I85PREP
⌘ K
CENTC study materials
CENTC study resources

CENTC practice questions

One question at a time. Build your CENTC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Concepts and Fundamentals

Which OSI layer is responsible for logical addressing and routing of packets between networks?

  1. Data link layer
  2. Session layer
  3. Network layer Correct answer.
  4. Transport layer

Explanation

The network layer handles logical addressing and path selection so packets can travel between different networks. Routing protocols and IP addressing operate at this layer.

Question 2Network Security Concepts and Fundamentals

A user reports that a web server is reachable by IP address but not by hostname. Which service is most likely failing?

  1. DNS Correct answer.
  2. SMTP
  3. DHCP
  4. NTP

Explanation

Name resolution maps hostnames to IP addresses, so a hostname failure while direct IP connectivity works points to DNS. DHCP assigns addresses, NTP synchronizes time, and SMTP sends mail.

Question 3Network Security Concepts and Fundamentals

Which protocol provides reliable, connection-oriented delivery with acknowledgment and retransmission?

  1. TCP Correct answer.
  2. ICMP
  3. ARP
  4. UDP

Explanation

TCP establishes a connection and uses sequence numbers, acknowledgments, and retransmission to guarantee ordered delivery. UDP is connectionless and best-effort.

Question 4Network Security Concepts and Fundamentals

What is the primary purpose of a DMZ in a network architecture?

  1. To aggregate VLAN traffic at the access layer
  2. To isolate publicly accessible services from the internal network Correct answer.
  3. To provide backup routing for the core
  4. To encrypt all internal traffic

Explanation

A DMZ is a segmented zone that hosts externally reachable services while limiting their access to internal systems. If an exposed host is compromised, the internal network is still protected by the intervening controls.

Question 5Network Security Concepts and Fundamentals

Which device primarily forwards frames based on MAC addresses within a single broadcast domain?

  1. Router
  2. Firewall
  3. Layer 2 switch Correct answer.
  4. Load balancer

Explanation

A Layer 2 switch builds a MAC address table and forwards frames within a broadcast domain. Routers move packets between broadcast domains using IP addresses.

Question 6Network Security Concepts and Fundamentals

Which address range is reserved for private use under RFC 1918?

  1. 198.51.100.0/24
  2. 172.16.0.0/12 Correct answer.
  3. 169.254.0.0/16
  4. 192.0.2.0/24

Explanation

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as private ranges not routed on the public internet. The other listed ranges serve documentation or link-local purposes.

Question 7Network Security Concepts and Fundamentals

Which security principle grants users only the access required to perform their job functions?

  1. Defense in depth
  2. Separation of duties
  3. Zero trust
  4. Least privilege Correct answer.

Explanation

Least privilege limits permissions to the minimum necessary for a role, reducing the impact of compromise or misuse. Separation of duties instead divides critical tasks among multiple people.

Question 8Network Security Concepts and Fundamentals

Which protocol is used to securely transfer files over an encrypted channel and typically listens on TCP port 22?

  1. TFTP
  2. FTP
  3. Telnet
  4. SFTP Correct answer.

Explanation

SFTP runs over SSH on TCP port 22 and encrypts both authentication and data. FTP and TFTP are unencrypted, and Telnet is an unencrypted terminal protocol.

Question 9Network Security Concepts and Fundamentals

An organization wants to ensure that traffic leaving its network is inspected for malicious content. Which control best accomplishes this?

  1. Spanning tree configuration
  2. Static ARP entries
  3. Port mirroring on the core switch
  4. Egress filtering with a proxy Correct answer.

Explanation

Egress filtering combined with a proxy inspects outbound traffic and can block malicious content or unauthorized destinations. The other options are switching or link-layer mechanisms that do not inspect payloads.

Question 10Network Security Concepts and Fundamentals

A packet captures shows repeated SYN packets to a server with no completing handshake from many spoofed sources. Which attack is indicated?

  1. VLAN hopping
  2. DNS tunneling
  3. ARP poisoning
  4. SYN flood Correct answer.

Explanation

A SYN flood exhausts the server's connection table by sending many half-open connection requests that are never completed. The spoofed sources make filtering harder.

Question 11Network Security Concepts and Fundamentals

Which mechanism allows multiple private hosts to share a single public IPv4 address?

  1. CIDR
  2. Subnetting
  3. NAT Correct answer.
  4. Proxy ARP

Explanation

Network Address Translation rewrites private source addresses to a shared public address, tracking connections so replies return to the correct host. Subnetting and CIDR divide address space but do not translate addresses.

Question 12Network Security Concepts and Fundamentals

A firewall rule set processes rules top-down and stops at the first match. A permit rule for any source to TCP 443 sits above a deny rule for a specific host to TCP 443. What is the effect on that host?

  1. Its traffic is denied because the specific rule takes precedence
  2. Its traffic is permitted because the first matching rule wins Correct answer.
  3. Its traffic is dropped by the default policy
  4. Its traffic is logged but permitted

Explanation

In first-match rule processing, the earliest rule that matches the traffic determines the action. A later, more specific rule is never evaluated for traffic already matched.

Question 13Network Security Concepts and Fundamentals

Which characteristic distinguishes an IDS from an IPS?

  1. An IDS inspects payloads while an IPS inspects only headers
  2. An IPS blocks traffic inline while an IDS only detects and alerts Correct answer.
  3. An IPS is always host-based while an IDS is always network-based
  4. An IDS can decrypt traffic while an IPS cannot

Explanation

An IPS is deployed inline and can drop malicious traffic, whereas an IDS monitors a copy of traffic and generates alerts without blocking. Both can inspect payloads and exist in host and network forms.

Question 14Network Security Concepts and Fundamentals

Which practice most directly mitigates the risk of credential theft from unencrypted management sessions?

  1. Disabling port security
  2. Enabling CDP on all interfaces
  3. Replacing Telnet with SSH Correct answer.
  4. Using community SNMP strings

Explanation

SSH encrypts the management session so credentials and commands cannot be captured in transit. Telnet transmits everything in cleartext.

Question 15Network Security Concepts and Fundamentals

Which technology segments a single physical switch into multiple isolated broadcast domains?

  1. VLANs Correct answer.
  2. Link aggregation
  3. Trunking
  4. Port mirroring

Explanation

VLANs logically partition a switch so that each VLAN forms its own broadcast domain. Trunking carries multiple VLANs across links but does not itself create the separation.

Question 16Network Security Concepts and Fundamentals

A switch port configured for a native VLAN that differs from the trunk peer's native VLAN creates which risk?

  1. VLAN hopping between the mismatched VLANs Correct answer.
  2. Reduced MTU on the link
  3. Loss of DHCP relay
  4. Duplicate MAC address detection

Explanation

Mismatched native VLANs on a trunk can cause untagged frames to be placed into the wrong VLAN, enabling VLAN hopping. Best practice is to align native VLANs and avoid using a user VLAN as native.

Question 17Network Security Concepts and Fundamentals

Which record type maps a hostname to an IPv6 address?

  1. AAAA Correct answer.
  2. A
  3. CNAME
  4. MX

Explanation

An AAAA record maps a name to an IPv6 address, while an A record maps to an IPv4 address. MX and CNAME serve mail routing and aliasing respectively.

Question 18Network Security Concepts and Fundamentals

Which technique best defends against ARP spoofing on a switched network?

  1. Using static routes
  2. Dynamic ARP Inspection with DHCP snooping Correct answer.
  3. Enabling proxy ARP
  4. Increasing ARP cache timeout

Explanation

Dynamic ARP Inspection validates ARP packets against a trusted binding table built by DHCP snooping, dropping spoofed replies. Longer cache timeouts and proxy ARP can worsen the exposure.

Question 19Network Security Concepts and Fundamentals

Which statement best describes the function of a reverse proxy in front of web servers?

  1. It resolves external hostnames for clients
  2. It encrypts database traffic between servers
  3. It terminates client connections and forwards requests to backend servers Correct answer.
  4. It assigns IP addresses to internal clients

Explanation

A reverse proxy accepts client connections on behalf of backend servers, providing load distribution, TLS termination, and shielding of internal topology. Address assignment and name resolution are separate services.

Question 20Network Security Concepts and Fundamentals

An analyst observes a workstation resolving many random-looking subdomains of a single domain in rapid succession. Which threat is most consistent with this behavior?

  1. DNS tunneling for data exfiltration Correct answer.
  2. DHCP starvation
  3. Smurf amplification
  4. BGP hijacking

Explanation

Encoding data in many unique subdomain queries is a hallmark of DNS tunneling used for exfiltration or command and control. The high volume of unique labels distinguishes it from normal caching behavior.

Question 21Network Security Concepts and Fundamentals

A network uses 192.168.10.0/26. How many usable host addresses does each subnet provide?

  1. 30
  2. 64
  3. 62 Correct answer.
  4. 126

Explanation

A /26 mask leaves 6 host bits, giving 64 total addresses; subtracting the network and broadcast addresses yields 62 usable hosts.

Question 22Network Security Concepts and Fundamentals

Which control most directly limits lateral movement after an internal host is compromised?

  1. Disabling logging on endpoints
  2. Microsegmentation between internal workloads Correct answer.
  3. Flattening the internal network
  4. A longer password rotation interval

Explanation

Microsegmentation applies granular policy between workloads so a compromised host cannot freely reach other systems. Flat networks and reduced logging make lateral movement easier.

Question 23Network Security Concepts and Fundamentals

A TLS inspection device breaks end-to-end encryption between clients and external servers. Which tradeoff must be evaluated before deploying it?

  1. Mandatory use of UDP for inspected sessions
  2. Inability to perform NAT on inspected flows
  3. Requirement to disable all VLANs
  4. Loss of certificate pinning compatibility and privacy implications Correct answer.

Explanation

Interception requires re-signing traffic with an internal certificate authority, which breaks certificate pinning and raises privacy and trust concerns. NAT and VLAN operation are unaffected by inspection.

Question 24Network Security Concepts and Fundamentals

Which condition makes a man-in-the-middle ARP attack on a switched LAN most effective?

  1. The victim uses a public DNS resolver
  2. The switch has spanning tree enabled
  3. The gateway uses a /24 subnet mask
  4. The attacker is on the same broadcast domain as the victim and gateway Correct answer.

Explanation

ARP operates within a broadcast domain, so an attacker must share that segment to poison the victim's and gateway's caches. DNS choice, STP, and mask length do not enable the attack.

Question 25Network Security Concepts and Fundamentals

An organization must allow remote workers to reach internal applications without exposing those applications directly to the internet. Which design best meets this requirement?

  1. A port-forward on the border firewall to each application server
  2. Placing the application servers in the DMZ with full internal routing
  3. A VPN concentrator that authenticates users before granting internal access Correct answer.
  4. A public-facing jump host with shared credentials

Explanation

A VPN concentrator authenticates remote users and establishes an encrypted tunnel, so internal applications remain unreachable from the internet directly. Direct port-forwards and shared-credential jump hosts expand the attack surface.

Question 26Network Security Concepts and Fundamentals

Which term describes the guarantee that data has not been altered in transit by an unauthorized party?

  1. Availability
  2. Confidentiality
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity ensures that data remains unaltered and trustworthy throughout its lifecycle, including during transmission. Confidentiality protects secrecy, availability ensures timely access, and non-repudiation prevents denial of an action.

Question 27Network Security Concepts and Fundamentals

At which layer of the OSI model does a router primarily operate when forwarding packets between networks?

  1. Data Link Layer
  2. Transport Layer
  3. Network Layer Correct answer.
  4. Application Layer

Explanation

Routers make forwarding decisions based on logical addresses, such as IP addresses, which are defined at the Network Layer (Layer 3). The Data Link Layer handles physical addressing, the Transport Layer handles end-to-end connections, and the Application Layer supports user services.

Question 28Network Security Concepts and Fundamentals

Which protocol provides connectionless, best-effort delivery of datagrams and does not guarantee ordering or reliability?

  1. SCTP
  2. ICMP
  3. TCP
  4. UDP Correct answer.

Explanation

UDP is a connectionless transport protocol that sends datagrams without establishing a session, so delivery, ordering, and duplicate suppression are not guaranteed. TCP provides reliable, ordered delivery, ICMP is used for diagnostics, and SCTP offers reliable message-oriented transport.

Question 29Network Security Concepts and Fundamentals

In a TCP three-way handshake, what is the purpose of the final ACK sent by the initiating client?

  1. It informs the server of the client's maximum segment size.
  2. It terminates the connection immediately after establishment.
  3. It requests a new session key for encryption.
  4. It acknowledges the server's SYN and confirms the client's receive capability. Correct answer.

Explanation

The three-way handshake consists of SYN, SYN-ACK, and ACK. The final ACK from the client acknowledges the server's SYN, completing the handshake and confirming that the client can receive the server's sequence number. Encryption keys and MSS are negotiated through other mechanisms or options, and termination uses a different exchange.

Question 30Network Security Concepts and Fundamentals

A network engineer needs to connect two offices over the internet so that internal hosts can communicate as if on the same private network, while ensuring that traffic is encrypted and authenticated. Which technology best meets this requirement?

  1. Port forwarding
  2. GRE tunnel
  3. IPsec VPN Correct answer.
  4. VLAN trunking

Explanation

An IPsec VPN provides confidentiality, integrity, and authentication for IP traffic, making it suitable for secure site-to-site connectivity over untrusted networks. GRE provides tunneling but lacks built-in encryption, VLAN trunking is Layer 2, and port forwarding exposes specific services rather than creating a private network.

Question 31Network Security Concepts and Fundamentals

Which statement accurately describes the difference between stateful and stateless packet filtering?

  1. Stateful filtering tracks connection state and can automatically allow return traffic, while stateless filtering evaluates each packet independently. Correct answer.
  2. Stateless filtering requires more memory and processing power than stateful filtering.
  3. Stateful filtering operates only at the application layer, while stateless filtering operates at the network layer.
  4. Stateless filtering tracks connection state, while stateful filtering evaluates each packet in isolation.

Explanation

Stateful firewalls maintain a state table of active connections, allowing them to permit return traffic for established sessions without explicit rules. Stateless filters examine each packet against a static rule set and cannot automatically associate return traffic with an existing session.

Question 32Network Security Concepts and Fundamentals

Which protocol is commonly used to synchronize time across network devices and is important for accurate log correlation?

  1. Syslog
  2. NTP Correct answer.
  3. SNMP
  4. DHCP

Explanation

NTP (Network Time Protocol) synchronizes clocks across network devices, ensuring that log timestamps are consistent for correlation and forensic analysis. SNMP is for management, Syslog is for event logging, and DHCP assigns network configuration.

Question 33Network Security Concepts and Fundamentals

What is the primary security concern with using default credentials on network devices such as routers and switches?

  1. They expire too quickly and cause frequent lockouts.
  2. They cannot be changed after initial configuration.
  3. They are incompatible with multi-factor authentication.
  4. They are easily guessed and widely known, allowing unauthorized access. Correct answer.

Explanation

Default credentials are published by vendors and shared across many devices, so attackers can easily find and use them to gain access. Best practice is to change default credentials during initial setup and enforce strong authentication.

Question 34Network Security Concepts and Fundamentals

A company wants to allow employees to access internal web applications from personal devices without installing a VPN client, while enforcing authentication and device posture checks. Which solution best fits?

  1. A transparent proxy
  2. A clientless remote access gateway Correct answer.
  3. A site-to-site IPsec tunnel
  4. A reverse proxy with basic authentication

Explanation

A clientless remote access gateway provides browser-based access to internal applications and can enforce authentication and endpoint posture checks without requiring a full VPN client. Site-to-site tunnels connect networks, transparent proxies intercept traffic without user authentication, and a reverse proxy with basic authentication does not perform device posture checks.

Question 35Network Security Concepts and Fundamentals

In a switched network, an attacker connects a rogue switch and sends BPDUs with a lower bridge priority than the root bridge. What is the likely impact?

  1. All switches revert to hub mode.
  2. The attacker gains access to the management VLAN.
  3. The attacker's switch becomes the root bridge, allowing traffic to be intercepted. Correct answer.
  4. The network experiences a broadcast storm due to a loop.

Explanation

Spanning Tree Protocol (STP) elects the root bridge based on the lowest bridge priority. An attacker sending superior BPDUs can become the root bridge and position themselves to intercept or alter traffic. This is known as a STP root bridge attack.

Question 36Network Security Concepts and Fundamentals

Which security zone design principle places public-facing web servers in a separate network segment from internal databases?

  1. Defense in depth
  2. Zero trust
  3. Least privilege
  4. Network segmentation Correct answer.

Explanation

Network segmentation divides the network into zones with controlled access between them, so a compromise in one zone does not automatically expose others. Placing web servers in a DMZ separate from internal databases is a classic segmentation example.

Question 37Network Security Concepts and Fundamentals

Which type of attack involves an adversary intercepting and potentially altering communication between two parties who believe they are communicating directly?

  1. SQL injection
  2. Phishing
  3. Man-in-the-middle Correct answer.
  4. Denial-of-service

Explanation

A man-in-the-middle (MITM) attack positions the adversary between two communicating parties, allowing interception and modification of traffic. DoS disrupts availability, phishing tricks users into revealing information, and SQL injection targets database queries.

Question 38Network Security Concepts and Fundamentals

Which DNS record type is used to specify the mail servers responsible for accepting email on behalf of a domain?

  1. A
  2. TXT
  3. MX Correct answer.
  4. CNAME

Explanation

MX (Mail Exchange) records identify the mail servers for a domain and include a preference value for prioritization. A records map hostnames to IPv4 addresses, CNAME records create aliases, and TXT records hold arbitrary text such as SPF policies.

Question 39Network Security Concepts and Fundamentals

An organization wants to detect unauthorized changes to critical system files on a server. Which control best addresses this requirement?

  1. Host-based firewall
  2. File integrity monitoring Correct answer.
  3. Antivirus scanning
  4. Security information and event management

Explanation

File integrity monitoring (FIM) computes and compares cryptographic hashes of files to detect unauthorized modifications. Antivirus detects known malware, a host firewall controls network traffic, and SIEM aggregates and correlates logs but does not by itself detect file changes.

Question 40Network Security Concepts and Fundamentals

A security analyst is reviewing a network diagram and needs to identify where a DMZ should be placed. Which placement is most appropriate?

  1. Between the internal network and the internet, hosting public-facing services Correct answer.
  2. Between two internal VLANs that host user workstations
  3. On the internet-facing side of the external firewall, outside any firewall
  4. Entirely within the internal network, protecting database servers

Explanation

A DMZ is a buffer zone between the untrusted internet and the trusted internal network, hosting public-facing services so that if they are compromised, the internal network remains protected. Placing it inside the internal network or outside all firewalls defeats its purpose.

Question 41Network Security Threats and Vulnerabilities

Which category of malware is designed to spread autonomously across a network by exploiting vulnerabilities in other hosts without requiring user interaction?

  1. A worm Correct answer.
  2. A trojan
  3. A logic bomb
  4. A rootkit

Explanation

A worm self-replicates and propagates across networks by exploiting vulnerable services, without needing a host file or user action. Other malware types rely on user execution or concealment rather than autonomous network spread.

Question 42Network Security Threats and Vulnerabilities

An attacker floods a target with a very high volume of traffic from many compromised hosts to exhaust bandwidth. Which type of denial-of-service attack is this?

  1. SYN flood
  2. Distributed volumetric attack Correct answer.
  3. Slowloris
  4. Reflected amplification attack

Explanation

A distributed volumetric attack uses many compromised hosts to saturate the target's bandwidth with aggregate traffic. The defining feature is the sheer volume generated from multiple sources.

Question 43Network Security Threats and Vulnerabilities

Which social engineering technique involves an attacker leaving a malware-infected USB drive in a parking lot hoping an employee plugs it into a corporate system?

  1. Tailgating
  2. Phishing
  3. Vishing
  4. Baiting Correct answer.

Explanation

Baiting exploits curiosity or greed by leaving enticing physical or digital items, such as infected media, for a victim to use. The attacker relies on the victim taking the bait rather than deceiving them directly.

Question 44Network Security Threats and Vulnerabilities

An employee receives an email that appears to come from the CEO requesting an urgent wire transfer. Which attack does this describe?

  1. Watering hole
  2. Business email compromise Correct answer.
  3. Credential stuffing
  4. SQL injection

Explanation

Business email compromise impersonates an executive or trusted party to trick employees into transferring funds or data. The attack relies on authority and urgency rather than technical exploitation.

Question 45Network Security Threats and Vulnerabilities

Which term describes an attack in which an adversary intercepts and possibly alters communication between two parties who believe they are communicating directly?

  1. Privilege escalation
  2. Replay
  3. Man-in-the-middle Correct answer.
  4. Denial-of-service

Explanation

A man-in-the-middle attack places the adversary between two communicating parties to eavesdrop or modify traffic. The parties believe they have a direct channel while the attacker relays or alters messages.

Question 46Network Security Threats and Vulnerabilities

Which cryptographic weakness makes WEP unsuitable for securing a wireless network?

  1. It mandates AES-256 encryption
  2. It authenticates every frame individually
  3. It uses a static, short initialization vector that allows keystream reuse Correct answer.
  4. It requires certificates that are difficult to distribute

Explanation

WEP's 24-bit initialization vector is too short and frequently reused, allowing attackers to collect keystreams and recover the key. This design flaw makes WEP trivially breakable regardless of passphrase strength.

Question 47Network Security Threats and Vulnerabilities

Which protocol is the secure replacement for Telnet that encrypts remote command-line sessions?

  1. SNMPv1
  2. FTP
  3. HTTP
  4. SSH Correct answer.

Explanation

SSH provides encrypted remote shell access and replaces cleartext protocols such as Telnet. FTP, SNMPv1, and HTTP do not provide encrypted interactive shell sessions.

Question 48Network Security Threats and Vulnerabilities

Which type of attack tricks a user into installing malicious software by disguising it as a legitimate application update?

  1. Trojan Correct answer.
  2. Adware
  3. Spyware
  4. Worm

Explanation

A trojan presents itself as desirable or legitimate software, such as a fake update, so the user installs it willingly. Once executed, it performs malicious actions hidden behind the legitimate appearance.

Question 49Network Security Threats and Vulnerabilities

A technician notices many half-open TCP connections on a web server, with the source addresses being spoofed. Which attack is most likely occurring?

  1. DNS poisoning
  2. ARP spoofing
  3. SYN flood Correct answer.
  4. Ping flood

Explanation

A SYN flood sends many SYN packets with spoofed sources, leaving the server with half-open connections that exhaust its backlog. The server waits for ACKs that never arrive.

Question 50Network Security Threats and Vulnerabilities

An attacker sends a request to a DNS resolver with a spoofed source address of the victim, causing a large response to be sent to the victim. Which technique is this?

  1. DNS amplification Correct answer.
  2. Zone transfer abuse
  3. Domain fronting
  4. DNS tunneling

Explanation

DNS amplification spoofs the victim's address so that the resolver sends a much larger response to the victim, amplifying the attack. The small request produces a disproportionately large reply directed at the target.