SSCP Network Communications Security Questions and Answers

Question 1

A network administrator needs to implement a VPN solution that encrypts the entire IP packet, including the header and payload, providing the highest level of security for site-to-site communication. Which protocol and mode should be implemented?

Accepted Answer

IPsec in Tunnel mode

Answer

IPsec in Tunnel mode is the correct choice because it encrypts the entire original IP packet (both the header and payload) and encapsulates it within a new IP packet. This provides robust security for gateway-to-gateway or site-to-site VPNs, hiding the original source and destination IP addresses. IPsec Transport mode only encrypts the payload, leaving the original header intact. SSL/TLS operates at the application layer and is typically used for client-to-server VPNs, not for encrypting entire network packets between sites. L2TP itself does not provide encryption and relying on PAP for authentication is highly insecure.

Question 2

An organization is upgrading its wireless network security. The primary goal is to protect against offline dictionary attacks and provide individualized data encryption, even on open, public-facing guest networks. Which wireless security standard BEST meets these requirements?

Accepted Answer

WPA3

Answer

WPA3 is the most advanced wireless security standard and directly addresses the requirements. It introduces Simultaneous Authentication of Equals (SAE), which replaces the Pre-Shared Key (PSK) method of WPA2 and is inherently resistant to offline dictionary attacks. WPA3 also provides individualized data encryption on open networks, meaning each user's traffic is encrypted separately even without a password. WPA2 is vulnerable to offline dictionary attacks (like KRACK), WPA is outdated, and WEP is completely insecure.

Question 3

A security analyst is reviewing network traffic logs and notices that a workstation is communicating with a command-and-control server using encrypted DNS queries. At which layer of the OSI model is this malicious activity primarily occurring?

Accepted Answer

Layer 7 (Application)

Answer

DNS (Domain Name System) is an Application layer (Layer 7) protocol. Even when encrypted (e.g., DNS over HTTPS or DNS over TLS), the communication is initiated by and serves an application-level function—translating domain names to IP addresses. The malicious activity is leveraging this high-level protocol to conceal its communications. Layers 2, 3, and 4 are involved in transporting the data, but the protocol itself and its misuse originate at Layer 7.

Question 4

A company wants to implement a Network Access Control (NAC) solution to ensure that only devices with up-to-date antivirus software and the latest OS patches can connect to the internal corporate network. When a device attempts to connect, the NAC system must verify its compliance before granting access. This process is known as:

Accepted Answer

Posture assessment

Answer

Posture assessment is the process used by Network Access Control (NAC) solutions to check the security compliance of a device before allowing it to connect to the network. This includes verifying attributes like the status of antivirus software, OS patch levels, and firewall configuration. Vulnerability scanning is a broader process of identifying weaknesses, intrusion detection involves monitoring for malicious activity, and MAC filtering is a simpler control based only on the device's hardware address.

Question 5

Which of the following security mechanisms is specifically designed to provide confidentiality, integrity, and authentication for IP packets at the network layer, making it suitable for securing both TCP and UDP traffic without application awareness?

Accepted Answer

IPsec (Internet Protocol Security)

Answer

IPsec (Internet Protocol Security) operates at the Network layer (Layer 3) of the OSI model and is designed to secure all IP traffic between two endpoints, regardless of the application generating the traffic (e.g., TCP, UDP). TLS operates at a higher layer, securing application-specific traffic. SSH is primarily for secure remote administration, and S/MIME is for securing email messages.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Network Communications Security Questions and Answers