CCST Network Security & Best Practices 5 — Questions and Answers
Question 1: Which type of network attack involves an attacker sending gratuitous ARP replies to associate their MAC address with a legitimate IP address?
- DNS spoofing
- ARP poisoning (Correct answer)
- IP spoofing
- MAC flooding
Correct answer: ARP poisoning
ARP poisoning (ARP spoofing) corrupts the ARP cache of hosts by sending fake ARP replies, redirecting traffic to the attacker.
Question 2: A company needs to allow remote employees to securely access internal resources over the internet as if they were on the local network. Which solution best meets this need?
- NAT overload (PAT)
- Remote Access VPN (Correct answer)
- Site-to-site VPN
- Proxy server
Correct answer: Remote Access VPN
A remote access VPN creates an encrypted tunnel from an individual user's device to the corporate network, providing secure access to internal resources.
Question 3: What does 'two-factor authentication' (2FA) require that single-factor authentication does not?
- A longer and more complex password
- Verification using two different categories of credentials (e.g., password + OTP) (Correct answer)
- Two separate passwords for the same account
- Authentication by two different administrators
Correct answer: Verification using two different categories of credentials (e.g., password + OTP)
2FA requires credentials from two different categories: something you know (password), something you have (token), or something you are (biometric).
Question 4: Which network security tool monitors and analyzes traffic in real time to detect and potentially block malicious activity?
- Vulnerability scanner
- Intrusion Detection/Prevention System (IDS/IPS) (Correct answer)
- Network Access Control (NAC)
- Security Information and Event Management (SIEM)
Correct answer: Intrusion Detection/Prevention System (IDS/IPS)
An IDS detects suspicious traffic and alerts administrators, while an IPS can also actively block or drop malicious packets in real time.
Question 5: A technician needs to prevent rogue devices from sending forged ARP responses on a VLAN. DHCP snooping is already enabled. What additional feature should be configured?
- Port security
- Dynamic ARP Inspection (DAI) (Correct answer)
- IP Source Guard
- Storm control
Correct answer: Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets and drop those with spoofed IP-to-MAC mappings.
Question 6: Which of the following best describes a 'zero-day' vulnerability?
- A vulnerability that has been patched but not yet deployed
- A vulnerability that is publicly known and has an available exploit before a patch exists (Correct answer)
- A vulnerability discovered on the first day a product is released
- A vulnerability with a CVSS score of zero indicating low risk
Correct answer: A vulnerability that is publicly known and has an available exploit before a patch exists
A zero-day vulnerability is one that is unknown to the vendor or has no available patch, giving defenders 'zero days' to prepare.
Question 7: What is the role of a Certificate Authority (CA) in Public Key Infrastructure (PKI)?
- To generate private keys for all users on the network
- To issue, sign, and revoke digital certificates that bind public keys to identities (Correct answer)
- To encrypt all network traffic between endpoints
- To store and manage user passwords securely
Correct answer: To issue, sign, and revoke digital certificates that bind public keys to identities
A Certificate Authority is a trusted entity that issues digital certificates, cryptographically binding a public key to a verified identity.
CCST Network Security & Best Practices 5
Which type of network attack involves an attacker sending gratuitous ARP replies to associate their MAC address with a legitimate IP address?