CAP Network Security Fundamentals 3 — Questions and Answers
Question 1: Which encryption protocol is considered insecure and should NOT be used for securing wireless networks?
- WPA3
- WPA2-Enterprise
- WEP (Correct answer)
- 802.11i
Correct answer: WEP
WEP (Wired Equivalent Privacy) uses weak RC4 encryption and has known cryptographic flaws that allow it to be cracked in minutes.
Question 2: What is the purpose of a Security Information and Event Management (SIEM) system in network security?
- To block malware at the endpoint level
- To aggregate, correlate, and analyze security event logs across the network (Correct answer)
- To encrypt data in transit between network nodes
- To manage user identities and access rights
Correct answer: To aggregate, correlate, and analyze security event logs across the network
A SIEM collects and correlates log data from multiple sources to detect security incidents and support incident response and compliance reporting.
Question 3: Under NIST SP 800-53, which control family specifically addresses network boundary protection?
- Access Control (AC)
- System and Communications Protection (SC) (Correct answer)
- Incident Response (IR)
- Configuration Management (CM)
Correct answer: System and Communications Protection (SC)
NIST SP 800-53 SC (System and Communications Protection) controls cover network boundary protection, including firewalls, encryption, and secure communications.
Question 4: What does an Intrusion Prevention System (IPS) do that an Intrusion Detection System (IDS) does not?
- Monitors network traffic passively
- Sends alerts to administrators only
- Actively blocks or drops malicious traffic in real time (Correct answer)
- Generates detailed forensic logs of attacks
Correct answer: Actively blocks or drops malicious traffic in real time
An IPS actively blocks or drops malicious traffic inline, while an IDS only detects and alerts without taking preventive action.
Question 5: Which VPN protocol is commonly used with IPsec to provide site-to-site connectivity and operates at Layer 3?
- SSL/TLS
- L2TP/IPsec (Correct answer)
- PPTP
- OpenVPN
Correct answer: L2TP/IPsec
L2TP/IPsec combines L2TP tunneling with IPsec encryption and authentication, commonly used for site-to-site Layer 3 VPN connectivity.
Question 6: What is the purpose of network flow data (e.g., NetFlow) in security monitoring?
- To decrypt encrypted network sessions
- To provide summary metadata about network communications for anomaly detection (Correct answer)
- To block unauthorized connections automatically
- To generate SSL certificates for network devices
Correct answer: To provide summary metadata about network communications for anomaly detection
NetFlow and similar flow data provide metadata (source, destination, ports, volume) that enables baseline modeling and anomaly detection without capturing full packet payloads.
Question 7: Which concept ensures that network traffic between two security zones always passes through a security enforcement point?
- Split tunneling
- Choke point (Correct answer)
- Peer-to-peer routing
- Broadcast domain
Correct answer: Choke point
A choke point is a single enforced passage between zones that ensures all inter-zone traffic is inspected and controlled by security devices.
CAP Network Security Fundamentals 3
Which encryption protocol is considered insecure and should NOT be used for securing wireless networks?