CCP Network Security & Threat Mitigation 2 — Questions and Answers
Question 1: Which type of attack involves an adversary intercepting and potentially altering communications between two parties without their knowledge?
- Replay attack
- Man-in-the-middle (MitM) attack (Correct answer)
- Denial-of-service attack
- SQL injection attack
Correct answer: Man-in-the-middle (MitM) attack
A man-in-the-middle attack occurs when an attacker secretly intercepts and relays messages between two parties who believe they are communicating directly.
Question 2: What is the primary purpose of network segmentation in a defense-in-depth strategy?
- Increase network throughput
- Limit lateral movement by containing breaches to isolated zones (Correct answer)
- Reduce hardware costs
- Simplify network management
Correct answer: Limit lateral movement by containing breaches to isolated zones
Network segmentation divides a network into isolated zones so that a compromise in one segment cannot easily spread to others, limiting lateral movement.
Question 3: A security team detects a high volume of UDP packets flooding a target server. Which attack type does this most likely represent?
- Phishing
- UDP flood DDoS attack (Correct answer)
- ARP spoofing
- DNS cache poisoning
Correct answer: UDP flood DDoS attack
A UDP flood is a volumetric DDoS attack that overwhelms the target with large numbers of UDP packets, exhausting network resources.
Question 4: Which protocol is commonly used to securely manage network devices remotely, replacing the insecure Telnet protocol?
- FTP
- SNMP
- SSH (Correct answer)
- HTTP
Correct answer: SSH
SSH (Secure Shell) provides encrypted remote management of network devices, making it the secure replacement for plaintext Telnet.
Question 5: What does a stateful firewall track that a stateless packet filter does not?
- Source MAC addresses
- The state of active network connections (Correct answer)
- User authentication tokens
- Routing table entries
Correct answer: The state of active network connections
A stateful firewall maintains a connection state table to track active sessions, allowing it to make context-aware filtering decisions.
Question 6: Which mitigation technique is most effective against SYN flood attacks?
- Enabling STP on switches
- Implementing SYN cookies (Correct answer)
- Configuring OSPF authentication
- Using WPA3 encryption
Correct answer: Implementing SYN cookies
SYN cookies allow servers to respond to SYN requests without allocating resources until the three-way handshake is complete, defeating SYN floods.
Question 7: An attacker sends crafted ICMP packets to a broadcast address, causing multiple hosts to reply to a victim. What attack is this?
- Smurf attack (Correct answer)
- Fraggle attack
- Teardrop attack
- Land attack
Correct answer: Smurf attack
A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed victim source IP, causing all hosts on the network to flood the victim with replies.
CCP Network Security & Threat Mitigation 2
Which type of attack involves an adversary intercepting and potentially altering communications between two parties without their knowledge?