I85PREP
⌘ K
DSST MIS study materials
DSST MIS study resources

DSST MIS practice questions

One question at a time. Build your DSST MIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Telecommunications

In a digital transmission system, what is the primary purpose of a codec?

  1. To convert analog voice signals into digital bit streams and back again Correct answer.
  2. To amplify the signal power along a long copper cable run
  3. To route packets between separate networks using logical addressing
  4. To encrypt the payload so that only the receiver can decode it

Explanation

A codec (coder-decoder) performs analog-to-digital conversion at the sending end and digital-to-analog conversion at the receiving end. It is the boundary component between the analog local loop and the digital network, so its job is signal conversion rather than routing, amplification, or security.

Question 2Telecommunications

Which organization historically developed and published the T-carrier and other North American telecommunications standards?

  1. The Internet Engineering Task Force (IETF)
  2. The International Telecommunication Union Telecommunication Standardization Sector (ITU-T)
  3. The Institute of Electrical and Electronics Engineers (IEEE)
  4. Telcordia, formerly Bellcore Correct answer.

Explanation

Bellcore, later renamed Telcordia, produced the generic requirements that governed North American carrier systems such as T-carrier. Its documents became the reference for operating and engineering the public switched network in that region.

Question 3Telecommunications

A DS-1 signal in North America carries how many voice channels, and at what aggregate line rate?

  1. 24 channels at 1.544 Mbps Correct answer.
  2. 30 channels at 2.048 Mbps
  3. 12 channels at 1.544 Mbps
  4. 24 channels at 2.048 Mbps

Explanation

A DS-1 frame contains 24 time slots, each carrying one 64 kbps voice channel, giving an aggregate line rate of 1.544 Mbps. The 2.048 Mbps rate belongs to the European E-1 system, which carries 30 channels plus signaling and framing.

Question 4Telecommunications

Which characteristic distinguishes packet switching from traditional circuit switching?

  1. A dedicated physical path is reserved for the entire duration of the call
  2. Bandwidth is allocated in fixed 64 kbps increments for each conversation
  3. Signaling is always carried on a separate common channel from the voice path
  4. Data is divided into units that share links and are forwarded independently Correct answer.

Explanation

Packet switching breaks traffic into packets that are statistically multiplexed and forwarded hop by hop, so no end-to-end circuit is held open. Circuit switching instead reserves a continuous path and fixed capacity for the life of the connection.

Question 5Telecommunications

What does the term 'local loop' refer to in the public switched telephone network?

  1. The internal switching fabric inside a Class 5 end office
  2. The international gateway linking carriers in different countries
  3. The trunk group connecting two central offices within a city
  4. The pair of copper wires connecting a subscriber premises to the central office Correct answer.

Explanation

The local loop, also called the subscriber loop, is the physical access pair running from the customer premises to the serving central office. It is the analog access segment where a codec at the office converts the signal to digital form.

Question 6Telecommunications

Which multiplexing technique assigns each conversation a distinct frequency band on a shared medium?

  1. Statistical packet multiplexing
  2. Frequency-division multiplexing Correct answer.
  3. Code-division multiple access
  4. Time-division multiplexing

Explanation

Frequency-division multiplexing splits the available spectrum into separate bands, each carrying one channel simultaneously. Time-division multiplexing instead shares the same spectrum by giving each channel a repeating time slot.

Question 7Telecommunications

In a T-carrier system, what is the role of the repeater?

  1. It performs the time-slot interchange that routes calls between offices
  2. It regenerates the attenuated digital pulses so the signal can travel farther Correct answer.
  3. It terminates the signaling channel and forwards call setup messages
  4. It converts the digital line signal back to analog voice for the subscriber

Explanation

A T-carrier repeater is a regenerative device that reshapes and retimes the received pulses before retransmitting them, extending the reach of the span. Because it regenerates rather than simply amplifies, noise does not accumulate in the same way as with analog amplifiers.

Question 8Telecommunications

Which statement best describes the function of a modem in a dial-up data connection?

  1. It multiplexes several voice calls onto a single trunk
  2. It compresses the file being transferred before transmission
  3. It converts digital data to an analog signal suitable for the voice network and back Correct answer.
  4. It assigns IP addresses to hosts on the local network

Explanation

A modem performs modulation and demodulation, translating digital data into analog tones that can pass through the voice-grade channel and reversing the process at the far end. This lets data travel over plant designed for analog voice.

Question 9Telecommunications

A technician needs to extend a DS-1 span beyond the normal distance a single span supports. Which approach is appropriate?

  1. Reduce the line rate to 56 kbps so the signal travels farther
  2. Replace the twisted pair with a longer single copper pair
  3. Increase the transmit amplitude at the office until the far end receives it
  4. Add regenerative repeaters at the recommended spacing along the span Correct answer.

Explanation

DS-1 spans are limited by pulse dispersion and attenuation, so repeaters are inserted at engineered intervals to regenerate the signal. Simply raising power does not correct the timing distortion that accumulates over long copper runs.

Question 10Telecommunications

A DS-1 uses extended superframe (ESF) formatting. Which capability does ESF provide that the older D4 format does not?

  1. A cyclic redundancy check and a data link on the framing bits Correct answer.
  2. Robbed-bit signaling in every sixth frame
  3. A separate 64 kbps channel dedicated to voice
  4. A 193rd bit used only for frame alignment

Explanation

ESF reuses the framing bit positions for a 4 kbps facilities data link, a CRC-6 error check, and frame alignment, which supports performance monitoring. D4 uses its framing bits only for synchronization and relies on robbed-bit signaling.

Question 11Telecommunications

Why does robbed-bit signaling slightly degrade the quality of a voice channel?

  1. It doubles the line rate to carry signaling overhead
  2. It converts the channel from PCM to analog transmission
  3. It removes an entire time slot from the frame
  4. It replaces the least significant bit with a signaling bit in certain frames Correct answer.

Explanation

Robbed-bit signaling overwrites the least significant bit of each voice sample in designated frames with a signaling bit. Because that bit carries a small part of each sample's amplitude information, the reconstructed signal has a slightly higher quantizing noise floor.

Question 12Telecommunications

A channel bank is being configured for a T-carrier span. What is its primary function?

  1. To multiplex 24 analog voice channels into a single DS-1 bit stream Correct answer.
  2. To terminate the international SS7 signaling links
  3. To provide the DC power feeding the subscriber telephone sets
  4. To switch calls between different central offices

Explanation

A channel bank contains per-channel codecs and multiplexing logic that combine 24 voice-grade channels into one DS-1 signal. It sits at the boundary between analog access lines and the digital carrier span.

Question 13Telecommunications

In a PCM voice system, what is the purpose of companding?

  1. To reduce the number of bits per sample from eight to four
  2. To synchronize the clocks of two connected offices
  3. To encrypt the digitized voice before transmission
  4. To compress large-amplitude samples and expand small ones for a better signal-to-noise ratio Correct answer.

Explanation

Companding applies a nonuniform quantization law so small signals get finer resolution and large signals coarser resolution, improving perceived quality for a given bit rate. Mu-law and A-law are the two common companding standards.

Question 14Telecommunications

A DS-3 signal is described as carrying 672 voice channels. What line rate corresponds to DS-3?

  1. 44.736 Mbps Correct answer.
  2. 139.264 Mbps
  3. 6.312 Mbps
  4. 51.840 Mbps

Explanation

DS-3 operates at 44.736 Mbps and carries 28 DS-1 signals, which corresponds to 672 DS-0 channels. The 6.312 Mbps rate is DS-2, while 51.840 Mbps is an STS-1 SONET rate and 139.264 Mbps is the European E-4 level.

Question 15Telecommunications

Which statement accurately describes a SONET OC-3 signal?

  1. It runs at 44.736 Mbps and is equivalent to one DS-3
  2. It runs at 155.52 Mbps and is built from three STS-1 frames Correct answer.
  3. It carries exactly three DS-3 signals and no overhead
  4. It uses a single 64 kbps channel for all payload and overhead

Explanation

OC-3 is the optical carrier level corresponding to three STS-1 frames, giving a line rate of 155.52 Mbps. SONET frames include transport overhead, so the payload is not simply three raw DS-3 signals.

Question 16Telecommunications

A network engineer observes that a SONET ring survives a single fiber cut without losing service. Which SONET feature primarily provides this protection?

  1. The use of robbed-bit signaling on the working path
  2. Automatic protection switching that reroutes traffic onto the standby path Correct answer.
  3. The section overhead byte used for frame alignment
  4. The companding law applied to each voice channel

Explanation

SONET rings use automatic protection switching, such as a unidirectional path-switched ring or a bidirectional line-switched ring, to move traffic to a protect path when a span fails. This restoration is a transport-layer function independent of payload framing details.

Question 17Telecommunications

How does asynchronous transfer mode (ATM) differ from a pure time-division multiplexed carrier system?

  1. ATM requires a dedicated physical pair for each virtual circuit
  2. ATM carries only analog voice and cannot transport data
  3. ATM uses fixed-length cells that are statistically multiplexed over virtual circuits Correct answer.
  4. ATM assigns every connection a fixed 64 kbps time slot for the call duration

Explanation

ATM transports data in fixed 53-byte cells and multiplexes them statistically across virtual circuits, allowing flexible bandwidth use. TDM instead reserves fixed recurring time slots whether or not the user is transmitting.

Question 18Telecommunications

Which of the following best describes the function of a digital cross-connect system in a carrier network?

  1. It provides loop power to subscriber telephone sets
  2. It grooms and rearranges DS-0, DS-1, and DS-3 signals between facilities without full call switching Correct answer.
  3. It terminates dial tone and provides call features to the subscriber
  4. It converts analog voice to packetized voice for the local loop

Explanation

A digital cross-connect system terminates many digital facilities and can cross-connect individual channels or higher-rate signals, supporting grooming and reconfiguration. It operates at the transport level and does not itself provide per-call switching or subscriber features.

Question 19Telecommunications

In the SS7 signaling architecture, what is the role of a signal transfer point?

  1. It routes signaling messages between signaling points on the network Correct answer.
  2. It provides the physical loop to the subscriber premises
  3. It stores the subscriber's call features and billing records
  4. It converts analog voice calls to digital PCM

Explanation

A signal transfer point is a packet switch in the SS7 network that forwards signaling messages between service switching points, service control points, and other nodes. It does not itself handle voice payload or subscriber line functions.

Question 20Telecommunications

A carrier wants signaling to travel on a separate channel from the voice path so that calls can be set up faster and features can be added. Which signaling approach fits this requirement?

  1. Common-channel signaling such as SS7 Correct answer.
  2. Robbed-bit signaling within each DS-0
  3. DC loop-start supervision on the subscriber line
  4. In-band signaling using tones within the voice band

Explanation

Common-channel signaling places call-control messages on a dedicated signaling path separate from the voice channels, enabling faster setup and richer services. In-band and robbed-bit methods share the voice path and offer far less capability.

Question 21Telecommunications

Which transmission medium is most appropriate for a high-capacity interoffice trunk that must span several kilometers without repeaters?

  1. Unshielded twisted pair rated for voice-grade service
  2. Single-mode optical fiber Correct answer.
  3. Two-wire subscriber drop cable
  4. Coaxial cable with analog amplifiers every 500 meters

Explanation

Single-mode fiber offers very low loss and enormous bandwidth, allowing long interoffice spans without intermediate regeneration. Twisted pair and coaxial cable suffer much higher loss and limited capacity over comparable distances.

Question 22Telecommunications

A DS-1 span is experiencing bipolar violations that are not part of a valid framing pattern. Which condition should be investigated first?

  1. An incorrect IP address assigned to the channel bank
  2. A subscriber telephone set that is off-hook
  3. A line-coding or timing problem such as a misconfigured repeater or a wrong framing format Correct answer.
  4. A mismatch in the companding law between the two ends

Explanation

Bipolar violations outside the expected framing positions usually indicate a physical-layer or line-coding fault, such as a defective repeater, a cabling problem, or a framing mismatch between endpoints. These are layer-one issues, so higher-layer settings and subscriber state are not the first suspect.

Question 23Telecommunications

An engineer must transport 28 DS-1 signals across a SONET network. Which approach allows the DS-1s to be carried most efficiently?

  1. Map each DS-1 into its own STS-1 payload
  2. Carry each DS-1 on a separate OC-48 wavelength
  3. Convert each DS-1 to an analog voice channel before transport
  4. Map the DS-1s into a single DS-3, then map the DS-3 into a SONET payload Correct answer.

Explanation

Twenty-eight DS-1 signals combine into one DS-3, which can then be mapped into a SONET payload, giving efficient use of transport capacity. Mapping each DS-1 to a whole STS-1 wastes most of that frame's capacity.

Question 24Telecommunications

A carrier is comparing TDM and statistical multiplexing for bursty data traffic. Which outcome is expected when statistical multiplexing is used?

  1. Each user is guaranteed a fixed bandwidth at all times
  2. Average link utilization improves, but some delay or loss can occur during congestion Correct answer.
  3. Total capacity of the link increases beyond its physical line rate
  4. Signaling overhead is eliminated entirely from the network

Explanation

Statistical multiplexing shares link capacity on demand, so it can serve more users than fixed TDM assignment on average. The tradeoff is that bursts can cause queuing delay or loss when many users transmit at once.

Question 25Telecommunications

A network planner must choose between a protected SONET ring and an unprotected linear SONET span for a critical route. Which consideration most strongly favors the ring?

  1. The ring removes the need for synchronization between nodes
  2. The ring allows the use of analog voice channels over fiber
  3. The ring eliminates the need for any transport overhead
  4. The ring provides automatic restoration after a single span failure Correct answer.

Explanation

A protected ring offers automatic protection switching so that traffic survives a single span cut, which is the key reliability advantage over an unprotected linear span. SONET rings still carry overhead and still require proper timing.

Question 26Telecommunications

A legacy carrier network transmits 24 digitized voice channels over a single DS-1 span. Which multiplexing method does this arrangement use?

  1. Statistical multiplexing, in which slots are allocated only to channels with active traffic
  2. Wavelength-division multiplexing, in which each channel is carried on a distinct optical wavelength
  3. Frequency-division multiplexing, in which each channel occupies a separate carrier frequency
  4. Time-division multiplexing, in which each channel is assigned a recurring time slot Correct answer.

Explanation

A DS-1 interleaves 24 channels by giving each one a fixed, recurring position in the transmitted frame, which is the defining behavior of time-division multiplexing. Fixed slot assignment guarantees each voice channel a steady 64 kbps without contention.

Question 27Telecommunications

A customer's router is connected to a carrier through a channel service unit/data service unit (CSU/DSU). Which pair of functions does this device perform?

  1. It maps DS-1 channels into SONET virtual tributaries for optical transport
  2. It aggregates 28 DS-1 signals into a single higher-rate DS-3 payload
  3. It terminates the digital carrier line and isolates the customer premises equipment from line faults Correct answer.
  4. It converts analog voice to PCM samples and compresses them before transmission

Explanation

The CSU/DSU is the demarcation device: it terminates the carrier's digital circuit, regenerates and equalizes the signal, and protects the router from electrical faults and loopback conditions on the line. It also supplies the timing and keep-alive signaling the carrier expects.

Question 28Telecommunications

A private branch exchange must hand calls to the public switched telephone network so that the carrier can interpret dialed digits and route each call. Which arrangement provides this?

  1. A station loop that connects each telephone set to a line card in the PBX
  2. A tie trunk that connects the PBX directly to a second PBX at another site
  3. A central office trunk using a common-channel signaling protocol such as ISDN PRI or SS7 Correct answer.
  4. A local loop that carries only battery and ringing current to the subscriber set

Explanation

Calls leaving the premises need a trunk to the carrier's central office, and the carrier needs signaling that conveys addressing and call-control information. ISDN PRI or SS7 common-channel signaling carries the dialed digits and setup messages the central office uses to route the call.

Question 29Telecommunications

An engineer is designing a digital carrier link and must account for the fact that a DS-1 frame carries 193 bits, of which one is a framing bit. What is the resulting payload rate available to the 24 voice channels?

  1. 1.544 Mbps, because the framing bit is counted as part of the payload
  2. 64 kbps, because only one channel can be active in a frame at a time
  3. 1.536 Mbps, because the 8 kbps framing overhead is excluded from the 1.544 Mbps line rate Correct answer.
  4. 2.048 Mbps, because the frame is padded to match the E-carrier hierarchy

Explanation

The DS-1 line rate is 8000 frames per second times 193 bits, or 1.544 Mbps. One bit per frame is framing overhead, leaving 192 payload bits per frame, which at 8000 frames per second yields 1.536 Mbps of usable channel capacity.

Question 30Network security

Which security objective is primarily concerned with ensuring that data has not been altered in transit between two systems?

  1. Integrity Correct answer.
  2. Nonrepudiation
  3. Confidentiality
  4. Availability

Explanation

Integrity means data remains accurate and complete and has not been modified without authorization, whether in storage or in transit. Hash functions and message authentication codes are the standard tools used to detect alteration. Confidentiality instead hides content, availability keeps resources reachable, and nonrepudiation prevents later denial of an action.

Question 31Network security

A user receives an email warning that the account will be closed unless credentials are entered at a linked page that mimics the company login portal. Which attack is this?

  1. Phishing Correct answer.
  2. Smurfing
  3. Piggybacking
  4. War driving

Explanation

Phishing uses deceptive messages that impersonate a trusted entity to trick recipients into revealing credentials or clicking malicious links. The fake login page is the classic credential-harvesting element. Smurfing, piggybacking, and war driving are unrelated network or physical access techniques.

Question 32Network security

Which device is placed in a network segment to detect and log suspicious traffic without directly blocking it?

  1. Load balancer
  2. Proxy cache
  3. Intrusion detection system Correct answer.
  4. Intrusion prevention system

Explanation

An intrusion detection system monitors traffic and raises alerts but sits outside the forwarding path, so it does not stop the traffic itself. An intrusion prevention system is deployed inline and can drop malicious packets. Load balancers and proxy caches serve performance and content purposes rather than security monitoring.

Question 33Network security

Which protocol provides encrypted remote terminal access and has largely replaced Telnet for administrative sessions?

  1. SNMP
  2. FTP
  3. SSH Correct answer.
  4. TFTP

Explanation

Secure Shell encrypts the entire session, including authentication, and is the standard replacement for the cleartext Telnet protocol. FTP, SNMP, and TFTP are not interactive remote shell protocols, and their basic forms send data without strong encryption.

Question 34Network security

In a symmetric encryption scheme used to protect bulk network traffic, which property creates the key distribution problem?

  1. Keys expire after every packet
  2. Keys are derived only from a passphrase
  3. Both parties must share the same secret key Correct answer.
  4. Each party uses a different key from a public directory

Explanation

Symmetric algorithms require sender and receiver to hold an identical secret key, so that key must be delivered securely before communication begins. This out-of-band distribution requirement is the classic weakness of symmetric-only systems. Public key systems avoid it by using separate public and private keys.

Question 35Network security

Which term describes a network security zone that sits between the public internet and the internal trusted network?

  1. NAT pool
  2. Loopback
  3. DMZ Correct answer.
  4. VLAN

Explanation

A demilitarized zone is a segmented area that hosts externally reachable services while shielding the internal network from direct exposure. Traffic between the internet and internal hosts is forced through firewall rules around the DMZ. VLANs, NAT pools, and loopback interfaces are addressing or segmentation tools, not security zones by definition.

Question 36Network security

Which practice most directly reduces the risk of unauthorized access caused by a stolen employee laptop?

  1. Full-disk encryption with strong authentication Correct answer.
  2. Disabling the firewall on the laptop
  3. Sharing the local administrator password among the team
  4. Storing credentials in a plain text file on the desktop

Explanation

Full-disk encryption renders the drive unreadable without the correct authentication, so a thief cannot extract stored data. Strong pre-boot authentication adds a second barrier beyond possession of the device. The other choices increase exposure rather than reduce it.

Question 37Network security

Which security control is designed to verify that a person is who they claim to be before granting access to a system?

  1. Authentication Correct answer.
  2. Accounting
  3. Authorization
  4. Auditing

Explanation

Authentication establishes identity by checking credentials such as a password, token, or biometric. Authorization then determines what the authenticated identity may do, while accounting and auditing record and review activity. Confusing authentication with authorization is a common source of access control design errors.

Question 38Network security

A company wants to allow remote employees to reach internal applications without exposing those applications directly to the internet. Which approach best meets this goal?

  1. Require a VPN connection that authenticates users before granting internal access Correct answer.
  2. Publish each internal server with a public IP address and no filtering
  3. Disable the firewall so remote clients can connect directly
  4. Place all internal servers on the same flat network as guest Wi-Fi

Explanation

A VPN creates an encrypted tunnel and authenticates the user before any internal resource is reachable, so applications need no public exposure. This keeps the internal network hidden behind the tunnel endpoint. Publishing servers directly or flattening the network removes the protective boundary.

Question 39Network security

An administrator configures a firewall rule that permits only TCP port 443 to a web server and denies all other inbound traffic. Which security principle does this best illustrate?

  1. Defense in depth
  2. Separation of duties
  3. Security through obscurity
  4. Implicit deny with least privilege Correct answer.

Explanation

The rule allows only the single service required and blocks everything else by default, which is the implicit deny posture. Restricting inbound access to the minimum necessary port also reflects least privilege at the network layer. Defense in depth, separation of duties, and obscurity describe different concepts.

Question 40Network security

Which characteristic distinguishes an intrusion prevention system from an intrusion detection system on the same network?

  1. The prevention system replaces the firewall entirely
  2. The prevention system is deployed inline and can drop malicious packets Correct answer.
  3. The prevention system encrypts all monitored traffic
  4. The prevention system only writes alerts to a log

Explanation

An intrusion prevention system sits inline in the traffic path, so it can actively block or drop packets it flags as malicious. An intrusion detection system is passive and only alerts. Encryption of traffic and replacement of the firewall are not defining features of either system.

Question 41Network security

A web application reflects user-supplied input directly into HTML pages, and an attacker submits a script that executes in other users' browsers. Which mitigation most directly addresses this vulnerability?

  1. Enabling verbose error messages
  2. Increasing the length of session identifiers
  3. Storing passwords with reversible encryption
  4. Output encoding of user-supplied data Correct answer.

Explanation

Cross-site scripting occurs when untrusted input is rendered as executable content, so context-aware output encoding neutralizes the injected markup. Input validation also helps, but encoding at the output point is the direct fix. The other options affect unrelated areas such as session handling, error disclosure, and password storage.

Question 42Network security

Which protocol is used to securely retrieve email while leaving messages on the server and supports encrypted transport?

  1. IMAP over TLS Correct answer.
  2. DNS
  3. POP3 without encryption
  4. SMTP

Explanation

IMAP keeps messages on the server and synchronizes state across clients, and running it over TLS protects credentials and content. SMTP is for sending mail, unencrypted POP3 exposes credentials, and DNS resolves names.

Question 43Network security

An organization wants to detect when an attacker is probing many ports on a host in a short time. Which log source is most useful for this?

  1. Firewall and router traffic logs Correct answer.
  2. Printer spooler logs
  3. Application source code repository
  4. Password change history

Explanation

Port scanning produces connection attempts that appear in firewall and router logs as a series of denied or accepted connections to many ports. Analyzing these records reveals the scan pattern. Password history, printer logs, and source repositories do not record network connection attempts.

Question 44Network security

Which statement best describes the role of a certificate authority in a public key infrastructure?

  1. It encrypts all traffic between clients and servers
  2. It assigns IP addresses to network hosts
  3. It signs certificates that bind a public key to a verified identity Correct answer.
  4. It stores every user's private key for recovery

Explanation

A certificate authority verifies an entity's identity and issues a signed certificate that binds that identity to a public key. Relying parties trust the authority's signature, which lets them validate the certificate chain. Private keys are not centrally stored, encryption of traffic is done by protocols, and address assignment is DHCP's job.

Question 45Network security

A network administrator wants to prevent users on the guest wireless network from reaching internal file servers while still allowing internet access. Which control best accomplishes this?

  1. Increase the wireless encryption key length
  2. Assign guest devices static IP addresses
  3. Segment the guest network and apply firewall rules restricting access to internal subnets Correct answer.
  4. Enable broadcast storm control on the guest access points

Explanation

Placing guests on a separate segment and enforcing firewall policy between that segment and internal subnets isolates them while preserving internet access. Segmentation plus explicit rules is the direct control. Static addressing, storm control, and longer keys do not restrict reachability to internal servers.

Question 46Network security

What is the primary purpose of a DMZ in a network architecture?

  1. To centralize user password storage
  2. To provide backup power to critical servers
  3. To accelerate traffic through caching
  4. To host internet-facing services while limiting direct exposure of the internal network Correct answer.

Explanation

A DMZ isolates systems that must be reachable from untrusted networks so that a compromise there does not grant direct access to the internal network. Firewall rules tightly control traffic between the DMZ and internal segments. Power backup, caching, and password storage are unrelated functions.

Question 47Network security

An attacker intercepts traffic between two parties and relays it while remaining undetected, reading and possibly modifying messages. Which attack is described?

  1. Denial of service
  2. Man-in-the-middle Correct answer.
  3. Privilege escalation
  4. SQL injection

Explanation

A man-in-the-middle attack places the adversary between two communicating parties so that each believes it is talking directly to the other. The attacker can read and alter traffic, and strong mutual authentication with TLS helps detect it. Denial of service, SQL injection, and privilege escalation describe other classes of attack.

Question 48Network security

Which measure best mitigates the risk of ARP spoofing on a local network?

  1. Using a longer Wi-Fi passphrase
  2. Increasing the DHCP lease time
  3. Dynamic ARP inspection on managed switches Correct answer.
  4. Disabling spanning tree protocol

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding table, typically built from DHCP snooping, and drops forged replies. This directly counters an attacker claiming another host's IP address at Layer 2. The other options do not validate ARP messages.

Question 49Network security

A security team wants to detect unauthorized changes to critical configuration files on servers. Which control is most appropriate?

  1. A honeypot on the DMZ segment
  2. A network tap capturing all traffic
  3. A web application firewall in front of the servers
  4. File integrity monitoring that compares hashes against a known baseline Correct answer.

Explanation

File integrity monitoring computes cryptographic hashes of files and alerts when they differ from the approved baseline, which reveals tampering. Network taps, web application firewalls, and honeypots monitor traffic or attract attackers but do not verify stored file contents.

Question 50Network security

An organization uses TLS with mutual authentication between internal services. Which security property does the client certificate primarily add?

  1. Protection against denial of service
  2. Confidentiality of the server's private key
  3. Assurance that the client is a legitimate trusted service Correct answer.
  4. Reduction of certificate revocation checks

Explanation

In mutual TLS the server also validates a client certificate, so each side proves its identity to the other. This prevents an unauthorized client from connecting even if it reaches the service endpoint. It does not protect the server's private key, remove revocation checks, or stop denial of service.