ISC2 CC Network Security 2 — Questions and Answers
Question 1: What is the key difference between an IDS and an IPS?
- An IDS is hardware-based; an IPS is software-based
- An IDS detects and alerts while an IPS also actively blocks detected threats (Correct answer)
- An IPS only monitors incoming traffic while an IDS monitors all traffic
- They are identical in function and can be used interchangeably
Correct answer: An IDS detects and alerts while an IPS also actively blocks detected threats
An IDS monitors and alerts on suspicious activity, while an IPS can additionally take automated action to block detected threats.
Question 2: What protocol does HTTPS use to secure web communications?
- SSL only
- TLS (Transport Layer Security) (Correct answer)
- IPSec
- SSH
Correct answer: TLS (Transport Layer Security)
HTTPS uses TLS (Transport Layer Security) to encrypt communications between web browsers and servers.
Question 3: What is a man-in-the-middle (MITM) attack?
- An attack where a hacker gains physical access to a server
- An attacker secretly intercepting and potentially altering communications between two parties (Correct answer)
- An insider threat from a current or former employee
- An attack targeting database servers with SQL injection
Correct answer: An attacker secretly intercepting and potentially altering communications between two parties
In a MITM attack, an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly.
Question 4: What is a denial of service (DoS) attack?
- Stealing user credentials through phishing
- Overwhelming a system with traffic or requests to make it unavailable to legitimate users (Correct answer)
- Intercepting encrypted network communications
- Escalating privileges on a compromised system
Correct answer: Overwhelming a system with traffic or requests to make it unavailable to legitimate users
A DoS attack floods a system with traffic or requests to overwhelm its resources, making it unavailable to legitimate users.
Question 5: What type of malware replicates itself across networks without requiring user action?
- Trojan
- Virus
- Worm (Correct answer)
- Spyware
Correct answer: Worm
A worm is self-replicating malware that spreads across networks automatically without requiring user interaction or attachment to another file.
Question 6: What is phishing?
- A technique for scanning open network ports
- A social engineering attack using fraudulent communications to steal sensitive information (Correct answer)
- An attack that targets web application databases with malicious queries
- A technique for cracking encrypted passwords offline
Correct answer: A social engineering attack using fraudulent communications to steal sensitive information
Phishing uses fraudulent emails, messages, or websites to trick users into revealing sensitive information like credentials or financial data.
ISC2 CC Network Security 2
What is the key difference between an IDS and an IPS?