CCP Network Security & Communication Protection 2

Question 1

A security engineer needs to prevent eavesdropping on inter-VLAN traffic within a switched network. Which attack does proper VLAN segmentation primarily mitigate?

Accepted Answer

VLAN hopping

Answer

VLAN hopping exploits trunk port misconfigurations to access traffic across VLANs, which proper segmentation and disabling DTP prevents.

Question 2

Which IPsec mode encapsulates the entire original IP packet, including its header, making it suitable for site-to-site VPN tunnels?

Accepted Answer

Tunnel mode

Answer

Tunnel mode wraps the entire original IP packet in a new IP header, hiding internal addressing and making it ideal for gateway-to-gateway VPNs.

Question 3

An organization deploys a network device that inspects traffic up to Layer 7 and can block application-specific threats. What type of device is this?

Accepted Answer

Next-Generation Firewall (NGFW)

Answer

NGFWs perform deep packet inspection at Layer 7, enabling application awareness and the ability to detect and block sophisticated application-layer threats.

Question 4

Which protocol is used to securely exchange encryption keys over an insecure channel without prior shared secrets?

Accepted Answer

Diffie-Hellman

Answer

Diffie-Hellman key exchange allows two parties to establish a shared secret over an untrusted channel without transmitting the secret itself.

Question 5

A penetration tester discovers that a web application reflects user input directly in HTTP responses. Which network-layer control would BEST limit exploitation?

Accepted Answer

Web Application Firewall (WAF)

Answer

A WAF inspects HTTP/HTTPS traffic and can detect and block XSS and injection attacks by filtering malicious input patterns before they reach the application.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Network Security & Communication Protection 2