Communication and Network Security practice questions

Answer: A) Layer 3, the Network layer

• AThe Network layer handles logical addressing and path determination/routing between different networks; IP operates here.
• BLayer 2 deals with physical (MAC) addressing and framing within a single link/segment, not inter-network routing.
• CLayer 4 provides end-to-end connections, segmentation, and reliability (TCP/UDP), not routing between networks.
• DLayer 7 is where application protocols operate; it is far above routing.

Answer: A) Network policy and forwarding decisions move from individual devices to a central controller, so the controller and its APIs become a high-value target that needs strong protection.

SDN separates the control plane from the data plane and centralizes it in a controller. This allows consistent, programmable policy, but it also concentrates risk in the controller and its APIs, which must be strongly authenticated, authorized and kept highly available.

• ACorrect. SDN separates the control plane from the data plane and centralizes it in a controller that is programmed through northbound and southbound APIs. If the controller is compromised or unavailable, the whole network is affected. Its API authentication, authorization, encryption and availability are therefore critical.
• BIncorrect. This describes the opposite of SDN. SDN takes per-device control logic out of the switches and centralizes it, so policy is no longer decided independently on each switch.
• CIncorrect. SDN is defined by separating the control plane from the data plane, not combining them. It also keeps a management interface (the controller's northbound API), and that interface must be secured.
• DIncorrect. SDN is about centralized, programmable control, not built-in encryption. Overlay encapsulations such as VXLAN, NVGRE and GRE do not encrypt traffic by themselves. Encryption has to be added separately, for example with IPsec.

Answer: A) Public peering between the networks

When two networks interconnect to exchange traffic directly between themselves and their customers, especially at an internet exchange, that is peering (public or exchange peering). Transit and multihoming involve paying upstream providers for full internet reachability.

• ACorrect. Peering means two networks interconnect to exchange traffic directly with each other. When it runs over an internet exchange's switch fabric it is called public or exchange peering, and it reduces transit costs and network hops.
• BIncorrect. With transit, a customer pays a provider to carry its traffic to and from the entire internet. Here the networks only exchange traffic for each other's customers, and the goal is to cut transit costs.
• CIncorrect. Multihoming means connecting to two or more upstream providers, usually for redundancy, and those providers still carry traffic to the whole internet. It does not describe exchanging only each other's customer traffic at an exchange.
• DIncorrect. A CDN stores copies of content on servers close to users. It is a content-distribution technique, not the name for a direct traffic-exchange relationship between networks.

Answer: A) In a screened subnet between the external and internal firewalls, allowing only specific required flows from it to internal hosts

A DMZ (screened subnet) puts public-facing services in a separate zone between firewalls. Traffic from that zone to the internal network is limited to specific required flows, so a compromised public server cannot freely reach internal systems.

• AThis is a DMZ (perimeter network, or screened subnet) design. The public-facing server sits in its own zone, and the internal firewall allows only narrowly defined connections inward. A compromised server still faces another layer of filtering before it can reach internal assets.
• BPort forwarding makes the server reachable, but the server still lives on the trusted internal network. If it is compromised, the attacker is already inside, next to the databases.
• CHost firewalls help, but putting an internet-facing host in the same segment as sensitive databases removes network-level separation. That makes lateral movement after a compromise much easier.
• DA separate VLAN only provides isolation when traffic between segments is filtered. Permitting any traffic from the web server's VLAN to internal subnets defeats the purpose of the separation.

Answer: A) WPA2/WPA3-Enterprise using 802.1X with a RADIUS server

• AEnterprise mode delegates authentication to 802.1X/EAP against a RADIUS server, giving per-user credentials, central control, and per-session keys.
• BPSK mode uses one shared passphrase for everyone, with no individual authentication or easy revocation.
• CA captive portal may collect an acceptance click but doesn't provide strong per-user authentication or link-layer encryption by itself.
• DMAC filtering is trivially bypassed by spoofing and isn't authentication.

Answer: A) Confidentiality of the data in transit through encryption; B) Integrity of the data in transit through message authentication

• AAfter the handshake, TLS encrypts the session so an on-path observer cannot read the traffic.
• BTLS records carry a MAC/AEAD tag so tampering with the ciphertext is detected.
• CTLS only protects data while it is on the wire; data at rest needs separate encryption.
• DTLS does nothing to keep a service up; availability is a separate concern.

Answer: A) Encapsulating Security Payload (ESP) provides encryption; tunnel mode encrypts the whole original packet and wraps it in a new IP header

• AAH provides integrity/authentication only (no encryption). ESP provides confidentiality plus optional integrity. Transport mode protects the payload; tunnel mode protects the entire original packet, which is why it's used for gateway-to-gateway VPNs.
• BAH does not encrypt anything, and transport mode leaves the original IP header exposed.
• CESP is right for encryption, but it's tunnel mode (not transport) that protects the entire original packet including its header.
• DBoth halves are wrong — AH doesn't encrypt, and tunnel mode with ESP does provide confidentiality.

Answer: A) An IPS placed inline in the traffic path; a false positive can block legitimate requests, and the device adds latency and a potential failure point

An IDS normally watches a copy of the traffic out-of-band and alerts, while an IPS sits inline and can block in real time. The inline position is what allows prevention, and it is also why false positives can block legitimate traffic and why the device adds latency and a possible failure point.

• AOnly a device in the forwarding path can drop packets before they reach the server. Because it enforces decisions in real time, a faulty or overly broad signature blocks legitimate traffic, and the inline device can add latency or become a single point of failure unless it is designed to fail open or is deployed redundantly.
• BA SPAN port delivers a copy of the traffic to an out-of-band sensor. The original packets are already on their way to the server, so the sensor can alert but cannot drop them.
• CAn alert-only sensor detects and reports but does not block, so the exploit traffic still reaches the application. It does not meet the requirement to drop packets automatically.
• DA passive tap gives the sensor only a copy of the traffic, so the device is out-of-band and cannot discard packets in the live flow. Placement, not the product label, decides whether a sensor can prevent an attack.

Answer: A) Internet-bound traffic skips corporate inspection, so a compromised client can bridge the internet and the internal network

Split tunneling sends only corporate-bound routes through the VPN, so other traffic avoids central security controls and a compromised endpoint can bridge the two networks. Force tunneling sends all traffic through corporate controls but at a cost in capacity and performance.

• ACorrect. In a split tunnel, only routes to the corporate network use the VPN, and all other traffic leaves through the local physical interface. That traffic bypasses the corporate proxy, inspection and filtering, and a compromised device can become a pivot point between the internet and internal resources.
• BIncorrect. This describes force tunneling, where every connection is sent back through the corporate network. Split tunneling is often used to reduce exactly this load.
• CIncorrect. In a split tunnel, the routes to corporate subnets are the ones that go through the encrypted VPN tunnel. Only traffic outside those routes uses the physical interface.
• DIncorrect. Split tunneling is a routing decision about which destinations use the tunnel. Users must still authenticate to set up the VPN connection.

Answer: A) A proxy (application-layer) firewall

• AA proxy firewall breaks the direct connection, understands the application protocol, and can filter on content, commands, and context — at the cost of more processing.
• BIt filters individual packets on header fields only, with no connection state or application awareness.
• CIt tracks connection state and is faster than a proxy, but it generally does not fully terminate and reconstruct the application session.
• DA screening router applies basic ACLs at the network edge, not application-layer proxying.