Network Security & Protocols Flashcards
7 cards from real TOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Network Security & Protocols flashcards as text
What is the difference between an IDS and an IPS in network security?
Answer: IDS only detects and alerts on threats; IPS detects and actively blocks them
An Intrusion Detection System (IDS) passively monitors and alerts, while an Intrusion Prevention System (IPS) sits inline and actively blocks malicious traffic.
Which attack exploits the trust relationship between a DNS resolver and its cache to redirect users to malicious sites?
Answer: Pharming via DNS cache poisoning
DNS cache poisoning (pharming) inserts fraudulent DNS records into a resolver's cache, redirecting users to attacker-controlled IP addresses without their knowledge.
A security team wants to monitor all traffic passing through a network switch for analysis. Which switch feature should they enable?
Answer: Port mirroring / SPAN
Port mirroring (also called SPAN) copies traffic from one or more switch ports to a designated monitoring port, allowing a sensor or analyzer to capture all traffic.
Which of the following BEST describes a zero-day vulnerability?
Answer: A vulnerability unknown to the vendor with no available patch
A zero-day vulnerability is one that is unknown to (or unaddressed by) the software vendor, meaning no patch exists, leaving systems exposed to exploitation.
What is the purpose of network access control (NAC) in enterprise environments?
Answer: To ensure only compliant, authenticated devices can connect to the network
NAC enforces security policy by checking device health (patches, antivirus, certificates) before granting network access, preventing non-compliant endpoints from connecting.
Which protocol is used by network devices to send log and alert messages to a centralized logging server?
Answer: Syslog
Syslog is the standard protocol for transmitting log, event, and alert messages from network devices to a centralized log management or SIEM system.
A penetration tester performs a port scan and finds port 23 open on a network device. What security concern does this raise?
Answer: The device is using Telnet, which transmits data including passwords in plaintext
Port 23 is associated with Telnet, an unencrypted protocol that transmits all data — including credentials — in plaintext, making it easily interceptable.