6.2 - Understand Network Attacks (e.g., Distributed Denial of Service (DDoS), Man-In-The-Middle (MITM), Domain Name System (DNS) Cache Poisoning) SSCP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does network access control (NAC) help mitigate network attacks?

   • ABy blocking or quarantining devices that do not meet security policy requirements
   • BBy monitoring and alerting on suspicious network traffic
   • CBy providing a backup of network configurations
   • DBy encrypting all data stored on network servers
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes how DNS cache poisoning works?

   • AAn attacker sends a forged DNS response to a resolver, which is then cached and served to clients.
   • BAn attacker floods a DNS server with more queries than it can handle.
   • CAn attacker uses social engineering to trick a DNS administrator into changing records.
   • DAn attacker physically steals the DNS server's hard drive.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which countermeasure is specifically designed to authenticate DNS responses and prevent cache poisoning?

   • ARate limiting
   • BNetwork access control (NAC)
   • CDNSSEC
   • DIntrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A news website is hit by a DDoS attack that sends a massive volume of HTTP GET requests for a specific article page, causing the origin server to exhaust its CPU. The attack traffic appears to come from a botnet of compromised IoT devices. Which countermeasure would be most effective at mitigating this specific attack?

   • AConfigure the CDN to cache the article page and serve it from edge locations
   • BDeploy an IDPS in passive mode to monitor the attack traffic
   • CBlock all HTTP GET requests from IP addresses that are not in the company's country
   • DIncrease the origin server's CPU capacity to handle the additional load
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company suspects an attacker is performing ARP spoofing on the internal network to intercept traffic between employees and the payment gateway. The security team wants to detect this activity in real time and automatically block the offending MAC address. Which solution best meets this requirement?

   • AConfigure the switch to disable all dynamic ARP inspection on the segment
   • BDeploy an intrusion prevention system (IPS) in inline mode on the internal network segment
   • CEnable port security on the switch to allow only one MAC address per port
   • DDeploy an intrusion detection system (IDS) in passive mode on the network tap
   Reveal Solution Discussion Select an answer first