22 Network Security Concepts Practice Questions & Answers

1. 1. A network engineer describes a function that assigns logical addresses to hosts and selects the best path between separate networks. Which OSI layer performs that function?

   • A.Layer 3, the Network layer, which routes packets between networks using IP addresses✓ Answer
   • B.Layer 2, the Data Link layer, which moves frames between devices on one local segment
   • C.Layer 4, the Transport layer, which tracks conversations between applications using ports
   • D.Layer 7, the Application layer, which formats requests for services such as web and mail

   Logical addressing and path selection are the defining jobs of the Network layer: it uses IP addresses to decide how a packet reaches a destination on a different network. The Data Link layer only delivers frames inside one segment and cannot reach across networks.

   Source: ISO/IEC 7498-1, OSI Reference Model — network layer; ISC2 CC Exam Outline, Networking and Cloud Security Concepts (OSI and TCP/IP models)Report a problem with this question

2. 2. In the four-layer TCP/IP model, the bottom layer is the Network Access (Link) layer. Which OSI layers does it correspond to?

   • A.OSI Layers 1 and 2, because physical signaling and local frame delivery form one layer✓ Answer
   • B.OSI Layer 1 only, because frame addressing is handled instead by the model's Internet layer
   • C.OSI Layers 2 and 3, because local frame delivery and routing between networks are merged
   • D.OSI Layer 3 only, because cabling and signaling are considered to sit outside the protocol stack

   The TCP/IP model compresses the OSI stack: OSI Layers 1 and 2 become the single Network Access layer, OSI Layer 3 becomes the Internet layer, OSI Layer 4 becomes Transport, and OSI Layers 5 to 7 become Application. Nothing in the OSI stack is left outside the TCP/IP model.

   Source: RFC 1122, Requirements for Internet Hosts — Communication Layers (link layer); ISC2 CC Exam Outline, Networking and Cloud Security Concepts (OSI and TCP/IP models)Report a problem with this question

3. 3. A device receives Ethernet frames and forwards each one out only the port where it learned the destination hardware address. At which OSI layer does it operate, and what is the data unit called?

   • A.Layer 1, where the data unit is a bit stream repeated out of every attached port
   • B.Layer 3, where the data unit is a packet addressed by logical (IP) address
   • C.Layer 2, where the data unit is a frame addressed by hardware (MAC) address✓ Answer
   • D.Layer 4, where the data unit is a segment identified by a pair of port numbers

   Learning hardware addresses and forwarding selectively is switching, which is a Data Link layer behavior, and the Layer 2 protocol data unit is the frame. A Layer 1 device such as a hub simply repeats the signal out of every port because it reads no addresses at all.

   Source: ISO/IEC 7498-1, OSI Reference Model — data link layer; IEEE 802.3 Ethernet frame formatReport a problem with this question

4. 4. An administrator is asked to 'open the port for ping' so that ICMP echo requests can pass the firewall. Why is that request phrased incorrectly?

   • A.ICMP runs at the Transport layer and uses a reserved port that firewalls block, so the rule must name that port explicitly
   • B.ICMP runs at the Network layer and carries no port numbers, so the rule must permit the ICMP protocol and the message types wanted✓ Answer
   • C.ICMP is an Application layer protocol, so the firewall has to inspect payload content instead of any protocol header field
   • D.ICMP is a Data Link protocol that never leaves the local segment, so no rule is required on the firewall for it at all

   Ports belong to the Transport layer protocols TCP and UDP. ICMP is carried directly by IP at the Network layer and has message types and codes instead of ports, so a firewall rule for ping permits ICMP echo request and echo reply, not a port number.

   Source: RFC 792, Internet Control Message ProtocolReport a problem with this question

5. 5. As a user's data moves down the protocol stack of the sending host, what happens at each successive layer?

   • A.Each layer encrypts the data again so that the layers below cannot read what they carry
   • B.Each layer removes the header written by the layer above before passing the data down
   • C.Each layer adds its own header to the information it received from the layer above it✓ Answer
   • D.Each layer rewrites the source address so that only the final layer's address remains

   This is encapsulation: going down the stack each layer wraps what it received in its own header, which is why a segment becomes a packet and then a frame. The receiving host reverses the process, stripping one header per layer on the way up.

   Source: ISO/IEC 7498-1, OSI Reference Model — encapsulation of service data unitsReport a problem with this question

6. 6. Transport layer port numbers are divided into three ranges by convention. Which range is the well-known range, and what is it reserved for?

   • A.49152–65535, set aside for widely used server services and fixed permanently by each vendor
   • B.1024–49151, set aside for widely used server services and issued only to operating systems
   • C.0–1023, set aside for widely used server services such as web, mail and directory access✓ Answer
   • D.0–65535 as one undivided range, so that any service may claim any port number it prefers

   Ports 0 through 1023 are the well-known range that identifies standard server services, 1024 through 49151 are registered ports, and 49152 through 65535 are dynamic or ephemeral ports that clients borrow for the life of one connection.

   Source: IANA Service Name and Transport Protocol Port Number Registry — port range assignmentsReport a problem with this question

7. 7. Which pairing of a service with its default port assignment is correct?

   • A.Server Message Block (SMB) file sharing — TCP 445✓ Answer
   • B.Secure LDAP (LDAPS) directory queries — TCP 389
   • C.POP3 mail retrieval in the clear — TCP 995
   • D.Telnet remote terminal connections — TCP 22

   SMB file sharing listens on TCP 445. The other three swap a protocol with its counterpart: LDAPS uses 636 while 389 is cleartext LDAP, POP3 in the clear uses 110 while 995 is POP3 over TLS, and Telnet uses 23 while 22 belongs to SSH.

   Source: IANA Service Name and Transport Protocol Port Number RegistryReport a problem with this question

8. 8. A contractor states that 172.32.14.9 is a private address under RFC 1918 and can therefore be reused freely inside the company. Which statement is correct?

   • A.The address is private, because the reserved block covers 172.0.0.0 through 172.255.255.255
   • B.The address is private, because any address that begins with 172 is reserved for internal use
   • C.The address is public, because the private block covers 172.16.0.0 through 172.31.255.255 only✓ Answer
   • D.The address is public, because RFC 1918 reserves only 10.0.0.0/8 for organizations to reuse

   RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The 172 block stops at 172.31.255.255, so 172.32.14.9 is publicly routable space assigned to someone else, and using it internally will eventually break reachability to the real owner.

   Source: RFC 1918, Address Allocation for Private InternetsReport a problem with this question

9. 9. A manager argues that network address translation (NAT) removes the need for a firewall, because outsiders cannot see the internal addresses. Which statement best evaluates that claim?

   • A.NAT blocks all inbound connections permanently, so no further filtering is required at the edge of the organization
   • B.NAT checks every session against a rule base, so it duplicates the work a stateful firewall would otherwise be doing
   • C.NAT encrypts the addressing information in each packet, so internal hosts stay confidential across the public internet
   • D.NAT maps private addresses to public ones and incidentally obscures internal addressing, but it enforces no security policy✓ Answer

   NAT is an addressing mechanism whose purpose is conserving public addresses; hiding internal structure is a side effect, not a policy. It makes no allow-or-deny decision about content, applications or users, so a firewall is still required to enforce rules.

   Source: RFC 3022, Traditional IP Network Address Translator; ISC2 CC Exam Outline, Networking and Cloud Security Concepts (IPv4 addressing)Report a problem with this question

10. 10. Which statement describes a structural difference between IPv6 and IPv4 addressing?

    • A.IPv6 uses 128-bit addresses and has no broadcast at all, relying on multicast and anycast delivery instead✓ Answer
    • B.IPv6 uses 64-bit addresses and keeps broadcast, which is why its address space is larger than IPv4's
    • C.IPv6 uses 128-bit addresses but requires NAT on every network, because its addresses are not routable
    • D.IPv6 uses 32-bit addresses written in hexadecimal, which is what makes its notation shorter than IPv4's

    IPv6 quadruples the address length from 32 to 128 bits, which is what solves IPv4 exhaustion, and it drops broadcast entirely in favor of multicast and anycast. Because the space is so large, NAT is no longer needed to stretch public addresses.

    Source: RFC 4291, IP Version 6 Addressing ArchitectureReport a problem with this question

11. 11. A vendor claims that moving the company to IPv6 will 'encrypt all traffic automatically.' How should a security practitioner assess that claim?

    • A.It is wrong, because IPv6 has no confidentiality mechanism at all and must be tunneled inside IPv4 to be protected
    • B.It is right, because IPv6 headers are encrypted by the protocol itself and cannot be read by intermediate devices
    • C.It is right, because the far larger IPv6 address space leaves traffic unreadable without the interface identifier
    • D.It is wrong, because IPsec is available throughout the IPv6 protocol suite but still has to be configured and keyed✓ Answer

    IPsec was designed as part of the IPv6 protocol suite, so the capability is present, but capability is not configuration: without policies, peers and keys the traffic travels in the clear exactly as IPv4 does. Address size has nothing to do with confidentiality.

    Source: RFC 8200, Internet Protocol, Version 6 (IPv6) Specification; ISC2 CC Exam Outline, Networking and Cloud Security Concepts (IPv6)Report a problem with this question

12. 12. Remote staff reach internal systems through a corporate VPN. Which statement best describes what the VPN protects and what it does not?

    • A.It protects the client from malware, because every packet is scanned inside the tunnel before reaching the host
    • B.It protects traffic in transit with encryption and authentication, but not a client infected with malware✓ Answer
    • C.It protects the availability of the corporate network, because tunneled sessions are immune to denial of service
    • D.It protects the user's identity from the employer, because the tunnel anonymizes who is sending the traffic inside

    A VPN provides confidentiality, integrity and authentication for data crossing an untrusted network. It says nothing about the security state of either endpoint, so malware on the connecting laptop simply rides the tunnel into the corporate network.

    Source: NIST SP 800-77, Guide to IPsec VPNs; ISC2 CC Exam Outline, Networking and Cloud Security Concepts (VPN)Report a problem with this question

13. 13. A remote-access VPN is configured so that only traffic bound for company systems enters the tunnel, while ordinary web browsing leaves directly through the user's home connection. What is the security consequence?

    • A.Browsing traffic is inspected twice, at home and at the gateway, which slows the connection down for no real gain
    • B.Browsing traffic bypasses corporate filtering and inspection, so a compromise there is invisible to security✓ Answer
    • C.Browsing traffic is still encrypted by the VPN client anyway, so the arrangement costs no visibility and no control
    • D.Browsing traffic forces the tunnel to renegotiate its keys constantly, which is the main weakness of the arrangement

    This is split tunneling. Because the internet-bound half of the traffic never passes the corporate gateway, web filtering, logging and inspection do not apply to it, and an endpoint compromised through that path then has a live tunnel into the internal network.

    Source: NIST SP 800-77, Guide to IPsec VPNs — split tunneling riskReport a problem with this question

14. 14. Two gateways build an IPsec connection joining the networks behind them, and each original packet is wrapped inside a new packet addressed gateway to gateway. Which mode is in use, and what does it protect?

    • A.Transport mode, which protects the entire original packet and is the usual choice for gateway-to-gateway links
    • B.Tunnel mode, which protects the entire original packet, including its original source and destination addresses✓ Answer
    • C.Tunnel mode, which protects only the payload and leaves the original addressing visible for routing decisions
    • D.Transport mode, which protects only the payload and is the usual choice for host-to-host sessions on a LAN

    Tunnel mode encapsulates the whole original packet, headers included, inside a new outer packet between the two gateways, so the internal addressing is protected as well as the data. Transport mode protects only the payload and is used between two end hosts.

    Source: RFC 4301, Security Architecture for the Internet Protocol — tunnel and transport modesReport a problem with this question

15. 15. What distinguishes a stateful inspection firewall from a simple packet-filtering firewall?

    • A.It examines only the source address, destination address and port of each packet, one packet at a time
    • B.It records established connections in a state table and admits the return traffic that belongs to them✓ Answer
    • C.It terminates each connection and rebuilds it on the client's behalf so that the content can be examined
    • D.It compares the payload against signatures of known attacks and drops any packet that matches one of them

    Stateful inspection tracks the state of each session in a connection table, so it can tell a legitimate reply from an unsolicited inbound packet. A stateless packet filter has no memory between packets and must rely on static rules alone.

    Source: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy — stateful inspectionReport a problem with this question

16. 16. A company must permit one approved collaboration application while blocking other programs that also ride over TCP 443. Which firewall capability makes that possible?

    • A.Application awareness, which identifies the program generating the traffic rather than judging by port alone✓ Answer
    • B.Stateless packet filtering, which matches the destination port of each packet against a list of permitted numbers
    • C.Address translation, which rewrites the source address of outbound sessions so that only approved hosts get out
    • D.Static routing, which sends approved traffic over a chosen path and discards whatever arrives on other interfaces

    Once many different applications share one port, a rule written about port 443 cannot tell them apart. Application awareness inspects the session and identifies the application itself, which is what allows one program to be permitted and its neighbors denied.

    Source: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy — application firewalls and application awarenessReport a problem with this question

17. 17. A new firewall is being configured, and the team is debating how the rule base should end. Which posture reflects the standard principle, and why?

    • A.Deny traffic during business hours and permit it overnight, because monitoring staff are on duty at night
    • B.Permit anything that is not explicitly denied, so that business traffic is never interrupted by a missing rule
    • C.Permit all internal traffic and deny only inbound traffic, because internal users sit inside the trusted zone
    • D.Deny anything that is not explicitly permitted, so a flow must be justified by a rule before it passes✓ Answer

    Default deny applies least privilege at the network layer: the rule base ends with an implicit deny, so anything the organization has not deliberately approved is dropped. A default-permit posture leaves the firewall exposed to every service nobody remembered to block.

    Source: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy — default deny ruleset policyReport a problem with this question

18. 18. An access point supports both WPA2 and WPA3 in personal mode. Which statement best explains why WPA3 is the stronger choice?

    • A.Its handshake hides the wireless network name so that attackers cannot locate the network to attack it
    • B.Its handshake resists offline guessing of the passphrase from captured frames and adds forward secrecy✓ Answer
    • C.Its handshake replaces AES with the RC4 stream cipher, which is faster and harder to attack in software
    • D.Its handshake removes the need for a passphrase, because devices authenticate by hardware address alone

    WPA2 personal lets an attacker capture the four-way handshake and grind through candidate passphrases offline. WPA3 personal replaces that exchange with Simultaneous Authentication of Equals, which defeats offline dictionary attacks and gives each session forward secrecy.

    Source: Wi-Fi Alliance WPA3 security specification — Simultaneous Authentication of Equals (SAE)Report a problem with this question

19. 19. To secure a wireless network, an administrator proposes to stop broadcasting the network name and to allow only a list of known hardware addresses. How should that proposal be assessed?

    • A.Address filtering is a strong control, while hiding the name adds nothing because the vendor chooses the name
    • B.Both measures are strong controls, since the network becomes invisible and unknown devices cannot associate
    • C.Hiding the name is a strong control, while address filtering adds nothing because addresses are assigned locally
    • D.Both measures are obscurity only, since names and addresses travel in the traffic and addresses can be forged✓ Answer

    A hidden network name still appears in the frames that legitimate clients send, and hardware addresses are visible in the clear and trivially changed in software. Neither measure authenticates anyone, so encryption and per-user authentication remain the real controls.

    Source: NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks — SSID hiding and MAC address filteringReport a problem with this question

20. 20. An executive's phone is paired with a car kit. An attacker standing a few meters away retrieves the phone's contact list and stored messages without the owner noticing. Which Bluetooth attack is this?

    • A.Deauthentication, the forcing of a device off its link so that it has to associate with the link again
    • B.Bluejacking, the sending of unsolicited messages to a nearby device over a Bluetooth connection
    • C.War driving, the mapping of wireless networks and their signal strength while moving through an area
    • D.Bluesnarfing, the unauthorized copying of stored data from a device over its Bluetooth connection✓ Answer

    Bluesnarfing is theft of data from a Bluetooth device, which makes it a confidentiality breach; bluejacking only pushes unwanted messages and is a nuisance. Keeping devices out of discoverable mode and pairing only in trusted places limits both.

    Source: NIST SP 800-121, Guide to Bluetooth Security; ISC2 CC Exam Outline, Networking and Cloud Security Concepts (wireless: Bluetooth)Report a problem with this question

21. 21. A security team wants to apply its standard monthly patch cycle to the controllers running a chemical plant's process line. Why does an industrial control environment call for a different approach?

    • A.Patching is unnecessary, because control protocols authenticate every command and reject unsigned instructions
    • B.Confidentiality comes first, so the controllers must be patched at once even if the process line has to be stopped
    • C.Safety and availability come first, so changes wait for a planned outage while segmentation compensates meanwhile✓ Answer
    • D.Patching is automatic, because control vendors ship updates that install without interrupting a running process

    In operational technology the priority order inverts: an unplanned reboot can injure people or ruin a batch, so availability and safety outrank confidentiality. Patches therefore wait for approved change windows, and segmentation and monitoring carry the risk until then.

    Source: NIST SP 800-82, Guide to Operational Technology (OT) Security — differences between OT and IT security prioritiesReport a problem with this question

22. 22. A facilities team installs hundreds of networked sensors and cameras throughout a building. Which combination of characteristics makes such embedded devices hard to secure?

    • A.Shipped default credentials, limited or absent update paths, and long service lives on unsupported software✓ Answer
    • B.Strong default credentials, frequent vendor updates, and short service lives that force regular replacement
    • C.Individually powerful processors, full operating systems, and management tooling equal to corporate servers
    • D.Isolated operation by design, no network interface of their own, and no way to reach outside the building

    Embedded and IoT devices ship with known default credentials, often have no supported way to update firmware, and stay in service for many years after the software stops being maintained. The usual answer is to segment them and change every default at installation.

    Source: NISTIR 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy RisksReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →