NSE Network Security Protocols & Technologies 5

Question 1

Which protocol is the IETF standard replacement for the deprecated SSL and early TLS versions, currently at version 1.3?

Accepted Answer

TLS 1.3

Answer

TLS 1.3 is the current IETF standard (RFC 8446), removing insecure features like RSA key exchange and requiring forward-secret cipher suites.

Question 2

What does the term 'perfect forward secrecy' (PFS) guarantee in a TLS session?

Accepted Answer

Compromise of the long-term private key does not expose past session keys

Answer

PFS uses ephemeral key exchange (ECDHE/DHE) so that session keys are generated fresh each time and cannot be derived from the server's private key.

Question 3

Which type of DNS attack poisons a resolver's cache with forged responses to redirect users to malicious IP addresses?

Accepted Answer

DNS cache poisoning (Kaminsky attack)

Answer

The Kaminsky attack exploits the DNS transaction ID space to inject forged responses into a resolver's cache before the legitimate reply arrives.

Question 4

In a zero-trust network architecture, what replaces the concept of a trusted internal network perimeter?

Accepted Answer

Continuous verification of identity and device posture for every access request

Answer

Zero trust eliminates implicit trust based on network location and instead verifies every user, device, and session before granting access.

Question 5

What is the primary security risk mitigated by enabling BPDU Guard on an access switch port?

Accepted Answer

Rogue switches causing spanning tree topology changes

Answer

BPDU Guard shuts down an access port if it receives a BPDU frame, preventing rogue switches or tools from manipulating the STP topology.

(NSE) Network Security Expert Practice Test