CCD Network Security 3 — Questions and Answers
Question 1: What is ARP spoofing and what layer of the OSI model does it target?
- Forging IP packets at Layer 3
- Sending fake MAC-to-IP mappings at Layer 2 (Correct answer)
- Hijacking DNS records at Layer 7
- Flooding ports at Layer 4
Correct answer: Sending fake MAC-to-IP mappings at Layer 2
ARP spoofing sends forged ARP replies to link the attacker's MAC address with a legitimate IP, enabling MitM attacks at Layer 2.
Question 2: Which firewall inspection method tracks the state of active connections and makes decisions based on connection context?
- Packet filtering
- Stateful inspection (Correct answer)
- Application-layer filtering
- NAT traversal
Correct answer: Stateful inspection
Stateful inspection firewalls maintain a state table of active connections and allow only packets that match established sessions.
Question 3: What is the function of a Network Access Control (NAC) system?
- Encrypting wireless traffic
- Enforcing security policies before granting network access (Correct answer)
- Assigning dynamic IP addresses
- Monitoring bandwidth usage
Correct answer: Enforcing security policies before granting network access
NAC systems verify that endpoints meet security requirements (patch level, antivirus status) before allowing them onto the network.
Question 4: Which protocol is commonly used for centralized authentication, authorization, and accounting (AAA) in network environments?
- SNMP
- RADIUS (Correct answer)
- ICMP
- BGP
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) is widely used for centralized AAA in networks including Wi-Fi and VPN environments.
Question 5: What is a 'zero-day' vulnerability in the context of network security?
- A vulnerability with no CVSS score
- A flaw unknown to the vendor with no patch available (Correct answer)
- A vulnerability discovered at midnight
- A flaw that only affects older operating systems
Correct answer: A flaw unknown to the vendor with no patch available
A zero-day vulnerability is an unknown security flaw for which no patch exists, giving defenders zero days to prepare before exploitation.
Question 6: Which type of IDS/IPS detection method uses behavioral baselines to identify deviations from normal network activity?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Policy-based detection
- Heuristic-based detection
Correct answer: Anomaly-based detection
Anomaly-based detection establishes a baseline of normal behavior and alerts when traffic deviates significantly from that baseline.
Question 7: What does VLAN hopping allow an attacker to do?
- Bypass encryption on a VPN
- Gain unauthorized access to traffic on a different VLAN (Correct answer)
- Flood the network with broadcast packets
- Hijack a wireless access point
Correct answer: Gain unauthorized access to traffic on a different VLAN
VLAN hopping exploits switch misconfigurations (e.g., double tagging or trunk negotiation) to send traffic to VLANs the attacker should not access.
CCD Network Security 3
What is ARP spoofing and what layer of the OSI model does it target?