CCST Network Security & Best Practices 3 — Questions and Answers
Question 1: Which security practice involves assigning users only the permissions they need to perform their job functions?
- Separation of duties
- Least privilege (Correct answer)
- Role-based access control
- Need-to-know policy
Correct answer: Least privilege
The principle of least privilege limits users and processes to only the access rights they need, reducing the attack surface.
Question 2: What is the function of DHCP snooping on a Cisco switch?
- Prevents unauthorized DHCP servers from assigning IP addresses (Correct answer)
- Blocks all DHCP traffic on untrusted ports
- Encrypts DHCP messages between clients and servers
- Assigns static IP addresses based on MAC addresses
Correct answer: Prevents unauthorized DHCP servers from assigning IP addresses
DHCP snooping identifies trusted DHCP server ports and drops DHCP offers from untrusted ports, preventing rogue DHCP servers.
Question 3: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Trojan horse (Correct answer)
- Ransomware
- Rootkit
Correct answer: Trojan horse
A Trojan horse is malware that masquerades as legitimate or desirable software to deceive users into executing it.
Question 4: A company wants to ensure that if one employee's credentials are compromised, the attacker cannot access all systems. Which security principle best addresses this?
- Encryption at rest
- Network segmentation with least privilege (Correct answer)
- Strong password policy
- Two-factor authentication alone
Correct answer: Network segmentation with least privilege
Combining network segmentation with least privilege limits what any single compromised account can access across the network.
Question 5: What is the purpose of a honeypot in network security?
- To store sensitive data in an encrypted format
- To attract and detect attackers by simulating a vulnerable system (Correct answer)
- To balance traffic load across multiple servers
- To monitor bandwidth usage by department
Correct answer: To attract and detect attackers by simulating a vulnerable system
A honeypot is a decoy system designed to lure attackers, allowing security teams to study attack methods and detect intrusions.
Question 6: Which VPN protocol is commonly used for site-to-site VPN connections on Cisco routers and provides both authentication and encryption?
- PPTP
- L2TP alone
- IPsec (Correct answer)
- GRE alone
Correct answer: IPsec
IPsec is widely used for site-to-site VPNs and provides authentication, integrity, and encryption for IP traffic.
Question 7: What does AAA stand for in the context of Cisco network security?
- Authentication, Authorization, Auditing
- Authentication, Authorization, Accounting (Correct answer)
- Access, Authentication, Authorization
- Accounting, Auditing, Access
Correct answer: Authentication, Authorization, Accounting
AAA stands for Authentication (verifying identity), Authorization (what the user can do), and Accounting (tracking what the user did).
CCST Network Security & Best Practices 3
Which security practice involves assigning users only the permissions they need to perform their job functions?