CSA Network and Security Administration 2 — Questions and Answers
Question 1: Which protocol uses port 443 by default for encrypted web traffic?
- HTTP
- HTTPS (Correct answer)
- FTP
- SMTP
Correct answer: HTTPS
HTTPS (HTTP Secure) uses TLS encryption and listens on TCP port 443 by default.
Question 2: What does a stateful firewall track that a stateless packet filter does not?
- Source IP addresses
- Destination port numbers
- Active connection state (Correct answer)
- MAC addresses
Correct answer: Active connection state
Stateful firewalls maintain a connection table to track the state of active sessions, allowing them to make smarter allow/deny decisions.
Question 3: An administrator needs to segment a physical network into multiple isolated broadcast domains. Which technology achieves this?
- STP
- VLAN (Correct answer)
- NAT
- ARP
Correct answer: VLAN
VLANs (Virtual Local Area Networks) logically segment a switch into multiple isolated broadcast domains without requiring separate physical hardware.
Question 4: Which type of VPN creates an encrypted tunnel between two routers to connect entire office networks?
- Remote-access VPN
- SSL VPN
- Site-to-site VPN (Correct answer)
- Split-tunnel VPN
Correct answer: Site-to-site VPN
Site-to-site VPNs connect two networks (e.g., branch offices) by establishing a persistent encrypted tunnel between gateway devices.
Question 5: What is the primary purpose of Network Address Translation (NAT)?
- Encrypt packets in transit
- Map private IP addresses to a public IP address (Correct answer)
- Assign IP addresses via DHCP
- Resolve hostnames to IP addresses
Correct answer: Map private IP addresses to a public IP address
NAT translates private internal IP addresses to a public IP address, conserving IPv4 address space and masking internal topology.
Question 6: Which attack exploits trust relationships by forging ARP replies to redirect traffic to a malicious host?
- DNS spoofing
- ARP poisoning (Correct answer)
- IP spoofing
- VLAN hopping
Correct answer: ARP poisoning
ARP poisoning sends forged ARP replies to associate the attacker's MAC address with a legitimate IP, intercepting traffic on the local network.
Question 7: An IDS detects suspicious traffic but takes no automatic blocking action. What differentiates an IPS from an IDS?
- An IPS logs events; an IDS does not
- An IPS can actively block or drop malicious traffic (Correct answer)
- An IPS operates at Layer 7 only
- An IPS requires a separate VLAN
Correct answer: An IPS can actively block or drop malicious traffic
An Intrusion Prevention System (IPS) is inline with traffic and can actively drop or block packets, whereas an IDS only monitors and alerts.
CSA Network and Security Administration 2
Which protocol uses port 443 by default for encrypted web traffic?