CCST Network Security & Best Practices 5

Question 1

Which type of network attack involves an attacker sending gratuitous ARP replies to associate their MAC address with a legitimate IP address?

Accepted Answer

ARP poisoning

Answer

ARP poisoning (ARP spoofing) corrupts the ARP cache of hosts by sending fake ARP replies, redirecting traffic to the attacker.

Question 2

A company needs to allow remote employees to securely access internal resources over the internet as if they were on the local network. Which solution best meets this need?

Accepted Answer

Remote Access VPN

Answer

A remote access VPN creates an encrypted tunnel from an individual user's device to the corporate network, providing secure access to internal resources.

Question 3

What does 'two-factor authentication' (2FA) require that single-factor authentication does not?

Accepted Answer

Verification using two different categories of credentials (e.g., password + OTP)

Answer

2FA requires credentials from two different categories: something you know (password), something you have (token), or something you are (biometric).

Question 4

Which network security tool monitors and analyzes traffic in real time to detect and potentially block malicious activity?

Accepted Answer

Intrusion Detection/Prevention System (IDS/IPS)

Answer

An IDS detects suspicious traffic and alerts administrators, while an IPS can also actively block or drop malicious packets in real time.

Question 5

A technician needs to prevent rogue devices from sending forged ARP responses on a VLAN. DHCP snooping is already enabled. What additional feature should be configured?

Accepted Answer

Dynamic ARP Inspection (DAI)

Answer

Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets and drop those with spoofed IP-to-MAC mappings.

(CCST) Cisco Certified Support Technician Networking Practice Test

(CCST) Cisco Certified Support Technician Networking Practice Test

CCST Network Security & Best Practices 5