CSCU Securing Network Connections 2 — Questions and Answers

Question 1: What is the primary function of a Virtual Private Network (VPN)?

To increase internet connection speed
To create an encrypted tunnel for data transmission, protecting privacy and security on untrusted networks (Correct answer)
To provide free internet access
To block all advertisements while browsing

Correct answer: To create an encrypted tunnel for data transmission, protecting privacy and security on untrusted networks

A VPN creates an encrypted tunnel between your device and a VPN server, protecting data from interception on untrusted networks and masking your IP address from websites.

A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a VPN server, routing all internet traffic through this secure connection. The primary functions are: encryption of data in transit (preventing eavesdropping on unsecured networks like public Wi-Fi), IP address masking (websites see the VPN server's IP instead of yours, enhancing privacy), and bypassing geographic restrictions. VPN protocols include OpenVPN, WireGuard, IKEv2/IPSec, and L2TP/IPSec, each with different security and performance characteristics. While VPNs significantly enhance security on untrusted networks, they are not a complete privacy solution—the VPN provider can see your traffic, DNS leaks may expose browsing activity, and websites can still track you through cookies, fingerprinting, and account logins. Choosing a reputable VPN provider with a verified no-logs policy, strong encryption, and a kill switch (which blocks internet if VPN drops) is essential.

Question 2: What is the difference between WPA2 and WPA3 wireless security protocols?

WPA3 is older than WPA2
WPA3 provides stronger encryption, protection against offline dictionary attacks, and individualized data encryption for each device on the network (Correct answer)
WPA2 is more secure than WPA3
There is no meaningful difference between them

Correct answer: WPA3 provides stronger encryption, protection against offline dictionary attacks, and individualized data encryption for each device on the network

WPA3 improves upon WPA2 with Simultaneous Authentication of Equals (SAE) that prevents offline dictionary attacks, individualized encryption per device, and mandatory Protected Management Frames.

WPA3 (Wi-Fi Protected Access 3), released in 2018, addresses several vulnerabilities in WPA2. Key improvements include: Simultaneous Authentication of Equals (SAE), replacing the Pre-Shared Key (PSK) exchange with a more secure handshake that resists offline dictionary attacks—an attacker who captures the handshake cannot take it offline to crack the password; forward secrecy, ensuring that compromise of the current session key does not compromise past sessions; individualized data encryption, where each device's connection to the access point is encrypted with a unique key, preventing other devices on the same network from decrypting each other's traffic (a significant vulnerability in WPA2-Personal where all devices share the same encryption key); and mandatory Protected Management Frames (PMF) that prevent deauthentication attacks. WPA3-Enterprise mode offers 192-bit security for sensitive environments. While WPA3 adoption is growing, many networks still use WPA2, and transition modes support both protocols simultaneously.

Question 3: What is ARP spoofing and how does it threaten network security?

A method to speed up network connections
An attack that manipulates the Address Resolution Protocol to redirect network traffic through the attacker's device (Correct answer)
A technique for testing network speed
A wireless signal amplification method

Correct answer: An attack that manipulates the Address Resolution Protocol to redirect network traffic through the attacker's device

ARP spoofing sends falsified ARP messages to link the attacker's MAC address with a legitimate IP address, causing traffic intended for that IP to be sent to the attacker instead.

ARP (Address Resolution Protocol) spoofing is a network attack where an attacker sends forged ARP messages to a local area network. ARP is used to map IP addresses to MAC (hardware) addresses on a network. By sending fake ARP replies, the attacker associates their own MAC address with the IP address of a legitimate network device—typically the default gateway (router). This causes other devices on the network to send traffic intended for the gateway to the attacker's device instead. The attacker can then: intercept and read all network traffic (man-in-the-middle attack), modify data in transit, steal credentials and session tokens, redirect users to malicious websites, or deny service by dropping traffic. ARP spoofing is particularly effective on local networks (LANs) including corporate networks and public Wi-Fi. Countermeasures include Dynamic ARP Inspection (DAI) on managed switches, static ARP entries for critical devices, VPN usage, and network monitoring tools that detect ARP anomalies.

Question 4: Why should you disable Wi-Fi auto-connect on your mobile devices?

It saves battery life
Auto-connect may join malicious networks that impersonate trusted ones, exposing your data to attackers (Correct answer)
Auto-connect slows down the device
It prevents receiving phone calls

Correct answer: Auto-connect may join malicious networks that impersonate trusted ones, exposing your data to attackers

Auto-connect can cause your device to join rogue access points that mimic the names of networks you have previously connected to, enabling attackers to intercept your traffic.

When Wi-Fi auto-connect is enabled, your device broadcasts probe requests for previously connected networks and automatically connects to any access point with a matching network name (SSID). Attackers exploit this through evil twin attacks—setting up rogue access points with common SSIDs (like 'Airport Free WiFi', 'Starbucks', or 'Hotel_Guest') that your device may have previously connected to. When your device auto-connects to the rogue AP, all your network traffic flows through the attacker's device, enabling man-in-the-middle attacks, credential theft, and session hijacking. Even more concerning, modern attacks can respond to any probe request with a matching SSID, meaning the attacker's AP automatically impersonates whatever network your device is looking for. To protect yourself: disable auto-connect for Wi-Fi networks, forget networks you no longer use, manually connect only when you need Wi-Fi, use a VPN when connecting to any public network, and verify the correct network name with the establishment.

Question 5: What is network segmentation and why is it important for security?

Splitting a network cable into multiple connections
Dividing a network into isolated segments to contain breaches and limit attacker movement between segments (Correct answer)
Measuring network cable lengths
Connecting multiple networks into one large network

Correct answer: Dividing a network into isolated segments to contain breaches and limit attacker movement between segments

Network segmentation divides a network into separate zones with access controls between them, limiting the lateral movement of attackers and containing the impact of a security breach.

Network segmentation is the practice of dividing a computer network into smaller, isolated subnetworks (segments or zones), each with its own security controls and access policies. This is a fundamental security principle because it: limits lateral movement—if an attacker compromises one segment, they cannot easily move to others; contains the blast radius of security incidents; protects sensitive resources by placing them in restricted segments; reduces the attack surface visible from any given point; enables more granular security policies per segment; and simplifies compliance by isolating systems subject to specific regulations (like PCI DSS for payment processing). Implementation methods include VLANs, firewalls between segments, access control lists (ACLs), and software-defined networking (SDN). Common segmentation patterns include separating guest networks, IoT devices, development environments, and production servers. The most advanced form—micro-segmentation—applies security controls at the individual workload level, embodying zero-trust principles.

Question 6: What is a DNS spoofing attack?

Creating a fake website that looks like DNS
Corrupting DNS records to redirect users from legitimate websites to malicious ones without their knowledge (Correct answer)
A technique to speed up DNS resolution
Registering a domain name similar to a popular website

Correct answer: Corrupting DNS records to redirect users from legitimate websites to malicious ones without their knowledge

DNS spoofing (or DNS cache poisoning) corrupts DNS resolution so that queries for legitimate domain names return attacker-controlled IP addresses, silently redirecting users to malicious sites.

DNS spoofing (also called DNS cache poisoning) is an attack that corrupts the Domain Name System resolution process, causing legitimate domain names to resolve to attacker-controlled IP addresses. When a user types a website address, their computer queries DNS servers to translate the domain name into an IP address. In a DNS spoofing attack, the attacker injects false DNS records into a DNS resolver's cache, so subsequent queries return the attacker's IP address instead of the legitimate one. Users are silently redirected to malicious websites that may perfectly replicate the legitimate site, capturing login credentials, financial information, or installing malware. The attack is particularly dangerous because the URL in the browser appears correct—the user typed the right address but was sent to the wrong server. Protection includes using DNSSEC (which cryptographically signs DNS records), DNS-over-HTTPS or DNS-over-TLS, maintaining updated DNS server software, and monitoring for unusual DNS behavior.

CSCU Securing Network Connections 2

What is the primary function of a Virtual Private Network (VPN)?

🃏 CSCU Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CSCU Study Guide →