Communication & Network Security

At which layer of the OSI model does a traditional packet-filtering firewall that makes decisions based solely on IP addresses and port numbers primarily operate?

• A Layer 7 (Application)
• B Layer 2 (Data Link)
• C Layer 3 (Network) and Layer 4 (Transport) ✓
• D Layer 5 (Session)

Answer: Packet-filtering firewalls inspect IP addresses (Layer 3) and TCP/UDP port numbers (Layer 4) to permit or deny traffic.

Which IPsec component provides confidentiality, integrity, and authentication for the payload, whereas its companion protocol provides only integrity and authentication without encryption?

• A Internet Key Exchange (IKE) provides confidentiality
• B Security Association (SA) provides confidentiality
• C Authentication Header (AH) provides confidentiality
• D Encapsulating Security Payload (ESP) provides confidentiality ✓

Answer: Encapsulating Security Payload (ESP) encrypts the payload to provide confidentiality, while Authentication Header (AH) offers integrity and authentication only.

An attacker sends a flood of TCP SYN packets with spoofed source addresses and never completes the handshake, exhausting the target's connection table. Which attack is this?

• A SYN flood attack ✓
• B Teardrop attack
• C DNS amplification attack
• D Smurf attack

Answer: A SYN flood sends many half-open connection requests without completing the three-way handshake, exhausting the server's backlog of pending connections.

Which network segmentation approach isolates and forwards traffic based on logical groupings at Layer 2, allowing devices on the same physical switch to be separated into different broadcast domains?

• A Virtual Local Area Network (VLAN) ✓
• B Demilitarized Zone (DMZ)
• C Port Address Translation (PAT)
• D Network Address Translation (NAT)

Answer: A VLAN logically segments a switch into separate broadcast domains at Layer 2, isolating traffic without requiring separate physical hardware.

Which wireless security protocol introduced Simultaneous Authentication of Equals (SAE) to replace the pre-shared key handshake and resist offline dictionary attacks?

• A WPA3 ✓
• B WEP
• C WPA
• D WPA2

Answer: WPA3 replaced the WPA2 four-way handshake with Simultaneous Authentication of Equals (SAE, or Dragonfly), protecting against offline dictionary attacks.

A security architect needs a protocol to securely manage network devices that provides encryption and integrity, replacing an older protocol that sent community strings in cleartext. Which version should be selected?

• A SNMPv2c
• B SNMPv3 ✓
• C Telnet
• D SNMPv1

Answer: SNMPv3 adds authentication and encryption (the USM security model), unlike SNMPv1/v2c which transmit community strings in cleartext.