Network Security

427 questions

All types427 Multiple choice218 Multiple select95 Matching81 Ordering33

An enterprise network security team notices an unexpected influx of inbound UDP traffic targeted at the organization's public web server IP address. Packet captures reveal that the incoming traffic consists of large, unsolicited DNS response payloads originating from various external open resolver servers on UDP port 53. Further investigation indicates that the web server itself never initiated any corresponding DNS queries. Which of the following attack types and mechanisms is actively occurring?

A DNS amplification attack, where the adversary sends queries with a spoofed source IP address to open resolvers to reflect enlarged responses onto the target.

A DNS cache poisoning attack, where the adversary spoofs ARP replies on the target subnet to redirect legitimate DNS queries to a malicious resolver.

A TCP SYN flood attack, where the adversary uses DNS port 53 over connection-oriented TCP to overwhelm state tables on the perimeter firewall.

A DNS resource exhaustion attack, where malicious CNAME record queries flood the local authoritative server to exhaust its storage buffers.

Show answer & explanation

Answer: A DNS amplification attack, where the adversary sends queries with a spoofed source IP address to open resolvers to reflect enlarged responses onto the target.

Answer

A DNS amplification attack, where the adversary sends queries with a spoofed source IP address to open resolvers to reflect enlarged responses onto the target.

The correct answer accurately identifies a DNS amplification attack. In this attack vector, the threat actor sends DNS requests (often requesting ANY or TXT records via EDNS0 extension) to publicly accessible open DNS resolvers while spoofing the source IP address to match the target victim. Because UDP is connectionless, the resolvers send their large response packets directly to the victim, resulting in volumetric denial of service.

Step-by-Step Solution

Analyze the packet capture symptoms

Inbound traffic consists of unsolicited, large DNS response payloads on UDP port 53 from open resolvers sent to a web server that initiated no queries.

This behavior demonstrates reflection, as open resolvers are responding to queries they received, but sending the answers to the victim.

Identify the underlying mechanism

The attacker crafted DNS request packets using the victim's public IP address as the source IP address (IP spoofing) and requested large DNS record types.

Connectionless protocols like UDP allow IP spoofing without needing a TCP three-way handshake.

Determine the attack class

The combination of reflection via open resolvers and bandwidth amplification defines a DNS Amplification Attack.

Small query payloads yield disproportionately large response payloads sent to the victim, saturating network bandwidth.

Key Concept

DNS Amplification Attack Vector and IP Spoofing Reflection

Question 242Question →

A network security administrator is auditing packet captures of an IKEv2 remote access VPN connection. Place the stages of the IPsec IKEv2 session setup in the correct chronological order from initial connection attempt to payload data transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with negotiating cryptographic parameters and exchanging Diffie-Hellman values in cleartext (IKE_SA_INIT), followed by deriving keying material from the shared secret to encrypt the control channel, then exchanging authenticated identities securely (IKE_AUTH), and concluding with establishing the Child Security Association (IPsec SA) for user data traffic.

IKEv2 session establishment follows a strict sequence: first, the IKE_SA_INIT exchange establishes cryptographic algorithms and shares Diffie-Hellman keys in cleartext. Second, both sides calculate the shared secret to encrypt the control channel. Third, the IKE_AUTH exchange transmits encrypted identity and credential information. Finally, Child SAs are negotiated to encrypt actual user data traffic.

Step-by-Step Solution

Identify the initial unencrypted parameters exchange stage

The endpoints execute the IKE_SA_INIT exchange to agree on algorithms and share public Diffie-Hellman values.

Cryptographic material must be exchanged first so that a secure channel can be derived before sensitive identities are shared.

Determine control plane key derivation

Both peers compute the Diffie-Hellman shared secret and generate symmetric encryption keys.

Symmetric key derivation is required to activate encryption and integrity checks on all subsequent control messages.

Identify peer identity authentication stage

The endpoints send encrypted authentication payloads during the IKE_AUTH phase.

Authenticating within the encrypted channel prevents eavesdroppers from harvesting username/certificate identity information.

Identify user payload tunnel establishment stage

The peers finalize Child SA creation and define traffic selectors for ESP encapsulation.

Child SAs define the specific security parameters used to protect end-user application data passing through the tunnel.

Key Concept

IKEv2 IPsec VPN Tunnel Negotiation Sequence

Question 243Question →

A principal network security architect is evaluating the control and management plane hardening profile for a cluster of core Layer 3 switches deployed in a zero-trust enterprise architecture. To comprehensively secure management communications against eavesdropping and protect inter-switch trunk connections from unauthorized traffic manipulation and VLAN exploitation, which of the following configuration practices must be implemented? (Select TWO.)

Select all that apply

Enforce SNMPv3 using the authPriv security level configured with SHA-based authentication and AES payload encryption, paired with restrictive infrastructure management ACLs.

Deploy SNMPv2c using randomized community strings while depending on edge firewall rules to block UDP port 161 traffic at the perimeter.

Reassign the 802.1Q native VLAN on all inter-switch trunk links from default VLAN 1 to an unused, dedicated non-default VLAN ID that carries no user or management traffic.

Retain default VLAN 1 as the native VLAN across all trunks while disabling 802.1Q tagging on management interfaces to lower control-plane CPU overhead.

Enable Telnet on TCP port 23 alongside SSH on TCP port 22 to serve as an unencrypted secondary fallback access method during public-key authentication failures.

Show answer & explanation

Answer: Enforce SNMPv3 using the authPriv security level configured with SHA-based authentication and AES payload encryption, paired with restrictive infrastructure management ACLs.; Reassign the 802.1Q native VLAN on all inter-switch trunk links from default VLAN 1 to an unused, dedicated non-default VLAN ID that carries no user or management traffic.

Answer

The validated hardening controls require enforcing SNMPv3 with authPriv (SHA/AES) protected by access control lists, and reassigning the 802.1Q native VLAN on trunk ports away from default VLAN 1 to a dedicated, unused non-default VLAN.

Hardening switch infrastructure requires securing both management access protocols and Layer 2 trunking behaviors. Utilizing SNMPv3 at the authPriv security level ensures SHA authentication hashing and AES symmetric encryption for management communications. Simultaneously, reassigning the 802.1Q native VLAN from default VLAN 1 to an isolated, unused VLAN ID stops un-tagged frame leakage and mitigates VLAN hopping attacks.

Step-by-Step Solution

Analyze management plane security requirements

Identified that cleartext management protocols (SNMPv2c, Telnet) expose credentials and monitoring data to eavesdropping.

SNMPv3 with authPriv is the only SNMP standard providing full cryptographic integrity, authentication, and payload confidentiality.

Analyze Layer 2 infrastructure security requirements

Identified that default native VLAN 1 on 802.1Q trunks enables attack vectors like VLAN hopping and double-tagging.

Configuring an unused non-default VLAN as native neutralizes un-tagged frame injection and VLAN hopping vulnerabilities.

Validate complete baseline solution

Selected the combination of encrypted SNMPv3 authPriv management and non-default native VLAN trunk isolation.

Both measures directly harden the control/management plane against active and passive network threats.

Key Concept

Management Plane Hardening & Trunk Isolation

Question 244Question →

During a routine audit, a system administrator discovers that an internal API service running on a web server had its configuration settings modified without authorization. While the service remained continuously reachable and no sensitive customer records were exposed or viewed by unauthorized parties, the altered configuration caused transaction logs to record invalid data. Which principle of the CIA triad was directly compromised in this scenario, and which security mechanism specifically protects against this type of breach?

Integrity; protected by enforcing strict file access control lists and cryptographic hashing to detect and prevent unauthorized data alterations.

Availability; protected by implementing redundant load balancing across multiple active server nodes.

Confidentiality; protected by enforcing Transport Layer Security (TLS) payload encryption over TCP connection channels.

Authentication; protected by switching remote management traffic from RADIUS to TACACS+ for network hardware devices.

Show answer & explanation

Answer: Integrity; protected by enforcing strict file access control lists and cryptographic hashing to detect and prevent unauthorized data alterations.

Answer

Integrity was compromised, which is best protected by enforcing file access control lists and cryptographic hashing to prevent unauthorized alterations.

Integrity is the core security concept dedicated to ensuring data, configurations, and system resources remain unmodified and accurate unless explicitly changed by authorized users. Enforcing strict file permissions and verifying checksums or cryptographic hashes ensures files cannot be secretly altered.

Step-by-Step Solution

Analyze the impact on system attributes based on the scenario metrics.

The service remained reachable (Availability intact) and data was not exposed to unauthorized viewers (Confidentiality intact), but service configuration and logs were altered without authorization.

Identifying which security boundary was crossed requires analyzing what stayed secure versus what was impacted.

Map the specific impact to the CIA triad pillars.

Unauthorized modification of data or settings directly violates Integrity.

Integrity guarantees that data has not been altered, tampered with, or corrupted by unauthorized entities.

Select the security control that directly preserves integrity.

Access control lists combined with cryptographic hashing maintain data integrity and detect unauthorized changes.

Hashing validates data consistency and file access permissions prevent unauthorized write operations.

Key Concept

CIA Triad Principles & Integrity Controls

Estimated Time:1m 15s

Question 245Question →

A network technician is preparing to deploy a new switch into a production environment. Which TWO of the following security configuration steps represent essential device hardening best practices for securing administrative management access? (Select TWO.)

Select all that apply

Disable Telnet and mandate the use of SSH version 2 for remote command-line administrative sessions

Use unencrypted HTTP for the web interface to minimize processing overhead on the switch CPU

Change default administrative credentials and implement strong password policies

Enable SNMPv1 with default community strings to simplify remote system monitoring

Assign all unused physical switch ports to the active native VLAN to simplify network provisioning

Show answer & explanation

Answer: Disable Telnet and mandate the use of SSH version 2 for remote command-line administrative sessions; Change default administrative credentials and implement strong password policies

Answer

Disabling cleartext protocols like Telnet in favor of SSH version 2 and replacing default administrative login credentials with strong passwords are primary network device hardening controls.

Device hardening on network equipment prioritizes securing administrative access. Disabling Telnet in favor of SSH version 2 ensures management commands and credentials are cryptographically encrypted. Changing default administrative usernames and establishing complex passwords prevents unauthorized users from easily guessing factory default login parameters.

Step-by-Step Solution

Identify insecure management protocols

Recognize that cleartext management protocols (such as Telnet, HTTP, and SNMPv1) expose management traffic to interception and must be replaced with encrypted equivalents.

Securing the management plane requires encryption of credentials and administrative commands in transit.

Identify authentication hardening requirements

Recognize that default accounts and credentials must be updated immediately upon switch deployment.

Default credentials are widely documented and represent a severe security vulnerability if left unchanged.

Key Concept

Network Device Hardening Best Practices

Question 246Question →

A network security administrator is establishing data protection policies for automated router configuration backups stored on a remote server. Which TWO of the following technical controls directly safeguard the Integrity pillar of the CIA triad for these backup files?

Select all that apply

Calculating SHA-256 cryptographic checksums for each configuration backup immediately after creation and verifying them prior to restoration

Applying digital signatures to backup file manifests using an enterprise public key infrastructure (PKI)

Encrypting the backup files at rest using AES-256 bit symmetric block ciphers

Transmitting backup files across the network using SSH/SFTP on TCP port 22

Show answer & explanation

Answer: Calculating SHA-256 cryptographic checksums for each configuration backup immediately after creation and verifying them prior to restoration; Applying digital signatures to backup file manifests using an enterprise public key infrastructure (PKI)

Answer

Calculating SHA-256 checksums and applying digital signatures to backup manifests directly safeguard the Integrity pillar of the CIA triad.

Integrity guarantees that data remains authentic, accurate, and safeguard against unauthorized modification. Calculating SHA-256 checksums allows administrators to verify that a backup file has not been corrupted or altered prior to applying it to network equipment. Digital signatures combine asymmetric cryptography with hashing to guarantee both file integrity and origin non-repudiation.

Step-by-Step Solution

Identify the core requirement of the CIA triad pillar in question.

The target pillar is Integrity, which focuses on preventing unauthorized modification or corruption of data.

Security controls must be categorized according to whether they preserve confidentiality, integrity, or availability.

Evaluate checksums and digital signatures.

SHA-256 hashing and digital signatures provide tamper detection and mathematical proof of unchanged contents.

Both techniques produce verifiable values that change upon any alteration of the underlying file.

Evaluate encryption methods.

AES-256 disk encryption and SFTP transport encryption protect data confidentiality by preventing unauthorized disclosure.

Confusing confidentiality mechanisms (encryption) with integrity mechanisms (hashing/signatures) is a common misconception.

Key Concept

CIA Triad - Integrity Controls vs. Confidentiality Controls

Question 247Question →

A network security team is designing physical and environmental security controls for a new high-security cryptographic key server enclosure located inside a multi-tenant facility. The facility audit identified two primary vulnerability vectors: potential physical access through shared drop-ceiling spaces into the server enclosure, and risk of electromagnetic eavesdropping (TEMPEST risks) on unshielded cryptographic hardware. Additionally, localized water pipe leakage under the raised floor must be detected immediately without placing electrical components at risk of direct contact with conductive standing water. Which of the following physical and environmental measures should the network security engineer implement to directly mitigate these identified risks? (Select TWO.)

Select all that apply

Extend structural walls slab-to-slab from the true floor to the structural ceiling and enclose the server room with a Faraday cage.

Install a non-conductive zone-based liquid leak detection sensing cable beneath the raised flooring tied to the environmental monitoring system.

Deploy a high-volume wet-pipe sprinkler system directly above the server racks set to actuate immediately upon localized temperature elevation.

Configure single-hinged entry doors with interior request-to-exit infrared sensors to allow rapid egress without access log registration.

Lower relative humidity to under 15% across all server bays to eliminate condensation accumulation near sensitive busbars.

Show answer & explanation

Answer: Extend structural walls slab-to-slab from the true floor to the structural ceiling and enclose the server room with a Faraday cage.; Install a non-conductive zone-based liquid leak detection sensing cable beneath the raised flooring tied to the environmental monitoring system.

Answer

The network security engineer should extend structural walls slab-to-slab with a Faraday cage enclosure and deploy non-conductive liquid leak detection sensing cables beneath the raised flooring.

Building walls slab-to-slab (from concrete subfloor to the structural deck above) eliminates the perimeter security gap created by false drop ceilings. Implementing a Faraday cage blocks electromagnetic emissions (TEMPEST) from leaking outside the secured area. Furthermore, non-conductive liquid detection cables beneath raised floor tiles provide early warning of fluid accumulation before water damages electrical infrastructure.

Step-by-Step Solution

Analyze perimeter breach and RF leakage threats

Standard drop ceilings allow intruders to climb over partial walls. RF emissions allow interception of cryptographic operations.

Slab-to-slab wall construction eliminates overhead entry pathways, and a Faraday cage blocks electromagnetic signal emissions.

Evaluate sub-floor environmental moisture risks

Water pipe leaks under raised floors threaten electrical supply feeds and low-lying cabling.

Liquid sensing cables placed under raised floor tiles detect moisture presence immediately and alert monitoring systems prior to equipment contact.

Key Concept

Physical Perimeter Hardening, RF Shielding, and Environmental Leak Detection

Question 248Question →

A network facility security officer is auditing physical defense mechanisms and environmental protection systems across an enterprise data center. Match each physical security or environmental vulnerability scenario on the left with the corresponding technical control on the right that provides appropriate mitigation.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Electromagnetic eavesdropping matches with Faraday cage / RF shielding enclosure; thermal shock and equipment destruction from fire matches with Clean-agent gaseous fire suppression system; single-corded power failure matches with Rack-mounted Automatic Transfer Switch (ATS); and undetected sub-floor fluid accumulation matches with Conductive liquid-detection sensing cable array.

Each risk factor requires a targeted physical or environmental control: RF shielding blocks electromagnetic leakage; clean-agent gases put out electrical fires cleanly; automatic transfer switches grant dual-feed resilience to single-corded network hardware; and liquid-detection cables spot hidden sub-floor leaks.

Step-by-Step Solution

Analyze the electromagnetic emissions scenario.

Identified electromagnetic leakage outside building boundaries as an RF security threat (TEMPEST).

Faraday cages and metallic mesh/enclosures block electromagnetic signals and RF propagation.

Analyze fire protection requirements for energized electronics.

Determined that water sprinklers cause shorts and chemical powders damage equipment.

Clean-agent gaseous systems extinguish fires without liquid residue or electrical conductivity.

Evaluate power redundancy for single-corded hardware.

Selected a mechanism that allows legacy single-cord hardware to connect to dual utility feeds.

Rack-mounted ATS units draw from dual circuits and rapidly switch feeds if primary power fails.

Identify early warning systems for fluid leaks under raised floors.

Selected sub-floor moisture sensing arrays.

Conductive sensing cables placed under raised floors detect localized moisture immediately upon contact.

Key Concept

Physical and Environmental Controls Integration

Question 249Question →

An infrastructure manager is auditing the environmental and life-safety controls of a newly built core network distribution facility. The server room relies on a total-flooding clean-agent gaseous fire suppression system to protect high-density switches and fiber interconnects. During a simulated system test, concern is raised regarding structural room integrity and agent containment when the high-pressure gas discharges. Which HVAC and airflow control procedure must be implemented upon fire suppression activation to ensure maximum suppression effectiveness while preventing structural damage?

Automatically actuate motorized dampers to seal HVAC supply and return ducts while opening dedicated pressure relief vents to manage displacement pressure.

Maintain full capacity operation of the primary HVAC exhaust fans to extract combustion smoke while the clean agent dissipates.

Switch the HVAC system into a high-volume negative pressure mode to draw surrounding ambient air into the room during discharge.

Engage auxiliary wet-pipe sprinkler heads simultaneously to cool room boundaries and absorb the expanding gaseous agent.

Show answer & explanation

Answer: Automatically actuate motorized dampers to seal HVAC supply and return ducts while opening dedicated pressure relief vents to manage displacement pressure.

Answer

Automatically actuate motorized dampers to seal HVAC supply and return ducts while opening dedicated pressure relief vents to manage displacement pressure.

Clean-agent gaseous fire suppression systems function by rapidly discharging gas into an enclosed space to achieve a specific chemical concentration. Automatically closing HVAC supply and return dampers prevents the agent from diluting or escaping into neighboring zones. Concurrently, opening dedicated pressure relief vents dissipates the sudden rise in room pressure during discharge, safeguarding the structural integrity of walls and ceiling enclosures.

Step-by-Step Solution

Analyze total-flooding clean-agent fire suppression operational requirements.

Gaseous agents (such as FM-200 or Novec 1230) require an enclosed room to maintain minimum design concentration for suppressing fire without oxygen depletion or equipment corrosion.

Air leakage through open ductwork dilutes the suppression agent.

Evaluate pressure dynamics during rapid gas discharge.

Discharging high-pressure gaseous agents within seconds creates a positive pressure wave that can damage drywalls, ceiling tiles, and doors if unvented.

Pressure relief vents calibrated for over-pressure release protect room integrity without permitting continuous ambient airflow.

Determine correct HVAC damper and vent control sequence.

Motorized fire/smoke dampers on main HVAC ducts must instantly close upon discharge signal, while dedicated pressure relief vents open temporarily to release peak pressure.

This sequence ensures structural safety while keeping suppression agent concentration contained.

Key Concept

Clean-Agent Fire Suppression and Environmental HVAC Interlocks

Estimated Time:2m 0s

Question 250Question →

An organization needs to grant remote workers secure access to corporate web applications from unmanaged personal devices. Corporate policy prohibits installing dedicated VPN software or administrative agents on these personal endpoints while requiring full encryption for all remote web traffic. Which protocol and transport layer configuration must be permitted on the perimeter firewall to support this clientless remote access design?

SSL/TLS operating over TCP port 443

L2TP operating over TCP port 1701

IPsec IKE operating over TCP port 500

GRE encapsulation operating over UDP port 47

Show answer & explanation

Answer: SSL/TLS operating over TCP port 443

Answer

SSL/TLS operating over TCP port 443 is the correct choice because clientless SSL VPN portals leverage standard web browsers using HTTPS without requiring endpoint client installation.

Clientless SSL/TLS VPN portals permit users to establish encrypted remote sessions to internal web applications directly through a standard web browser. Because web browsers natively handle TLS encryption over TCP port 443, no client software installation is required on the user's personal device.

Step-by-Step Solution

Analyze the endpoint restriction requirements

Unmanaged personal endpoints cannot have third-party VPN client software installed.

The requirement specifies a clientless solution for remote web application access.

Identify the protocol compatible with clientless browser access

SSL/TLS (HTTPS) provides secure browser-based portal sessions.

Standard web browsers natively support SSL/TLS encryption without additional software.

Determine the transport protocol and port number

SSL/TLS for web traffic operates over TCP port 443.

Perimeter firewalls must allow TCP port 443 for HTTPS/SSL VPN portal traffic.

Key Concept

Clientless SSL/TLS Remote Access VPN

Question 251Question →

A network security administrator is configuring centralized access control for managing enterprise switch and router CLI sessions. The security policy mandates two key capabilities: full packet payload encryption for all authorization traffic, and granular per-command authorization for administrative roles. Which of the following operational characteristics of TACACS+ satisfy these requirements when compared to RADIUS? (Select TWO.)

Select all that apply

TACACS+ encrypts the entire body of the packet, whereas RADIUS encrypts only the password field.

TACACS+ separates authentication, authorization, and accounting into distinct functions, enabling individual command authorization.

TACACS+ uses UDP transport to minimize session establishment overhead compared to RADIUS TCP connections.

TACACS+ combines authentication and authorization into a single protocol exchange to streamline server processing.

Show answer & explanation

Answer: TACACS+ encrypts the entire body of the packet, whereas RADIUS encrypts only the password field.; TACACS+ separates authentication, authorization, and accounting into distinct functions, enabling individual command authorization.

Answer

TACACS+ encrypts the entire body of the packet, whereas RADIUS encrypts only the password field, and TACACS+ separates authentication, authorization, and accounting into distinct functions, enabling individual command authorization.

TACACS+ encrypts the entire packet payload following its standard header and decouples the AAA pillars into independent services. Decoupling authentication from authorization allows TACACS+ to perform real-time, per-command authorization checks for administrative CLI sessions.

Step-by-Step Solution

Evaluate the encryption boundary of each protocol.

TACACS+ encrypts the entire packet body following the header, whereas RADIUS encrypts only the user password field within Access-Request packets.

Protecting management commands and authorization responses across the network requires full payload encryption.

Evaluate how AAA functions are handled.

TACACS+ separates AAA into independent services, allowing the network access server to validate each command executed by an administrator against the AAA server.

RADIUS binds authentication and authorization together, which prevents granular per-command restriction during an established session.

Key Concept

AAA Framework protocol characteristics (TACACS+ vs RADIUS)

Question 252Question →

A network security administrator is transitioning a segment from a stateful firewall to a router utilizing stateless extended IPv4 Access Control Lists (ACLs). The administrator configures an inbound ACL on the interface connecting internal monitoring workstations ( $172.16.10.0/24$ ) to allow diagnostic queries to a remote Syslog server ( $10.20.30.50$ ) using UDP port $514$ . After applying the ACL, technicians report that while outbound query packets are sent successfully, return diagnostic responses from the Syslog server are blocked. Which statement accurately explains why this communication failure occurs?

Stateless ACLs inspect packets individually without maintaining session state tables, meaning return traffic from the Syslog server is blocked unless explicitly permitted by a return ACL rule.

The inbound ACL rule allows the request, but the implicit deny at the end of the ACL automatically drops UDP packets because they lack an ESTABLISHED flag.

Extended IPv4 ACLs operate strictly at Layer 2 of the OSI model, making them incapable of inspecting Layer 4 transport protocol fields like UDP port numbers.

The configured ACL rule specifies port 514, but standard Syslog services operate exclusively over TCP port 22, resulting in a port mismatch that drops the traffic.

Show answer & explanation

Answer: Stateless ACLs inspect packets individually without maintaining session state tables, meaning return traffic from the Syslog server is blocked unless explicitly permitted by a return ACL rule.

Answer

Stateless ACLs inspect packets individually without maintaining session state tables, meaning return traffic from the Syslog server is blocked unless explicitly permitted by a return ACL rule.

Stateful firewalls maintain connection tracking tables that dynamically permit return traffic associated with established sessions. In contrast, stateless router ACLs evaluate every packet independently. When replacing a stateful firewall with stateless ACLs, an explicit rule must be created to allow response packets traveling in the reverse direction, as they will otherwise be blocked by the implicit deny statement.

Step-by-Step Solution

Differentiate between stateful firewall operation and stateless ACL processing.

Stateful firewalls track connection states (e.g., TCP handshakes, active UDP pseudo-sessions) in a state table, automatically allowing reverse return flows for permitted outbound connections. Stateless ACLs process every packet independently against configured rules without context of prior packets.

Understanding the fundamental operational difference between stateful firewalls and stateless router ACLs is essential for network access troubleshooting.

Analyze the directional packet flow for UDP communication.

Outbound packet flow: Source

172.16.10.0/24 \rightarrow

Destination

10.20.30.50:514

(Permitted by inbound ACL).
Return packet flow: Source

10.20.30.50:514 \rightarrow

Destination

172.16.10.0/24

(No explicit permit rule; hit by implicit deny).

Because UDP is connectionless and the ACL is stateless, return packets are evaluated independently against the interface rules.

Identify the required configuration modification to restore bi-directional communication.

An explicit return rule must be configured on the appropriate interface to permit traffic originating from

10.20.30.50

with source UDP port

514

back to the

172.16.10.0/24

subnet.

Without a state table or an explicit return permit rule, return packets encounter the implicit deny all statement at the end of the stateless ACL.

Key Concept

Stateful Firewalls vs. Stateless Access Control Lists (ACLs)

Estimated Time:2m 0s

Question 253Question →

An organization deploys a client-based IPsec VPN solution for remote system administrators. During initial deployment testing, users connecting from home networks behind Network Address Translation (NAT) devices experience immediate packet drops when using IPsec with Authentication Header (AH). However, changing the VPN configuration to use Encapsulating Security Payload (ESP) resolves the issue and allows full connectivity. Which of the following best explains why the AH configuration failed in this scenario?

Authentication Header includes the outer IP header in its Integrity Check Value calculation, causing cryptographic validation failure when NAT modifies the IP address.

Authentication Header relies exclusively on TCP port 500 for key negotiation, which cannot be translated by PAT routers that only perform UDP port mapping.

Authentication Header encapsulates data at OSI Layer 2, preventing it from being routed across Layer 3 public network boundaries without GRE.

Authentication Header encrypts authentication credentials using TACACS+ headers, which PAT gateways rewrite and corrupt during IP address overload translation.

Show answer & explanation

Answer: Authentication Header includes the outer IP header in its Integrity Check Value calculation, causing cryptographic validation failure when NAT modifies the IP address.

Answer

Authentication Header (AH) includes the outer IP header in its ICV integrity calculation, causing packet drops when a NAT router modifies the source/destination IP address.

The correct answer identifies that IPsec Authentication Header (AH) includes the outer IP header in its integrity hash calculation. When a NAT router translates the IP address, the header modification invalidates the cryptographic checksum, causing the recipient IPsec endpoint to drop the packet. Switching to Encapsulating Security Payload (ESP) avoids this because ESP does not include the outer IP header in its ICV.

Step-by-Step Solution

Analyze the functional difference between IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP).

AH provides integrity and authentication for the entire IP packet (including outer IP headers), whereas ESP provides confidentiality and integrity primarily for the payload.

Understanding which packet header fields are covered by cryptographic integrity checks is necessary to evaluate NAT compatibility.

Evaluate the effect of Network Address Translation (NAT) on IP headers.

NAT alters IP header fields by modifying the source or destination IP addresses.

Routers performing NAT must mutate packet headers to route traffic between private and public IP address spaces.

Correlate NAT modifications with AH integrity verification.

Because AH calculates its Integrity Check Value (ICV) over immutable and mutable IP header fields, changing the IP address breaks the ICV validation at the receiving gateway.

The receiver recalculates the ICV upon arrival; since NAT changed the header, the calculated hash does not match the transmitted hash, leading to dropped packets unless ESP with NAT-Traversal (NAT-T) is utilized.

Key Concept

IPsec AH vs ESP NAT Incompatibility

Question 254Question →

A network security engineer is performing a physical security audit of a high-density transaction processing facility. The audit reveals three distinct vulnerabilities: confidential packet data is leaking via unintended electromagnetic emissions from server chassis, unauthorized employees are frequently tailgating through access doors during shift changes, and intruders could potentially bypass door access controls by crawling through the hollow space above the suspended drop ceiling. Which of the following combinations of physical security measures directly mitigates all three identified vulnerabilities?

Erecting slab-to-slab barrier walls extending from the true floor to the structural ceiling, deploying an anti-tailgating man-trap with interlocking doors, and housing sensitive server clusters within a Faraday enclosure.

Installing clean-agent gaseous fire suppression systems, deploying motion-detecting CCTV cameras, and configuring anti-passback rules on the electronic badge reader system.

Deploying biometric authentication readers at main entrances, grounding all server racks with ESD grounding straps, and installing locks on plenum air handling units.

Installing environmental monitoring sensors for humidity control, configuring 802.1X port authentication on access switches, and setting up tamper-evident cable conduits.

Show answer & explanation

Answer: Erecting slab-to-slab barrier walls extending from the true floor to the structural ceiling, deploying an anti-tailgating man-trap with interlocking doors, and housing sensitive server clusters within a Faraday enclosure.

Answer

The solution prescribing slab-to-slab walls, an anti-tailgating man-trap, and a Faraday enclosure directly mitigates all three security vulnerabilities. Slab-to-slab walls extend past suspended drop ceilings up to the solid structural deck, preventing intruders from climbing over locked access doors. A man-trap uses interlocking doors to physically enforce one-person entry, eliminating tailgating during high-traffic shift changes. A Faraday enclosure blocks electromagnetic emissions from radiating outside the server room, neutralizing eavesdropping risks.

Step-by-Step Solution

Analyze Vulnerability 1 (Electromagnetic Data Leakage)

Identified the need for electromagnetic shielding (Faraday enclosure or TEMPEST shielding) to block unintended RF emissions from active computing hardware.

Unshielded high-speed data buses and network hardware radiate electromagnetic signals that can be captured externally by specialized eavesdropping gear.

Analyze Vulnerability 2 (Tailgating during shift changes)

Identified the requirement for a man-trap (security vestibule) equipped with presence sensors and interlocking doors.

Standard single-door access points allow unauthorized individuals to follow authorized personnel during a door unlock cycle, whereas man-traps physically restrict access to one validated person at a time.

Analyze Vulnerability 3 (Drop-ceiling interstitial intrusion)

Identified the need for slab-to-slab physical partition walls extending from the structural subfloor to the upper concrete ceiling slab.

Suspended drop ceilings leave open plenum space above interior walls, allowing intruders to climb over locked doors unless true structural barrier walls are installed.

Synthesize Physical Safeguards

Selected the combination featuring slab-to-slab walls, anti-tailgating man-traps, and Faraday enclosures.

This specific combination provides target-specific physical and environmental countermeasures for all three audited vulnerabilities.

Key Concept

Physical Access Controls, Perimeter Security Barriers, and RF/EM Shielding

Estimated Time:2m 0s

Question 255Question →

During a security assessment of an enterprise LAN segment, a network technician observes that host traffic intended for the default gateway at IP address $192.168.10.1$ is being redirected through an unauthorized laptop at $192.168.10.88$ . Packet inspection reveals that host machines are continuously receiving unsolicited frame updates mapping $192.168.10.1$ to MAC address `00:11:22:AA:BB:CC`, which belongs to the laptop. Which network attack type is taking place, and what is its primary vector?

ARP poisoning, which exploits the lack of authentication in ARP responses to update host ARP caches with forged IP-to-MAC address mappings.

DNS spoofing, which corrupts local domain resolution caches to map the gateway domain name to an incorrect IP address.

MAC flooding, which targets switch CAM tables over TCP port 80 to force switch interfaces into a fail-open broadcast hub state.

DNS amplification, which leverages misconfigured recursive CNAME records to reflect magnified response traffic back to the gateway IP address.

Show answer & explanation

Answer: ARP poisoning, which exploits the lack of authentication in ARP responses to update host ARP caches with forged IP-to-MAC address mappings.

Answer

ARP poisoning, which exploits the lack of authentication in ARP responses to update host ARP caches with forged IP-to-MAC address mappings.

The correct answer identifies ARP poisoning. ARP is a stateless Layer 2 protocol that maps IPv4 addresses to MAC addresses. Because ARP lacks authentication, hosts accept unsolicited ARP responses, allowing an attacker to broadcast forged ARP replies that associate their own MAC address with the IP address of the legitimate default gateway.

Step-by-Step Solution

Analyze the observed network symptom

Unsolicited frames map default gateway IP

192.168.10.1

to an unauthorized host's MAC address `00:11:22:AA:BB:CC`.

This indicates targeted Layer 2 address cache tampering rather than domain name resolution or volumetric flooding.

Identify the protocol and vulnerability involved

Address Resolution Protocol (ARP) is inherently stateless and unauthenticated, accepting gratuitous ARP replies without validation.

Because hosts accept these responses, their local ARP tables are updated with spoofed bindings.

Determine the specific attack classification

The attack is ARP poisoning (or ARP spoofing), facilitating an On-Path (Man-in-the-Middle) scenario.

Traffic destined for external networks passes to the attacker's MAC address first before being forwarded.

Key Concept

ARP Poisoning and Spoofing Vectors

Question 256Question →

A network manager is reviewing a proposed upgrade plan for a corporate wireless network. The organization requires per-user authentication tied to Active Directory so that individual access can be revoked immediately upon employee termination. A technician suggests deploying WPA3-Personal with a complex 32-character passphrase to avoid configuring an 802.1X RADIUS infrastructure. Which of the following best explains why this recommendation fails to meet the organization's security requirements?

Pre-shared key deployment uses a single shared secret, preventing unique user identification and requiring passphrase rotation across all client devices when offboarding a single employee.

WPA3-Personal relies on legacy TKIP encryption rather than AES, making pre-shared passphrase sessions vulnerable to offline dictionary attacks.

WPA3-Personal only encrypts management frames, leaving user data payloads unencrypted unless TACACS+ server credentials are supplied.

WPA3-Personal disables Protected Management Frames (PMF), allowing unauthorized access points to perform ARP poisoning against connected clients.

Show answer & explanation

Answer: Pre-shared key deployment uses a single shared secret, preventing unique user identification and requiring passphrase rotation across all client devices when offboarding a single employee.

Answer

Pre-shared key deployment uses a single shared secret, preventing unique user identification and requiring passphrase rotation across all client devices when offboarding a single employee.

WPA3-Personal uses Simultaneous Authentication of Equals (SAE) with a shared password. While SAE provides forward secrecy and protection against offline dictionary attacks, it still relies on a single shared secret across devices. Consequently, it cannot authenticate individual user accounts against Active Directory or allow an administrator to revoke access for a departing employee without changing the passphrase on every device across the enterprise. Achieving per-user authentication requires WPA3-Enterprise with 802.1X/RADIUS.

Step-by-Step Solution

Identify the organization's core access control requirements.

The requirement specifies per-user authentication tied to Active Directory with selective revocation capability.

Enterprise access control demands individual accountability via 802.1X authentication.

Evaluate the mechanism of WPA3-Personal.

WPA3-Personal uses Simultaneous Authentication of Equals (SAE) based on a common Pre-Shared Key (PSK).

Because everyone uses the same passphrase, individual users cannot be identified or individually disabled at the RADIUS level.

Compare WPA3-Personal against WPA3-Enterprise.

WPA3-Enterprise integrates with an 802.1X RADIUS server and Active Directory, meeting all requirements, whereas WPA3-Personal does not.

WPA3-Personal cannot satisfy requirements for individual user auditability or single-user credential revocation.

Key Concept

WPA3-Personal vs. WPA3-Enterprise Authentication Requirements

Question 257Question →

A network administrator is overseeing the construction of a new network closet situated directly adjacent to a light manufacturing area that produces significant airborne dust and debris. Which environmental control should be configured for the network closet's HVAC system to prevent dust from entering the room when personnel open the entry door?

Maintain positive air pressure inside the network closet relative to adjacent spaces.

Maintain negative air pressure inside the network closet relative to adjacent spaces.

Increase relative humidity levels inside the closet above 80% to settle airborne particles.

Deploy a dedicated wet-pipe sprinkler system directly inside the HVAC supply ductwork.

Show answer & explanation

Answer: Maintain positive air pressure inside the network closet relative to adjacent spaces.

Answer

Maintaining positive air pressure inside the network closet relative to surrounding areas ensures air flows outward when doors open, preventing airborne dust and debris from entering.

Maintaining positive air pressure inside a network closet creates a higher atmospheric pressure within the room compared to adjacent spaces. When the door to the closet is opened, air naturally flows outward into the hallway or manufacturing area, effectively creating an air barrier that prevents airborne dust and debris from entering sensitive network equipment areas.

Step-by-Step Solution

Analyze the environmental threat described in the scenario.

The primary threat is airborne dust and particulate intrusion from the adjacent manufacturing floor whenever the door opens.

Dust accumulation on network devices can impair cooling fans, cause overheating, and lead to component failure.

Evaluate HVAC airflow pressure differential options.

Positive air pressure keeps internal pressure higher than external pressure, forcing clean air outward through doorways and gaps.

Negative pressure would draw unfiltered air and dust inward into the equipment space.

Select the appropriate environmental control mechanism.

Configuring HVAC systems for positive air pressure mitigates particulate contamination while preserving proper equipment operating conditions.

Positive pressure directly addresses the risk without introducing unwanted moisture or liquid hazards.

Key Concept

HVAC Air Pressure Differentials and Environmental Contamination Control

Question 258Question →

A network technician is configuring remote administrative access on a newly installed network switch. Which protocol should be enabled to ensure that command-line interface (CLI) sessions and authentication credentials are encrypted across the network?

SSH

Telnet

HTTP

SNMPv1

Show answer & explanation

Answer: SSH

Answer

SSH should be enabled because it provides encrypted shell sessions and secure password transmission for device management.

SSH (Secure Shell) operates on TCP port 22 and uses cryptographic methods to encrypt all management traffic, preventing unauthorized eavesdropping and credential theft during remote administration sessions.

Step-by-Step Solution

Identify the primary requirement for device hardening

The requirement is to secure remote interactive CLI management access using encryption.

Unencrypted administrative protocols allow attackers to capture login credentials using network sniffing tools.

Evaluate protocol security capabilities

SSH provides strong encryption for administrative sessions over TCP port 22.

Replacing legacy cleartext protocols such as Telnet with SSH is a baseline network device hardening best practice.

Key Concept

Management Plane Hardening via Encrypted Protocols

Estimated Time:45s

Question 259Question →

A security analyst is auditing a wireless network transition from WPA2-Personal to WPA3-Personal across several satellite offices. The goal is to support modern WPA3 security enhancements while maintaining temporary backward compatibility for legacy WPA2 devices. Which TWO of the following configuration settings or protocols are required to properly achieve this deployment? (Select TWO)

Select all that apply

Enable WPA3 Transition Mode to allow legacy WPA2-PSK clients and WPA3 SAE clients to connect to the same SSID.

Configure an 802.1X RADIUS server to distribute individual SAE passphrase scalars to authenticating clients.

Set Protected Management Frames (PMF) to required or capable to safeguard management traffic against spoofing.

Integrate TACACS+ accounting services to encrypt the initial 4-way handshake key generation parameters.

Show answer & explanation

Answer: Enable WPA3 Transition Mode to allow legacy WPA2-PSK clients and WPA3 SAE clients to connect to the same SSID.; Set Protected Management Frames (PMF) to required or capable to safeguard management traffic against spoofing.

Answer

The correct requirements are enabling WPA3 Transition Mode for dual-protocol support and configuring Protected Management Frames (PMF) to secure wireless management frames.

Deploying WPA3-Personal in an environment with legacy clients requires WPA3 Transition Mode so that WPA2-PSK clients and WPA3-SAE clients can connect to the same wireless network. Additionally, Protected Management Frames (PMF / IEEE 802.11w) must be enabled because PMF is a required security baseline under the WPA3 standard to stop frame spoofing attacks.

Step-by-Step Solution

Determine the mechanism for supporting legacy WPA2-Personal devices alongside WPA3-Personal devices.

Identify WPA3 Transition Mode as the standard feature allowing WPA2-PSK and WPA3-SAE clients on a single SSID.

Transition mode provides a seamless migration path without requiring separate SSIDs for legacy and modern clients.

Identify mandatory WPA3 security controls for frame integrity.

Select Protected Management Frames (PMF / IEEE 802.11w).

WPA3 standards mandate PMF to prevent common wireless attacks such as rogue deauthentication frame injection.

Evaluate authentication and authorization protocols in the wrong options.

Exclude RADIUS and TACACS+ options for this Personal (PSK/SAE) deployment scenario.

WPA3-Personal does not rely on centralized 802.1X RADIUS servers or TACACS+ administration systems.

Key Concept

WPA3-Personal (SAE), Transition Mode, and Mandatory PMF

Estimated Time:1m 30s

Question 260Question →

A network security analyst is investigating logs from multiple enterprise security incidents across the network infrastructure. Match each observed attack symptom and mechanism to its corresponding network attack vector.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings are: 1) Nested 802.1Q headers on a native VLAN corresponds to VLAN Hopping (Double Tagging); 2) Spoofed UDP requests using monlist commands correspond to an NTP Amplification Attack; 3) Intercepting HTTP/HTTPS redirects to downgrade connection security corresponds to SSL/TLS Stripping; 4) Spoofed 802.11 disassociation management frames correspond to a Wireless Deauthentication Attack.

Each attack vector maps directly to its underlying technical exploit method: nested 802.1Q headers exploit switch native VLAN parsing (VLAN Hopping), monlist query responses reflect high-volume traffic (NTP Amplification), modifying HTTP location headers prevents encryption (SSL Stripping), and spoofing 802.11 management frames forces wireless disassociation (Deauthentication).

Step-by-Step Solution

Analyze Incident 1 (Nested 802.1Q headers on native VLAN)

Identify that two 802.1Q tags allow traffic to jump from the native VLAN across trunk lines without passing through a router.

This structural behavior specifically defines double-tagging VLAN hopping.

Analyze Incident 2 (Spoofed UDP requests with monlist to time servers)

Recognize that monlist returns a large list of historical IP addresses over UDP (port 123) with a spoofed victim IP address.

This is a classic reflection/amplification attack targeting Network Time Protocol (NTP) services.

Analyze Incident 3 (Interception and modification of HTTPS links to plain HTTP)

Determine that modifying web headers to prevent TLS handshake upgrades strips transport layer security.

This technique is known as SSL/TLS stripping or protocol downgrade attack.

Analyze Incident 4 (Spoofed 802.11 management disassociation frames)

Determine that unauthenticated wireless management frames cause clients to disconnect.

This describes a wireless deauthentication attack aimed at denial of service or forcing clients onto a rogue access point.

Key Concept

Common Network Attack Vectors and Mechanisms

PreviousPage 13 / 22Next

Network Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept