I85PREP
⌘ K
Network Security Analyst study materials
Network Security Analyst study resources

Network Security Analyst practice questions

One question at a time. Build your Network Security Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals

A security analyst is reviewing a packet capture and sees a TCP segment with the SYN and ACK flags both set. What does this segment represent in the TCP three-way handshake?

  1. The first step, where the client initiates a connection and advertises its initial sequence number
  2. The final step, where the client confirms receipt of the server's sequence number
  3. A connection reset request used to tear down an existing session
  4. The second step, where the server acknowledges the client's SYN and synchronizes its own sequence number Correct answer.

Explanation

In the three-way handshake the server replies to the initial SYN with a segment that has both SYN and ACK set, acknowledging the client's sequence number while advertising its own. The client then completes the handshake with a final ACK. A segment with only SYN set is the opening request, and RST is used to abort a connection.

Question 2Network Security Fundamentals

Which protocol and port combination is used by a client to query a DNS server for a hostname resolution over the network by default?

  1. UDP port 123
  2. TCP port 443
  3. TCP port 53
  4. UDP port 53 Correct answer.

Explanation

Standard DNS queries are sent over UDP port 53 because the request and response are small and connectionless transport is efficient. TCP port 53 is used for zone transfers and for responses too large for UDP. Port 123 is NTP and port 443 is HTTPS.

Question 3Network Security Fundamentals

An analyst observes a workstation sending frames to a destination MAC address of ff:ff:ff:ff:ff:ff. What is the workstation doing?

  1. Sending a unicast frame to a single host on the local segment
  2. Sending a frame to the default gateway for routing
  3. Broadcasting a frame to every host on the local network segment Correct answer.
  4. Triggering a spanning tree topology change notification

Explanation

The address ff:ff:ff:ff:ff:ff is the reserved Ethernet broadcast address, so every NIC on the local broadcast domain receives and processes the frame. ARP requests and DHCP discovers commonly use it. Unicast traffic targets a specific host MAC, and the gateway is reached with its own unicast MAC.

Question 4Network Security Fundamentals

Which OSI model layer is responsible for logical addressing and path selection between networks?

  1. Transport layer
  2. Network layer Correct answer.
  3. Data link layer
  4. Session layer

Explanation

The network layer handles logical (IP) addressing and routing decisions that move packets between different networks. The data link layer handles physical MAC addressing on a single segment, and the transport layer provides end-to-end delivery and ports. The session layer manages dialogue control, not routing.

Question 5Network Security Fundamentals

A host has the IPv4 address 192.168.10.130 with a subnet mask of 255.255.255.192. What is the network address of the subnet this host belongs to?

  1. 192.168.10.64
  2. 192.168.10.128 Correct answer.
  3. 192.168.10.192
  4. 192.168.10.0

Explanation

The mask 255.255.255.192 is a /26, which gives blocks of 64 addresses. The host value 130 falls in the 128-191 range, so the network address is 192.168.10.128. The .0, .64, and .192 values are the network addresses of the other /26 subnets in the same /24.

Question 6Network Security Fundamentals

Which characteristic distinguishes a stateful packet-filtering firewall from a stateless one?

  1. It inspects only the header fields of each packet in isolation
  2. It filters traffic solely by MAC address at layer 2
  3. It maintains a session table to track established connections and allow return traffic Correct answer.
  4. It decrypts TLS sessions to inspect application payloads

Explanation

A stateful firewall records active connections in a state table so that return traffic for an outbound session is permitted without an explicit inbound rule. A stateless filter evaluates each packet independently against static rules. Deep TLS decryption and layer-2 MAC filtering are separate functions not implied by statefulness.

Question 7Network Security Fundamentals

A network uses NAT. Which statement best describes how an internal host's traffic appears to an external server after passing through a typical port-address-translation gateway?

  1. The source IP is preserved unchanged while only the destination is rewritten
  2. The source IP is rewritten to the internal host's MAC address
  3. The source IP is rewritten to the gateway's public IP with a translated source port Correct answer.
  4. The destination IP remains the internal host's private address throughout the exchange

Explanation

Port address translation rewrites the private source IP to the gateway's public address and assigns a unique source port so multiple internal sessions can share one public address. The gateway tracks these mappings to route return traffic back to the correct internal host. Destination rewriting to a private address would break external reachability, and MAC addresses are not carried in IP packets.

Question 8Network Security Fundamentals

An attacker sends a flood of SYN packets with spoofed source addresses to a web server. What resource is the attacker primarily trying to exhaust?

  1. The server's disk space used for logging
  2. The server's DNS cache entries
  3. The server's ARP table entries
  4. The server's half-open connection table Correct answer.

Explanation

In a SYN flood the server allocates state for each half-open connection and waits for the final ACK that never arrives, exhausting the backlog queue. This prevents legitimate clients from completing handshakes. Disk logging and DNS or ARP caches are not the resource this attack targets.

Question 9Network Security Fundamentals

Which protocol provides confidentiality for HTTP traffic by encapsulating it in an encrypted session, and on which port does it normally listen?

  1. SSH on TCP port 22
  2. IPsec ESP on UDP port 500
  3. TLS on TCP port 443 Correct answer.
  4. SNMP on UDP port 161

Explanation

HTTPS wraps HTTP inside a TLS session that encrypts and authenticates the exchange, listening by default on TCP port 443. SSH provides an encrypted shell but is not the protocol that secures HTTP. IPsec and SNMP serve different purposes and ports.

Question 10Network Security Fundamentals

A security engineer wants to detect a host on the internal network that is initiating connections to a known command-and-control IP address. Which network monitoring approach is most directly suited to this goal?

  1. Reviewing DNS zone transfer logs
  2. Reviewing DHCP lease logs for address assignments
  3. Reviewing switch MAC address tables for port flapping
  4. Reviewing NetFlow records for outbound sessions to the suspicious destination Correct answer.

Explanation

Flow records summarize which internal hosts talked to which external addresses and ports, making them well suited to spotting outbound sessions to a known C2 endpoint. DHCP logs only show address assignments, zone transfers show DNS replication, and MAC tables show layer-2 forwarding. None of those directly reveal the outbound session.

Question 11Network Security Fundamentals

Which statement accurately describes the difference between an IDS and an IPS?

  1. An IPS operates only at layer 2, while an IDS operates only at layer 7
  2. An IDS blocks malicious traffic inline, while an IPS only logs it
  3. An IDS and an IPS both sit inline and differ only in signature format
  4. An IPS sits inline and can drop malicious traffic, while an IDS monitors passively and alerts Correct answer.

Explanation

An intrusion prevention system is deployed inline so it can actively drop or reset malicious traffic, whereas an intrusion detection system receives a copy of traffic and raises alerts without blocking. Both can use similar signature or anomaly detection methods. Their difference is placement and response capability, not OSI layer.

Question 12Network Security Fundamentals

An analyst captures traffic and needs to reconstruct the contents of an unencrypted HTTP POST. Which tool capability is required?

  1. Spanning tree analysis
  2. ARP cache poisoning
  3. BGP route inspection
  4. TCP stream reassembly Correct answer.

Explanation

The HTTP request is split across multiple TCP segments, so the analyst must reassemble the TCP stream in sequence order to recover the full payload. ARP, BGP, and spanning tree analysis concern other layers and do not reconstruct application data. Stream reassembly is a core feature of protocol analyzers.

Question 13Network Security Fundamentals

What is the primary security weakness of the original SNMPv1 and SNMPv2c protocols?

  1. They require mutual TLS certificates
  2. They encrypt community strings with AES-256
  3. They transmit community strings in cleartext Correct answer.
  4. They authenticate users with Kerberos tickets

Explanation

SNMPv1 and SNMPv2c authenticate requests using a community string sent in cleartext, so anyone who can capture traffic can read it and reuse it. SNMPv3 adds proper authentication and encryption. The earlier versions do not use AES, TLS certificates, or Kerberos.

Question 14Network Security Fundamentals

A workstation resolves a hostname to an IP address that does not match the legitimate server, and the analyst suspects an on-path attacker spoofed the DNS response. Which mitigation most directly prevents this class of attack?

  1. Implementing DHCP snooping on the LAN
  2. Disabling ICMP redirects on routers
  3. Deploying DNSSEC validation on the resolving server Correct answer.
  4. Enabling port security on access switches

Explanation

DNSSEC signs DNS records so a resolver can cryptographically verify that a response is authentic and unmodified, defeating spoofed answers. Port security, ICMP redirect suppression, and DHCP snooping address layer-2 and DHCP threats but do not validate DNS record authenticity.

Question 15Network Security Fundamentals

Which address range is reserved for IPv4 link-local (APIPA) addressing and is not routed on the internet?

  1. 172.16.0.0/12
  2. 169.254.0.0/16 Correct answer.
  3. 192.168.0.0/16
  4. 10.0.0.0/8

Explanation

The 169.254.0.0/16 block is reserved for link-local autoconfiguration, used when a host cannot obtain an address via DHCP, and it is never routed. The 10/8, 172.16/12, and 192.168/16 ranges are private-use blocks that are also non-routable but serve different purposes.

Question 16Network Security Fundamentals

A user reports that internal web browsing fails but pinging the gateway works. The analyst finds the workstation's ARP entry for the default gateway maps to an unknown MAC address. Which attack is most likely?

  1. A DNS cache poisoning attack
  2. ARP spoofing poisoning the gateway mapping Correct answer.
  3. A SYN flood against the web server
  4. A VLAN hopping attack

Explanation

A wrong MAC for the gateway in the ARP table means traffic destined for the gateway is sent to an attacker's NIC, a classic ARP spoofing symptom that breaks or intercepts traffic. SYN floods target service availability, DNS poisoning alters name resolution, and VLAN hopping crosses layer-2 boundaries. None of those directly corrupt the gateway's ARP mapping.

Question 17Network Security Fundamentals

Which wireless security configuration provides the strongest protection against offline password cracking of captured handshake traffic?

  1. WPA3-SAE with a strong passphrase Correct answer.
  2. Open authentication with a captive portal
  3. WEP with a 128-bit key
  4. WPA2-Personal with a short passphrase

Explanation

WPA3-SAE uses a simultaneous authentication of equals handshake that resists offline dictionary attacks on captured exchanges, and a strong passphrase adds further resistance. WEP is cryptographically broken, WPA2-Personal with a weak passphrase is vulnerable to offline cracking, and open networks provide no encryption.

Question 18Network Security Fundamentals

A company wants remote employees to access internal resources through an encrypted tunnel where only the client's traffic to corporate subnets is routed through the tunnel. Which technology fits this requirement?

  1. A layer-2 hub extension over the internet
  2. A transparent proxy with no encryption
  3. A split-tunnel remote-access VPN Correct answer.
  4. A site-to-site VPN carrying all branch traffic

Explanation

A split-tunnel remote-access VPN encrypts only traffic destined for corporate subnets while other traffic uses the user's local internet path. A site-to-site VPN links entire networks and is not client-centric. A transparent proxy does not encrypt, and extending a hub over the internet exposes layer-2 traffic.

Question 19Network Security Fundamentals

An analyst sees a large volume of traffic from many different source IP addresses to a single destination on TCP port 80, with each source sending only a few packets. Which conclusion is best supported?

  1. A distributed denial-of-service attack is targeting the web service Correct answer.
  2. A backup job is transferring data to the server
  3. A single host is performing a port scan of the destination
  4. The server is rebooting and clients are retrying

Explanation

Many distinct sources each sending a small number of packets to one service is the signature of a distributed denial-of-service flood. A port scan would come from one or few sources and touch many ports. A backup transfer would involve large sustained flows, and reboot retries would not produce this many-source pattern.

Question 20Network Security Fundamentals

In a TCP connection teardown, what does a segment with the RST flag set indicate?

  1. A request to increase the receive window size
  2. An immediate abort of the connection, often due to an unexpected segment or closed port Correct answer.
  3. A request to retransmit the previous segment
  4. A graceful close where both sides have finished sending data

Explanation

RST aborts a connection immediately rather than performing the normal FIN exchange, and it is commonly returned when a segment arrives for a closed port or an invalid state. Graceful closure uses FIN and ACK. Retransmission is triggered by missing acknowledgments or timeouts, and window scaling is negotiated with the window field and options.

Question 21Network Security Fundamentals

A network architect must segment a data center so that a compromised web server cannot reach database servers directly. Which control most directly enforces this?

  1. Using a single flat VLAN for all servers
  2. Microsegmentation policies between server tiers Correct answer.
  3. Enabling CDP on all switch ports
  4. Increasing the size of the broadcast domain

Explanation

Microsegmentation applies granular allow/deny policies between workloads so traffic from a web tier to a database tier can be blocked regardless of physical topology. Enlarging broadcast domains and flattening VLANs increase exposure, and CDP is a discovery protocol that leaks device information.

Question 22Network Security Fundamentals

Which protocol and port does a client use to securely retrieve email while keeping messages on the server, using TLS encryption?

  1. IMAP over TCP 993 Correct answer.
  2. FTP over TCP 21
  3. SMTP over TCP 25
  4. POP3 over TCP 110

Explanation

IMAPS uses TCP port 993 to carry IMAP inside TLS, letting clients read mail that remains stored on the server. POP3 typically downloads and removes messages, and its secure port is 995. SMTP on port 25 is for sending mail, and FTP on 21 is for file transfer.

Question 23Network Security Fundamentals

A penetration tester wants to map which TCP ports are open on a target host. Which technique sends a SYN and interprets the response without completing the handshake?

  1. UDP scan
  2. ICMP echo sweep
  3. TCP connect scan
  4. TCP SYN scan Correct answer.

Explanation

A TCP SYN scan sends a SYN and infers port state from the SYN-ACK or RST reply, then avoids completing the handshake, which is faster and less likely to be logged by the application. A connect scan completes the full handshake. UDP scans and ICMP sweeps probe different protocols or host liveness.

Question 24Network Security Fundamentals

An analyst reviewing a capture notices that a host is sending gratuitous ARP replies claiming to own the IP address of the default gateway. What is the most likely intent?

  1. Redundant default gateway failover
  2. On-path interception of traffic destined for the gateway Correct answer.
  3. Legitimate duplicate address detection
  4. Automatic VLAN assignment via DHCP

Explanation

Gratuitous ARP claiming the gateway's IP lets an attacker redirect other hosts' gateway-bound traffic through their own NIC, enabling on-path interception. Duplicate address detection uses ARP probes, not unsolicited replies claiming an existing gateway. VLAN assignment and gateway failover use different mechanisms such as DHCP and VRRP/HSRP.

Question 25Network Security Fundamentals

Which statement correctly describes how a VLAN improves security on a switched network?

  1. It prevents MAC flooding by limiting the switch CAM table size
  2. It automatically authenticates users with 802.1X on every port
  3. It logically separates broadcast domains so traffic between groups must pass through a router or firewall Correct answer.
  4. It encrypts all frames on the segment with a per-VLAN key

Explanation

VLANs divide a switch into separate logical broadcast domains, so hosts in different VLANs cannot communicate at layer 2 and must traverse a router or firewall where policy can be enforced. VLANs do not encrypt frames, do not inherently limit CAM table size, and do not perform user authentication.

Question 26Network Security Fundamentals

Which security property of the OSI model is primarily provided by the Transport Layer Security (TLS) record protocol when it is correctly implemented?

  1. Protection against denial-of-service flooding at the network edge
  2. Authentication of every intermediate router along the path
  3. Confidentiality and integrity of application data in transit Correct answer.
  4. Guaranteed delivery ordering equal to TCP sequencing guarantees

Explanation

TLS uses symmetric encryption with negotiated keys to keep application data confidential and a MAC or AEAD construction to detect tampering in transit. It does not authenticate routers, does not add reliability beyond TCP, and provides no defense against volumetric flooding.

Question 27Network Security Fundamentals

A security analyst is reviewing firewall rule sets and needs to identify the layer at which a standard stateless ACL inspects traffic. Which description matches that operation?

  1. It tracks the full TCP state machine and permits return traffic automatically
  2. It parses application payloads to detect protocol anomalies
  3. It evaluates each packet independently against header fields such as source IP, destination IP, and port Correct answer.
  4. It decrypts TLS sessions to inspect the enclosed HTTP requests

Explanation

A stateless ACL examines individual packet headers without memory of prior packets, so return traffic must be explicitly permitted. State tracking, payload parsing, and TLS decryption are capabilities of stateful or next-generation devices, not plain ACLs.

Question 28Network Security Fundamentals

During incident triage, an analyst must determine which port number is associated with the standard secure shell service used for encrypted remote administration. Which port is correct?

  1. 3389
  2. 22 Correct answer.
  3. 443
  4. 23

Explanation

SSH listens on TCP port 22 by default and provides encrypted remote administration. Port 23 is Telnet, 443 is HTTPS, and 3389 is RDP, so those do not describe SSH.

Question 29Network Security Fundamentals

An organization wants to reduce the blast radius if a single host is compromised. Which design principle best supports that goal in a flat enterprise network?

  1. Segmenting systems into zones with enforced inter-zone access control Correct answer.
  2. Relying on perimeter firewalls alone for internal traffic control
  3. Disabling host-based firewalls to simplify troubleshooting
  4. Assigning all hosts addresses from a single large subnet

Explanation

Segmentation limits lateral movement because traffic between zones must pass through an enforcing control point. A single flat subnet, disabled host firewalls, and perimeter-only filtering all allow an intruder to reach many peers directly.

Question 30Network Security Fundamentals

Which statement describes the security role of a demilitarized zone (DMZ) in a typical three-tier network architecture?

  1. It hosts internet-facing services while restricting their direct access to the internal network Correct answer.
  2. It provides encrypted tunnels for remote employee access
  3. It replaces the need for an internal firewall between user subnets
  4. It stores offline backups that are never connected to any network

Explanation

A DMZ places externally reachable servers on a segment separated from internal systems by a firewall, so a compromised public server cannot freely reach internal hosts. It is not a backup vault, not a substitute for internal segmentation, and not a VPN concentrator.

Question 31Network Security Fundamentals

An analyst observes a host repeatedly sending ARP requests for the same gateway IP but with a changing source MAC address. Which network security concern does this pattern most directly suggest?

  1. A DHCP scope exhaustion event affecting the subnet
  2. ARP cache poisoning attempts aimed at intercepting gateway traffic Correct answer.
  3. A DNS zone transfer leaking internal records
  4. A TCP SYN flood targeting the default gateway

Explanation

Repeated ARP claims for a gateway IP from varying MAC addresses indicate an attempt to poison ARP caches so traffic is redirected through an attacker. DHCP exhaustion, DNS zone transfers, and SYN floods produce different observable signatures.

Question 32Network Security Fundamentals

Which protocol operates at the network layer and is used to report delivery errors such as an unreachable destination back to the sending host?

  1. ICMP Correct answer.
  2. SNMP
  3. NTP
  4. SMTP

Explanation

ICMP carries control and error messages, including destination unreachable and time exceeded, at the network layer. SNMP is for device management, SMTP for mail transfer, and NTP for time synchronization.

Question 33Network Security Fundamentals

A security team wants to ensure that management traffic to routers is encrypted and that device credentials are never sent in cleartext. Which configuration change achieves this for SNMP?

  1. Migrate from SNMPv2c to SNMPv3 with authentication and privacy enabled Correct answer.
  2. Change the community string from public to a long random value
  3. Restrict SNMP to UDP port 161 on the management VLAN
  4. Enable SNMP traps instead of polling

Explanation

SNMPv3 adds authentication and the privacy (encryption) option so credentials and data are protected; v1 and v2c send community strings in cleartext. Changing a community string or restricting the port does not encrypt traffic, and traps do not provide confidentiality.

Question 34Network Security Fundamentals

An analyst inspects a capture and sees a host send a TCP segment with the SYN flag set, receive SYN-ACK, and then send an ACK before any data transfer. Which activity does this sequence represent?

  1. A reset of an existing connection
  2. A port scan using a half-open SYN probe
  3. A UDP-based service discovery attempt
  4. Completion of the TCP three-way handshake Correct answer.

Explanation

The SYN, SYN-ACK, ACK exchange establishes a TCP connection and is known as the three-way handshake. A half-open scan deliberately omits the final ACK, a reset uses the RST flag, and UDP has no handshake.

Question 35Network Security Fundamentals

A web application must be reachable from the internet, but the database behind it must remain unreachable from external hosts. Which control placement enforces this requirement most directly?

  1. A load balancer placed in front of the web servers
  2. A firewall rule set between the web tier and the database tier that permits only required application traffic Correct answer.
  3. A host-based antivirus agent on the database server
  4. A DNS record that hides the database hostname from public resolvers

Explanation

Tier-to-tier firewall policy restricts which systems may open connections to the database, enforcing least privilege at the network layer. Antivirus, hidden DNS names, and load balancing do not prevent direct network access to the database.

Question 36Network Security Fundamentals

An analyst must choose a control that detects a host resolving known malicious domains without blocking legitimate traffic. Which capability fits the requirement?

  1. A DNSSEC validator that rejects unsigned responses
  2. Passive DNS monitoring that logs and alerts on suspicious resolutions Correct answer.
  3. An inline DNS firewall that drops matching queries
  4. A sinkhole that redirects all matching queries to a blackhole address

Explanation

Passive DNS monitoring observes and records resolution activity and can raise alerts while leaving traffic unaffected. Sinkholing and inline dropping both change or block traffic, and DNSSEC validation concerns response integrity rather than malicious-domain detection.

Question 37Network Security Fundamentals

A network uses 802.1X port-based access control on its switches. Which component decides whether a supplicant is granted network access?

  1. The default gateway forwarding the traffic
  2. The authentication server, such as a RADIUS server, evaluating credentials Correct answer.
  3. The DHCP server assigning an address
  4. The supplicant software running on the endpoint

Explanation

In 802.1X the authenticator (switch) relays credentials to an authentication server, typically RADIUS, which makes the authorization decision. The supplicant only presents credentials, and DHCP or the gateway play no role in the access decision.

Question 38Network Security Fundamentals

A security engineer needs to protect a web application from credential-stuffing attempts while minimizing disruption to legitimate users. Which control placement is most appropriate?

  1. A reverse proxy or WAF in front of the application that rate-limits and blocks suspicious login patterns Correct answer.
  2. A host-based file integrity monitor on the web server
  3. A perimeter router ACL that blocks the entire source country
  4. A network IDS sensor that only logs authentication failures

Explanation

A reverse proxy or WAF can inspect HTTP login requests, apply rate limits, and block patterns typical of credential stuffing before they reach the application. Detection-only IDS logging does not stop the attempts, broad geo-blocking causes false positives, and file integrity monitoring does not affect login traffic.

Question 39Network Security Fundamentals

Which characteristic of a VPN using IPsec ESP in tunnel mode distinguishes it from transport mode?

  1. Authentication of the packet header is disabled to reduce overhead
  2. It operates only between two hosts on the same local subnet
  3. The entire original IP packet is encapsulated and encrypted inside a new IP header Correct answer.
  4. Only the TCP or UDP payload is encrypted while the original IP header stays visible

Explanation

Tunnel mode wraps the full original packet, including its IP header, inside a new outer IP header and encrypts the inner packet. Transport mode leaves the original IP header visible and encrypts only the upper-layer payload, and ESP tunnel mode is not limited to a local subnet.

Question 40Network Security Fundamentals

An analyst reviewing logs sees many TCP connections to port 445 from internal workstations to a single internal server, each carrying an executable payload. Which threat does this pattern most strongly indicate?

  1. A reflective DNS amplification attack
  2. A brute-force attack against SSH
  3. Lateral movement using SMB file sharing Correct answer.
  4. A DNS tunneling exfiltration channel

Explanation

Port 445 is SMB, and many internal hosts connecting to one server with executable payloads is consistent with worm-like lateral movement across file shares. DNS tunneling, SSH brute force, and DNS amplification would show different protocols and traffic directions.

Question 41Network Security Fundamentals

A network architect is choosing between a stateful firewall and a next-generation firewall for a data center edge. Which additional capability justifies the NGFW choice?

  1. VLAN trunking between switch ports
  2. Basic five-tuple packet filtering
  3. Static NAT translation of internal addresses
  4. Application identification and user-aware policy enforcement Correct answer.

Explanation

NGFWs add application-layer identification, user identity awareness, and often intrusion prevention on top of stateful filtering. Five-tuple filtering and NAT are also provided by conventional stateful firewalls, and VLAN trunking is a switch function.

Question 42Network Security Fundamentals

An administrator notices that a switch port configured for a single user VLAN is receiving frames tagged for several different VLANs. What security issue does this most likely represent?

  1. A routing loop caused by spanning tree convergence
  2. VLAN hopping through trunk negotiation or double tagging Correct answer.
  3. A DHCP relay misconfiguration on the access switch
  4. A normal condition for access ports carrying voice traffic

Explanation

Tagged frames arriving on a port that should carry one untagged VLAN suggest VLAN hopping, often via switch spoofing or double tagging. Access ports do not normally receive multi-VLAN tags, and DHCP relay or spanning tree issues present different symptoms.

Question 43Network Security Fundamentals

Which practice most effectively mitigates the risk of an attacker capturing and replaying authentication credentials on a wireless network using WPA2-Personal?

  1. Using a long, high-entropy pre-shared key and rotating it when staff leave Correct answer.
  2. Disabling SSID broadcast on the access point
  3. Lowering transmit power to reduce the coverage area
  4. Filtering clients by MAC address on the access point

Explanation

WPA2-Personal security depends on the strength and secrecy of the pre-shared key, so a long random key and rotation on staff departure limit offline cracking and unauthorized reuse. Hiding the SSID, MAC filtering, and reducing power are weak obscurity measures that do not fix a compromised key.

Question 44Network Security Fundamentals

An analyst sees a large number of DNS responses with very large TXT records returning to a single internal host at regular intervals. Which hypothesis best explains the observation?

  1. Data exfiltration over DNS tunneling Correct answer.
  2. A cache poisoning attack against the resolver
  3. A zone transfer from an authoritative server
  4. A reflection attack using the internal host as the source

Explanation

Oversized or frequent TXT responses to one internal host are a classic sign of DNS tunneling used to move data out through the resolver. Cache poisoning manipulates resolver records, zone transfers use AXFR over TCP, and reflection attacks target a victim rather than originating from an internal client.

Question 45Network Security Fundamentals

A security team is deploying an IDS on a switched network and needs it to see traffic between hosts on the same VLAN. Which configuration accomplishes this?

  1. Place the sensor behind the default gateway on a routed segment
  2. Enable promiscuous mode on the sensor without any switch configuration
  3. Configure a SPAN or mirror port that copies selected VLAN traffic to the sensor Correct answer.
  4. Assign the sensor an IP address on the monitored subnet only

Explanation

A switch forwards unicast frames only to the destination port, so the sensor needs a SPAN or mirror session to receive copies of other hosts' traffic. An IP address or promiscuous mode alone does not cause the switch to deliver frames the sensor would not otherwise receive.

Question 46Network Security Fundamentals

An analyst observes that a server receives a valid TLS ClientHello, but the negotiated cipher suite is one the organization has explicitly deprecated. Which control should have prevented this outcome?

  1. A DNS filtering policy blocking the server's hostname
  2. An intrusion detection signature for malformed TLS records
  3. A firewall rule limiting inbound connections to port 443
  4. A TLS policy on the endpoint or inspection proxy that restricts enabled cipher suites Correct answer.

Explanation

Cipher suite negotiation is governed by the TLS configuration on the server or terminating proxy, so a restrictive TLS policy is what prevents deprecated suites from being selected. Port filtering, DNS blocking, and malformed-record signatures do not control which suite is negotiated.

Question 47Network Security Fundamentals

A penetration tester wants to determine whether a firewall is stateful by sending crafted packets that do not belong to any established session. Which observation would indicate a stateless device?

  1. A packet to a denied port is dropped silently
  2. A SYN packet to a permitted port receives a SYN-ACK from the server
  3. A fragmented packet is reassembled before inspection
  4. A packet with the ACK flag set and no prior handshake is forwarded to the internal host Correct answer.

Explanation

A stateful firewall tracks sessions and drops unsolicited ACK packets that do not match an existing connection, whereas a stateless ACL that permits the port forwards them. Normal SYN handling, silent drops, and reassembly do not by themselves reveal statelessness.

Question 48Network Security Fundamentals

An organization must detect unauthorized changes to routing advertisements inside its network. Which monitoring approach addresses this requirement?

  1. Alerting on unexpected OSPF or BGP neighbor and route changes from known baselines Correct answer.
  2. Logging DHCP lease assignments for each subnet
  3. Enabling port security on access switch ports
  4. Blocking all ICMP echo requests at the perimeter

Explanation

Route hijacking or injection appears as new neighbors or unexpected route updates, so baseline comparison and alerting on routing protocol changes detects it. ICMP filtering, port security, and DHCP logging address different threats and would not reveal manipulated routing advertisements.

Question 49Network Security Fundamentals

An analyst must determine whether a suspicious host is communicating with a command-and-control server over HTTPS without decrypting the payload. Which network metadata is most useful for this determination?

  1. Connection timing patterns, byte volumes, and JA3/JA3S TLS fingerprints Correct answer.
  2. The contents of the server's private key
  3. The user agent string in plaintext HTTP headers
  4. The HTTP response body returned by the server

Explanation

When payloads are encrypted, analysts rely on flow metadata such as beaconing intervals, upload and download volumes, and TLS client and server fingerprints to identify malicious infrastructure. Response bodies and headers are not visible inside TLS, and the server's private key is not available to the analyst.

Question 50Network Security Fundamentals

A company wants to prevent employees from reaching known malicious IP addresses while allowing normal internet access. Which control most directly satisfies this requirement?

  1. Full packet capture retained for ninety days
  2. Egress filtering with a threat-intelligence blocklist applied at the perimeter firewall Correct answer.
  3. Host-based disk encryption on employee laptops
  4. Ingress filtering that blocks spoofed source addresses

Explanation

Egress filtering with an updated blocklist stops outbound connections to known-bad addresses while permitting other traffic. Ingress filtering addresses spoofing, packet capture supports investigation but does not block, and disk encryption protects data at rest.