I85PREP
⌘ K
Engineer Information Security study materials
Engineer Information Security study resources

Engineer Information Security practice questions

One question at a time. Build your Engineer Information Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Laws and Regulations

情報セキュリティの基本特性である機密性・完全性・可用性のうち、「可用性」が損なわれた状態を表すものはどれか。

  1. 退職者のアカウントが削除されずに残っていた
  2. ランサムウェアにより業務サーバが暗号化され利用できなくなった Correct answer.
  3. 通信経路で改ざんされ、送金金額が書き換えられた
  4. 許可されていない利用者が顧客名簿を閲覧できてしまった

Explanation

可用性は、正当な利用者が必要なときに情報やシステムを利用できる性質を指す。ランサムウェアでサーバが暗号化され業務が停止するのは、可用性が損なわれた典型例である。機密性は閲覧制御、完全性はデータの正確さや完全さに関わる。

Question 2Information Security Fundamentals and Laws and Regulations

日本の個人情報保護法において、生存する個人に関する情報であって、氏名等により特定の個人を識別できるものを何というか。

  1. 個人情報 Correct answer.
  2. 匿名加工情報
  3. 特定個人情報
  4. 仮名加工情報

Explanation

個人情報保護法上の「個人情報」とは、生存する個人に関する情報であって、氏名、生年月日その他の記述等により特定の個人を識別できるもの、または個人識別符号を含むものをいう。仮名加工情報や匿名加工情報は、この個人情報を加工して保護を緩和した区分である。

Question 3Information Security Fundamentals and Laws and Regulations

不正アクセス禁止法が規制する「不正アクセス行為」に該当するものはどれか。

  1. 他人の識別符号を無断で使用してアクセス制御を突破する行為 Correct answer.
  2. 公開されているWebサイトのトップページを閲覧する行為
  3. 自社のサーバに自己の権限でログインする行為
  4. 管理者から委任された範囲で保守作業を行う行為

Explanation

不正アクセス行為とは、アクセス制御機能を有する特定電子計算機に対し、他人の識別符号を無断で入力するなどしてアクセス制御機能を回避し、利用可能な状態にする行為をいう。正当な権限に基づくアクセスは規制の対象外である。

Question 4Information Security Fundamentals and Laws and Regulations

共通鍵暗号方式と公開鍵暗号方式を比較した説明として正しいものはどれか。

  1. 共通鍵暗号方式は、鍵配送問題を原理的に生じない
  2. 公開鍵暗号方式は、暗号化鍵を秘匿し復号鍵を公開する
  3. 共通鍵暗号方式は、暗号化と復号に同一の鍵を用いる Correct answer.
  4. 公開鍵暗号方式は、共通鍵暗号方式より一般に処理速度が速い

Explanation

共通鍵暗号方式は、送信者と受信者が同じ秘密鍵を共有し、その鍵で暗号化と復号を行う方式である。公開鍵暗号方式は暗号化鍵を公開し復号鍵を秘密に保つため、鍵配送問題を緩和できるが、処理速度は一般に共通鍵より遅い。

Question 5Information Security Fundamentals and Laws and Regulations

マルウェアの一種で、感染したファイルを実行すると自身の複製を他のファイルやプログラムに埋め込んで増殖するものはどれか。

  1. コンピュータウイルス Correct answer.
  2. ワーム
  3. スパイウェア
  4. トロイの木馬

Explanation

コンピュータウイルスは、宿主となるファイルやプログラムに寄生し、実行を契機に自身の複製を他のファイルへ感染させて増殖する。ワームは宿主を必要とせずネットワーク経由で自己増殖する点で区別される。

Question 6Information Security Fundamentals and Laws and Regulations

情報セキュリティマネジメントシステムの国際規格であり、ISMSの要求事項を定めたものはどれか。

  1. ISO/IEC 27002
  2. ISO/IEC 20000
  3. ISO/IEC 15408
  4. ISO/IEC 27001 Correct answer.

Explanation

ISO/IEC 27001はISMSの要求事項を定めた規格で、認証審査の基準となる。ISO/IEC 27002は管理策の実践規範であり、要求事項そのものを定める規格ではない。

Question 7Information Security Fundamentals and Laws and Regulations

ある企業が、顧客のクレジットカード番号を含むデータベースを暗号化して保管している。この対策が主として確保する情報セキュリティの特性はどれか。

  1. 可用性
  2. 真正性
  3. 完全性
  4. 機密性 Correct answer.

Explanation

保存データの暗号化は、媒体の盗難や不正アクセスがあっても内容を読めなくする対策であり、主として機密性の確保を目的とする。可用性や完全性への副次的な効果はあるが、主目的は機密性である。

Question 8Information Security Fundamentals and Laws and Regulations

個人情報保護法において、個人情報取扱事業者が第三者に個人データを提供する際に原則として必要となる手続はどれか。

  1. 個人情報保護委員会への事前届出を原則とする
  2. あらかじめ本人の同意を得ることを原則とする Correct answer.
  3. 提供先の同意を得ることを原則とする
  4. 本人の同意を得ることなく自由に提供できる

Explanation

個人情報保護法では、個人データを第三者に提供する場合、あらかじめ本人の同意を得ることが原則として求められる。ただし法令に基づく場合や、オプトアウト届出など法定の例外が認められている。

Question 9Information Security Fundamentals and Laws and Regulations

要配慮個人情報に該当するものはどれか。

  1. 健康診断の結果 Correct answer.
  2. 契約している携帯電話の機種名
  3. 本人が公開している趣味の情報
  4. 勤務先の会社名

Explanation

要配慮個人情報とは、人種、信条、社会的身分、病歴、犯罪の経歴など、不当な差別や偏見が生じないように取り扱いに特に配慮を要する個人情報をいう。健康診断の結果は病歴等に類する情報として該当する。

Question 10Information Security Fundamentals and Laws and Regulations

刑法上の「電子計算機損壊等業務妨害罪」が成立する行為に該当するものはどれか。

  1. 会社の備品である机を故意に壊した
  2. 他人の業務用サーバにデータを書き込み、業務を妨害した Correct answer.
  3. 公開されているWebサイトに正当な手続で意見を投稿した
  4. 自己のアカウントで社内システムにログインした

Explanation

電子計算機損壊等業務妨害罪は、人の業務に使用する電子計算機に虚偽の情報や不正な指令を与えて誤動作させたり、データを破壊したりして業務を妨害する罪である。業務用サーバへの不正な書き込みで業務を妨害する行為が典型例となる。

Question 11Information Security Fundamentals and Laws and Regulations

ハッシュ関数を用いた完全性の確認について正しい説明はどれか。

  1. ハッシュ値から元のデータを容易に復元できる
  2. データが1ビットでも変化するとハッシュ値は大きく変化する Correct answer.
  3. ハッシュ関数は暗号化と復号の両方に用いられる
  4. 同じハッシュ値となるデータは原理的に存在しない

Explanation

暗号学的ハッシュ関数には、わずかな入力の変化で出力が大きく変わる性質（雪崩効果）がある。この性質により、保存したハッシュ値と再計算した値を比較することでデータの改ざんを検知できる。

Question 12Information Security Fundamentals and Laws and Regulations

デジタル署名の仕組みに関する説明として正しいものはどれか。

  1. 受信者の秘密鍵で署名を生成し、送信者の公開鍵で検証する
  2. 送信者の公開鍵で署名を生成し、秘密鍵で検証する
  3. 送信者の秘密鍵で署名を生成し、公開鍵で検証する Correct answer.
  4. 共通鍵で署名を生成し、同じ鍵で検証する

Explanation

デジタル署名は、送信者が自身の秘密鍵で署名を生成し、受信者が送信者の公開鍵で検証する仕組みである。これにより、署名の作成者であることの確認と、メッセージが改ざんされていないことの確認が可能となる。

Question 13Information Security Fundamentals and Laws and Regulations

サイバーセキュリティ基本法に基づき設置され、日本のサイバーセキュリティ政策の司令塔機能を担う組織はどれか。

  1. サイバーセキュリティ戦略本部 Correct answer.
  2. 情報処理推進機構（IPA）
  3. 総務省
  4. 個人情報保護委員会

Explanation

サイバーセキュリティ基本法に基づき、内閣にサイバーセキュリティ戦略本部が設置され、サイバーセキュリティ戦略の策定や施策の総合調整を担う。個人情報保護委員会は個人情報保護法に基づく監督機関である。

Question 14Information Security Fundamentals and Laws and Regulations

テンペスト攻撃として知られる脅威の説明として正しいものはどれか。

  1. 機器から漏えいする電磁波を傍受して情報を復元する Correct answer.
  2. 偽のWebサイトに誘導して認証情報を窃取する
  3. 通信経路に介在して通信内容を盗聴する
  4. 大量の通信を送りつけてサービスを停止させる

Explanation

テンペスト攻撃は、情報機器が発する微弱な電磁波を遠隔から傍受・解析し、画面表示や処理内容などの情報を復元しようとする脅威である。電磁シールドや遮へい室の設置などが対策となる。

Question 15Information Security Fundamentals and Laws and Regulations

SQLインジェクション対策として最も適切なものはどれか。

  1. プレースホルダを用いたパラメータ化クエリを使用する Correct answer.
  2. エラーメッセージを詳細に表示して原因を特定させる
  3. データベースの管理者パスワードを短くして覚えやすくする
  4. 入力値から特殊文字をすべて削除する

Explanation

SQLインジェクションは、入力値がSQL文の一部として解釈されることで発生する。プレースホルダを用いたパラメータ化クエリにより、入力値をSQL構文として解釈させないことが根本的な対策となる。

Question 16Information Security Fundamentals and Laws and Regulations

多要素認証の考え方に照らして、認証要素として適切な組み合わせはどれか。

  1. 社員証と入館証
  2. パスワードと指紋認証 Correct answer.
  3. ユーザIDとパスワード
  4. パスワードと秘密の質問

Explanation

多要素認証は、知識・所持・生体のうち異なる種類の要素を組み合わせることをいう。パスワード（知識）と指紋認証（生体）は異なる種類の要素であり、多要素認証として成立する。

Question 17Information Security Fundamentals and Laws and Regulations

A社は、委託先B社に顧客データの処理を委託している。個人情報保護法上の安全管理措置に関する説明として正しいものはどれか。

  1. 安全管理措置は委託先B社のみが講じればよい
  2. 委託契約に秘密保持条項があれば他の措置は不要である
  3. A社は委託先の監督を含む安全管理措置を講じる必要がある Correct answer.
  4. 委託した時点でA社の安全管理措置の義務は終了する

Explanation

個人情報取扱事業者は、委託先に個人データの取扱いを委託する場合でも、委託先の適切な監督を含め、安全管理措置を講じる義務を負う。委託契約の締結や実地確認など、委託先の状況を把握する取組みが求められる。

Question 18Information Security Fundamentals and Laws and Regulations

ある組織が、重要情報を暗号化して保管し、復号鍵を別システムのハードウェアセキュリティモジュール（HSM）で管理している。この構成が主として狙う効果はどれか。

  1. 利用者の認証を省略できるようにする
  2. 暗号文の改ざんを検知する
  3. 鍵と暗号文を分離して鍵漏えい時の影響を抑える Correct answer.
  4. 通信の可用性を高める

Explanation

暗号化したデータと復号鍵を別の管理系に分離することで、一方が漏えいしても他方が直ちに漏えいする事態を避けられる。鍵をHSM内に保持し外部へ取り出さない運用は、鍵漏えい時の影響範囲を限定する効果を持つ。

Question 19Information Security Fundamentals and Laws and Regulations

A社は、社内システムの脆弱性診断を外部業者に依頼する。委託に当たっての契約上の取決めとして最も適切なものはどれか。

  1. 診断業者が見つけた脆弱性はすべて公開するよう義務付ける
  2. 診断結果の報告は口頭のみでよいとする
  3. 診断中はA社の担当者を一切関与させない
  4. 診断対象の範囲と作業時間帯を明確に定め、書面で合意する Correct answer.

Explanation

脆弱性診断のような能動的な作業を委託する場合、対象範囲や作業時間帯、禁止事項を書面で明確にしておくことが、対象外システムへの影響やトラブルを防ぐうえで重要である。結果の取扱いや報告方法も契約で定める。

Question 20Information Security Fundamentals and Laws and Regulations

暗号利用モードの一つであるCBCモードに関する説明として正しいものはどれか。

  1. 初期化ベクトルを固定して用いることが推奨される
  2. 前のブロックの暗号文を次のブロックの入力に用いるため、同一平文でも暗号文が異なり得る Correct answer.
  3. 平文のビットをそのまま加算するだけで暗号化する
  4. 各ブロックを独立して暗号化するため並列処理が容易である

Explanation

CBCモードでは、前のブロックの暗号文を次のブロックの暗号化入力に用いる連鎖的な処理を行う。そのため同一の平文でも初期化ベクトルが異なれば暗号文は変わり、パターンの露出を抑えられる。

Question 21Network Security

An organization wants to place a device that inspects traffic inline and can drop malicious packets in real time. Which deployment mode of an intrusion prevention system satisfies this requirement?

  1. Passive mode, where the sensor receives a copy of traffic from a SPAN port
  2. Inline mode, where traffic passes through the sensor before reaching its destination Correct answer.
  3. Promiscuous mode, where the NIC accepts all frames on the segment
  4. Tap mode, where the sensor observes mirrored frames without affecting forwarding

Explanation

An IPS must sit in the forwarding path so it can act as a bump in the wire and block traffic before delivery. Passive, tap, and promiscuous modes only observe copies of traffic and therefore cannot prevent delivery.

Question 22Network Security

A security engineer needs to protect a web application from SQL injection and cross-site scripting while allowing legitimate parameter values through. Which control is most appropriate?

  1. A network intrusion detection system monitoring NetFlow records
  2. A web application firewall applying signature and parsing-based rules to HTTP payloads Correct answer.
  3. An IPsec tunnel between the client and the load balancer
  4. A stateless packet filter permitting only port 443

Explanation

A WAF parses HTTP requests and can detect injection patterns in parameters, headers, and bodies, which is required for application-layer attacks. Packet filters, flow records, and encrypted transport do not inspect the semantics of HTTP content.

Question 23Network Security

Which statement correctly describes the difference between a stateful firewall and a stateless packet filter?

  1. A stateful firewall tracks connection state and can allow return traffic without an explicit inbound rule, while a stateless filter evaluates each packet in isolation Correct answer.
  2. A stateless filter maintains a session table while a stateful firewall inspects only the first packet
  3. A stateful firewall encrypts all traffic while a stateless filter only authenticates users
  4. A stateful firewall operates only at the application layer while a stateless filter operates only at layer 2

Explanation

Stateful inspection keeps a connection table so replies belonging to an established session are permitted automatically. A stateless filter has no memory of prior packets and needs explicit rules for both directions.

Question 24Network Security

An administrator must allow remote staff to reach internal applications without exposing those servers directly to the internet. Which architecture achieves this goal?

  1. A DNS forwarder that resolves internal hostnames for external clients
  2. A reverse proxy that forwards inbound requests to the internal servers Correct answer.
  3. A load balancer that distributes traffic across public web servers
  4. A VPN concentrator that authenticates users and places them on the internal network

Explanation

A reverse proxy terminates client connections at the perimeter and forwards requests to internal servers, which remain unreachable from the internet. This is the standard pattern for publishing internal applications safely.

Question 25Network Security

Which protocol and port combination is used by the standard TLS-based remote access VPN that many vendors implement for client-to-site connectivity?

  1. L2TP over UDP 1701
  2. IPsec ESP over UDP 500
  3. PPTP over TCP 1723
  4. OpenVPN over TCP or UDP 1194 Correct answer.

Explanation

OpenVPN commonly uses port 1194 and can run over either TCP or UDP, which helps it traverse restrictive networks. The other options describe different tunneling protocols and their associated ports.

Question 26Network Security

What is the primary security purpose of network segmentation using VLANs and internal firewalls?

  1. To eliminate the need for authentication on internal systems
  2. To simplify routing by placing all hosts in one broadcast domain
  3. To increase available bandwidth between user segments
  4. To limit lateral movement by restricting traffic between zones to explicitly permitted flows Correct answer.

Explanation

Segmentation divides the network into zones with enforced policy between them, so a compromised host cannot freely reach other systems. This containment directly reduces lateral movement during an incident.

Question 27Network Security

Which record type should an organization publish to reduce the risk of email spoofing by declaring which hosts are authorized to send mail for its domain?

  1. An MX record with a higher priority value
  2. A PTR record for the mail server
  3. A CNAME record
  4. An SPF TXT record Correct answer.

Explanation

SPF is published as a TXT record listing the IP addresses and mechanisms authorized to send mail for the domain. Receivers compare the sending host against this list and can reject or flag unauthorized senders.

Question 28Network Security

A company wants wireless clients to authenticate with individual credentials against a central directory before gaining network access. Which standard should be deployed?

  1. WEP with a rotating static key
  2. WPA2-Personal with a shared pre-shared key
  3. WPA2/WPA3-Enterprise using 802.1X with EAP Correct answer.
  4. An open network with a captive portal that stores no credentials

Explanation

Enterprise mode uses 802.1X and EAP so each user authenticates to a RADIUS server with unique credentials, enabling per-user accountability and revocation. Personal mode uses one shared key for all clients.

Question 29Network Security

A network sensor reports an alert showing a scan of TCP ports 1 through 1024 from a single source in a few seconds. Which detection method most likely produced this alert?

  1. File integrity monitoring of system binaries
  2. Threshold-based detection of many connection attempts in a short interval Correct answer.
  3. Protocol anomaly detection based on RFC compliance checks
  4. Signature matching against known malware hashes

Explanation

A rapid sweep across many ports is a volumetric behavior best caught by a threshold or rate-based rule. Signature and integrity checks target known content rather than connection patterns.

Question 30Network Security

During an incident, an analyst observes that a compromised host is sending DNS queries for randomly generated subdomains of a single domain at a high rate. Which threat is most consistent with this behavior?

  1. Cache poisoning of a recursive resolver
  2. A denial-of-service attack against the authoritative server
  3. A zone transfer from a secondary name server
  4. DNS tunneling used to exfiltrate data Correct answer.

Explanation

Encoding data in many unique subdomain labels and querying them lets an attacker move data out through DNS, which is often allowed through firewalls. High-volume unique-name queries to one domain are a classic tunneling indicator.

Question 31Network Security

An engineer configures a firewall rule set and wants to verify that only management hosts can reach the device's SSH service. Which approach provides the strongest assurance?

  1. Enabling verbose logging on the SSH daemon
  2. Reviewing the rule comments in the configuration file
  3. Checking that the SSH service banner is changed from the default
  4. Running an authenticated scan and an unauthenticated scan from a non-management segment to confirm port 22 is filtered Correct answer.

Explanation

Testing reachability from both an authorized and an unauthorized vantage point confirms the rule actually filters traffic as intended. Configuration review alone can miss rule ordering errors or shadowed rules.

Question 32Network Security

A security team deploys a NIDS on a switched network but sees almost no traffic beyond broadcasts. What is the most likely cause?

  1. The sensor is configured with an IP address in the monitored subnet
  2. The sensor is running in inline mode and dropping frames
  3. The sensor's signature database is out of date
  4. The sensor interface is connected to a SPAN port configured for the wrong VLAN or direction Correct answer.

Explanation

On a switched network a passive sensor only sees traffic that is mirrored to it, so a misconfigured SPAN session or wrong VLAN yields near-empty captures. Signature freshness and IP addressing do not change what frames reach the interface.

Question 33Network Security

Which configuration most effectively mitigates ARP spoofing on a managed switch?

  1. Enabling DHCP snooping and dynamic ARP inspection on user VLANs Correct answer.
  2. Segmenting the network into smaller VLANs without additional controls
  3. Increasing the ARP cache timeout on all hosts
  4. Disabling Spanning Tree Protocol on access ports

Explanation

Dynamic ARP inspection validates ARP packets against the DHCP snooping binding table, so hosts cannot claim another host's IP address. DHCP snooping supplies the trusted bindings that DAI relies on.

Question 34Network Security

An organization must let partners reach a single internal API without granting broader network access. Which control best meets this requirement?

  1. A site-to-site IPsec tunnel that routes the entire partner network into the data center
  2. A flat VPN pool that assigns partners addresses in the server VLAN
  3. A NAT rule that forwards all inbound ports to the API server
  4. An API gateway that authenticates partners and exposes only the specific API endpoints Correct answer.

Explanation

An API gateway enforces authentication and exposes only the defined endpoints, applying least privilege at the application layer. Broad tunnels and port forwarding give partners far more reachable surface than required.

Question 35Network Security

A penetration tester captures traffic on a switched segment and notices that the switch is flooding unicast frames to all ports. Which condition most likely explains this?

  1. The switch is running Rapid Spanning Tree Protocol
  2. The switch has enabled port security with a sticky MAC address
  3. The switch is performing proxy ARP for all hosts
  4. The switch's MAC address table has overflowed due to a MAC flooding attack Correct answer.

Explanation

When the CAM table is filled with bogus entries, the switch cannot map destinations to ports and falls back to flooding, which lets an attacker sniff traffic. Port security limits learned addresses and would counter, not cause, this condition.

Question 36Network Security

Which mechanism allows a site-to-site VPN to encrypt traffic between two gateways while preserving the original source and destination addresses of internal hosts?

  1. Tunnel mode IPsec, which encapsulates the entire original packet in a new IP header Correct answer.
  2. Transport mode IPsec, which encrypts only the payload
  3. AH in transport mode, which provides integrity without encryption
  4. NAT-T, which rewrites addresses to avoid conflicts

Explanation

Tunnel mode wraps the whole original packet inside a new IP packet between the gateways, so internal addressing is preserved across the tunnel. Transport mode protects only the payload and leaves the original IP header in the clear.

Question 37Network Security

An analyst reviews proxy logs and sees requests to a domain that resolves to a newly registered IP, with the User-Agent string matching a known malware family and the URI containing a long base64 string. Which conclusion is best supported?

  1. The proxy is misconfigured and caching responses
  2. The DNS resolver is returning stale records
  3. The user is performing a legitimate software update
  4. The host is likely beaconing to a command-and-control server Correct answer.

Explanation

The combination of a newly registered infrastructure, a known malicious User-Agent, and encoded URI data is consistent with malware checking in or exfiltrating data to command-and-control. No single indicator is conclusive, but together they support that conclusion.

Question 38Network Security

Which practice most directly reduces the risk of credential theft when administrators manage network devices remotely?

  1. Using SSH with key-based authentication and restricting management access to a dedicated VLAN Correct answer.
  2. Using Telnet with a complex password
  3. Sharing a single administrator account among the team
  4. Enabling HTTP for device management to avoid certificate errors

Explanation

SSH encrypts the session and key-based authentication avoids sending reusable passwords, while a dedicated management VLAN limits who can reach the interface. Together they address both interception and exposure.

Question 39Network Security

A company wants to detect unauthorized changes to its public DNS records that could redirect users to attacker infrastructure. Which control is most appropriate?

  1. Enabling DNSSEC validation at resolvers
  2. Publishing a wildcard A record for the domain
  3. Monitoring authoritative zone data and registrar settings for unexpected changes Correct answer.
  4. Increasing the TTL on all records

Explanation

Monitoring the authoritative zone and registrar account detects hijacking or unauthorized edits that could redirect users. DNSSEC protects integrity of signed answers but does not by itself detect a compromised registrar or zone administrator.

Question 40Network Security

An engineer is designing a DMZ for internet-facing web servers. Which placement follows security best practice?

  1. Place the web servers directly on the internet-facing router interface without filtering
  2. Place the web servers on the same VLAN as the database to reduce latency
  3. Place the web servers in a separate DMZ segment with distinct inbound and outbound rules Correct answer.
  4. Place the web servers in the internal LAN and allow inbound traffic through the internal firewall

Explanation

A DMZ isolates internet-facing systems from the internal network and enforces separate policy for inbound and outbound flows. If a web server is compromised, the internal firewall still restricts access to back-end systems.

Question 41Network Security

A network uses IPsec with IKEv2. An administrator wants to ensure that peers authenticate using certificates rather than a shared secret. Which change is required?

  1. Disable perfect forward secrecy to simplify key exchange
  2. Configure RSA or ECDSA signatures with a trusted CA certificate on both peers Correct answer.
  3. Configure pre-shared key authentication and increase key length
  4. Switch from ESP to AH to carry certificates

Explanation

Certificate-based IKE authentication uses digital signatures validated against a trusted CA, so each peer proves possession of its private key. Pre-shared keys are symmetric and do not provide this per-peer identity proof.

Question 42Network Security

An analyst must determine whether a suspicious TLS session is using a self-signed certificate presented by an internal service or a certificate from a public CA. Which data source provides the most direct evidence?

  1. NetFlow records for the session
  2. The DHCP lease table for the client
  3. A full packet capture containing the TLS handshake Correct answer.
  4. Syslog messages from the core switch

Explanation

The TLS handshake carries the server certificate, including its issuer and signature, so a packet capture lets the analyst inspect the certificate chain directly. Flow records and logs lack the certificate contents.

Question 43Network Security

A SOC wants to detect lateral movement using pass-the-hash against internal servers. Which network-visible indicator is most relevant when monitoring SMB traffic?

  1. Successful NTLM authentication from a workstation to many servers in a short period using the same account Correct answer.
  2. Large outbound HTTP uploads to a cloud storage provider
  3. Periodic DNS queries for the domain controller
  4. A single Kerberos TGT request at user logon time

Explanation

Pass-the-hash reuses a captured NTLM hash to authenticate to multiple hosts, producing a pattern of NTLM logons from one account across many servers in a short window. Normal logon activity does not show that fan-out pattern.

Question 44Network Security

An organization deploys a next-generation firewall with TLS decryption. Which operational consideration is most important before enabling decryption for all outbound traffic?

  1. Disabling certificate pinning on all applications to avoid errors
  2. Ensuring the firewall's inspection CA certificate is trusted by managed endpoints and that privacy and legal requirements are addressed Correct answer.
  3. Routing all traffic through the firewall in tap mode
  4. Removing forward proxy caching to improve throughput

Explanation

Decryption requires the firewall to re-sign traffic with its own CA, so endpoints must trust that CA and pinned applications must be handled deliberately. Policy, privacy, and legal review is also necessary because decryption exposes sensitive content.

Question 45Network Security

An engineer observes that a firewall's state table is being exhausted by many half-open TCP connections from spoofed sources. Which mitigation most directly addresses this condition?

  1. Allowing all inbound traffic to reduce rule processing
  2. Enabling SYN cookies or SYN flood protection on the firewall Correct answer.
  3. Increasing the idle timeout for established sessions
  4. Disabling logging of denied sessions

Explanation

SYN flood protection such as SYN cookies avoids allocating full state for each half-open connection until the handshake completes, preserving table capacity. Longer timeouts and broader rules would worsen the exhaustion.

Question 46Network Security

An engineer is hardening a DNS resolver against cache poisoning. Which measure most directly prevents an off-path attacker from guessing the transaction and injecting a forged response?

  1. Randomizing both the query ID and the source port for each outstanding query Correct answer.
  2. Enabling EDNS0 to advertise a larger UDP payload size
  3. Setting a short negative TTL for names that do not resolve
  4. Publishing a CAA record restricting which CAs may issue certificates

Explanation

Cache poisoning by an off-path attacker requires guessing the transaction ID and the source port used for the query; randomizing both makes the search space large enough that blind guessing is impractical. EDNS0 affects payload size and can reduce truncation, but it does not by itself provide unpredictability. CAA and negative TTL settings address certificate issuance and caching behavior respectively, not forged-response injection.

Question 47Network Security

A company uses a stateful firewall between users and the internet. Which behavior is expected for a TCP connection initiated from the internet toward an internal client that has no existing session?

  1. The packet is dropped because no state entry matches the inbound flow Correct answer.
  2. The packet is allowed if it uses destination port 443
  3. The packet is queued until the internal client opens a matching session
  4. The packet is forwarded after the firewall verifies the TCP checksum

Explanation

A stateful firewall only permits return traffic that matches an existing connection entry, so unsolicited inbound packets with no session are dropped by default. Checksum verification is a correctness check, not an authorization decision, and it does not create state. Queuing until the client initiates inverts the model, and allowing port 443 inbound is a policy choice that is not implied by statefulness.

Question 48Network Security

An engineer must let a remote worker reach internal applications over an untrusted network without exposing those applications directly to the internet. Which design achieves this with the least exposure?

  1. A remote-access VPN terminating at a gateway that applies per-user authorization before forwarding traffic Correct answer.
  2. A split tunnel that sends only intranet traffic through the tunnel and the rest directly
  3. An inbound firewall rule allowing the worker's home IP address to reach the application ports
  4. A static NAT rule that maps each internal application server to a public address

Explanation

A remote-access VPN creates an authenticated encrypted tunnel, and terminating it at a gateway that enforces per-user authorization means internal applications need no public exposure. Static NAT publishes servers directly, increasing attack surface. Split tunneling changes which traffic is protected but does not reduce exposure of the applications themselves, and IP-based inbound rules are brittle and still expose ports publicly.

Question 49Network Security

A monitoring team wants to identify hosts that are communicating with a botnet controller using a domain generated by a domain generation algorithm. Which network-visible characteristic is the most reliable detection signal?

  1. Periodic DNS queries to the same well-known CDN domain
  2. Many queries for high-entropy, previously unseen domains that mostly return NXDOMAIN Correct answer.
  3. A single long-lived TLS session to a domain with a valid certificate
  4. Frequent HTTP redirects from a site using HSTS

Explanation

Domain generation algorithms produce large volumes of pseudo-random names, most of which are unregistered, so a burst of high-entropy queries returning NXDOMAIN is a strong indicator. A single valid TLS session is normal for many applications. Repeated queries to a reputable CDN and HSTS redirects are ordinary behaviors with no DGA signature.

Question 50Network Security

An engineer is deploying 802.1X on switch ports used by both managed laptops and unmanaged printers. Which combination best balances access control with operational continuity for the printers?

  1. EAP-TLS for managed laptops and MAC authentication bypass with a restricted VLAN for printers Correct answer.
  2. PEAP-MSCHAPv2 for all devices using a shared account for printers
  3. Disabling 802.1X on printer ports and placing them in the same VLAN as user laptops
  4. Open authentication with port security limiting each port to one MAC address

Explanation

Managed laptops can present certificates via EAP-TLS, which resists password theft, while printers that cannot run a supplicant can be handled by MAC authentication bypass and confined to a restricted VLAN with limited reachability. A shared account for all printers weakens accountability and invites credential reuse. Open authentication with port security gives no identity check, and mixing printers into the user VLAN removes the segmentation benefit.