CCP Network Security & Communication Protection 3 — Questions and Answers
Question 1: Which wireless security protocol uses SAE (Simultaneous Authentication of Equals) to protect against offline dictionary attacks?
- WEP
- WPA2-Personal
- WPA3 (Correct answer)
- WPA-Enterprise
Correct answer: WPA3
WPA3 replaces WPA2's PSK handshake with SAE, which prevents offline password guessing even if an attacker captures the four-way handshake.
Question 2: A company wants to ensure that only authenticated and policy-compliant devices can connect to the corporate network. Which technology enforces this?
- SNMP
- Network Access Control (NAC) (Correct answer)
- RADIUS accounting only
- Spanning Tree Protocol
Correct answer: Network Access Control (NAC)
NAC evaluates device health posture and authentication status before granting network access, quarantining non-compliant endpoints.
Question 3: Which DNS security extension mechanism digitally signs DNS resource records to prevent DNS cache poisoning?
- DNSSEC (Correct answer)
- DoH (DNS over HTTPS)
- DoT (DNS over TLS)
- EDNS
Correct answer: DNSSEC
DNSSEC uses public key cryptography to sign DNS records, allowing resolvers to verify record authenticity and detect tampering.
Question 4: An IDS generates an alert for legitimate traffic that matches a known attack signature. What is this called?
- True positive
- False negative
- False positive (Correct answer)
- True negative
Correct answer: False positive
A false positive occurs when an IDS incorrectly flags benign traffic as malicious, which can lead to alert fatigue and blocking legitimate activity.
Question 5: Which protocol provides secure, encrypted remote command-line access to network devices and replaces Telnet?
- SFTP
- SSH (Correct answer)
- HTTPS
- SNMPv3
Correct answer: SSH
SSH (Secure Shell) encrypts all traffic including authentication credentials, replacing the plaintext Telnet protocol for remote administration.
Question 6: A network engineer implements 802.1X on switch ports. Which component acts as the intermediary that forwards authentication requests to the authentication server?
- Supplicant
- Authenticator (Correct answer)
- RADIUS server
- Certificate Authority
Correct answer: Authenticator
In 802.1X, the authenticator (switch or AP) passes credentials from the supplicant (client) to the authentication server (RADIUS) without processing them.
Question 7: Which attack exploits the trust relationship between a DNS resolver and its cache by injecting forged DNS responses?
- BGP hijacking
- DNS cache poisoning (Correct answer)
- ARP spoofing
- IP spoofing
Correct answer: DNS cache poisoning
DNS cache poisoning corrupts a resolver's cache with fraudulent records, redirecting users to attacker-controlled servers without their knowledge.
CCP Network Security & Communication Protection 3
Which wireless security protocol uses SAE (Simultaneous Authentication of Equals) to protect against offline dictionary attacks?