CSS CSS Network Security & Architecture 2 — Questions and Answers
Question 1: Which VPN technology is commonly recommended for modern enterprise deployments due to its simplicity and performance?
- WireGuard (Correct answer)
- PPTP
- L2TP without IPsec
- SLIP
Correct answer: WireGuard
WireGuard is a modern VPN protocol known for its lean codebase, high performance, and strong cryptographic defaults.
Question 2: What does the term 'east-west traffic' refer to in data center network security?
- Lateral traffic between servers within the same data center (Correct answer)
- Traffic flowing from users to the internet
- Encrypted traffic exiting the perimeter
- Traffic between two geographically separated sites
Correct answer: Lateral traffic between servers within the same data center
East-west traffic refers to internal server-to-server communication, which is a key focus for micro-segmentation strategies.
Question 3: Which security mechanism prevents a compromised VLAN from accessing other VLANs through switch exploitation?
- Disabling trunk negotiation and using dedicated native VLANs (Correct answer)
- Enabling spanning tree protocol
- Using dynamic ARP inspection only
- Increasing VLAN ID numbers
Correct answer: Disabling trunk negotiation and using dedicated native VLANs
Disabling Dynamic Trunking Protocol and setting a dedicated unused native VLAN prevents VLAN hopping attacks.
Question 4: What is the primary role of an intrusion prevention system (IPS) compared to an IDS?
- An IPS can actively block malicious traffic, while an IDS only detects and alerts (Correct answer)
- An IPS only monitors encrypted traffic
- An IDS blocks traffic while an IPS only logs
- An IPS operates at Layer 7 only
Correct answer: An IPS can actively block malicious traffic, while an IDS only detects and alerts
An IPS sits inline with traffic and can drop or block malicious packets, whereas an IDS is passive and only generates alerts.
Question 5: Which technique do security teams use to capture and analyze network packets for forensic investigation?
- Packet capture (PCAP) analysis (Correct answer)
- Sandboxing
- Fuzzing
- Tokenization
Correct answer: Packet capture (PCAP) analysis
PCAP files capture raw network traffic that analysts can replay and inspect using tools like Wireshark during investigations.
Question 6: What network security control is designed to detect and prevent unauthorized wireless access points?
- Wireless intrusion prevention system (WIPS) (Correct answer)
- WPA2 encryption
- MAC address filtering
- SSID broadcasting
Correct answer: Wireless intrusion prevention system (WIPS)
A WIPS monitors the radio frequency spectrum to detect rogue access points and automatically mitigate them.
CSS CSS Network Security & Architecture 2
Which VPN technology is commonly recommended for modern enterprise deployments due to its simplicity and performance?