SSCP Certification SSCP Network Communications Security 3 — Questions and Answers
Question 1: Which type of firewall can track the state of active network connections and make decisions based on connection context?
- Packet filtering firewall
- Stateful inspection firewall (Correct answer)
- Application-layer gateway
- Circuit-level gateway
Correct answer: Stateful inspection firewall
Stateful inspection firewalls maintain a state table of active connections and evaluate packets in the context of established sessions.
Question 2: A network engineer wants to isolate IoT devices from corporate systems on the same physical switch. Which technology achieves this?
- Spanning tree protocol
- VLAN segmentation (Correct answer)
- Port mirroring
- Link aggregation
Correct answer: VLAN segmentation
VLANs logically segment a physical switch into isolated broadcast domains, preventing direct communication between device groups.
Question 3: What is the main purpose of Network Address Translation (NAT) from a security perspective?
- Encrypting internal IP traffic
- Hiding internal IP addresses from external networks (Correct answer)
- Authenticating inbound connections
- Filtering malicious packets
Correct answer: Hiding internal IP addresses from external networks
NAT obscures internal network addressing by presenting a single public IP, making it harder to directly target internal hosts.
Question 4: Which Wi-Fi attack captures the four-way handshake to perform offline brute-force attacks against the passphrase?
- Evil twin attack
- WPA2 handshake capture attack (Correct answer)
- KRACK attack
- Deauthentication flood
Correct answer: WPA2 handshake capture attack
Capturing the WPA2 four-way handshake allows an attacker to perform offline dictionary or brute-force attacks against the pre-shared key.
Question 5: What distinguishes an IPS from an IDS in network security deployments?
- IPS operates at the application layer while IDS operates at the network layer
- IPS can actively block malicious traffic while IDS only detects and alerts (Correct answer)
- IPS uses signatures while IDS uses anomaly detection
- IPS requires an agent while IDS is agentless
Correct answer: IPS can actively block malicious traffic while IDS only detects and alerts
An IPS is deployed inline and can drop or modify malicious packets in real time, while an IDS passively monitors and generates alerts.
Question 6: Which protocol is used by RADIUS to transport authentication messages between the NAS and authentication server?
- TCP port 389
- UDP ports 1812/1813 (Correct answer)
- TCP port 636
- UDP port 514
Correct answer: UDP ports 1812/1813
RADIUS uses UDP port 1812 for authentication/authorization and UDP port 1813 for accounting by default.
Question 7: A company deploys a honeynet to study attacker behavior. What is the PRIMARY security benefit?
- Blocking attacks before they reach production systems
- Gathering threat intelligence on attacker tools and techniques (Correct answer)
- Reducing false positives in the IDS
- Encrypting sensitive data at rest
Correct answer: Gathering threat intelligence on attacker tools and techniques
Honeynets attract attackers to decoy systems, allowing defenders to observe TTPs without risking production data.
SSCP Certification SSCP Network Communications Security 3
Which type of firewall can track the state of active network connections and make decisions based on connection context?