CISSP Communication and Network Security 2

Question 1

Which protocol provides hop-by-hop encryption for MPLS VPN traffic between provider edge routers?

Accepted Answer

MACsec (802.1AE)

Answer

MACsec (802.1AE) operates at Layer 2 and provides hop-by-hop encryption between directly connected devices such as MPLS PE routers.

Question 2

A security analyst observes that a web application firewall is generating excessive false positives for legitimate API calls. Which tuning approach is BEST?

Accepted Answer

Create allowlist rules for known-good API endpoints and tighten base signatures

Answer

Creating allowlist rules for known-good API patterns while refining base signatures reduces false positives without eliminating protection.

Question 3

Which network architecture principle is BEST demonstrated by placing database servers in a separate VLAN accessible only from the application tier?

Accepted Answer

Network segmentation

Answer

Placing database servers in an isolated VLAN with restricted inter-tier access is a direct application of network segmentation.

Question 4

An organization uses 802.1X for wired network access control. Which component authenticates the end-user credentials?

Accepted Answer

Authentication Server (RADIUS)

Answer

In 802.1X, the Authentication Server (typically RADIUS) validates supplicant credentials; the authenticator (switch) enforces the decision.

Question 5

What is the PRIMARY purpose of a network tap versus a SPAN port for security monitoring?

Accepted Answer

Taps provide passive, out-of-band full-duplex capture without affecting production traffic

Answer

Network taps passively copy all traffic on a link out-of-band without introducing latency or risking dropped packets, unlike SPAN ports which share switch resources.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Communication and Network Security 2