CISSP Communication and Network Security 5 — Questions and Answers
Question 1: Which protocol is used by network devices to dynamically assign IP addresses and provide configuration parameters to hosts?
- ARP
- DHCP (Correct answer)
- ICMP
- IGMP
Correct answer: DHCP
DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to network clients.
Question 2: A company discovers that an attacker exploited a switch to access traffic on a VLAN they should not have access to by sending specially crafted 802.1Q frames. This attack is known as:
- MAC flooding
- ARP spoofing
- VLAN hopping (double tagging) (Correct answer)
- STP manipulation
Correct answer: VLAN hopping (double tagging)
VLAN hopping via double tagging embeds two 802.1Q tags so traffic crosses VLAN boundaries when the outer tag is stripped by the first switch.
Question 3: Which network security concept ensures that all traffic, including internal east-west traffic, is inspected and no implicit trust is granted based on network location?
- Defense in depth
- Zero Trust Network Access (ZTNA) (Correct answer)
- Network Access Control (NAC)
- Microsegmentation
Correct answer: Zero Trust Network Access (ZTNA)
Zero Trust Network Access operates on the principle of 'never trust, always verify,' requiring authentication and authorization for all traffic regardless of source location.
Question 4: What is the MAIN difference between a stateful packet inspection (SPI) firewall and a stateless packet filter?
- SPI firewalls operate faster than packet filters
- SPI firewalls track connection state and context; packet filters evaluate each packet in isolation (Correct answer)
- Packet filters can block application-layer attacks; SPI cannot
- SPI firewalls only inspect inbound traffic
Correct answer: SPI firewalls track connection state and context; packet filters evaluate each packet in isolation
Stateful inspection firewalls maintain a connection state table to evaluate packets in the context of their TCP/UDP session, while packet filters assess each packet independently.
Question 5: Which Bluetooth attack allows an attacker to send unsolicited messages to a discoverable Bluetooth device without pairing?
- Bluesnarfing
- Bluejacking (Correct answer)
- Bluebugging
- BIAS attack
Correct answer: Bluejacking
Bluejacking sends unsolicited messages (typically via vCard or messages) to nearby discoverable Bluetooth devices without requiring authentication or pairing.
Question 6: An organization implements a proxy server that terminates client SSL sessions, inspects decrypted content, then re-encrypts and forwards traffic. This is BEST described as:
- SSL offloading
- SSL/TLS inspection (man-in-the-middle proxy) (Correct answer)
- VPN split tunneling
- TLS mutual authentication
Correct answer: SSL/TLS inspection (man-in-the-middle proxy)
SSL/TLS inspection proxies act as a controlled man-in-the-middle, decrypting traffic for content inspection then re-encrypting to the destination server.
Question 7: Which network protocol allows multiple physical WAN links to be combined into a single logical channel for increased bandwidth and redundancy?
- OSPF equal-cost multipath (ECMP)
- Link Aggregation Control Protocol (LACP / 802.3ad) (Correct answer)
- Spanning Tree Protocol (STP)
- Border Gateway Protocol (BGP)
Correct answer: Link Aggregation Control Protocol (LACP / 802.3ad)
LACP (802.3ad) negotiates link aggregation between devices, bundling multiple physical links into a single logical interface for both throughput and redundancy.
CISSP Communication and Network Security 5
Which protocol is used by network devices to dynamically assign IP addresses and provide configuration parameters to hosts?