CCP Network Security & Threat Mitigation 3 — Questions and Answers
Question 1: Which technology creates an encrypted tunnel over a public network to securely connect remote users to an organization's internal network?
- VLAN
- VPN (Correct answer)
- NAT
- MPLS
Correct answer: VPN
A Virtual Private Network (VPN) establishes an encrypted tunnel that allows remote users to securely access internal corporate resources over the internet.
Question 2: What is the role of an Intrusion Prevention System (IPS) compared to an Intrusion Detection System (IDS)?
- IPS only logs threats; IDS blocks them
- IPS actively blocks malicious traffic; IDS only detects and alerts (Correct answer)
- IPS operates on endpoints; IDS operates on the network
- IPS uses signatures only; IDS uses anomaly detection only
Correct answer: IPS actively blocks malicious traffic; IDS only detects and alerts
An IPS is deployed inline and can actively block or drop malicious traffic, while an IDS monitors traffic passively and generates alerts without blocking.
Question 3: Which network attack exploits trust relationships between systems by forging the source IP address of packets?
- Port scanning
- IP spoofing (Correct answer)
- Session hijacking
- Wardriving
Correct answer: IP spoofing
IP spoofing involves crafting packets with a falsified source IP address to impersonate trusted systems or conceal the attacker's identity.
Question 4: In the context of wireless security, what does a deauthentication attack accomplish?
- Steals WPA2 handshakes to crack passwords
- Forces clients to disconnect from an access point (Correct answer)
- Injects malicious frames into encrypted traffic
- Bypasses MAC address filtering
Correct answer: Forces clients to disconnect from an access point
A deauthentication attack sends forged 802.11 deauth frames to disconnect clients from a wireless access point, which can be used to capture handshakes or cause disruption.
Question 5: What is the primary function of a DMZ (Demilitarized Zone) in network architecture?
- To host internal databases securely
- To provide a buffer zone for publicly accessible servers between the internet and internal network (Correct answer)
- To encrypt all outbound traffic
- To store backup copies of firewall rules
Correct answer: To provide a buffer zone for publicly accessible servers between the internet and internal network
A DMZ is a subnet that exposes external-facing services (web, email, DNS) to the internet while isolating the internal network from direct external access.
Question 6: Which protocol is most commonly used to carry out DNS amplification DDoS attacks?
- TCP
- UDP (Correct answer)
- ICMP
- TLS
Correct answer: UDP
DNS amplification attacks use UDP because DNS queries are small but responses can be much larger, and UDP requires no handshake, enabling high-volume spoofed floods.
Question 7: A network administrator wants to prevent unauthorized devices from accessing the corporate LAN via switch ports. Which feature should be configured?
- Spanning Tree Protocol (STP)
- Port security with MAC address limiting (Correct answer)
- OSPF route authentication
- Quality of Service (QoS) tagging
Correct answer: Port security with MAC address limiting
Port security allows administrators to restrict which MAC addresses can connect to a switch port, preventing unauthorized devices from accessing the network.
CCP Network Security & Threat Mitigation 3
Which technology creates an encrypted tunnel over a public network to securely connect remote users to an organization's internal network?