A network engineer is troubleshooting a slow connection to a web server. The engineer suspects that the TCP handshake is taking too long. Which protocol and mechanism is most relevant to this issue?

DNS resolution; the engineer should check the DNS server response time.

UDP connectionless communication; the engineer should check for dropped packets.

HTTP request/response cycle; the engineer should check the web server's response time.

TCP three-way handshake; the engineer should check for packet loss or high latency that delays SYN, SYN-ACK, and ACK exchanges.

A security analyst is reviewing network logs and sees a large volume of UDP traffic to port 53 on an internal DNS server. The source IP addresses are spoofed, and the responses are larger than the queries. This pattern is characteristic of which attack, and what mitigation should be applied?

TCP SYN flood; enable SYN cookies on the DNS server.

DNS amplification; configure the DNS server to disable recursion for external queries and enable rate limiting.

Ping of death; block ICMP traffic.

ARP spoofing; enable Dynamic ARP Inspection.

A small business is setting up a wireless network for its office. The business wants to ensure that only authorized employees can connect to the network and that the wireless traffic is encrypted. Which configuration is most appropriate?

Use an open network with a captive portal that requires employees to enter a password.

Use WPA2-Enterprise with a RADIUS server for authentication and AES encryption.

Use WPA2-PSK with a strong shared password and enable WPS to simplify device setup.

Use WEP with a 128-bit key to provide encryption.

A company has just experienced a network breach where an attacker gained access to an internal server and is using it to launch internal reconnaissance scans. The incident response team wants to contain the threat while preserving the ability to gather forensic evidence. Which action is most appropriate?

Isolate the compromised server from the network by disconnecting its network cable, then take a memory image and capture network traffic from the switch port.

Allow the scans to continue but increase logging to capture the attacker's actions.

Block the compromised server's IP address at the firewall and continue monitoring the server's activity.

Shut down the compromised server immediately to stop the scans and prevent further damage.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 3

Network Security CCISO Practice Questions (Page 9)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 41–45

41application · medium
A network engineer is troubleshooting a slow connection to a web server. The engineer suspects that the TCP handshake is taking too long. Which protocol and mechanism is most relevant to this issue?
Select an answer first
42application · medium
A security analyst is reviewing network logs and sees a large volume of UDP traffic to port 53 on an internal DNS server. The source IP addresses are spoofed, and the responses are larger than the queries. This pattern is characteristic of which attack, and what mitigation should be applied?
Select an answer first
43application · easy
A security analyst is troubleshooting a network issue where users cannot access a website by its domain name, but they can access it by its IP address. Which protocol is most likely involved in this issue?
Select an answer first
44application · medium
A small business is setting up a wireless network for its office. The business wants to ensure that only authorized employees can connect to the network and that the wireless traffic is encrypted. Which configuration is most appropriate?
Select an answer first
45expert · hard
A company has just experienced a network breach where an attacker gained access to an internal server and is using it to launch internal reconnaissance scans. The incident response team wants to contain the threat while preserving the ability to gather forensic evidence. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Network Security CCISO Practice Questions (Page 9)

Questions 41–45

A network engineer is troubleshooting a slow connection to a web server. The engineer suspects that the TCP handshake is taking too long. Which protocol and mechanism is most relevant to this issue?

A security analyst is reviewing network logs and sees a large volume of UDP traffic to port 53 on an internal DNS server. The source IP addresses are spoofed, and the responses are larger than the queries. This pattern is characteristic of which attack, and what mitigation should be applied?

A security analyst is troubleshooting a network issue where users cannot access a website by its domain name, but they can access it by its IP address. Which protocol is most likely involved in this issue?

A small business is setting up a wireless network for its office. The business wants to ensure that only authorized employees can connect to the network and that the wireless traffic is encrypted. Which configuration is most appropriate?

Keep studying — Information Security Core Competencies