I85PREP
⌘ K
NISP Level 2 study materials
NISP Level 2 study resources

NISP Level 2 practice questions

One question at a time. Build your NISP Level 2 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Security Management

在信息安全管理中，"机密性"（Confidentiality）主要保障的是下列哪一项？

  1. 确保数据仅被经过授权的主体访问 Correct answer.
  2. 确保数据在传输过程中不被篡改
  3. 确保授权用户能够随时访问数据
  4. 确保数据在系统故障后可以恢复

Explanation

机密性关注的是防止未授权的主体获取信息，通常通过访问控制、加密等手段实现。它针对的是信息的"不可泄露"属性，与完整性和可用性有明确区分。识别这三项属性的不同侧重点是信息安全基础的核心考点。

Question 2Information Security Fundamentals and Security Management

某企业规定员工离职当日必须注销其所有系统账号。这一控制措施最直接地服务于CIA三要素中的哪一项？

  1. 机密性 Correct answer.
  2. 不可否认性
  3. 可用性
  4. 完整性

Explanation

及时注销离职人员账号可以防止前员工继续访问企业信息，因此直接降低信息被未授权获取的风险，属于机密性保护。完整性关注数据是否被非法更改，可用性关注合法访问是否持续。不可否认性不属于CIA三要素本身。

Question 3Information Security Fundamentals and Security Management

根据风险管理的一般原则，对于"发生可能性高且影响严重"的风险，组织通常应优先采取的措施是？

  1. 通过保险转移全部风险
  2. 仅记录风险而不做处理
  3. 规避或采取控制措施降低风险 Correct answer.
  4. 接受该风险并持续监控

Explanation

风险处置策略包括规避、降低、转移和接受。对于高可能性且高影响的风险，通常优先选择规避或通过控制措施降低，使其落入可接受范围。单纯接受或仅记录会使组织暴露在不可承受的损失之下。

Question 4Information Security Fundamentals and Security Management

某组织完成风险评估后决定购买网络安全保险以应对潜在损失。这一处置方式属于哪种风险处置策略？

  1. 风险降低
  2. 风险转移 Correct answer.
  3. 风险规避
  4. 风险接受

Explanation

风险转移是将风险的财务后果转由第三方承担，购买保险是典型形式。风险规避是停止相关活动，风险降低是实施控制措施减小可能性或影响。保险并不消除风险本身，只是转移其经济后果。

Question 5Information Security Fundamentals and Security Management

在风险评估中，"风险值"通常由哪两个因素共同决定？

  1. 资产数量与员工人数
  2. 审计频率与整改周期
  3. 控制措施的数量与成本
  4. 威胁发生的可能性与影响程度 Correct answer.

Explanation

风险通常被表达为威胁利用脆弱性造成影响的可能性与影响严重程度的组合。资产价值会影响影响程度，但风险值的核心构成是可能性与影响。控制措施、审计频率等是影响风险大小的因素，而非风险值的直接构成维度。

Question 6Information Security Fundamentals and Security Management

"最小权限原则"在访问控制中的含义是？

  1. 用户仅被授予完成其工作所必需的最小访问权限 Correct answer.
  2. 所有用户默认拥有管理员权限以便工作
  3. 权限分配应完全依赖用户自我申报
  4. 权限一旦授予便不再回收以保证稳定性

Explanation

最小权限原则要求主体只获得完成其任务所必需的最低限度权限，从而缩小误用与滥用造成的损害范围。它与职责分离、定期复核共同构成访问控制的基础。权限过度授予会扩大攻击面和内部威胁影响。

Question 7Information Security Fundamentals and Security Management

财务系统中，录入付款申请的职员不得同时拥有审批该付款的权限。这一安排体现了哪项安全原则？

  1. 纵深防御
  2. 最小权限
  3. 职责分离 Correct answer.
  4. 默认拒绝

Explanation

职责分离要求将相互关联、可被滥用进行舞弊的职责分配给不同人员，使单人无法独立完成并掩盖不当行为。最小权限关注权限数量，纵深防御关注多层控制，默认拒绝关注访问判定起点。此处核心是防止一人同时申请与审批。

Question 8Information Security Fundamentals and Security Management

在信息安全策略体系中，通常位于最高层、由管理层批准并规定组织安全总体方向和承诺的文件是？

  1. 事件响应手册
  2. 信息安全方针 Correct answer.
  3. 基线配置清单
  4. 操作规程

Explanation

信息安全方针是顶层文件，阐明管理层对信息安全的承诺、目标与总体原则，并授权下层标准、规程的制定。操作规程和手册属于更具体的执行层文件。方针为整个策略体系提供方向和依据。

Question 9Information Security Fundamentals and Security Management

某公司制定信息安全方针后，又发布了密码使用标准、访问控制标准等文件。这些标准相对于方针的正确关系是？

  1. 标准与方针处于同一层级可互相替代
  2. 标准可以随意偏离方针的要求
  3. 标准仅由技术人员口头传达即可
  4. 标准应支持并细化方针中的原则 Correct answer.

Explanation

方针确立总体原则和方向，标准则规定为实现这些原则必须满足的具体要求，因此必须与方针保持一致并对其细化。标准不能与方针冲突，也不可替代方针。分层文档体系保证从原则到执行的贯通。

Question 10Information Security Fundamentals and Security Management

信息分类分级的主要目的是？

  1. 增加文档数量以便统计
  2. 统一所有信息的访问权限
  3. 根据信息的敏感程度施加相应级别的保护 Correct answer.
  4. 减少员工培训内容

Explanation

分类分级依据信息的敏感性和价值将其划分为不同级别，从而匹配相应强度的保护措施与处理规则。这样可以在安全与可用之间取得平衡，避免过度或不足保护。分级结果是访问控制和标记管理的基础。

Question 11Information Security Fundamentals and Security Management

某员工将标注为"内部"的文件上传至公共网盘以便在家办公。从信息分类管理角度看，最恰当的评价是？

  1. 只要文件未加密即可上传
  2. 上传网盘可自动提升文件安全级别
  3. 内部文件在任何情况下都可公开
  4. 该行为违反了按信息级别处理的要求 Correct answer.

Explanation

信息分类后须按对应级别规定的存储与传输要求处理，将内部文件放入公共网盘通常超出允许范围，构成违规。分类管理的意义正在于让处理方式与敏感级别匹配。是否加密并不能使不当存储变得合规。

Question 12Information Security Fundamentals and Security Management

在人员安全管理中，新员工入职时签署保密协议的主要作用是？

  1. 替代技术访问控制措施
  2. 免除组织的信息安全责任
  3. 明确员工对机密信息的法律与合同义务 Correct answer.
  4. 保证员工永不离职

Explanation

保密协议通过合同方式明确员工对保密信息的义务与责任，为事后追责提供依据。它是人员管理层面的控制，不能替代技术控制，也不能免除组织自身的安全责任。协议是意识与责任约束的一部分。

Question 13Information Security Fundamentals and Security Management

员工岗位调整后仍保留原岗位系统的访问权限，最可能带来的风险是？

  1. 权限累积导致越权访问风险增加 Correct answer.
  2. 网络带宽不足
  3. 备份数据丢失
  4. 系统性能下降

Explanation

岗位变动后未及时调整权限会造成权限累积，使员工能够访问与其当前职责无关的信息，增加越权和数据泄露风险。定期权限复核和及时回收是控制该风险的关键。权限累积属于访问管理缺陷，而非性能问题。

Question 14Information Security Fundamentals and Security Management

信息安全意识培训对组织最主要的价值在于？

  1. 彻底消除所有技术漏洞
  2. 使员工具备识别并正确应对安全风险的能力 Correct answer.
  3. 降低硬件采购成本
  4. 取代安全审计工作

Explanation

意识培训旨在提升员工对钓鱼、社交工程、违规操作等风险的识别与应对能力，从而减少人为失误这一重要风险来源。它无法消除技术漏洞，也不能替代审计等技术与管理控制。人是安全防线中的关键环节。

Question 15Information Security Fundamentals and Security Management

某员工收到一封要求立即点击链接并输入账号密码的紧急邮件，邮件发件人域名与公司域名仅一字之差。最恰当的处理方式是？

  1. 回复邮件索要更多信息
  2. 转发给全体同事提醒大家点击核实
  3. 立即点击并按提示输入凭据
  4. 不点击链接，通过独立渠道向安全团队报告 Correct answer.

Explanation

该邮件具备钓鱼的典型特征：制造紧迫感、仿冒域名、诱导输入凭据。正确做法是不与可疑链接交互，并通过已知的独立渠道向安全团队报告。回复或转发都会扩大风险，输入凭据则直接导致账号泄露。

Question 16Information Security Fundamentals and Security Management

"纵深防御"（Defense in Depth）策略的核心思想是？

  1. 通过多层互补的控制措施降低单点失效的影响 Correct answer.
  2. 只部署一种最强的安全设备
  3. 仅在边界部署防火墙
  4. 将所有安全职责交给一个部门

Explanation

纵深防御通过在网络、主机、应用、数据、人员等多个层面部署互补控制，使某一层被突破时仍有其他层提供保护。它强调冗余与互补，而非依赖单一最强控制。单点防护一旦失效会导致全面失守。

Question 17Information Security Fundamentals and Security Management

某系统在边界防火墙之外，又在服务器上部署主机入侵检测，并对关键数据加密存储。这组措施最能体现哪一原则？

  1. 职责分离
  2. 纵深防御 Correct answer.
  3. 默认拒绝
  4. 最小权限

Explanation

边界防护、主机检测与数据加密分别位于不同层面，形成互补的多层防护，正是纵深防御的体现。职责分离针对人员职责，最小权限针对授权范围，默认拒绝针对访问判定。多层控制可降低单点失效风险。

Question 18Information Security Fundamentals and Security Management

在业务连续性管理（BCM）中，"恢复时间目标"（RTO）指的是？

  1. 数据备份的保留天数
  2. 业务中断后可容忍的最长恢复时间 Correct answer.
  3. 系统正常运行的累计时长
  4. 灾难发生的平均间隔

Explanation

RTO定义业务功能在中断后必须恢复运行的最长时间，是设计恢复方案的关键指标。它与RPO（可容忍的数据丢失量）不同，也与备份保留期和故障间隔无关。明确RTO有助于确定恢复资源的投入。

Question 19Information Security Fundamentals and Security Management

某业务规定最多可丢失15分钟的交易数据。这一要求对应的是哪项指标？

  1. 服务级别协议（SLA）
  2. 恢复点目标（RPO） Correct answer.
  3. 平均无故障时间（MTBF）
  4. 恢复时间目标（RTO）

Explanation

RPO表示可容忍的数据丢失量，通常以时间衡量，决定备份或复制频率。RTO关注恢复运行所需时间，MTBF关注故障间隔，SLA是服务承诺文件。此处强调数据丢失窗口，因此对应RPO。

Question 20Information Security Fundamentals and Security Management

信息安全事件管理流程中，在"检测与报告"之后通常紧接着进行的环节是？

  1. 关闭事件记录
  2. 事后复盘与改进
  3. 更新资产清单
  4. 初步分类与分级 Correct answer.

Explanation

事件被发现和报告后，需要先进行初步分类与分级，以判断严重程度并决定响应资源与升级路径。复盘改进通常在事件处置完成后进行，关闭记录是流程末端。合理分级是有效响应的前提。

Question 21Information Security Fundamentals and Security Management

某组织在安全事件处置完成后召开会议，分析根本原因并修订相关控制措施。这一活动属于？

  1. 应急遏制
  2. 证据保全
  3. 事后复盘与持续改进 Correct answer.
  4. 事件分级

Explanation

事件处置后的复盘旨在查找根本原因、评估响应效果并改进控制，是持续改进的重要环节。事件分级发生在响应初期，遏制用于阻止扩散，证据保全服务于调查与追责。复盘使组织从事件中学习。

Question 22Information Security Fundamentals and Security Management

"业务影响分析"（BIA）在业务连续性管理中的主要产出是？

  1. 列出所有网络设备型号
  2. 识别关键业务功能及其中断影响与恢复要求 Correct answer.
  3. 确定员工薪资结构
  4. 制定市场营销计划

Explanation

BIA通过分析各业务功能中断造成的影响，识别关键业务并确定其RTO、RPO等恢复要求，为连续性策略提供依据。设备清单、薪资和营销计划均不属于BIA的核心产出。BIA是BCM的起点性分析活动。

Question 23Information Security Fundamentals and Security Management

某公司允许员工使用个人移动设备访问企业邮箱，但未制定任何相关管理要求。从安全治理角度看，最应优先补充的是？

  1. 制定移动设备使用与安全管理制度 Correct answer.
  2. 增加邮箱存储容量
  3. 更换办公桌椅
  4. 禁止所有移动办公

Explanation

自带设备场景需要明确的管理要求，如设备准入、加密、远程擦除、访问范围等，以控制数据泄露与合规风险。简单禁止可能损害业务，扩容与办公设施与安全治理无关。制度建设是治理层面的首要动作。

Question 24Information Security Fundamentals and Security Management

在信息安全治理结构中，最高管理层（如董事会）对信息安全的主要职责是？

  1. 亲自编写所有安全代码
  2. 确定安全战略方向并提供资源与监督 Correct answer.
  3. 执行每日数据备份
  4. 负责日常防火墙配置

Explanation

治理层的职责是确立安全战略方向、批准方针、分配资源并对风险进行监督问责，而非介入具体技术操作。日常配置与备份属于执行层职责。清晰的治理分工是有效安全管理的前提。

Question 25Information Security Fundamentals and Security Management

某组织将风险评估结果与既定风险准则比较后，决定某风险处于可接受范围内并继续监控。这一决策属于？

  1. 风险接受 Correct answer.
  2. 风险转移
  3. 风险降低
  4. 风险规避

Explanation

风险接受是在评估后认为风险处于组织可容忍范围内，选择承担并持续监控。规避是停止相关活动，降低是实施控制减小风险，转移是将财务后果转给第三方。接受需要有明确的风险准则和监控机制支撑。

Question 26Information Security Fundamentals and Security Management

在信息安全风险管理中，组织在识别风险并完成分析后，选择购买网络安全保险将部分财务损失转移给第三方。这一风险处置方式属于哪一类？

  1. 风险规避
  2. 风险接受
  3. 风险转移 Correct answer.
  4. 风险降低

Explanation

风险处置主要有规避、降低、转移和接受四类。购买保险并不消除风险发生的可能性，而是通过合同将风险发生后的财务后果转由保险公司承担，因此属于风险转移。风险降低依赖控制措施减少可能性或影响，与本例的合同安排不同。

Question 27Information Security Fundamentals and Security Management

某组织的安全方针要求所有敏感数据在传输和存储时均须加密，但未说明具体算法和密钥长度。安全团队据此编制了《加密技术规范》，明确采用AES-256并规定密钥轮换周期。该规范在策略体系中的定位是？

  1. 替代方针的最高层文件
  2. 与方针地位相同的基础文件
  3. 仅用于记录历史事件的日志
  4. 落实方针要求的标准或规程 Correct answer.

Explanation

信息安全策略体系通常分为方针、标准、规程等层次，方针规定总体方向和原则，标准与规程将其细化为可执行的技术与管理要求。本例中规范把方针的加密要求具体化为算法和密钥周期，属于对上层方针的落实。下层文件不得与方针冲突，也不能取代方针。

Question 28Information Security Fundamentals and Security Management

某在线支付平台将单笔交易拆分为“认证-授权-清算”三个环节，由不同团队分别负责，任一团队都无法单独完成一笔完整交易。除职责分离外，该设计还主要降低了哪类风险？

  1. 备份磁带在异地存放丢失的风险
  2. 内部人员单独伪造完整交易的风险 Correct answer.
  3. 外部DDoS攻击导致服务中断的风险
  4. 机房空调故障导致设备过热的风险

Explanation

将业务流程拆分并由不同主体分别控制，可使命中单一人员无法独立完成并掩盖一笔完整交易，从而降低内部欺诈与越权操作风险。这正是职责分离与多方可控的设计目的。DDoS、备份介质丢失和机房环境故障属于可用性或物理安全风险，与该流程拆分无直接关系。

Question 29Information Security Fundamentals and Security Management

某企业评估某信息系统资产时，判定其一旦遭篡改将造成重大财务与声誉损失，但该资产位于内网且现有控制措施较为完善，威胁发生的可能性被评定为低。按照风险=可能性×影响的基本模型，最恰当的风险评价结论是？

  1. 影响重大，风险等级仍可能较高，需结合风险准则判定 Correct answer.
  2. 可能性与影响相互抵消，风险为零
  3. 应直接删除该资产以消除风险
  4. 可能性低即可判定为可忽略风险

Explanation

风险由事件发生的可能性与其造成的影响共同决定，单一维度低并不必然使整体风险可接受。影响重大时，即使可能性较低，综合风险等级仍可能超出组织的风险准则，需要进一步处置或由管理层明确接受。是否可接受应依据预先确定的风险准则判断，而非凭直觉。

Question 30Information Security Fundamentals and Security Management

某组织在年度风险评估中采用定量方法，对某资产估算出：威胁每年发生的频率为0.5次，单次事件造成的平均损失为40万元，现有控制措施可减少80%的损失。若按年度损失期望（ALE）计算，实施控制后的剩余年度损失期望约为多少？

  1. 16万元
  2. 8万元
  3. 20万元
  4. 4万元 Correct answer.

Explanation

年度损失期望等于威胁发生频率乘以单次损失，即0.5×40万元=20万元。现有控制措施可减少80%的损失，剩余损失为20万元的20%，即4万元。计算时应先求控制前的年度损失期望，再按控制有效性折算剩余部分。

Question 31Network Security

Which TCP or UDP port is used by the Domain Name System for standard queries?

  1. 25
  2. 53 Correct answer.
  3. 123
  4. 389

Explanation

DNS servers listen on port 53 for both UDP queries and TCP transfers such as zone transfers and large responses. Port 25 is SMTP, port 123 is NTP, and port 389 is LDAP.

Question 32Network Security

Which protocol operates at the transport layer and provides reliable, connection-oriented delivery with acknowledgements and retransmission?

  1. ICMP
  2. UDP
  3. TCP Correct answer.
  4. ARP

Explanation

TCP establishes a connection with a three-way handshake and uses sequence numbers, acknowledgements and retransmission to guarantee ordered delivery. The other listed protocols either lack reliability or operate at other layers.

Question 33Network Security

A packet capture shows repeated SYN packets to many destination ports on one host, each answered with RST. Which activity does this pattern most strongly suggest?

  1. A TCP port scan of the target host Correct answer.
  2. An ARP spoofing attempt
  3. A TCP SYN flood against a single service
  4. A DNS amplification attack

Explanation

Sending SYNs to successive ports and receiving RST for closed ports is the signature of port scanning, used to enumerate listening services. A SYN flood targets one service with many half-open connections rather than sweeping many ports.

Question 34Network Security

Which firewall type tracks connection state and permits return traffic for sessions initiated from the internal network?

  1. Stateful inspection firewall Correct answer.
  2. Proxy ARP gateway
  3. Packet-filtering router
  4. Stateless ACL on a switch

Explanation

A stateful inspection firewall maintains a connection table so that replies belonging to an allowed outbound session are passed without a separate inbound rule. Stateless filters must define rules in both directions and cannot track sessions.

Question 35Network Security

An organisation wants to allow external users to reach an internal web server without exposing its private address. Which control accomplishes this?

  1. VLAN trunking to the DMZ
  2. A static route to the server
  3. Destination NAT on the border device Correct answer.
  4. Port mirroring on the core switch

Explanation

Destination NAT, often called port forwarding, rewrites the public destination address and port to the internal server address so external clients reach it while the private address stays hidden. Routing or trunking alone does not translate addresses.

Question 36Network Security

Which record type should be published so that receiving mail servers can check whether a sending host is authorised for a domain?

  1. MX
  2. CNAME
  3. PTR
  4. SPF TXT record Correct answer.

Explanation

An SPF record is published as a TXT record listing the hosts and networks authorised to send mail for the domain, letting receivers compare it with the sending IP. MX records only direct where mail should be delivered.

Question 37Network Security

Which mechanism in IPsec ESP provides assurance that a packet was not altered in transit?

  1. The ESP integrity check value Correct answer.
  2. Encapsulating Security Payload encryption only
  3. The anti-replay window
  4. The security parameter index

Explanation

ESP computes an integrity check value over the packet using a keyed hash, so a modified packet fails verification at the receiver. Encryption alone conceals content but does not by itself prove integrity.

Question 38Network Security

Which attack involves an adversary positioning itself between two communicating parties to read and relay their traffic?

  1. Privilege escalation
  2. Cross-site scripting
  3. Man-in-the-middle Correct answer.
  4. SQL injection

Explanation

A man-in-the-middle attacker intercepts and relays traffic between two parties, often after spoofing or certificate manipulation, to read or alter it. The other options target application input or local permissions.

Question 39Network Security

Which wireless security configuration offers the strongest protection for a modern enterprise network?

  1. WPA3-Enterprise with 802.1X authentication Correct answer.
  2. Open authentication with MAC filtering
  3. WPA2-Personal with a long passphrase
  4. WEP with a shared key

Explanation

WPA3-Enterprise combines the strongest current Wi-Fi encryption with per-user 802.1X authentication, avoiding a shared key and resisting offline dictionary attacks. The other options are weaker or deprecated.

Question 40Network Security

Which device primarily segments a network into separate broadcast domains at layer 2?

  1. VLAN-capable switch Correct answer.
  2. Hub
  3. Router
  4. Repeater

Explanation

A VLAN-capable switch assigns ports to distinct VLANs, and each VLAN forms its own broadcast domain. Hubs and repeaters simply extend one collision and broadcast domain.

Question 41Network Security

An administrator needs to detect intrusions by comparing traffic against known malicious patterns. Which detection method is being used?

  1. Anomaly-based detection
  2. Signature-based detection Correct answer.
  3. Statistical baseline detection
  4. Behaviour-based detection

Explanation

Signature-based detection matches traffic against a database of known attack patterns and is fast but blind to new variants. Anomaly and behaviour methods instead compare activity against learned baselines.

Question 42Network Security

Which ICMP message type is commonly blocked at the perimeter to reduce host and network reconnaissance?

  1. Destination unreachable
  2. Echo request Correct answer.
  3. Time exceeded
  4. Parameter problem

Explanation

Blocking inbound echo requests limits ping sweeps and host discovery from outside, though many administrators allow them internally. The other ICMP messages are needed for path MTU and error handling.

Question 43Network Security

A server accepts a connection from an external host and the attacker then uses that channel to send commands to the internal network. Which term best describes the resulting tunnel?

  1. Port scan
  2. ARP poisoning
  3. VLAN hopping
  4. Reverse shell Correct answer.

Explanation

A reverse shell is initiated from the compromised internal host outward, so the attacker's connection appears as outbound traffic and often bypasses inbound filtering. Port scanning and layer-2 attacks do not describe this channel.

Question 44Network Security

Which technology allows a remote worker's traffic to be encrypted and authenticated to the corporate gateway over the public internet?

  1. NAT
  2. VLAN
  3. VPN Correct answer.
  4. DHCP

Explanation

A VPN builds an encrypted, authenticated tunnel between the remote client and the corporate gateway, protecting traffic over untrusted networks. The other technologies handle local addressing or segmentation.

Question 45Network Security

In a demilitarised zone design, which placement is most appropriate for an internet-facing web server?

  1. On the internal user VLAN
  2. Directly on the border router interface
  3. In the DMZ behind a filtering firewall Correct answer.
  4. On the same segment as the domain controllers

Explanation

Placing public-facing servers in a DMZ limits the impact of a compromise because the DMZ is separated from the internal network by a firewall. Co-locating them with internal systems or on the border device exposes the core network.

Question 46Network Security

Which feature of a network access control deployment checks the patch level of a device before granting access?

  1. Link aggregation
  2. Spanning tree
  3. Port mirroring
  4. Posture assessment Correct answer.

Explanation

Posture assessment inspects endpoint attributes such as patch level, antivirus state and configuration before admitting the device to the network. The other features concern traffic copying or layer-2 topology.

Question 47Network Security

Which protocol is used to securely query and modify directory services over TLS?

  1. Kerberos on port 88
  2. LDAPS on port 636 Correct answer.
  3. RADIUS on port 1812
  4. LDAP on port 389

Explanation

LDAPS wraps LDAP in TLS on port 636, protecting credentials and directory data in transit. Plain LDAP on 389 transmits in clear text, and the other protocols serve different purposes.

Question 48Network Security

A switch port is configured to learn only one MAC address and to shut down if a second address appears. Which attack does this directly mitigate?

  1. BGP hijacking
  2. DNS cache poisoning
  3. MAC flooding Correct answer.
  4. SYN flooding

Explanation

Port security limiting learned MAC addresses prevents an attacker from flooding the CAM table with fake addresses to force fail-open hub behaviour. The other attacks operate at higher layers.

Question 49Network Security

Which protocol allows a host to discover the link-layer address associated with a known IPv4 address on the local segment?

  1. DHCP
  2. ARP Correct answer.
  3. NTP
  4. DNS

Explanation

ARP broadcasts a request for the MAC address owning a given IPv4 address and caches the reply. DNS maps names to addresses, DHCP assigns configuration, and NTP synchronises clocks.

Question 50Network Security

A security team wants to prevent cleartext credentials from crossing the network when administrators manage devices. Which measure best addresses this?

  1. Disabling logging on management devices
  2. Using SSH instead of Telnet Correct answer.
  3. Increasing the management VLAN size
  4. Enabling Telnet on management interfaces

Explanation

SSH encrypts the management session so credentials and commands are not readable on the wire, whereas Telnet sends them in clear text. The other measures do not add confidentiality.