6.2 - Understand Network Attacks (e.g., Distributed Denial of Service (DDoS), Man-In-The-Middle (MITM), Domain Name System (DNS) Cache Poisoning) SSCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a man-in-the-middle (MITM) attack, what is the attacker's primary action?

   • AOverwhelming a server with traffic to cause a denial of service
   • BIntercepting and potentially altering communications between two parties without their knowledge
   • CCorrupting a DNS resolver's cache to redirect users to a malicious site
   • DScanning a network to identify open ports and services
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a countermeasure for DNS cache poisoning?

   • AImplementing rate limiting on the DNS server
   • BUsing mutual authentication for web sessions
   • CRegularly flushing the DNS resolver's cache
   • DDeploying a next-generation firewall
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare provider's patient portal uses TLS but a security audit reveals that the portal's certificate was issued by a CA that is not trusted by the provider's own internal certificate store. An attacker could potentially exploit this by presenting a fraudulent certificate for the portal. Which control would most directly prevent this attack?

   • AConfigure the firewall to block all inbound TLS connections to the portal
   • BEnable TLS 1.3 on the portal and disable all older TLS versions
   • CConfigure the portal to use a certificate from a CA that is publicly trusted by all client systems
   • DAdd the portal's certificate to the provider's internal certificate store
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A multinational company's employees use a web-based HR portal that is accessed over the internet. The security team discovers that an attacker has been performing SSL stripping attacks, downgrading HTTPS connections to HTTP and intercepting login credentials. The company wants to prevent this attack without requiring employees to install any software. Which control would be most effective?

   • AImplement HTTP Strict Transport Security (HSTS) on the HR portal and preload the domain in browsers
   • BDeploy a VPN for all employees accessing the HR portal
   • CDeploy an IDPS to detect SSL stripping attempts and alert the security team
   • DConfigure the firewall to block all inbound HTTP traffic to the HR portal
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing company's engineers use a SCADA system to monitor industrial equipment. The system uses a proprietary protocol that does not support encryption. The security team is concerned about an attacker intercepting and altering commands between the engineering workstation and the SCADA controller. Which control would best protect the integrity of these commands?

   • ADeploy an IDPS to monitor for anomalous SCADA commands
   • BImplement network access control (NAC) to ensure only authorized workstations can connect
   • CConfigure the SCADA controller to require a static IP address for the engineering workstation
   • DDeploy a VPN tunnel between the engineering workstation and the SCADA network
   Reveal Solution Discussion Select an answer first