CISSP Communication and Network Security 4 — Questions and Answers
Question 1: Which firewall architecture places a screened subnet (DMZ) between two firewalls to isolate public-facing servers?
- Packet filtering firewall
- Screened host architecture
- Screened subnet (dual-firewall DMZ) architecture (Correct answer)
- Bastion host architecture
Correct answer: Screened subnet (dual-firewall DMZ) architecture
The screened subnet architecture uses two firewalls creating a DMZ between them, isolating public services from the internal network even if the outer firewall is compromised.
Question 2: An IDS generates an alert for a known attack signature, but investigation reveals no actual attack occurred. This scenario is BEST described as:
- True positive
- False negative
- True negative
- False positive (Correct answer)
Correct answer: False positive
A false positive occurs when an IDS alerts on benign activity that matches an attack signature, incorrectly indicating an attack took place.
Question 3: What is the MAIN security purpose of implementing Private VLANs (PVLANs)?
- Encrypt traffic between VLAN members
- Isolate hosts within the same VLAN from communicating directly with each other (Correct answer)
- Extend VLANs across WAN links
- Prevent VLAN hopping attacks via trunk ports
Correct answer: Isolate hosts within the same VLAN from communicating directly with each other
PVLANs use isolated, community, and promiscuous port types to restrict lateral communication between hosts sharing the same IP subnet.
Question 4: Which wireless authentication protocol is considered the MOST secure option for enterprise WPA3 deployments?
- WPA3-Personal with SAE
- WPA3-Enterprise with 192-bit mode (CNSA Suite) (Correct answer)
- WPA2-Enterprise with PEAP-MSCHAPv2
- Open authentication with captive portal
Correct answer: WPA3-Enterprise with 192-bit mode (CNSA Suite)
WPA3-Enterprise in 192-bit mode uses CNSA Suite algorithms (GCMP-256, BIP-GMAC-256, ECDHE) providing the highest security for wireless enterprise authentication.
Question 5: A security architect needs to ensure that a cloud-hosted application's API traffic is protected from volumetric DDoS attacks. Which solution is MOST appropriate?
- Deploy an on-premises IPS
- Use a cloud-based DDoS scrubbing service or CDN with DDoS mitigation (Correct answer)
- Implement IP reputation blacklists on the application server
- Increase server bandwidth capacity
Correct answer: Use a cloud-based DDoS scrubbing service or CDN with DDoS mitigation
Cloud-based DDoS scrubbing services absorb and filter volumetric attacks upstream, before traffic reaches the application, providing scalable mitigation beyond on-premises capacity.
Question 6: Which protocol vulnerability does the POODLE attack exploit?
- TLS 1.2 HMAC truncation
- SSL 3.0 CBC padding oracle (Correct answer)
- RC4 statistical bias in WEP
- MD5 collision in TLS certificates
Correct answer: SSL 3.0 CBC padding oracle
POODLE (Padding Oracle On Downgraded Legacy Encryption) exploits a padding oracle vulnerability in SSL 3.0's CBC mode encryption.
Question 7: When implementing IPsec in tunnel mode between two VPN gateways, which part of the original packet is encrypted?
- Only the TCP/UDP payload
- Only the original IP header
- The entire original IP packet (header + payload) (Correct answer)
- Only the application layer data
Correct answer: The entire original IP packet (header + payload)
In IPsec tunnel mode, the entire original IP packet (header and payload) is encapsulated and encrypted within a new outer IP packet.
CISSP Communication and Network Security 4
Which firewall architecture places a screened subnet (DMZ) between two firewalls to isolate public-facing servers?