Network Security

During a security incident response on subnet $192.168.50.0/24$, a network engineer observes that multiple workstations have lost connectivity to internal corporate servers and are transmitting sensitive traffic to an unapproved external address. Packet captures reveal a rapid influx of DHCP DISCOVER and REQUEST messages originating from thousands of randomly generated MAC addresses, which completely exhausts the legitimate DHCP server's IP address pool. Immediately after the pool is depleted, clients receive IP leases containing an unauthorized default gateway IP address broadcast by an unidentified device on the local Layer 2 broadcast domain. Which of the following attack types represents the primary vector used to hijack client traffic?

A network technician is configuring an IPsec site-to-site Virtual Private Network (VPN) between two branch offices. Arrange the following steps in the correct order in which an IPsec VPN connection is established between the two gateways.

A network technician is configuring a remote access solution for mobile workers to securely connect to internal enterprise resources. The technical requirements specify that the security protocol suite must operate at the Network layer (Layer 3) of the OSI model to authenticate and encrypt all IP packets passing through the tunnel. Which of the following protocols should the technician implement?

As part of a wireless security assessment, an engineer must accurately map each IEEE 802.11 cryptographic protocol to its underlying encryption algorithm and message integrity mechanism. Match each protocol on the left to its matching cryptographic pair on the right.

A network administrator is troubleshooting connectivity issues on a router filtering traffic between client workstations on subnet $172.16.20.0/24$ and an internal core server on host $10.10.1.5/32$. Workstations are unable to resolve domain names using the internal DNS service hosted on $10.10.1.5$. The administrator inspects the following IPv4 extended Access Control List (ACL) applied inbound on the workstation interface:

`10 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 53`
`20 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 88`
`30 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 445`

Which of the following best explains why standard DNS queries sent by client workstations to the server are being dropped?

Which wireless security standard introduced mandatory support for the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), utilizing the Advanced Encryption Standard (AES) cipher to replace legacy TKIP encryption?

A remote worker needs to access internal corporate web applications over the Internet using a standard web browser with SSL/TLS encryption, without installing any dedicated software on the laptop. Which of the following remote access solutions is being utilized?

An enterprise network engineer is documenting the connection workflow for remote employees accessing internal web applications via a Clientless SSL/TLS VPN gateway integrated with a central RADIUS AAA server. Arrange the operational steps in the correct chronological sequence from the initial remote connection request to the retrieval of internal corporate resources.

A network administrator installs a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port to monitor application traffic for web servers. All incoming web application traffic is encrypted end-to-end using TLS on TCP port 443. During a penetration test, simulated cross-site scripting (XSS) attacks sent inside HTTPS payloads pass through the network undetected by the NIDS. Which of the following best explains why the NIDS failed to generate an alert?

A system administrator is configuring a secure remote access solution using an SSL/TLS VPN to allow telecommuters to access internal network applications. Which transport layer protocol and default port number are used by an SSL/TLS VPN connection?

A network security administrator is deploying a site-to-site IPsec VPN tunnel between a branch office and central headquarters across an ISP connection where the branch router sits behind a network device performing Port Address Translation (PAT). Initial testing using Authentication Header (AH) in transport mode fails to pass traffic, whereas switching the configuration to Encapsulating Security Payload (ESP) in tunnel mode with NAT-Traversal (NAT-T) enabled allows full connectivity. Which of the following technical mechanisms explains why AH fails across a PAT-enabled device while ESP with NAT-T functions successfully?

A network security team is deploying an extended stateless IPv4 Access Control List (ACL) on an egress router interface filtering traffic between an internal database server ($10.50.10.25/24$) and external application servers ($172.16.100.0/24$). The application servers initiate database connections to TCP port $5432$ (PostgreSQL), and the database server is configured to send automated diagnostic alerts to an external syslog server at $172.16.100.50$ listening on UDP port $514$. Which TWO configuration entries or operational requirements must be implemented on the stateless egress ACL to guarantee bidirectional application communication and outbound alerting? (Select TWO.)

Remote workers attempting to connect to an enterprise network using an IPsec IKEv2 remote access client report that authentication succeeds, but no internal network resources are accessible and tunnel data transmission fails immediately after connection setup. The edge network security monitoring tool shows that Phase 1 (IKE) negotiations complete successfully over UDP port 500, but Encapsulating Security Payload (ESP) packets sent during Phase 2 are silently dropped by the remote users' Small Office/Home Office (SOHO) routers performing Port Address Translation (PAT). Which of the following configuration changes will resolve this connectivity issue while maintaining secure, encrypted communications?

An IT administrator investigating unexpected latency on a voice-over-IP (VoIP) network segment notices that host traffic destined for the default gateway IP address ($10.20.4.1$) is being redirected through an unauthorized host with MAC address `02:AB:C1:23:45:67`. Inspection of network captures reveals continuous unsolicited Gratuitous Address Resolution Protocol (GARP) frames originating from IP address $10.20.4.88$, associating its own physical address with $10.20.4.1$. Which of the following network attack types is actively occurring on this segment?

During a security incident investigation on an enterprise local area network, network monitoring tools record a high volume of traffic originating from a host connected to switch port Fa0/12. Analysis reveals that the host flooded the switch with thousands of Ethernet frames containing randomized source MAC addresses, completely filling the switch Content Addressable Memory (CAM) table. Immediately following this flood, analysts observe that confidential unicast traffic intended for a specific internal database server is being replicated and sent out all active ports on the VLAN. Which of the following statements accurately describe the underlying mechanics of this network attack and the appropriate Layer 2 countermeasures? (Select TWO)

Match each centralized authentication protocol or access control framework component to its corresponding transport layer behavior, encryption boundary, or operational function.

A network administrator needs to configure a wireless access point for a company office. Policy mandates that every employee must authenticate using their own unique corporate credentials managed by a centralized RADIUS server, rather than sharing a static password. Which wireless security mode should be configured on the access point?

An enterprise monitors its internal data center network using a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port. During a security incident, an attacker successfully exploits a vulnerability on a Linux target server by transmitting crafted TCP packets containing overlapping sequence numbers with conflicting data payloads (a TCP stream segmentation evasion attack). Although traffic reached the sensor, the NIDS failed to generate an alert because its stream reassembly engine interpreted the overlapping segments differently than the target server's IP/TCP protocol stack. Which of the following actions best addresses this detection failure while maintaining zero impact on network latency?

A network security administrator is deploying a client-based SSL/TLS remote access VPN solution with host posture assessment and Multi-Factor Authentication (MFA). In what chronological order do the following operational steps occur during a successful client connection sequence from initial packet transmission to secure internal network access?

A network technician is configuring a secure wireless network for a regional field office. Management mandates enhancing security beyond WPA2-Personal to protect against offline dictionary attacks and wireless management frame spoofing, but the site lacks the infrastructure required for centralized RADIUS authentication. Which TWO of the following features or protocols must be implemented to fulfill these requirements under WPA3-Personal?