TOC Network Security & Protocols 2 — Questions and Answers
Question 1: Which firewall type inspects the state of active connections and uses this context to make filtering decisions?
- Packet filter firewall
- Stateful inspection firewall (Correct answer)
- Application-layer gateway
- Circuit-level gateway
Correct answer: Stateful inspection firewall
A stateful inspection firewall tracks the state of network connections and uses that context to determine whether packets are part of a legitimate session.
Question 2: A company wants to ensure all remote workers' traffic is encrypted before it reaches the corporate network. Which protocol is MOST appropriate?
- SSH tunneling
- IPsec VPN (Correct answer)
- HTTPS proxy
- SFTP gateway
Correct answer: IPsec VPN
IPsec VPN encrypts all IP traffic between the remote device and the corporate network, making it the standard solution for secure remote access.
Question 3: What does the principle of 'defense in depth' mean in network security?
- Using the strongest single firewall available
- Placing all security controls at the network perimeter
- Layering multiple security controls so that failure of one doesn't compromise the whole system (Correct answer)
- Encrypting all data at maximum bit depth
Correct answer: Layering multiple security controls so that failure of one doesn't compromise the whole system
Defense in depth means implementing multiple overlapping security layers so that an attacker must bypass each one independently, reducing the risk of a single point of failure.
Question 4: Which protocol provides secure, encrypted remote command-line access to a network device?
- Telnet
- FTP
- SSH (Correct answer)
- SNMP
Correct answer: SSH
SSH (Secure Shell) encrypts the entire session including authentication, replacing plaintext protocols like Telnet for remote administration.
Question 5: An organization notices unusual outbound traffic spikes at 3 AM daily. What type of threat does this MOST likely indicate?
- DDoS attack
- Data exfiltration by malware or a compromised host (Correct answer)
- ARP spoofing
- DNS cache poisoning
Correct answer: Data exfiltration by malware or a compromised host
Regular, off-hours outbound traffic spikes are a classic indicator of malware performing scheduled data exfiltration to a command-and-control server.
Question 6: Which network segmentation technique limits the spread of a breach by isolating groups of systems with similar security requirements?
- Port mirroring
- VLAN segregation (Correct answer)
- Bandwidth throttling
- IP masquerading
Correct answer: VLAN segregation
VLANs (Virtual Local Area Networks) logically separate network segments, limiting lateral movement by an attacker who has compromised one segment.
Question 7: What is the primary security risk of using default credentials on network devices such as routers and switches?
- Increased network latency
- Unauthorized access since default passwords are publicly documented (Correct answer)
- Incompatibility with modern encryption standards
- Automatic firmware downgrade
Correct answer: Unauthorized access since default passwords are publicly documented
Default credentials for network equipment are published by manufacturers and widely known, making any device left with them trivially accessible to attackers.
TOC Network Security & Protocols 2
Which firewall type inspects the state of active connections and uses this context to make filtering decisions?