A user's web browser is unexpectedly redirected to a malicious website even though they typed the correct URL for their bank. The malicious site, which looks identical to the real one, captures the user's login credentials. This attack was most likely caused by:
A security analyst notices that a network switch has suddenly started broadcasting all traffic to every port, degrading network performance. Investigation reveals a device sending thousands of Ethernet frames with fake source MAC addresses. What attack is being performed?
An adversary sits between a user and a web server, intercepting and altering all communication between them. Neither the user nor the server is aware of the adversary's presence. This type of attack is best described as:
A company's web server suddenly becomes unresponsive due to an overwhelming flood of ICMP echo requests from thousands of different computers. This is a classic example of which type of attack?
An adversary finds an open, active network port in a conference room. They plug in a small, unauthorized wireless access point. What is the primary risk created by this rogue access point?
In an ARP poisoning attack, what is the adversary's primary goal?
A risk assessment identifies that a company's guest Wi-Fi network is using the outdated and insecure WEP encryption protocol. What is the most significant vulnerability this creates?
Credential harvesting is the primary goal of which of the following network attacks?
Topic 3.2: Protecting Networks: Managerial Controls and Wireless Security
A company's cybersecurity policy states that all wireless networks must use WPA3 encryption and that users must authenticate using their corporate credentials. This is an example of what type of security control?
A network administrator configures the office Wi-Fi access points to reduce their signal strength. What is the most likely security-related reason for this change?
A VPN policy prohibits 'split tunneling.' This means that when an employee is connected to the corporate VPN from home, they are prevented from:
Which of the following wireless encryption protocols is considered the most secure and should be used for all new network deployments?
A technician configures a switch to only allow a device with a specific MAC address to connect to a particular physical port. This security feature is known as:
A network administrator decides to stop broadcasting the network's name to make it harder for casual passersby to find. This action is known as:
A switch security policy might require that all unused physical ports on a switch be administratively disabled. What is the primary purpose of this rule?
A user is required to enter their username and password and then tap an approval on a smartphone app to connect to the corporate Wi-Fi. This is an example of implementing which security control on a wireless network?
An organization places its public-facing web server on a separate network segment that is isolated from the main internal corporate network by firewalls. This special segment is known as a(n):
What is the primary security benefit of network segmentation?
A network administrator uses a managed switch to logically divide devices into two groups: 'Accounting' and 'Engineering.' Although the devices are all plugged into the same physical switch, devices in the Accounting group cannot communicate directly with devices in the Engineering group. This is an implementation of:
How does network segmentation help in applying different security policies?
A switch is configured with port security to limit the number of MAC addresses that can be learned on a single port to one. What attack does this directly mitigate?
An adversary compromises a web server located in a company's DMZ. Because the network is properly segmented, what is the firewall between the DMZ and the internal network designed to prevent?
A company's network is not segmented. A single ransomware worm infects one workstation and rapidly spreads to encrypt files on every server and workstation in the company. How would network segmentation have minimized the damage?
A network administrator divides a large IP address range into several smaller, more manageable ranges, with each smaller range assigned to a different department. This process of dividing a network based on IP addressing is known as:
A firewall is configured with the following two rules in order: 1. DENY TCP traffic from ANY source to destination 10.0.1.10 on port 22. 2. ALLOW TCP traffic from ANY source to ANY destination. A user attempts to connect via SSH (port 22) to the server at 10.0.1.10. What will be the result?
A firewall that filters traffic based only on source/destination IP addresses and ports, without considering whether a packet is part of an existing connection, is known as a:
A stateful firewall offers an improvement over a stateless firewall primarily because it:
Where is the most critical place to install a firewall in a corporate network?
A firewall ACL contains a rule at the very end that denies all traffic that has not been explicitly allowed by a preceding rule. This is known as a(n):
An administrator wants to allow external users to access the company's secure web server. Which firewall rule would be most appropriate to allow this traffic?
A company has segmented its network into a Research VLAN and a Sales VLAN. To control the flow of traffic between these two VLANs, where should a firewall or ACL be placed?
A next-generation firewall (NGFW) can identify and block traffic based on the specific application being used (e.g., blocking a specific social media app while allowing general web browsing). This capability is known as:
A security tool is placed on a network to monitor traffic. It compares the traffic against a database of known malicious patterns and signatures. When a match is found, it generates an alert. This tool is a:
A network monitoring system is configured to establish a baseline of normal network traffic over several weeks. After the baseline is established, the system alerts administrators whenever it detects a significant deviation from this normal pattern. This is an example of:
What is a primary disadvantage of a signature-based detection system?
A Security Information and Event Management (SIEM) system provides the most value to a security team by:
An administrator is analyzing network traffic logs and notices a sudden, massive spike in ICMP requests directed at the network's broadcast address. This is a strong indicator of what type of attack?
A security analyst reviews firewall logs and sees thousands of connection attempts from a single external IP address to a wide range of ports on a server in a short period. This activity is characteristic of a:
Alert fatigue occurs when:
A Network Intrusion Prevention System (NIPS) differs from a Network Intrusion Detection System (NIDS) because a NIPS can: