CISSP Communication and Network Security 3 â Questions and Answers
Question 1: Which VPN technology operates at Layer 2 and allows remote sites to appear as if they are on the same local network segment?
- SSL VPN
- L2TP/IPsec
- MPLS L2VPN (VPLS) (Correct answer)
- GRE over IPsec
Correct answer: MPLS L2VPN (VPLS)
VPLS (Virtual Private LAN Service) is an MPLS-based L2VPN that bridges remote sites at Layer 2, making them appear as a single LAN.
Question 2: An organization wants to prevent employees from exfiltrating data via encrypted DNS tunnels. Which control is MOST effective?
- Block all UDP port 53 at the perimeter
- Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries (Correct answer)
- Require all DNS queries to use DNSSEC
- Implement DNS over HTTPS for all clients
Correct answer: Deploy a recursive DNS resolver with anomaly detection for high-volume or large TXT record queries
DNS tunneling detection relies on behavioral analysisâunusually high query volumes, large TXT records, and long subdomainsâwhich a monitored internal resolver can identify.
Question 3: What is the key security advantage of using SNMPv3 over SNMPv2c for network device management?
- SNMPv3 supports more OIDs
- SNMPv3 provides authentication and encryption; SNMPv2c uses only community strings (Correct answer)
- SNMPv3 eliminates the need for a management station
- SNMPv3 operates over TCP instead of UDP
Correct answer: SNMPv3 provides authentication and encryption; SNMPv2c uses only community strings
SNMPv3 adds USM (User-based Security Model) providing message authentication (HMAC-MD5/SHA) and encryption (AES), unlike SNMPv2c's cleartext community strings.
Question 4: A penetration tester uses a rogue AP broadcasting the same SSID as the corporate network to capture credentials. This attack is BEST described as:
- Deauthentication attack
- Evil twin attack (Correct answer)
- Bluejacking
- KRACK attack
Correct answer: Evil twin attack
An evil twin attack creates a fraudulent access point mimicking a legitimate SSID to intercept client connections and capture credentials.
Question 5: Which routing protocol security feature prevents unauthorized routers from injecting false routing information into an OSPF domain?
- Route filtering with ACLs
- OSPF MD5 or SHA authentication (Correct answer)
- BGP route reflectors
- Spanning Tree Protocol BPDU Guard
Correct answer: OSPF MD5 or SHA authentication
OSPF neighbor authentication (MD5 or SHA) requires routers to prove identity before exchanging routing updates, preventing rogue router injection.
Question 6: Under the OSI model, which layer is responsible for end-to-end error recovery and flow control between communicating hosts?
- Network layer (Layer 3)
- Data Link layer (Layer 2)
- Transport layer (Layer 4) (Correct answer)
- Session layer (Layer 5)
Correct answer: Transport layer (Layer 4)
The Transport layer (Layer 4) provides end-to-end error detection, retransmission, and flow control using protocols like TCP.
Question 7: Which attack targets the ARP table of hosts on a LAN to redirect traffic through an attacker's machine?
- IP spoofing
- ARP poisoning (ARP spoofing) (Correct answer)
- VLAN hopping
- MAC flooding
Correct answer: ARP poisoning (ARP spoofing)
ARP poisoning sends forged ARP replies to associate the attacker's MAC with a legitimate IP, causing victim hosts to send traffic to the attacker.
CISSP Communication and Network Security 3
Which VPN technology operates at Layer 2 and allows remote sites to appear as if they are on the same local network segment?