CCP Network Security & Communication Protection 2 — Questions and Answers
Question 1: A security engineer needs to prevent eavesdropping on inter-VLAN traffic within a switched network. Which attack does proper VLAN segmentation primarily mitigate?
- ARP spoofing
- VLAN hopping (Correct answer)
- MAC flooding
- DNS poisoning
Correct answer: VLAN hopping
VLAN hopping exploits trunk port misconfigurations to access traffic across VLANs, which proper segmentation and disabling DTP prevents.
Question 2: Which IPsec mode encapsulates the entire original IP packet, including its header, making it suitable for site-to-site VPN tunnels?
- Transport mode
- Tunnel mode (Correct answer)
- Aggressive mode
- Main mode
Correct answer: Tunnel mode
Tunnel mode wraps the entire original IP packet in a new IP header, hiding internal addressing and making it ideal for gateway-to-gateway VPNs.
Question 3: An organization deploys a network device that inspects traffic up to Layer 7 and can block application-specific threats. What type of device is this?
- Stateful firewall
- Packet filter
- Next-Generation Firewall (NGFW) (Correct answer)
- Load balancer
Correct answer: Next-Generation Firewall (NGFW)
NGFWs perform deep packet inspection at Layer 7, enabling application awareness and the ability to detect and block sophisticated application-layer threats.
Question 4: Which protocol is used to securely exchange encryption keys over an insecure channel without prior shared secrets?
- RSA
- Diffie-Hellman (Correct answer)
- AES
- MD5
Correct answer: Diffie-Hellman
Diffie-Hellman key exchange allows two parties to establish a shared secret over an untrusted channel without transmitting the secret itself.
Question 5: A penetration tester discovers that a web application reflects user input directly in HTTP responses. Which network-layer control would BEST limit exploitation?
- IDS in detection mode
- Web Application Firewall (WAF) (Correct answer)
- Network Access Control (NAC)
- VLAN isolation
Correct answer: Web Application Firewall (WAF)
A WAF inspects HTTP/HTTPS traffic and can detect and block XSS and injection attacks by filtering malicious input patterns before they reach the application.
Question 6: Which TLS component proves the server's identity to the client during the handshake process?
- Session key
- MAC address
- Digital certificate (Correct answer)
- Cipher suite
Correct answer: Digital certificate
The server presents a digital certificate signed by a trusted CA, allowing the client to verify the server's identity before establishing an encrypted session.
Question 7: An attacker intercepts and alters packets between two hosts without either party detecting the change. What type of attack is this?
- Replay attack
- Man-in-the-Middle (MitM) attack (Correct answer)
- Denial of Service
- Smurf attack
Correct answer: Man-in-the-Middle (MitM) attack
A MitM attack positions the attacker between two communicating parties to intercept, read, and potentially modify traffic in transit.
CCP Network Security & Communication Protection 2
A security engineer needs to prevent eavesdropping on inter-VLAN traffic within a switched network.
Which attack does proper VLAN segmentation primarily mitigate?