6.2 - Understand Network Attacks (e.g., Distributed Denial of Service (DDoS), Man-In-The-Middle (MITM), Domain Name System (DNS) Cache Poisoning) SSCP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A small business's employees report that typing the company's email login URL sometimes redirects them to a phishing site that mimics the login page. The issue is intermittent and affects different employees at different times. The IT administrator checks the company's DNS resolver and finds that the cache contains an incorrect IP address for the email server's domain. Which action should the administrator take to prevent this from recurring?

   • AConfigure the resolver to use a public DNS service instead of the ISP's resolver
   • BEnable DNSSEC validation on the company's DNS resolver
   • CBlock outbound DNS traffic from employee workstations to external resolvers
   • DFlush the DNS resolver cache and restart the resolver service
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A law firm's remote attorneys connect to an internal document server using a legacy client that only supports unencrypted HTTP. A network administrator discovers that an attacker on the same Wi-Fi network has been intercepting and modifying the attorneys' requests to the server. Which combination of controls would most effectively prevent this attack while maintaining the attorneys' ability to work remotely?

   • ARequire attorneys to use a VPN client that encrypts all traffic between their laptops and the corporate network
   • BEnable mutual authentication between the attorneys' laptops and the document server
   • CConfigure the document server to require client certificates for all connections
   • DAdd a firewall rule that blocks inbound traffic to the document server from non-corporate IP addresses
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary function of a firewall as a network security countermeasure?

   • ATo filter traffic based on a set of rules to block malicious or unauthorized activity
   • BTo authenticate users before they can access the network
   • CTo encrypt all traffic between two networks
   • DTo detect and alert on suspicious activity without taking action
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary goal of a DNS cache poisoning attack?

   • ATo overwhelm a DNS server with a flood of queries, causing a denial of service
   • BTo brute-force the password of a DNS administrator account
   • CTo intercept and modify DNS queries between a user and a DNS server
   • DTo redirect users to a malicious website by corrupting the DNS resolver's cache
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS uses signatures, while an IPS uses only anomaly detection.
   • BAn IDS monitors and alerts, while an IPS can actively block or drop malicious traffic.
   • CAn IDS is deployed inline, while an IPS is deployed out-of-band.
   • DAn IDS only monitors host activity, while an IPS only monitors network traffic.
   Reveal Solution Discussion Select an answer first