CISSP Communication and Network Security 2 — Questions and Answers
Question 1: Which protocol provides hop-by-hop encryption for MPLS VPN traffic between provider edge routers?
- IPsec Transport Mode
- MACsec (802.1AE) (Correct answer)
- TLS 1.3
- DTLS
Correct answer: MACsec (802.1AE)
MACsec (802.1AE) operates at Layer 2 and provides hop-by-hop encryption between directly connected devices such as MPLS PE routers.
Question 2: A security analyst observes that a web application firewall is generating excessive false positives for legitimate API calls. Which tuning approach is BEST?
- Switch WAF to detection-only mode permanently
- Create allowlist rules for known-good API endpoints and tighten base signatures (Correct answer)
- Disable WAF signatures for the affected application
- Increase WAF sensitivity threshold to maximum
Correct answer: Create allowlist rules for known-good API endpoints and tighten base signatures
Creating allowlist rules for known-good API patterns while refining base signatures reduces false positives without eliminating protection.
Question 3: Which network architecture principle is BEST demonstrated by placing database servers in a separate VLAN accessible only from the application tier?
- Defense in depth
- Network segmentation (Correct answer)
- Least privilege
- Zero trust
Correct answer: Network segmentation
Placing database servers in an isolated VLAN with restricted inter-tier access is a direct application of network segmentation.
Question 4: An organization uses 802.1X for wired network access control. Which component authenticates the end-user credentials?
- Supplicant
- Authenticator
- Authentication Server (RADIUS) (Correct answer)
- Certificate Authority
Correct answer: Authentication Server (RADIUS)
In 802.1X, the Authentication Server (typically RADIUS) validates supplicant credentials; the authenticator (switch) enforces the decision.
Question 5: What is the PRIMARY purpose of a network tap versus a SPAN port for security monitoring?
- Taps encrypt captured traffic; SPAN ports do not
- Taps provide passive, out-of-band full-duplex capture without affecting production traffic (Correct answer)
- SPAN ports capture more traffic than taps
- Taps require no additional hardware
Correct answer: Taps provide passive, out-of-band full-duplex capture without affecting production traffic
Network taps passively copy all traffic on a link out-of-band without introducing latency or risking dropped packets, unlike SPAN ports which share switch resources.
Question 6: Which DNS security mechanism cryptographically signs DNS records to prevent cache poisoning attacks?
- DNS over HTTPS (DoH)
- DNSSEC (Correct answer)
- DNS over TLS (DoT)
- DNS RPZ (Response Policy Zone)
Correct answer: DNSSEC
DNSSEC uses digital signatures on DNS resource records to allow resolvers to verify data authenticity and integrity, directly countering cache poisoning.
Question 7: During a network forensic investigation, an analyst discovers TCP sessions with SYN packets but no corresponding SYN-ACK replies across many source IPs. This MOST likely indicates:
- A distributed denial-of-service SYN flood attack (Correct answer)
- Normal asymmetric routing
- A TCP session hijacking attempt
- BGP route flapping
Correct answer: A distributed denial-of-service SYN flood attack
Numerous SYN packets from many sources with no SYN-ACK responses is the classic signature of a SYN flood DDoS attack exhausting the target's connection table.
CISSP Communication and Network Security 2
Which protocol provides hop-by-hop encryption for MPLS VPN traffic between provider edge routers?