CISA Network and Infrastructure Security 2 — Questions and Answers
Question 1: Which of the following BEST reduces the risk of unauthorized wireless network access?
- Enabling WEP encryption on all access points
- Using WPA3 with strong pre-shared keys and 802.1X authentication (Correct answer)
- Broadcasting the SSID to help users locate the network
- Placing access points near exterior walls for better signal
Correct answer: Using WPA3 with strong pre-shared keys and 802.1X authentication
WPA3 with 802.1X provides enterprise-grade authentication and strong encryption, making unauthorized access significantly harder.
Question 2: When auditing a VPN implementation, an IS auditor should FIRST verify that:
- VPN software licenses are current
- Strong encryption algorithms and multi-factor authentication are enforced (Correct answer)
- All employees are required to use VPN regardless of location
- VPN connection logs are deleted after 30 days
Correct answer: Strong encryption algorithms and multi-factor authentication are enforced
Strong encryption and MFA are the foundational controls that protect VPN tunnels from interception and unauthorized access.
Question 3: A penetration test differs from a vulnerability assessment primarily because a penetration test:
- Only scans for known CVEs using automated tools
- Actively attempts to exploit discovered vulnerabilities (Correct answer)
- Generates a compliance report for auditors
- Is conducted exclusively by internal staff
Correct answer: Actively attempts to exploit discovered vulnerabilities
Penetration testing goes beyond identifying vulnerabilities by actually attempting to exploit them to determine real-world impact.
Question 4: Which firewall rule principle states that anything not explicitly permitted should be denied?
- Default permit
- Least privilege
- Default deny (implicit deny) (Correct answer)
- Defense in depth
Correct answer: Default deny (implicit deny)
An implicit deny rule drops all traffic not explicitly allowed, minimizing exposure to unknown or unauthorized connections.
Question 5: An IS auditor reviewing network diagrams notices that production and development environments share the same network segment. The MAIN risk is:
- Slower network performance in production
- Higher infrastructure costs for the organization
- Potential for development activity to compromise production systems (Correct answer)
- Difficulty in assigning IP addresses to new devices
Correct answer: Potential for development activity to compromise production systems
Mixing production and development on the same segment can allow vulnerabilities or misconfigurations in dev to impact live systems.
Question 6: Which of the following is the BEST control for preventing DNS spoofing attacks?
- Disabling all external DNS queries
- Implementing DNSSEC to cryptographically sign DNS records (Correct answer)
- Using SNMP to monitor DNS traffic
- Configuring DNS servers on the DMZ only
Correct answer: Implementing DNSSEC to cryptographically sign DNS records
DNSSEC adds digital signatures to DNS records, allowing resolvers to verify authenticity and reject forged responses.
CISA Network and Infrastructure Security 2
Which of the following BEST reduces the risk of unauthorized wireless network access?