CompTIA Network+ Network+ Network Security 3 — Questions and Answers
Question 1: Which type of IDS/IPS detection method identifies threats by looking for deviations from a learned baseline of normal behavior?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Heuristic scanning
- Protocol analysis
Correct answer: Anomaly-based detection
Anomaly-based detection establishes a baseline of normal traffic patterns and flags deviations, making it effective against novel attacks.
Question 2: An attacker sends thousands of SYN packets without completing the three-way handshake. What attack is being performed?
- Smurf attack
- SYN flood (Correct answer)
- Ping of death
- Fraggle attack
Correct answer: SYN flood
A SYN flood exhausts a server's connection table by sending SYN packets and never sending the final ACK, leaving half-open connections.
Question 3: Which security framework uses the concept of 'never trust, always verify' as its core principle?
- Defense-in-depth
- Zero Trust (Correct answer)
- Security through obscurity
- Least privilege
Correct answer: Zero Trust
Zero Trust assumes no user or device is inherently trusted, requiring continuous verification regardless of network location.
Question 4: What is the function of a RADIUS server in network security?
- Encrypts VPN tunnels between branch offices
- Provides centralized authentication, authorization, and accounting for network access (Correct answer)
- Scans packets for malware signatures
- Assigns IP addresses to wireless clients
Correct answer: Provides centralized authentication, authorization, and accounting for network access
RADIUS (Remote Authentication Dial-In User Service) centralizes AAA services, allowing network devices to authenticate users against a single server.
Question 5: Which attack technique involves an attacker sending a spoofed ICMP echo request to a network broadcast address to amplify a DoS attack?
- Land attack
- Smurf attack (Correct answer)
- Teardrop attack
- Nuke attack
Correct answer: Smurf attack
A Smurf attack sends spoofed ICMP echo requests to a broadcast address so all hosts on that network reply to the victim's spoofed source IP.
Question 6: What does DNSSEC add to standard DNS to prevent DNS cache poisoning?
- Encryption of DNS queries and responses
- Digital signatures to validate DNS records (Correct answer)
- Rate limiting on DNS resolvers
- Two-factor authentication for DNS updates
Correct answer: Digital signatures to validate DNS records
DNSSEC uses public-key cryptography to digitally sign DNS records, allowing resolvers to verify that responses are authentic and unmodified.
Question 7: Which tool is commonly used to perform a man-in-the-middle attack on a LAN by combining ARP poisoning with traffic capture?
- Nmap
- Ettercap (Correct answer)
- Nessus
- Metasploit
Correct answer: Ettercap
Ettercap is an open-source tool that automates ARP poisoning and traffic interception, enabling MITM attacks on local network segments.
CompTIA Network+ Network+ Network Security 3
Which type of IDS/IPS detection method identifies threats by looking for deviations from a learned baseline of normal behavior?