CSX CSX Network Security Fundamentals 2 — Questions and Answers
Question 1: Which attack exploits the lack of source validation in DNS to amplify traffic toward a victim?
- SQL injection
- DNS amplification attack (Correct answer)
- ARP poisoning
- Session hijacking
Correct answer: DNS amplification attack
DNS amplification attacks send forged DNS queries with the victim's IP as the source, causing large response floods.
Question 2: What is the purpose of network access control (NAC) in a corporate environment?
- Encrypting emails
- Ensuring only compliant and authenticated devices connect to the network (Correct answer)
- Blocking all external web traffic
- Scanning for malware in email attachments
Correct answer: Ensuring only compliant and authenticated devices connect to the network
NAC enforces security policies by verifying device health and identity before granting network access.
Question 3: Which protocol is used to securely manage network devices by encrypting the management session?
- Telnet
- SNMP v1
- SSH (Correct answer)
- FTP
Correct answer: SSH
SSH encrypts management sessions, replacing insecure protocols like Telnet that transmit data in plaintext.
Question 4: What does an IDS (Intrusion Detection System) do that differentiates it from an IPS?
- It actively blocks malicious traffic
- It generates and enforces firewall rules
- It monitors and alerts on suspicious activity without blocking (Correct answer)
- It performs vulnerability scanning on endpoints
Correct answer: It monitors and alerts on suspicious activity without blocking
An IDS passively monitors traffic and generates alerts, while an IPS actively blocks detected threats.
Question 5: Which of the following best describes a man-in-the-middle (MitM) attack?
- An attacker floods a server with traffic to cause downtime
- An attacker intercepts and potentially alters communication between two parties (Correct answer)
- An attacker gains physical access to a server room
- An attacker exploits a buffer overflow to execute code
Correct answer: An attacker intercepts and potentially alters communication between two parties
In a MitM attack, the adversary secretly intercepts and can modify communications between two parties who believe they are communicating directly.
Question 6: What security control helps mitigate ARP spoofing attacks on a local network?
- Dynamic ARP Inspection (DAI) (Correct answer)
- Spanning Tree Protocol (STP)
- Border Gateway Protocol (BGP)
- Open Shortest Path First (OSPF)
Correct answer: Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection validates ARP packets against a trusted DHCP snooping binding table to prevent spoofing.
CSX CSX Network Security Fundamentals 2
Which attack exploits the lack of source validation in DNS to amplify traffic toward a victim?