CCST Network Security & Best Practices 2 — Questions and Answers
Question 1: Which type of attack involves an attacker secretly relaying and possibly altering communications between two parties who believe they are communicating directly?
- Replay attack
- Man-in-the-middle attack (Correct answer)
- Denial of service attack
- ARP poisoning
Correct answer: Man-in-the-middle attack
A man-in-the-middle (MitM) attack occurs when an attacker secretly intercepts and potentially alters communications between two parties.
Question 2: What is the primary purpose of a DMZ (Demilitarized Zone) in network security?
- To segment internal networks by department
- To host public-facing services while isolating them from the internal network (Correct answer)
- To connect remote VPN users securely
- To filter spam email before it reaches the mail server
Correct answer: To host public-facing services while isolating them from the internal network
A DMZ is a network segment that hosts public-facing services (like web servers) while keeping them isolated from the internal trusted network.
Question 3: Which 802.1X component is responsible for authenticating end-user devices before granting network access?
- Supplicant
- Authenticator
- Authentication Server (Correct answer)
- RADIUS proxy
Correct answer: Authentication Server
In 802.1X, the Authentication Server (typically a RADIUS server) verifies the credentials provided by the supplicant.
Question 4: A technician discovers that a switch port is receiving BPDU frames from an unauthorized device. Which Cisco feature should be enabled to protect against rogue switches?
- DHCP snooping
- Dynamic ARP Inspection
- BPDU Guard (Correct answer)
- Port security
Correct answer: BPDU Guard
BPDU Guard disables a port when unexpected BPDU frames are received, preventing unauthorized switches from influencing the Spanning Tree topology.
Question 5: What does the principle of 'defense in depth' mean in network security?
- Placing the most important firewall at the network perimeter
- Using multiple layers of security controls so that if one fails, others still protect the network (Correct answer)
- Deploying intrusion prevention systems at every network segment
- Encrypting all data at rest and in transit
Correct answer: Using multiple layers of security controls so that if one fails, others still protect the network
Defense in depth uses multiple overlapping security layers so that a failure in one control does not compromise the entire network.
Question 6: Which protocol provides secure remote management of network devices and encrypts all traffic, including authentication?
- Telnet
- SNMP v1
- SSH (Correct answer)
- HTTP
Correct answer: SSH
SSH (Secure Shell) encrypts all session data including credentials, unlike Telnet which transmits everything in plaintext.
Question 7: An attacker floods a network with spoofed TCP SYN packets to exhaust server resources. What type of attack is this?
- Ping of Death
- SYN flood (DoS) (Correct answer)
- Smurf attack
- Teardrop attack
Correct answer: SYN flood (DoS)
A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server connection resources.
CCST Network Security & Best Practices 2
Which type of attack involves an attacker secretly relaying and possibly altering communications between two parties who believe they are communicating directly?