SSCP Network & Communications Security 3 — Questions and Answers
Question 1: What distinguishes a site-to-site VPN from a remote-access VPN?
- Site-to-site connects entire networks; remote-access connects individual clients (Correct answer)
- Site-to-site uses SSL; remote-access uses IPsec only
- Site-to-site requires no encryption
- Remote-access VPNs cannot use split tunneling
Correct answer: Site-to-site connects entire networks; remote-access connects individual clients
Site-to-site VPNs create a permanent tunnel between two network gateways, while remote-access VPNs allow individual users to connect securely from any location.
Question 2: Which DNS attack causes a resolver to cache a fraudulent IP mapping for a legitimate domain?
- DNS cache poisoning (Correct answer)
- DNS zone transfer
- DNSSEC validation failure
- Reverse DNS lookup
Correct answer: DNS cache poisoning
DNS cache poisoning (Kaminsky attack) injects a forged DNS response so the resolver stores a malicious IP for a legitimate domain, redirecting users.
Question 3: In the context of 802.1X port-based access control, what is the role of the authenticator?
- Enforce access by relaying credentials to the authentication server (Correct answer)
- Store user credentials locally on the switch
- Generate one-time passwords for clients
- Assign IP addresses via DHCP
Correct answer: Enforce access by relaying credentials to the authentication server
The authenticator (typically a switch or access point) enforces access control by passing supplicant credentials to the RADIUS authentication server.
Question 4: What is the function of IPsec's Authentication Header (AH) protocol?
- Provides data integrity and origin authentication but no confidentiality (Correct answer)
- Encrypts payload data for confidentiality
- Establishes IKE phase 1 tunnels
- Handles NAT traversal exclusively
Correct answer: Provides data integrity and origin authentication but no confidentiality
AH provides integrity protection and authentication for the entire IP packet using HMAC, but unlike ESP it does not encrypt the payload.
Question 5: A security engineer needs to segment a physical network into multiple isolated broadcast domains without buying new hardware. What technology enables this?
- VLANs (Virtual Local Area Networks) (Correct answer)
- STP (Spanning Tree Protocol)
- MPLS tagging
- NAT overload
Correct answer: VLANs (Virtual Local Area Networks)
VLANs logically segment a physical switch into separate broadcast domains using 802.1Q tagging, allowing traffic isolation without additional hardware.
Question 6: Which wireless attack involves creating a rogue access point with the same SSID as a legitimate network to intercept traffic?
- Evil twin attack (Correct answer)
- Deauthentication flood
- WPS PIN brute force
- KRACK attack
Correct answer: Evil twin attack
An evil twin attack deploys a malicious AP broadcasting a legitimate SSID to lure clients into connecting through the attacker's device.
Question 7: What is the primary security benefit of using TLS 1.3 over TLS 1.2?
- Mandatory forward secrecy and removal of weak cipher suites (Correct answer)
- Supports RC4 for legacy compatibility
- Requires longer RSA keys only
- Removes client certificate authentication
Correct answer: Mandatory forward secrecy and removal of weak cipher suites
TLS 1.3 mandates forward secrecy via ephemeral key exchange, eliminates legacy ciphers (RC4, DES, MD5, SHA-1), and reduces handshake round trips.
SSCP Network & Communications Security 3
What distinguishes a site-to-site VPN from a remote-access VPN?