NSE Network Security Protocols & Technologies 5 — Questions and Answers
Question 1: Which protocol is the IETF standard replacement for the deprecated SSL and early TLS versions, currently at version 1.3?
- DTLS
- TLS 1.3 (Correct answer)
- QUIC
- mTLS
Correct answer: TLS 1.3
TLS 1.3 is the current IETF standard (RFC 8446), removing insecure features like RSA key exchange and requiring forward-secret cipher suites.
Question 2: What does the term 'perfect forward secrecy' (PFS) guarantee in a TLS session?
- Each packet is encrypted with a unique symmetric key
- Compromise of the long-term private key does not expose past session keys (Correct answer)
- The server certificate is re-issued for each new connection
- Session resumption tokens are encrypted with AES-256
Correct answer: Compromise of the long-term private key does not expose past session keys
PFS uses ephemeral key exchange (ECDHE/DHE) so that session keys are generated fresh each time and cannot be derived from the server's private key.
Question 3: Which type of DNS attack poisons a resolver's cache with forged responses to redirect users to malicious IP addresses?
- DNS amplification
- DNS tunneling
- DNS cache poisoning (Kaminsky attack) (Correct answer)
- NXDOMAIN hijacking
Correct answer: DNS cache poisoning (Kaminsky attack)
The Kaminsky attack exploits the DNS transaction ID space to inject forged responses into a resolver's cache before the legitimate reply arrives.
Question 4: In a zero-trust network architecture, what replaces the concept of a trusted internal network perimeter?
- A more robust VPN concentrator
- Continuous verification of identity and device posture for every access request (Correct answer)
- Increased use of network segmentation with VLANs
- Air-gapped network segments for sensitive data
Correct answer: Continuous verification of identity and device posture for every access request
Zero trust eliminates implicit trust based on network location and instead verifies every user, device, and session before granting access.
Question 5: What is the primary security risk mitigated by enabling BPDU Guard on an access switch port?
- MAC flooding attacks
- Rogue switches causing spanning tree topology changes (Correct answer)
- VLAN hopping via double tagging
- ARP spoofing on the local segment
Correct answer: Rogue switches causing spanning tree topology changes
BPDU Guard shuts down an access port if it receives a BPDU frame, preventing rogue switches or tools from manipulating the STP topology.
Question 6: Which encryption mode is vulnerable to block-level substitution attacks because identical plaintext blocks produce identical ciphertext blocks?
- CBC (Cipher Block Chaining)
- CTR (Counter mode)
- GCM (Galois/Counter Mode)
- ECB (Electronic Codebook) (Correct answer)
Correct answer: ECB (Electronic Codebook)
ECB mode encrypts each block independently, so identical plaintext blocks always produce identical ciphertext, leaking data patterns.
Question 7: What is the function of a Security Assertion Markup Language (SAML) Identity Provider (IdP) in federated authentication?
- It stores encrypted passwords for all service providers
- It authenticates the user and issues signed assertions that service providers trust (Correct answer)
- It acts as a proxy that terminates TLS on behalf of the service provider
- It generates one-time passwords and delivers them via SMS
Correct answer: It authenticates the user and issues signed assertions that service providers trust
The SAML IdP authenticates the user and produces a signed XML assertion that service providers (SPs) validate to grant access without re-authenticating.
NSE Network Security Protocols & Technologies 5
Which protocol is the IETF standard replacement for the deprecated SSL and early TLS versions, currently at version 1.3?