SSCP Network Communications Security Questions and Answers — Questions and Answers
Question 1: A network administrator needs to implement a VPN solution that encrypts the entire IP packet, including the header and payload, providing the highest level of security for site-to-site communication. Which protocol and mode should be implemented?
- SSL/TLS in any mode
- IPsec in Transport mode
- IPsec in Tunnel mode (Correct answer)
- L2TP with PAP
Correct answer: IPsec in Tunnel mode
IPsec in Tunnel mode is the correct choice because it encrypts the entire original IP packet (both the header and payload) and encapsulates it within a new IP packet. This provides robust security for gateway-to-gateway or site-to-site VPNs, hiding the original source and destination IP addresses. IPsec Transport mode only encrypts the payload, leaving the original header intact. SSL/TLS operates at the application layer and is typically used for client-to-server VPNs, not for encrypting entire network packets between sites. L2TP itself does not provide encryption and relying on PAP for authentication is highly insecure.
Question 2: An organization is upgrading its wireless network security. The primary goal is to protect against offline dictionary attacks and provide individualized data encryption, even on open, public-facing guest networks. Which wireless security standard BEST meets these requirements?
- WPA2-Personal with AES
- WPA with TKIP
- WPA3 (Correct answer)
- WEP
Correct answer: WPA3
WPA3 is the most advanced wireless security standard and directly addresses the requirements. It introduces Simultaneous Authentication of Equals (SAE), which replaces the Pre-Shared Key (PSK) method of WPA2 and is inherently resistant to offline dictionary attacks. WPA3 also provides individualized data encryption on open networks, meaning each user's traffic is encrypted separately even without a password. WPA2 is vulnerable to offline dictionary attacks (like KRACK), WPA is outdated, and WEP is completely insecure.
Question 3: A security analyst is reviewing network traffic logs and notices that a workstation is communicating with a command-and-control server using encrypted DNS queries. At which layer of the OSI model is this malicious activity primarily occurring?
- Layer 2 (Data Link)
- Layer 3 (Network)
- Layer 4 (Transport)
- Layer 7 (Application) (Correct answer)
Correct answer: Layer 7 (Application)
DNS (Domain Name System) is an Application layer (Layer 7) protocol. Even when encrypted (e.g., DNS over HTTPS or DNS over TLS), the communication is initiated by and serves an application-level function—translating domain names to IP addresses. The malicious activity is leveraging this high-level protocol to conceal its communications. Layers 2, 3, and 4 are involved in transporting the data, but the protocol itself and its misuse originate at Layer 7.
Question 4: A company wants to implement a Network Access Control (NAC) solution to ensure that only devices with up-to-date antivirus software and the latest OS patches can connect to the internal corporate network. When a device attempts to connect, the NAC system must verify its compliance before granting access. This process is known as:
- Posture assessment (Correct answer)
- Vulnerability scanning
- Intrusion detection
- MAC filtering
Correct answer: Posture assessment
Posture assessment is the process used by Network Access Control (NAC) solutions to check the security compliance of a device before allowing it to connect to the network. This includes verifying attributes like the status of antivirus software, OS patch levels, and firewall configuration. Vulnerability scanning is a broader process of identifying weaknesses, intrusion detection involves monitoring for malicious activity, and MAC filtering is a simpler control based only on the device's hardware address.
Question 5: Which of the following security mechanisms is specifically designed to provide confidentiality, integrity, and authentication for IP packets at the network layer, making it suitable for securing both TCP and UDP traffic without application awareness?
- TLS (Transport Layer Security)
- SSH (Secure Shell)
- S/MIME (Secure/Multipurpose Internet Mail Extensions)
- IPsec (Internet Protocol Security) (Correct answer)
Correct answer: IPsec (Internet Protocol Security)
IPsec (Internet Protocol Security) operates at the Network layer (Layer 3) of the OSI model and is designed to secure all IP traffic between two endpoints, regardless of the application generating the traffic (e.g., TCP, UDP). TLS operates at a higher layer, securing application-specific traffic. SSH is primarily for secure remote administration, and S/MIME is for securing email messages.
Question 6: A security team is deploying a new firewall. The policy requires that all traffic be denied by default, and only traffic that matches a specific set of rules for approved protocols, source/destination IPs, and ports is permitted. Which firewall rule-based logic does this scenario describe?
- Implicit allow
- Stateless inspection
- Implicit deny (Correct answer)
- Stateful inspection
Correct answer: Implicit deny
The principle of 'implicit deny' is a fundamental security best practice for firewalls. It means that unless a specific rule explicitly allows a packet to pass, it will be blocked. This forces administrators to create explicit 'allow' rules for all necessary traffic, adhering to the principle of least privilege. 'Implicit allow' would be the opposite and highly insecure. While the firewall may be stateful or stateless, the core logic described is implicit deny.
SSCP Network Communications Security Questions and Answers
A network administrator needs to implement a VPN solution that encrypts the entire IP packet, including the header and payload, providing the highest level of security for site-to-site communication.
Which protocol and mode should be implemented?