NSE Network Security Protocols & Technologies 4 — Questions and Answers
Question 1: What vulnerability does a TLS downgrade attack such as POODLE exploit?
- Weak RSA key generation
- Fallback to older, weaker protocol versions like SSLv3 (Correct answer)
- HMAC collision in SHA-1
- Certificate chain misconfiguration
Correct answer: Fallback to older, weaker protocol versions like SSLv3
POODLE exploits servers and clients that fall back to SSLv3, which has a CBC padding oracle vulnerability allowing decryption of ciphertext.
Question 2: In a split-tunnel VPN configuration, which traffic is sent through the encrypted VPN tunnel?
- All internet-bound traffic
- Only traffic destined for the corporate network (Correct answer)
- Only DNS queries
- All UDP traffic regardless of destination
Correct answer: Only traffic destined for the corporate network
Split tunneling routes only corporate-destined traffic through the VPN, while general internet traffic goes directly through the local ISP.
Question 3: Which RADIUS attribute is most commonly used to assign a VLAN to an authenticated user upon 802.1X success?
- Attribute 6 (Service-Type)
- Attribute 25 (Class)
- Attributes 64, 65, and 81 (Tunnel attributes) (Correct answer)
- Attribute 8 (Framed-IP-Address)
Correct answer: Attributes 64, 65, and 81 (Tunnel attributes)
RADIUS Tunnel-Type (64), Tunnel-Medium-Type (65), and Tunnel-Private-Group-ID (81) are used together to dynamically assign a VLAN after 802.1X authentication.
Question 4: What is the purpose of the Diffie-Hellman group parameter in an IPsec IKE Phase 1 negotiation?
- It selects the symmetric encryption algorithm for the tunnel
- It defines the modulus size or elliptic curve used for the key exchange (Correct answer)
- It sets the authentication method (PSK vs. certificates)
- It determines the lifetime of the IKE SA in seconds
Correct answer: It defines the modulus size or elliptic curve used for the key exchange
The DH group specifies the mathematical parameters (prime modulus size or EC curve) that determine the strength of the key exchange.
Question 5: Which attack targets the BGP routing protocol by injecting false route advertisements to redirect internet traffic?
- ARP poisoning
- BGP hijacking (Correct answer)
- DNS cache poisoning
- OSPF LSA flooding
Correct answer: BGP hijacking
BGP hijacking occurs when a router announces more-specific or falsified prefixes, causing other ASes to route traffic through the attacker's network.
Question 6: In the context of network segmentation, what security principle does a DMZ (demilitarized zone) implement?
- Least privilege for users
- Defense in depth by isolating public-facing servers from internal networks (Correct answer)
- Zero trust by requiring MFA for all zones
- Data loss prevention for outbound traffic
Correct answer: Defense in depth by isolating public-facing servers from internal networks
A DMZ places public-facing services in a separate zone between the internet and the internal network, limiting the blast radius if those services are compromised.
Question 7: What is the role of a Hardware Security Module (HSM) in a PKI deployment?
- It scans TLS traffic for malware without decryption
- It securely generates, stores, and performs operations with CA private keys (Correct answer)
- It acts as a registration authority for certificate requests
- It distributes CRLs to relying parties
Correct answer: It securely generates, stores, and performs operations with CA private keys
An HSM provides tamper-resistant hardware that protects CA private keys and ensures cryptographic operations are performed within the secure boundary.
NSE Network Security Protocols & Technologies 4
What vulnerability does a TLS downgrade attack such as POODLE exploit?