Network Security (14%)

N10-009 · 42 questions

• Guests at a hotel join a wireless name that matches the front desk's posted network, but the access point is not on the hotel controller and it presents its own sign-in page. Which attack is this?
• A law office wants each wall port to forward no user traffic until the attached laptop authenticates with a user certificate against the office RADIUS server. Which control provides that?
• Remote payroll clerks at a retail chain sign in with a password and then type a six-digit code from an authenticator app on a phone they carry. Which control does that second step add?
• An attacker on a campus switch's native VLAN sends a frame that carries two VLAN tags. The first switch strips the outer tag, and the inner tag delivers the frame into another VLAN. Which attack is this?
• At an office building, a person without a badge follows an employee through a door that locks after each badge read, pretending to carry boxes. The employee holds the door. Which attack is this?
• Workstations at a branch suddenly send their internet traffic to a laptop. A capture shows repeated gratuitous ARP replies binding the gateway's IP address to the laptop's MAC address. Which attack is that?
• A retail chain wants every cashier to receive the same point-of-sale rights without an administrator editing dozens of permissions on each new account. Which control does that job?
• A city-hall lobby has a wall jack that no device is supposed to use. A visitor who plugs in should not get a link light. Which hardening step matches that requirement directly?
• A contractor at a shipping depot needs a VPN sign-in and read access to one shipment share for two weeks. The admin is about to add the contractor to the domain administrators group because that group can already reach the share. Which principle does that choice violate?
• A retail employee receives an email that looks like the payroll vendor and is asked to type a network password into a lookalike site. Which attack is that?
• An office firewall permits only the office subnet to reach the servers and contains no explicit deny rule. Guest traffic matches no rule and is dropped. Which behavior drops it?
• An internal web tool at a factory presents a certificate the server signed itself, and browsers warn even though the session is encrypted. Which change removes the warning without giving up encryption?
• A retail payroll spreadsheet was mailed to the wrong distribution list. The file was not altered, and the mail server stayed up. Which principle of the CIA triad was harmed?
• A laptop on a retail user VLAN answers DHCP discovers from other clients and offers its own address as the default gateway. Which problem is present?
• A public web server for city hall must be reachable from the internet and must not sit on the internal LAN with the staff computers. Where should the server be placed?
• A retail file download finishes, yet bytes in the file were changed by a compromised router that forwarded the transfer. Which attack fits?
• A retail website is knocked offline by traffic from thousands of compromised cameras at once. No data on the site was changed. Which attack is this?
• People who are not staff can walk into an unlocked school closet and plug a laptop into a switch. Which control addresses that?
• A hotel booking site stores names and email addresses of European Union residents and stores no payment card data. Which framework should the design be checked against?
• A hotel lobby access point permits only listed MAC addresses. An attacker clones an allowed address and joins the network. Which statement fits?
• A city-hall employee signs in once at an identity provider, and a cloud permitting application accepts the signed assertion without asking for a second password. Which technology carries that assertion?
• A warehouse wireless passphrase was posted on the break-room wall, and the contractor who knew that passphrase has left the job. Which action is proper key management?
• In a retail back office, a person in the next chair watches a cashier type a password into the register and then uses that password. Which attack is the watching?
• A city library must stop patrons from opening betting.example and must leave other entertainment sites available. Which control matches that narrow block?
• A factory's machine network must not share a VLAN with guest laptops that visitors bring onto the wireless network. Which design matches that requirement?
• An office VPN asks for a code from an authenticator app that changes every 30 seconds, so a code someone copied from the screen stops working at the next change. Which factor is that code?
• A hotel VPN appliance is missing several published security fixes and is still exposed to the internet. Which security term describes that unpatched appliance?
• Staff at a hotel are sent to the wrong address when they use the real name of the booking site. The resolver's cache holds a forged record for that name. Which attack is this?
• A visitor on a campus access port sends frames with a new source MAC address until the switch MAC table is full. Legitimate frames then leave every port. Which attack is this?
• A clinic wall jack should accept one computer. A second laptop, plugged in through a small switch on that jack, must not get on the network. There is no RADIUS server. Which control fits?
• A stolen office laptop's disk was readable when it was attached to another machine. The VPN had encrypted the laptop's traffic only while the laptop was online. Which control was missing?
• A campus bookstore stores and processes payment card numbers on its point-of-sale systems. Which framework applies to that card data?
• A city office wants each laptop to log on to the wireless network with an account checked by a central server. Device command authorization is a later project. Which service should the access points use for that logon?
• Staff at a city hall sign in once and then open email and the file portal with no second password prompt. Which access method is that?
• Someone plugged an unauthorized access point into a conference-room jack at a factory. It advertises its own network name, not the factory's name. Which attack is this?
• A payroll file on a city server is encrypted on disk. Analysts download it across the network in the clear, and a capture shows the contents. Which control is missing?
• A new firewall at a warehouse still has the vendor's default admin password and is about to be placed on the network. Which hardening step fits before it goes into production?
• A clinic downloads an installer and the file's hash no longer matches the hash the vendor published. The server is up, and the installer was never a secret. Which security goal failed?
• Network engineers at a retailer must authenticate to the routers, and the router must authorize each configuration command. Which service fits that device administration?
• Printed network diagrams, with addresses and device names, are found in the trash behind a county office. Which attack gathered them?
• A school wants to block the whole social-media category and still allow other categories of websites. Which control fits?
• A security team places one decoy host on a lab network. It holds no real data and exists to log whoever attacks it. Which control is that host?