NE NE Network Security 2 — Questions and Answers
Question 1: Which VPN protocol uses UDP port 500 and ESP to create encrypted tunnels between sites?
- PPTP
- L2TP/IPsec
- IPsec IKEv2 (Correct answer)
- SSL/TLS VPN
Correct answer: IPsec IKEv2
IPsec IKEv2 uses UDP 500 for key exchange and ESP (Encapsulating Security Payload) for encryption and integrity.
Question 2: What is the purpose of Network Address Translation (NAT) in relation to security?
- It encrypts all internal traffic
- It hides internal IP addresses from external networks (Correct answer)
- It prevents all port-based attacks
- It authenticates remote users
Correct answer: It hides internal IP addresses from external networks
NAT obscures internal IP addressing by substituting public addresses, making it harder for external parties to map internal topology.
Question 3: Which type of ACL can filter traffic based on both source and destination IP addresses and port numbers?
- Standard ACL
- Extended ACL (Correct answer)
- Dynamic ACL
- Reflexive ACL
Correct answer: Extended ACL
Extended ACLs (Cisco numbered 100–199) match on source/destination IP, protocol, and port, giving granular traffic control.
Question 4: What is a Man-in-the-Middle (MitM) attack?
- Flooding a network with broadcast traffic
- Intercepting and potentially altering communication between two parties (Correct answer)
- Cracking passwords through dictionary attacks
- Exploiting buffer overflow vulnerabilities
Correct answer: Intercepting and potentially altering communication between two parties
In a MitM attack, the attacker secretly relays and can modify messages between two parties who believe they are communicating directly.
Question 5: Which protocol is used to centralize authentication, authorization, and accounting for network access?
- SNMP
- RADIUS (Correct answer)
- DHCP
- LDAP
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) centralizes AAA services, commonly used with 802.1X and VPN authentication.
Question 6: What does the term 'zero-day vulnerability' mean?
- A vulnerability with a patch available for zero days
- A vulnerability that is publicly known but has no vendor patch yet (Correct answer)
- A vulnerability only exploitable for 24 hours
- A vulnerability in newly deployed network hardware
Correct answer: A vulnerability that is publicly known but has no vendor patch yet
A zero-day vulnerability is one that is unknown to the vendor, meaning zero days have passed since the vendor became aware — leaving systems unpatched.
NE NE Network Security 2
Which VPN protocol uses UDP port 500 and ESP to create encrypted tunnels between sites?