CCNA Sscp Network Security Questions

WPA3 makes Protected Management Frames mandatory, whereas WPA2 left PMF optional. PMF cryptographically protects management frames such as deauthentication and disassociation, preventing forgery and denial-of-service attacks. This mandatory enforcement is a specific WPA3 security improvement over WPA2 that the stem asks you to identify.

WPA3-Enterprise adds an optional 192-bit cryptographic suite aligned with CNSA guidance, using stronger AES-GCM-256 and SHA-384 within EAP-TLS negotiations. This satisfies the stem's requirement for a genuinely new WPA3 feature, unlike WPA2's 128-bit-only Enterprise mode. Simultaneous Authentication of Equals and protected management frames are separate additions.

ARP spoofing poisons the victim's cache so the gateway's IP resolves to the attacker's MAC. A gateway ARP entry mapping to an unknown MAC therefore directly evidences cache poisoning, satisfying the man-in-the-middle indicator requirement in the stem.

SNMP traps are asynchronous notifications sent by agents to a manager, and they arrive on UDP port 162 rather than the polling port 161. This separation lets the manager listen for unsolicited alerts on 162 while still issuing requests to agents on 161, satisfying the stem's requirement for the trap-receiving port.

DNSSEC adds digital signatures to DNS records so a validating resolver can confirm that the data came from the authoritative zone and was not altered in transit. It directly addresses cache poisoning and record tampering by using a chain of trust from the root down to the zone. This matches the requirement for cryptographic validation of DNS responses.

DNSSEC adds digital signatures to DNS records, allowing a validating resolver to prove that a response genuinely came from the authoritative zone and was not altered in transit. This directly mitigates cache poisoning, because a forged or injected answer fails signature validation and is discarded rather than cached and served to internal clients. It does not by itself stop tunneling, but it is a core control for answer integrity.

Filtering inbound traffic to the management VLAN so that only the designated management host can reach the SSH service enforces exactly the stated requirement: the switch accepts remote CLI sessions only when they originate from the approved station. All other source addresses are dropped before they can reach the management plane, which also reduces the attack surface of the device itself.

DNS poisoning corrupts a resolver's cached records, substituting a malicious IP for the legitimate domain. Because the local resolver returns the forged entry, traffic is silently redirected to the attacker's server, matching the scenario's cache corruption and redirection.

Enlarging the SYN backlog queue lets the server hold more half-open connections before exhausting the table, absorbing bursts rather than dropping legitimate handshakes. It directly mitigates the stem's SYN flood constraint by raising the volume of pending requests the TCP stack tolerates.

SSL/TLS VPN tunnels over TCP 443, so it traverses existing firewall rules without opening extra ports, satisfying that constraint. It supports strong encryption and mutual authentication through client certificates, letting the organisation verify both user and server identities during the remote access session.

A ping sweep involves sending ICMP echo requests to multiple IP addresses to determine which hosts are active. This is a common reconnaissance technique used to map a network. The scenario describes ICMP echo requests from a single source to multiple destinations, which is characteristic of a ping sweep. Thus, it is the most likely attack.

DNS queries and responses use UDP port 53, whose connectionless datagram model avoids handshake overhead and suits the short request-response exchanges typical of name resolution. This satisfies the requirement for a fast transport matching DNS's small, self-contained message pattern.

WPA2-Enterprise implements IEEE 802.1X, which uses a supplicant on the client, an authenticator (the access point), and an authentication server (typically RADIUS). This allows for centralized authentication and per-user or per-device credentials, ensuring that only authorized devices can connect. It meets the requirement of using the three-party model and provides strong security for enterprise wireless networks.

A Smurf attack involves sending ICMP echo requests to a broadcast address with a spoofed source IP (the victim's IP). All hosts on the subnet respond to the victim, amplifying the traffic and causing a denial of service. This matches the scenario exactly.

Multi-factor authentication satisfies the auditor's requirement by adding a second verification factor beyond the password, defeating credential-stuffing and stolen-password attacks against the VPN gateway. Even if an attacker captures valid domain credentials, the missing second factor blocks authentication. Microsoft Entra ID Conditional Access can enforce MFA specifically for VPN sign-ins.

Egress filtering from the DMZ prevents a compromised host from freely reaching internal systems, so an attacker cannot pivot broadly. By allowing only the specific internal destinations and ports that the service legitimately needs, the administrator contains the blast radius. This is a core principle of DMZ design and directly limits lateral movement.

Firewalls enforce segmentation by inspecting traffic and permitting or denying flows between network zones according to rule sets, so sensitive-data segments stay isolated from untrusted areas. They satisfy the stem's requirement for an effective segmentation method by providing policy-based control at zone boundaries.

Disabling DTP prevents an attacker from negotiating a trunk on an access port, and moving unused ports out of the default VLAN removes a common double-tagging target. This preserves legitimate trunks on trusted links while closing the two main VLAN hopping vectors: switch spoofing and double tagging against the native VLAN.

The attacker sends ICMP echo requests with a spoofed source address to a network's broadcast address, so every host replies to the victim. This ICMP echo mechanism is the defining traffic characteristic of a Smurf attack.

A gratuitous ARP reply that binds the gateway's IP to the attacker's MAC is the defining signature of ARP spoofing, poisoning victims' ARP caches so traffic destined for the gateway is redirected to the attacker for interception or modification.

Port mirroring, often called Switched Port Analyzer (SPAN) on Cisco switches, copies frames from one or more source ports to a designated destination port where a monitoring device is connected. This allows the NIDS to see all traffic passing through the server port without disrupting network flow. It is the standard method for enabling intrusion detection on switched networks.

An application proxy firewall terminates and inspects traffic at Layer 7, examining HTTP request contents including URLs. This satisfies the requirement to inspect application-layer data and block malicious URLs, which packet-filtering firewalls cannot achieve since they only examine headers.

Extracting the PMKID from a single beacon frame enables offline brute-force or dictionary attacks against the WPA2 passphrase, without requiring a full four-way handshake capture or client interaction. This satisfies the scenario's constraint: deriving the network passphrase from minimal captured data.

SSH listens on TCP port 22 and encrypts the entire session, providing secure remote administration of network devices. Telnet offers similar administration but transmits credentials in cleartext on port 23, so SSH uniquely satisfies both the port and security constraints.

The primary security benefit of a DMZ is to isolate publicly accessible services from the internal network. If the web server is compromised, the attacker is contained within the DMZ and cannot directly access internal resources. Firewalls between the DMZ and internal network restrict traffic, adding a layer of defense. This segmentation limits the blast radius of a security breach.