CISSP Communication and Network Security: 63 practice questions

12 of the 63 Communication and Network Security questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Layer 7 for HTTP content inspection: Which OSI layers are associated with each control, respectively?

1. Layer 3 (Network) for HTTP inspection, Layer 3 (Network) for stateful filtering, and Layer 3 (Network) for ARP spoofing prevention

   Layer 3 handles IP routing and packet filtering. HTTP content inspection requires Layer 7 (application awareness), stateful inspection requires Layer 4 (TCP state), and ARP is a Layer 2 protocol — none of these are purely Layer 3 functions.
2. Layer 5 (Session) for HTTP content inspection, Layer 4 (Transport) for stateful filtering, and Layer 1 (Physical) for ARP spoofing prevention

   SSL/TLS sits at Layer 5/6, but HTTP application-layer inspection is Layer 7. ARP poisoning is a Layer 2 attack, not a Layer 1 (physical) issue. Physical layer deals with cables and signals, not MAC address-based ARP.
3. Layer 7 (Application) for HTTP inspection, Layer 3 (Network) for stateful filtering, and Layer 3 (Network) for ARP spoofing prevention

   While Layer 3 handles IP routing, stateful inspection tracks TCP connection state (Layer 4), not just IP packets. ARP is a Layer 2 protocol, not Layer 3 — ARP does not use IP addresses for its own operation.
4. Layer 7 (Application) for HTTP content inspection, Layer 4 (Transport) for stateful filtering, and Layer 2 (Data Link) for ARP protection ✓

   HTTP content inspection for injection attacks = Layer 7 (Application layer, where WAF/proxy operates). Stateful connection filtering = Layer 4 (Transport layer tracks TCP connection state). ARP operates at Layer 2 (Data Link), so ARP spoofing protection (Dynamic ARP Inspection) operates at Layer 2.

HTTP content inspection = Layer 7; stateful connection tracking = Layer 4; ARP/MAC-based controls = Layer 2.

2. Application proxy firewall that terminates each connection: Which firewall type meets these requirements?

1. Application proxy (Layer 7 gateway) firewall that terminates each connection, inspects the entire decrypted payload, and opens a fresh session to the server ✓

   An application proxy firewall operates at Layer 7 — it terminates the client connection, inspects the full application payload (including decrypted HTTPS content with TLS inspection), and establishes a new connection to the server. This enables detection of malicious content embedded in legitimate application protocols.
2. Packet filtering (stateless) firewall that evaluates each individual packet's IP and port headers against a static rule set with no awareness of session state

   Packet filtering operates at Layer 3/4 and examines individual packet headers only. It has no connection state awareness and cannot inspect application content. It is the least capable type for detecting application-layer threats.
3. Network Address Translation (NAT) gateway that rewrites the source and destination IP addresses and ports to conserve address space while hiding internal hosts

   NAT translates IP addresses and ports but provides no security inspection. It is not a firewall type in the security inspection sense and cannot examine application-layer content.
4. Stateful inspection firewall that tracks each TCP/UDP connection in a state table and permits return traffic matching an established session entry

   A stateful firewall tracks TCP/UDP connection state (Layer 4) and allows return traffic. However, it inspects only headers (IP, TCP/UDP) — it cannot inspect application-layer payload content or detect C2 traffic embedded in HTTPS.

Application proxy firewalls terminate connections, inspect Layer 7 content (including decrypted HTTPS), and re-establish connections — enabling detection of threats within legitimate protocols.

3. ESP in tunnel mode: Which IPsec configuration satisfies all requirements?

1. AH in transport mode

   AH transport mode provides authentication only (no encryption) and preserves original IP headers. This fails both requirements: no encryption and original headers remain visible.
2. ESP in tunnel mode ✓

   ESP (Encapsulating Security Payload) provides encryption AND authentication. Tunnel mode encapsulates the entire original IP packet (including original headers) within a new IP packet with VPN gateway addresses — hiding original source/destination from intermediate networks. This satisfies both requirements.
3. AH in tunnel mode

   AH (Authentication Header) provides authentication and integrity but does NOT provide encryption. The requirement explicitly calls for both authentication and encryption, so AH alone is insufficient.
4. ESP in transport mode

   ESP transport mode encrypts and authenticates the payload but preserves the original IP headers — intermediate networks can see original source and destination addresses. Transport mode is used for host-to-host communication, not site-to-site VPN with header hiding.

ESP provides encryption + authentication; tunnel mode hides original IP headers inside a new encapsulated packet — ESP tunnel mode is the correct choice for site-to-site VPN.

4. DNSSEC validates DNS record authenticity and integrity: What protection does DNSSEC provide, and what does it

1. DNSSEC encrypts every DNS query and response end-to-end between the resolver and the client, preventing any on-path interception or eavesdropping of the lookups as they cross the network

   DNSSEC does NOT encrypt DNS traffic. It only provides authentication and integrity of DNS records through digital signatures. DNS over HTTPS (DoH) or DNS over TLS (DoT) provide DNS encryption.
2. DNSSEC replaces the need for TLS certificates by directly authenticating the web server's identity through signed DNS records, providing end-to-end trust for the HTTPS connection itself

   DNSSEC validates DNS records only — it does not authenticate the web server itself or provide any protection for the HTTP/HTTPS connection. TLS certificates are still required for web traffic authentication.
3. DNSSEC validates DNS record authenticity and integrity using digital signatures; it does not encrypt DNS queries or protect against compromise of the authoritative DNS server itself ✓

   DNSSEC signs DNS records with the authoritative server's private key. Resolvers verify these signatures using the corresponding public key, preventing acceptance of forged DNS responses. However, DNSSEC does not encrypt DNS traffic (queries are still plaintext), and if the authoritative server is compromised, an attacker can sign fraudulent records.
4. DNSSEC prevents all DNS-based and routing-layer attacks, including cache poisoning, BGP prefix hijacking, and ARP spoofing across the local broadcast domain

   DNSSEC specifically addresses DNS record integrity. BGP hijacking operates at the routing layer, and ARP spoofing operates at Layer 2 — DNSSEC has no effect on these attack types.

DNSSEC validates DNS record integrity via digital signatures, preventing cache poisoning; it does NOT encrypt DNS queries — that requires DoH or DoT.

5. Victim hosts update their ARP caches with incorrect: What is the immediate effect, and which long-term attack

1. The attacker gains root-level access to every host on the subnet because the forged ARP replies are processed by each operating system as privileged remote commands

   ARP spoofing redirects network traffic — it does not grant privilege escalation or code execution on remote systems. The attacker positions themselves as a traffic intermediary, not as an authenticated user on victim systems.
2. The attacker bypasses the perimeter firewall entirely by spoofing the gateway's MAC address, causing filtered traffic to flow around the firewall's rule set

   ARP spoofing operates at Layer 2 within the broadcast domain. It does not bypass firewall rules — the firewall still inspects traffic. The effect is traffic interception, not firewall bypass.
3. The attacker causes denial of service by flooding the switch's ARP table with thousands of bogus entries until legitimate mappings are evicted and dropped

   While ARP table flooding can cause DoS, the described attack (sending attacker's MAC for gateway IP) specifically enables traffic interception (MitM), not table overflow DoS. The question describes targeted poisoning, not flooding.
4. Victim hosts update their ARP caches with incorrect MAC-to-IP mappings, enabling the attacker to perform a man-in-the-middle attack on all outbound traffic ✓

   ARP is stateless and trusts unsolicited replies. Poisoning the ARP cache with the attacker's MAC for the gateway IP causes all hosts to send outbound traffic to the attacker instead of the real gateway. The attacker can then inspect, modify, and forward traffic — a classic MitM position.

ARP spoofing poisons host ARP caches with wrong MAC-to-IP mappings, redirecting traffic through the attacker for a man-in-the-middle position.

6. Forward secrecy: Which property does TLS 1.3's mandatory key exchange mechanism provide that would have preven

1. Forward secrecy (Perfect Forward Secrecy); TLS 1.3 requires ephemeral Diffie-Hellman key exchange, so each session uses a unique key not derivable from the server's long-term private key ✓

   Forward secrecy means past session keys cannot be derived even if the long-term private key is later compromised. TLS 1.3 mandates ephemeral DH (ECDHE), generating unique session keys per connection that are discarded after use. TLS 1.2's RSA key exchange encrypts the session key directly with the server's public key — compromise of the private key retroactively decrypts all past sessions.
2. Certificate pinning; the server's certificate is bound to one specific public key inside the client, so an adversary who lacks that exact key cannot substitute a rogue certificate to decrypt the recorded sessions

   Certificate pinning prevents use of substitute certificates but does not protect past sessions if the genuine private key is compromised. It addresses certificate substitution attacks, not key compromise with retroactive decryption.
3. TLS 1.3 mandates AES-256 for bulk encryption, and its 256-bit key space is large enough that recorded ciphertext cannot be recovered even by an adversary holding the server's RSA private key

   The strength of AES-256 is irrelevant here. In TLS 1.2 RSA key exchange, the symmetric session key is encrypted with the server's RSA public key. Obtaining the RSA private key enables decryption of the session key, then decryption of all traffic. Encryption strength does not help if the key derivation mechanism allows retroactive recovery.
4. Key escrow deposited every session key with a neutral trusted third party under terms that cannot be subpoenaed, so the adversary is unable to obtain the keys needed to decrypt

   Key escrow is a mechanism for storing keys with a trusted third party for recovery purposes. It has no relationship to forward secrecy or preventing retroactive decryption by an adversary who compromised the server.

Forward secrecy (PFS) ensures past sessions cannot be decrypted even if the long-term key is later compromised — TLS 1.3 mandates ephemeral DH for this reason.

7. The attacker's access port is on the same VLAN as: Which switch misconfiguration enabled this attack, and what

1. The VLAN access control list was never configured on the trunk; the mitigation is to add explicit deny rules that block inter-VLAN traffic from VLAN 10 reaching VLAN 20 at the routed boundary

   While VLAN ACLs (VACLs) can filter inter-VLAN traffic, the double-tagging attack exploits native VLAN trunk behavior at Layer 2 — before inter-VLAN routing occurs. VACLs do not prevent double-tagging if the underlying native VLAN misconfiguration exists.
2. The attacker's access port is on the same VLAN as the switch's native VLAN (untagged VLAN); the mitigation is to set the native VLAN to an unused, dedicated VLAN that no hosts belong to ✓

   Double tagging VLAN hopping exploits the native VLAN behavior: frames arriving on a trunk port tagged with the native VLAN ID have that tag stripped. By double-tagging (outer tag = native VLAN, inner tag = target VLAN), the attacker's frame transits the trunk with the inner tag reaching VLAN 20. Mitigation: use a dedicated, unused VLAN ID as the native VLAN on all trunk ports.
3. Spanning Tree Protocol was left disabled on the access port; re-enabling STP with BPDU guard restores loop prevention and blocks the frames the double-tagging attack depends on

   STP prevents Layer 2 loops, not VLAN hopping. VLAN hopping exploits 802.1Q tagging mechanics on trunk ports. STP status does not affect VLAN isolation or double-tagging vulnerability.
4. The switch does not enforce 802.1X port authentication; deploying 802.1X so every device authenticates before connecting stops the workstation from injecting tagged frames

   802.1X is a port-based authentication protocol that controls who can connect to the network. It does not prevent VLAN hopping attacks — once a device is authenticated, VLAN tagging mechanics still apply.

VLAN hopping via double tagging exploits native VLAN stripping on trunk ports; mitigation is assigning an unused dedicated VLAN as the native VLAN on all trunks.

8. TACACS+: Which protocol meets all requirements?

1. LDAP over TLS (LDAPS)

   LDAP provides directory-based authentication but is not an AAA protocol with native command-level authorization. It requires additional components and integration to achieve AAA functionality for network device management.
2. RADIUS

   RADIUS uses UDP and encrypts ONLY the password field in authentication packets — the rest of the packet (username, attributes) is transmitted in cleartext. RADIUS also combines authentication and authorization, making separation difficult. Command-level authorization is not natively supported.
3. TACACS+ ✓

   TACACS+ uses TCP and encrypts the entire packet payload (not just the password). It separates AAA into three independent services, enabling fine-grained command-level authorization. It was designed specifically for device administration (Cisco AAA) with per-command authorization capabilities.
4. Kerberos

   Kerberos provides ticket-based authentication for network services but does not natively support command-level authorization for network device management or the AAA separation architecture described. It is not an AAA protocol in the network device administration sense.

TACACS+ uses TCP, encrypts the full packet (not just passwords), separates AAA, and supports command-level authorization — RADIUS only encrypts passwords and combines auth/authz.

9. Simultaneous Authentication of Equals: What specific WPA3 mechanism prevents offline dictionary attacks agains

1. WPA3 replaces the four-way handshake with a hardened TKIP variant using extended key lengths, so captured handshakes no longer contain material that a dictionary attack can test

   TKIP was a WPA1 patch for WEP's weaknesses and was deprecated in WPA2. WPA3 does not use TKIP — it mandates CCMP (AES). TKIP has known vulnerabilities and would not provide stronger dictionary attack resistance.
2. WPA3-Personal mandates certificate-based authentication for every client, eliminating the shared passphrase entirely so there is no password left for an offline dictionary attack to target

   WPA3-Personal still uses passwords (passphrases). WPA3-Enterprise uses 192-bit security with certificate-based authentication. WPA3-Personal's improvement is the SAE protocol replacing PSK, not eliminating passwords.
3. WPA3 upgrades the cipher from AES-128 to AES-256, enlarging the key space enough that brute-forcing a captured handshake becomes computationally infeasible for any attacker

   WPA3's resistance to offline dictionary attacks is specifically due to SAE's key exchange design, not the encryption cipher length. WPA2 also uses AES — the vulnerability is in the 4-way handshake key exchange, not the encryption algorithm.
4. Simultaneous Authentication of Equals (SAE); SAE is resistant to offline dictionary attacks because the protocol does not transmit password-equivalent data that can be tested offline ✓

   WPA3-Personal replaces PSK with SAE (Dragonfly handshake). SAE is a zero-knowledge proof — the protocol proves knowledge of the password without transmitting password-equivalent data. An attacker capturing SAE handshake frames cannot test password guesses offline because there is no challenge-response that can be replayed against a dictionary.

WPA3-Personal replaces PSK with SAE — a zero-knowledge protocol that doesn't transmit password-equivalent data, making captured handshakes useless for offline dictionary attacks.

10. Stateful firewall between DMZ and internal network: Which network architecture controls are most effective at

1. Stateful firewall between DMZ and internal network with explicit deny-all rules and only allowing specific database protocol traffic on required ports from web server IPs only ✓

   A stateful firewall between network segments with explicit allow rules limits the attack surface. Restricting by source IP (web server addresses only) and destination port (e.g., TCP 1433/3306 for database) prevents the compromised web server from accessing other systems or protocols. This is network segmentation with least-privilege access.
2. Encrypting all traffic between the DMZ and the internal network with TLS so that any data the compromised web server sends toward the database tier is protected in transit

   TLS encryption protects data in transit from eavesdropping but does not prevent an attacker from making connections. If the web server is compromised and the attacker uses legitimate application credentials, TLS will encrypt their malicious traffic. Encryption alone does not provide network segmentation.
3. Placing all servers on a single flat network segment and relying on host-based firewalls installed on each individual database server to filter unwanted inbound connections

   A flat network eliminates network segmentation — the first line of defense. Host-based firewalls on each database server are harder to centrally manage and a single misconfiguration exposes the system. Network segmentation with a stateful firewall is more robust than relying on individual host configurations.
4. Deploying an intrusion detection system on the internal network that inspects traffic and raises an alert whenever it observes the compromised web server attempting to pivot deeper

   An IDS detects intrusion attempts but is a detective control, not a preventive control. The question asks what prevents lateral movement — a firewall with restrictive rules prevents the connection; an IDS only alerts after the connection is attempted or established.

A stateful firewall with explicit least-privilege rules between DMZ and internal network — restricting by source IP and required ports — prevents lateral movement after DMZ compromise.

11. SSH encrypts all data in transit including commands: What does SSH provide that makes it a secure replacement

1. SSH mandates multi-factor authentication for each session, whereas Telnet permits only single-factor password login that provides no additional assurance of the user's identity

   SSH does not mandate MFA — it can be configured with password-only authentication. Its primary security improvement over Telnet is encryption and server authentication, not enforced MFA.
2. SSH encrypts all data in transit including commands and responses, and uses asymmetric key exchange to authenticate the server before establishing the session ✓

   Telnet transmits everything in cleartext — credentials, commands, output. SSH replaces Telnet by providing: encryption of all data in transit (prevents eavesdropping), server authentication using host keys (prevents MitM), and client authentication via passwords or public keys.
3. SSH compresses all session traffic to improve throughput over slow links, and this performance gain is the principal reason it is recommended to replace Telnet

   While SSH can optionally compress traffic, this is not the security reason to replace Telnet. The critical security improvement is encryption and authentication, not compression.
4. SSH communicates over TCP port 22, a port that most firewalls block by default, so limiting its exposure is what makes it safer than Telnet's port 23

   Port 22 is a well-known port that is generally open for SSH access — firewalls often allow it explicitly. Port number alone does not provide security. The value of SSH is encryption and authentication, not its port number.

SSH provides encryption of all traffic and server authentication using host keys — Telnet transmits credentials and commands in plaintext, enabling eavesdropping.

12. BGP lacks route origin authentication by default: What fundamental BGP vulnerability was exploited, and what m

1. DNSSEC prevents BGP hijacking by cryptographically signing the DNS records that map the bank's domain to its IP prefixes, so the forged route announcement is automatically rejected before any traffic can be redirected upstream

   DNSSEC protects DNS record integrity and has no effect on BGP routing. BGP hijacking operates at the IP routing layer (Layer 3), not the DNS application layer. A BGP hijack can intercept traffic before DNS resolution is even relevant.
2. BGP runs over connectionless UDP that is trivial for a rogue actor to spoof, so migrating every BGP session to a TCP transport wrapped in TLS between peers cryptographically blocks any unauthorized route injection into the global table

   BGP already uses TCP port 179 between BGP peers. TCP provides connection establishment, but TCP-based BGP sessions are between peered ASes — a rogue AS can still establish a legitimate BGP TCP session and announce fraudulent routes as a peer.
3. BGP lacks route origin authentication by default; Resource Public Key Infrastructure (RPKI) with Route Origin Authorizations (ROAs) can cryptographically validate that an AS is authorized to originate specific IP prefixes ✓

   BGP was designed without authentication — any AS can announce any IP prefix, and other routers will accept it if the path appears valid. RPKI allows IP address holders to cryptographically sign ROAs that specify which ASes are authorized to originate their prefixes. Routers validating RPKI can reject invalid route announcements.
4. Deploying a next-generation firewall with deep packet inspection at the perimeter lets the targeted organization detect the fraudulent BGP announcements and drop the redirected traffic before it leaves the network

   A perimeter firewall operates on traffic entering/exiting a network. BGP hijacking occurs in the internet routing infrastructure — upstream routers are manipulated to redirect traffic before it reaches the victim's network perimeter. Perimeter firewalls cannot detect or prevent BGP route manipulation.

BGP has no built-in route origin authentication; RPKI with ROAs cryptographically binds IP prefixes to authorized ASes, enabling routers to reject unauthorized route announcements.

Other CISSP domains

• Security and Risk Management — 89 questions →
• Security Architecture and Engineering — 87 questions →
• Identity and Access Management (IAM) — 63 questions →
• Software Development Security — 59 questions →
• Security Operations — 48 questions →
• All 497 CISSP questions →