SSCP Network & Communications Security 4 — Questions and Answers
Question 1: Which network security control operates at OSI Layer 7 and can inspect HTTP application-layer content?
- Web Application Firewall (WAF) (Correct answer)
- Packet-filtering firewall
- Layer 2 switch
- ICMP proxy
Correct answer: Web Application Firewall (WAF)
A WAF inspects HTTP/HTTPS requests at the application layer to detect and block SQL injection, XSS, and other web-layer attacks.
Question 2: What is the purpose of DNSSEC?
- Digitally sign DNS records to ensure authenticity and integrity (Correct answer)
- Encrypt DNS query payloads between client and resolver
- Block malicious domains via reputation feeds
- Cache DNS responses for faster resolution
Correct answer: Digitally sign DNS records to ensure authenticity and integrity
DNSSEC uses public key cryptography to digitally sign DNS zone records, allowing resolvers to verify that responses have not been tampered with.
Question 3: A security team detects a large volume of UDP packets sent to broadcast addresses with a spoofed victim source IP. What attack is occurring?
- Smurf attack (Correct answer)
- Teardrop attack
- SYN flood
- Ping of Death
Correct answer: Smurf attack
A Smurf attack spoofs the victim's IP as the source and sends ICMP echo requests to broadcast addresses, causing all hosts to reply to the victim simultaneously.
Question 4: Which NAC (Network Access Control) approach checks endpoint compliance before granting network access?
- Pre-admission NAC (Correct answer)
- Post-admission NAC
- Out-of-band NAC only
- VLAN hopping
Correct answer: Pre-admission NAC
Pre-admission NAC evaluates endpoint posture (patch level, AV status, configuration) before allowing the device to access network resources.
Question 5: What security mechanism does 802.11i (WPA2 Enterprise) use that authenticates users against a centralized directory?
- EAP with RADIUS server (Correct answer)
- WEP with rotating keys
- MAC address filtering only
- WPS push-button pairing
Correct answer: EAP with RADIUS server
WPA2 Enterprise uses 802.1X with EAP protocols and a RADIUS server to authenticate individual users against a directory like Active Directory.
Question 6: An attacker intercepts network traffic and replays a captured authentication token hours later. Which countermeasure specifically addresses this threat?
- Timestamp validation or nonce-based challenge-response (Correct answer)
- Increasing key length to 4096 bits
- Switching from TCP to UDP
- Implementing QoS policies
Correct answer: Timestamp validation or nonce-based challenge-response
Timestamps with acceptable skew windows or single-use nonces ensure captured tokens cannot be reused after a brief validity period.
Question 7: Which layer of the OSI model does IPsec Tunnel Mode encapsulate the entire original IP packet?
- Network layer (Layer 3) (Correct answer)
- Data link layer (Layer 2)
- Transport layer (Layer 4)
- Application layer (Layer 7)
Correct answer: Network layer (Layer 3)
IPsec Tunnel Mode wraps the entire original IP packet with a new IP header and ESP/AH protection at Layer 3, hiding the original source and destination.
SSCP Network & Communications Security 4
Which network security control operates at OSI Layer 7 and can inspect HTTP application-layer content?