CCST Network Security & Best Practices 4 — Questions and Answers
Question 1: Which type of IDS/IPS detection method identifies threats by comparing traffic against a database of known attack signatures?
- Anomaly-based detection
- Signature-based detection (Correct answer)
- Heuristic-based detection
- Behavioral-based detection
Correct answer: Signature-based detection
Signature-based detection compares network traffic or file hashes against a database of known malware or attack patterns.
Question 2: A user reports receiving an email claiming to be from IT support asking for their password to resolve an account issue. What type of attack is this?
- Vishing
- Spear phishing
- Phishing (Correct answer)
- Whaling
Correct answer: Phishing
Phishing is a social engineering attack using deceptive emails that appear legitimate to trick users into revealing sensitive information.
Question 3: Which Cisco IOS command prevents brute-force login attempts by blocking access after repeated failed logins?
- login block-for (Correct answer)
- service password-encryption
- security passwords min-length
- login local
Correct answer: login block-for
The 'login block-for' command temporarily blocks login attempts after a specified number of failures within a given time window.
Question 4: What is the key difference between a stateful firewall and a stateless (packet-filtering) firewall?
- Stateful firewalls only filter based on IP addresses; stateless also check ports
- Stateful firewalls track the state of active connections; stateless inspect each packet independently (Correct answer)
- Stateless firewalls are more secure because they inspect all packet content
- Stateful firewalls operate at Layer 2; stateless operate at Layer 3
Correct answer: Stateful firewalls track the state of active connections; stateless inspect each packet independently
A stateful firewall maintains a connection state table and can make decisions based on the context of a session, while stateless filters treat each packet independently.
Question 5: Which wireless security protocol replaced WEP and is currently considered the strongest standard for enterprise Wi-Fi authentication?
- WPA Personal
- WPA2 Personal
- WPA3 Enterprise (Correct answer)
- WPA2 Enterprise
Correct answer: WPA3 Enterprise
WPA3 Enterprise is the current strongest Wi-Fi security standard, offering 192-bit minimum encryption and improved authentication over WPA2.
Question 6: A network administrator wants to control which devices can connect to a specific switch port based on MAC addresses. Which feature should be configured?
- 802.1X authentication
- Port security (Correct answer)
- DHCP snooping
- Dynamic ARP Inspection
Correct answer: Port security
Port security allows a switch port to be locked to specific MAC addresses, restricting which devices can connect to that port.
Question 7: What is the purpose of encryption 'at rest' versus encryption 'in transit'?
- At rest protects data stored on disks/media; in transit protects data moving across the network (Correct answer)
- At rest protects data in RAM; in transit protects data on backup tapes
- At rest uses symmetric encryption; in transit always uses asymmetric encryption
- At rest and in transit are the same concept applied to different OSI layers
Correct answer: At rest protects data stored on disks/media; in transit protects data moving across the network
Encryption at rest protects stored data from unauthorized access, while encryption in transit protects data as it travels over the network.
CCST Network Security & Best Practices 4
Which type of IDS/IPS detection method identifies threats by comparing traffic against a database of known attack signatures?