SSCP Network & Communications Security 2 — Questions and Answers
Question 1: Which protocol provides secure key exchange using asymmetric cryptography before establishing a symmetric session key?
- Diffie-Hellman (Correct answer)
- MD5
- AES-256
- SHA-2
Correct answer: Diffie-Hellman
Diffie-Hellman allows two parties to establish a shared secret over an insecure channel using asymmetric math, then use that secret for symmetric encryption.
Question 2: A network administrator wants to prevent MAC address flooding attacks. Which switch feature is most effective?
- Port security with MAC limiting (Correct answer)
- Spanning Tree Protocol
- VLAN trunking
- SNMP polling
Correct answer: Port security with MAC limiting
Port security limits the number of MAC addresses learned on a switch port, preventing attackers from flooding the CAM table and forcing the switch to broadcast all frames.
Question 3: What is the primary purpose of a DMZ (Demilitarized Zone) in network architecture?
- Host public-facing services while isolating the internal network (Correct answer)
- Store encrypted backups offsite
- Route traffic between VLANs
- Monitor intrusion detection alerts
Correct answer: Host public-facing services while isolating the internal network
A DMZ places public-facing servers (web, email, DNS) in a segment separated from the internal trusted network, limiting breach impact.
Question 4: Which attack exploits the predictable initial sequence numbers in TCP connections to impersonate a trusted host?
- TCP session hijacking (Correct answer)
- ARP poisoning
- DNS amplification
- Smurf attack
Correct answer: TCP session hijacking
TCP session hijacking relies on predicting or intercepting sequence numbers to inject packets that appear to come from a legitimate, trusted endpoint.
Question 5: WPA3 improved upon WPA2 primarily by replacing PSK authentication with which mechanism?
- SAE (Simultaneous Authentication of Equals) (Correct answer)
- TKIP
- RC4 stream cipher
- EAP-TLS only
Correct answer: SAE (Simultaneous Authentication of Equals)
WPA3 uses SAE (Dragonfly handshake) instead of the PSK 4-way handshake, providing forward secrecy and resistance to offline dictionary attacks.
Question 6: An organization deploys a network device that reassembles fragmented packets and inspects them before forwarding. What type of device is this?
- Stateful inspection firewall (Correct answer)
- Hub
- Passive tap
- Layer 2 switch
Correct answer: Stateful inspection firewall
A stateful inspection firewall tracks connection state and can reassemble fragmented packets to detect attacks that exploit fragmentation.
Question 7: Which routing protocol uses MD5 or SHA authentication to prevent route injection attacks?
- OSPF with cryptographic authentication (Correct answer)
- RIP version 1
- BGP without authentication
- ICMP redirect
Correct answer: OSPF with cryptographic authentication
OSPF supports MD5 and SHA-HMAC authentication on adjacencies, ensuring only legitimate routers can inject routing updates.
SSCP Network & Communications Security 2
Which protocol provides secure key exchange using asymmetric cryptography before establishing a symmetric session key?