Common Network Protocols GNFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a potential man-in-the-middle attack on a web application. The analyst captures TLS traffic and notices that the server's certificate is signed by a certificate authority that is not in the client's trusted root store. The client's browser displays a warning, but the user clicks through it. What is the most significant risk?

   • AThe server's identity is verified, but the client's identity is not, allowing the server to be impersonated.
   • BThe TLS encryption is weakened because the certificate is not from a trusted CA, making the cipher suite weaker.
   • CThe connection is not encrypted because the certificate is not trusted, so all data is sent in plaintext.
   • DThe user's credentials and session data can be intercepted and read by an attacker who is impersonating the server.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is examining a packet capture from a dual-stack host that is unable to reach an IPv6-only server. The capture shows the host sending Neighbor Solicitation (NS) messages to the solicited-node multicast address, but no Neighbor Advertisement (NA) is received. Which conclusion is most directly supported by this evidence?

   • AThe router is not advertising the IPv6 prefix, so the host cannot form a global address.
   • BThe host's IPv6 address is misconfigured with a wrong prefix length, causing it to send NS to the wrong multicast group.
   • CThe target host is not responding because its IPv6 address is not assigned or its interface is down.
   • DThe host's firewall is blocking ICMPv6 Neighbor Advertisements from reaching the TCP/IP stack.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the TCP/IP model, which layer is responsible for routing packets across networks using logical addresses such as IP addresses?

   • ANetwork access layer
   • BApplication layer
   • CTransport layer
   • DInternet layer
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is comparing two email-related captures. The first capture shows a client connecting to a server on TCP port 993, and the second shows a client connecting to a server on TCP port 587. Both connections use TLS. Which statement correctly identifies the protocols and their roles?

   • APort 993 is IMAPS for retrieving and managing email on the server, and port 587 is SMTPS for submitting email messages to the server for relay.
   • BPort 993 is POP3S for downloading email to the client, and port 587 is IMAPS for synchronizing email folders.
   • CPort 993 is SMTPS for sending email, and port 587 is IMAPS for retrieving email.
   • DPort 993 is HTTP for webmail access, and port 587 is FTP for transferring email attachments.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary security feature added by HTTPS compared to plain HTTP?

   • AEncryption of data in transit
   • BPrevention of distributed denial-of-service attacks
   • CFaster data transfer speeds
   • DAuthentication of the client to the server
   Reveal Solution Discussion Select an answer first