allow packet sniffing
Filling the CAM table causes the switch to flood frames out all ports.
D
To bypass 802.1X authentication
Why wrong: MAC flooding does not bypass authentication mechanisms.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Network and Communications Security explanation →

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Trap 1: UDP port 80

Not a standard service.

Trap 2: UDP port 443

HTTPS uses TCP, not UDP.

Trap 3: TCP port 80

Port 80 is for HTTP, not HTTPS.

Study all Network and Communications Security common traps →

A
UDP port 80
Why wrong: Not a standard service.
B
UDP port 443
Why wrong: HTTPS uses TCP, not UDP.
C
TCP port 443
HTTPS uses TCP port 443 by default.
D
TCP port 80
Why wrong: Port 80 is for HTTP, not HTTPS.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Network and Communications Security explanation →

Which TWO of the following are functions of a network firewall?

Trap 1: Resolving domain names to IP addresses

DNS servers perform name resolution.

Trap 2: Encrypting data at rest

Encryption at rest is typically handled by storage systems, not firewalls.

Trap 3: Assigning IP addresses to hosts

DHCP servers assign IP addresses, not firewalls.

Study all Network and Communications Security common traps →

A
Resolving domain names to IP addresses
Why wrong: DNS servers perform name resolution.
B
Filtering traffic based on IP addresses and ports
Core function of a firewall.
C
Performing Network Address Translation (NAT)
Many firewalls include NAT functionality.
D
Encrypting data at rest
Why wrong: Encryption at rest is typically handled by storage systems, not firewalls.
E
Assigning IP addresses to hosts
Why wrong: DHCP servers assign IP addresses, not firewalls.

Full breakdown with real-world context →

Question 11mediummulti select

Read the full wireless explanation →

Which TWO of the following are best practices for securing a wireless network?

Trap 1: Enabling MAC address filtering

MAC filtering is easily bypassed by spoofing.

Trap 2: Using WEP encryption

WEP is easily broken and should not be used.

Trap 3: Leaving the default administrator password

Default passwords are a security risk.

Study all Network and Communications Security common traps →

A
Enabling MAC address filtering
Why wrong: MAC filtering is easily bypassed by spoofing.
B
Using WEP encryption
Why wrong: WEP is easily broken and should not be used.
C
Leaving the default administrator password
Why wrong: Default passwords are a security risk.
D
Using WPA2-Enterprise with 802.1X
Provides strong authentication and encryption.
E
Disabling SSID broadcast
Hides the network name from casual scans.

Full breakdown with real-world context →

Question 12hardmulti select

Read the full Network and Communications Security explanation →

Which THREE of the following are characteristics of a stateful firewall?

Trap 1: Operates only at the network layer (Layer 3)

Stateful firewalls operate at layers 3 and 4.

Trap 2: Performs deep packet inspection (DPI)

DPI is a feature of next-generation firewalls, not basic stateful.

Study all Network and Communications Security common traps →

A
Is generally slower than a stateless firewall
Stateful inspection requires more processing.
B
Maintains a state table of active connections
Stateful firewalls track connections to allow return traffic.
C
Can make decisions based on traffic patterns
Uses context from previous packets.
D
Operates only at the network layer (Layer 3)
Why wrong: Stateful firewalls operate at layers 3 and 4.
E
Performs deep packet inspection (DPI)
Why wrong: DPI is a feature of next-generation firewalls, not basic stateful.

Full breakdown with real-world context →

Question 13hardmulti select

Read the full Network and Communications Security explanation →

Which THREE of the following are common types of network attacks?

Trap 1: Pharming

Often considered an application-layer attack, though it manipulates DNS.

Trap 2: SQL injection

An application-layer attack on databases.

Study all Network and Communications Security common traps →

A
ARP spoofing
An attack on the local network to intercept traffic.
B
SYN flood
A network-layer DoS attack exploiting the TCP handshake.
C
Pharming
Why wrong: Often considered an application-layer attack, though it manipulates DNS.
D
DNS poisoning
Corrupts DNS cache to redirect traffic.
E
SQL injection
Why wrong: An application-layer attack on databases.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full Network and Communications Security explanation →

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky

Trap 1: The third device will be allowed to communicate because the phone's…

The phone's MAC is counted; the limit is 2, so the third is denied.

Trap 2: The port will be error-disabled.

Only 'shutdown' violation mode causes error-disable.

Trap 3: The port will remain up but all traffic will be dropped.

Only the third device's traffic is dropped, not all.

Study all Network and Communications Security common traps →

A
The third device will be allowed to communicate because the phone's MAC is not counted.
Why wrong: The phone's MAC is counted; the limit is 2, so the third is denied.
B
The third device's traffic will be dropped, and a syslog message will be generated.
'Restrict' drops excess traffic and logs the violation.
C
The port will be error-disabled.
Why wrong: Only 'shutdown' violation mode causes error-disable.
D
The port will remain up but all traffic will be dropped.
Why wrong: Only the third device's traffic is dropped, not all.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full network assurance explanation →

A security analyst reviews the syslog message from a router. What does this log entry indicate?

Exhibit

Refer to the exhibit.

syslog: %SEC-6-IPACCESSLOGP: list ACL_IN denied tcp 10.0.1.15(54321) -> 192.0.2.50(80), 1 packet

Trap 1: The router's ACL is misconfigured and is blocking all traffic.

Only one packet is logged; it may be a specific rule.

Trap 2: An external host attempted to access an internal web server and was…

The source is internal, destination external.

Trap 3: An internal host successfully accessed an external web server.

The log says 'denied', so access was blocked.

Study all Network and Communications Security common traps →

A
The router's ACL is misconfigured and is blocking all traffic.
Why wrong: Only one packet is logged; it may be a specific rule.
B
An external host attempted to access an internal web server and was blocked.
Why wrong: The source is internal, destination external.
C
An internal host attempted to access an external web server and was blocked.
The ACL denied the TCP connection to port 80.
D
An internal host successfully accessed an external web server.
Why wrong: The log says 'denied', so access was blocked.

Full breakdown with real-world context →

Question 16hardmultiple choice

Open the full VLAN trunking answer →

A medium-sized company with 200 employees has a single office with a flat network topology. Recently, the IT team noticed that network performance has degraded significantly during peak hours. A network analysis reveals excessive broadcast traffic and a high number of ARP requests. Additionally, the security team is concerned about the lack of segmentation, as a workstation infected with malware was able to spread rapidly to other systems. The company uses a single /24 subnet (192.168.1.0/24) and all devices are connected to a layer 2 switch. The IT manager wants to improve both performance and security without purchasing new hardware. The existing switch is a managed layer 2 switch that supports VLANs, but the router is a basic home-grade device that does not support VLAN routing. The company's internet connection is provided by a cable modem. What is the BEST course of action to address both performance and security concerns?

Trap 1: Divide the network into multiple subnets and connect each to a…

Cable modems typically provide only one public IP; not feasible.

Trap 2: Upgrade the router to a business-grade model that supports VLAN…

A flat network still has no segmentation, so malware can spread easily.

Trap 3: Replace the switch with a layer 3 switch to route between VLANs…

The prompt says no new hardware, but replacing the switch is new hardware.

Study all Network and Communications Security common traps →

A
Divide the network into multiple subnets and connect each to a separate port on the cable modem.
Why wrong: Cable modems typically provide only one public IP; not feasible.
B
Upgrade the router to a business-grade model that supports VLAN routing and keep the network flat.
Why wrong: A flat network still has no segmentation, so malware can spread easily.
C
Implement VLANs to separate departments and use a router-on-a-stick configuration with a capable router.
VLANs reduce broadcast traffic and contain threats; router-on-a-stick enables inter-VLAN routing.
D
Replace the switch with a layer 3 switch to route between VLANs without a router.
Why wrong: The prompt says no new hardware, but replacing the switch is new hardware.

Full breakdown with real-world context →

Question 17mediumdrag order

Read the full Network and Communications Security explanation →

Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps for implementing a patch management process into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediummatching

Read the full Network and Communications Security explanation →

Match each access control model to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Owner sets permissions

System-enforced labels

Roles determine access

Attributes and policies

Question 20mediummatching

Read the full Network and Communications Security explanation →

Match each vulnerability assessment tool to its use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Network scanning and port discovery

Vulnerability scanning

Exploitation framework

Packet analysis

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Network and Communications Security sessions

Start a Network and Communications Security only practice session

Every question in these sessions is drawn from the Network and Communications Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Network and Communications Security questions →Mixed SSCP session

Frequently asked questions

What does the SSCP exam test about Network and Communications Security?: Network and Communications Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Network and Communications Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Network and Communications Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SSCP topics?: Use the topic links above to move to related areas, or go back to the SSCP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SSCP exam covers. They are not copied from any real exam or dump site.

Network and Communications Security only

10 questions 20 questions 30 questions 50 questions

Mixed SSCP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SSCP questions Network and Communications Security domain overview SSCP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Network and Communications Security practice questions

What to know about Network and Communications Security

Common Network and Communications Security exam traps

Network and Communications Security questions

A security analyst notices unusual outbound traffic from a server in the DMZ to an external IP address on port 4444. The server runs a web application. Which action should the analyst take first?

A network engineer is designing a secure WAN link between two offices using IPsec VPN. The company requires encryption of all traffic, authentication of both endpoints, and protection against replay attacks. Which combination of IPsec protocols and modes should be used?

An organization wants to prevent unauthorized devices from connecting to its wired network. Which security control should be implemented?

A company's internal network uses a /24 subnet and has a single firewall connecting to the internet. Employees report that they cannot access an external web server at 203.0.113.50. The firewall has a rule that allows outbound HTTP. What is the most likely cause?

A security administrator is configuring a wireless network for a branch office. The office has legacy devices that only support WPA2-PSK. The administrator wants to provide the highest level of security while maintaining compatibility. Which configuration should be used?

A network technician needs to ensure that only authorized DHCP servers can assign IP addresses on the network. Which switch feature should be enabled?

A company is implementing a VPN for remote employees. The security policy requires that all traffic from the remote device to the corporate network be encrypted, but internet-bound traffic should go directly to the internet. Which VPN configuration should be used?

An organization detects that an attacker is performing a MAC flooding attack on a switch. What is the primary goal of this attack?

A network administrator is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which protocol and port should be allowed?

Which TWO of the following are functions of a network firewall?

Which TWO of the following are best practices for securing a wireless network?

Which THREE of the following are characteristics of a stateful firewall?

Which THREE of the following are common types of network attacks?

A network administrator configured the above port security on an access port connected to a VoIP phone and a PC. A third device is connected to the phone's passthrough port. What will happen when the third device attempts to communicate?

Exhibit

A security analyst reviews the syslog message from a router. What does this log entry indicate?

Exhibit

Drag and drop the steps for implementing mandatory access control (MAC) using security labels into the correct order.

Drag and drop the steps for implementing a patch management process into the correct order.

Match each access control model to its description.

Match each vulnerability assessment tool to its use.

Track your progress over time

Start a Network and Communications Security only practice session

Related SSCP topic practice pages

Risk Identification, Monitoring and Analysis practice questions