Network Security CCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a security incident, a network administrator discovers that an internal server has been sending outbound connections to a known command-and-control (C2) IP address. The administrator wants to contain the threat while preserving evidence for forensic analysis. What should be done first?

   • AIgnore the alert and continue monitoring to gather more information.
   • BPower off the server immediately to stop the malicious activity.
   • CReboot the server to clear the malicious processes.
   • DIsolate the affected server from the network by disconnecting its network cable or blocking its traffic at the switch port.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is reviewing network traffic logs and notices that a large number of DNS queries are being sent to a domain that is known to be malicious. The queries are coming from multiple internal hosts, but the responses are all being sent to a single internal IP address. Which attack is the analyst most likely observing?

   • ADNS amplification attack
   • BDNS rebinding
   • CDNS cache poisoning
   • DDNS tunneling
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices a large number of TCP SYN packets sent to a single internal server from many different source IP addresses, but no corresponding ACK packets are observed. The server's connection table is full, and legitimate users are unable to connect. What is the most likely attack, and what immediate action should the analyst take?

   • ASYN flood attack; enable SYN cookies on the server and configure the firewall to rate-limit incoming SYN packets.
   • BPing of death attack; block all ICMP traffic to the server.
   • CARP spoofing attack; configure static ARP entries on the server.
   • DDNS amplification attack; disable recursive DNS on the server.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is deploying a new web application that will be accessed by customers over the internet. The application is hosted on a single server in the company's data center. The security team wants to protect the server from common web attacks such as SQL injection and cross-site scripting, while also ensuring that the server is not directly exposed to the internet. Which solution best meets these requirements?

   • APlace a web application firewall (WAF) in front of the server and put the server in a DMZ behind a network firewall.
   • BUse a network firewall with deep packet inspection (DPI) to block SQL injection and XSS payloads.
   • CUse a reverse proxy server that terminates TLS and forwards traffic to the server, but do not use a WAF.
   • DPlace the server directly on the internet with a host-based firewall and rely on the application's input validation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of the Domain Name System (DNS) protocol?

   • ATo route packets across different networks
   • BTo assign IP addresses to devices dynamically
   • CTo translate human-readable domain names into IP addresses
   • DTo encrypt data transmitted between a client and server
   Reveal Solution Discussion Select an answer first