TOC Network Security & Protocols 3 — Questions and Answers
Question 1: What is the difference between an IDS and an IPS in network security?
- IDS encrypts traffic; IPS decrypts it
- IDS only detects and alerts on threats; IPS detects and actively blocks them (Correct answer)
- IDS works at Layer 7; IPS works at Layer 3
- IDS is hardware-based; IPS is software-only
Correct answer: IDS only detects and alerts on threats; IPS detects and actively blocks them
An Intrusion Detection System (IDS) passively monitors and alerts, while an Intrusion Prevention System (IPS) sits inline and actively blocks malicious traffic.
Question 2: Which attack exploits the trust relationship between a DNS resolver and its cache to redirect users to malicious sites?
- Pharming via DNS cache poisoning (Correct answer)
- SQL injection
- Cross-site scripting
- Man-in-the-middle via ARP spoofing
Correct answer: Pharming via DNS cache poisoning
DNS cache poisoning (pharming) inserts fraudulent DNS records into a resolver's cache, redirecting users to attacker-controlled IP addresses without their knowledge.
Question 3: A security team wants to monitor all traffic passing through a network switch for analysis. Which switch feature should they enable?
- STP (Spanning Tree Protocol)
- Port mirroring / SPAN (Correct answer)
- DHCP snooping
- 802.1X authentication
Correct answer: Port mirroring / SPAN
Port mirroring (also called SPAN) copies traffic from one or more switch ports to a designated monitoring port, allowing a sensor or analyzer to capture all traffic.
Question 4: Which of the following BEST describes a zero-day vulnerability?
- A vulnerability with a CVSS score of 0
- A flaw that has been patched within 24 hours of discovery
- A vulnerability unknown to the vendor with no available patch (Correct answer)
- A vulnerability affecting systems with zero users
Correct answer: A vulnerability unknown to the vendor with no available patch
A zero-day vulnerability is one that is unknown to (or unaddressed by) the software vendor, meaning no patch exists, leaving systems exposed to exploitation.
Question 5: What is the purpose of network access control (NAC) in enterprise environments?
- To restrict employee internet bandwidth
- To ensure only compliant, authenticated devices can connect to the network (Correct answer)
- To block all external traffic during off-hours
- To monitor social media usage
Correct answer: To ensure only compliant, authenticated devices can connect to the network
NAC enforces security policy by checking device health (patches, antivirus, certificates) before granting network access, preventing non-compliant endpoints from connecting.
Question 6: Which protocol is used by network devices to send log and alert messages to a centralized logging server?
- SNMP
- Syslog (Correct answer)
- NTP
- RADIUS
Correct answer: Syslog
Syslog is the standard protocol for transmitting log, event, and alert messages from network devices to a centralized log management or SIEM system.
Question 7: A penetration tester performs a port scan and finds port 23 open on a network device. What security concern does this raise?
- The device is running an unencrypted web server
- The device is using Telnet, which transmits data including passwords in plaintext (Correct answer)
- The device has an open SMTP relay
- The device is vulnerable to DNS amplification attacks
Correct answer: The device is using Telnet, which transmits data including passwords in plaintext
Port 23 is associated with Telnet, an unencrypted protocol that transmits all data — including credentials — in plaintext, making it easily interceptable.
TOC Network Security & Protocols 3
What is the difference between an IDS and an IPS in network security?