CCST Common Network Vulnerabilities 2 — Questions and Answers
Question 1: What type of attack involves intercepting communication between two parties without their knowledge?
- Denial of Service
- Man-in-the-Middle (Correct answer)
- SQL injection
- Cross-site scripting
Correct answer: Man-in-the-Middle
A MitM attack intercepts and potentially alters communication between two parties who believe they are communicating directly.
MitM attacks use ARP spoofing, DNS poisoning, or rogue Wi-Fi to intercept traffic. Defenses include encrypted protocols (HTTPS, SSH), certificate validation, and dynamic ARP inspection.
Question 2: Which vulnerability allows attackers to overwhelm a network by flooding it with traffic?
- Phishing
- Buffer overflow
- DDoS attack (Correct answer)
- Privilege escalation
Correct answer: DDoS attack
A DDoS attack uses multiple compromised systems to flood a target with traffic, making it unavailable to legitimate users.
DDoS attacks use botnets to generate massive traffic volumes. Types include volumetric (UDP floods), protocol (SYN floods), and application layer (HTTP floods). Defenses include rate limiting and traffic scrubbing services.
Question 3: What is a zero-day vulnerability?
- A vulnerability patched within one day
- A vulnerability that has existed for zero days
- A previously unknown vulnerability with no available patch (Correct answer)
- A vulnerability affecting day-zero firmware
Correct answer: A previously unknown vulnerability with no available patch
A zero-day is unknown to the vendor with no patch available. Developers have had zero days to fix it.
Zero-days are dangerous because they can be exploited before the vendor is aware. Defenses include behavior-based detection, network segmentation, and least privilege principles.
Question 4: Which social engineering technique tricks users into clicking a malicious link disguised as a legitimate email?
- Tailgating
- Phishing (Correct answer)
- Shoulder surfing
- Dumpster diving
Correct answer: Phishing
Phishing uses fraudulent emails from apparently trusted sources to trick recipients into revealing sensitive information.
Variants include spear phishing (targeted), whaling (executives), and smishing (SMS-based). Defenses include email filtering, MFA, and DMARC/SPF/DKIM.
Question 5: What does ARP spoofing allow an attacker to do on a local network?
- Bypass the firewall completely
- Redirect network traffic through their machine (Correct answer)
- Gain root access to the router
- Disable all wireless connections
Correct answer: Redirect network traffic through their machine
ARP spoofing sends fake ARP replies to associate the attacker's MAC with another device's IP, redirecting traffic.
ARP is stateless so devices accept unsolicited replies. Defenses include Dynamic ARP Inspection (DAI) and static ARP entries for critical devices.
Question 6: Which type of malware encrypts a victim's files and demands payment for the decryption key?
- Trojan horse
- Ransomware (Correct answer)
- Adware
- Rootkit
Correct answer: Ransomware
Ransomware encrypts files and demands payment, typically cryptocurrency, for the decryption key.
Modern ransomware also exfiltrates data for double extortion. Spreads via phishing, vulnerabilities, or compromised RDP. Defenses include offline backups and EDR solutions.
CCST Common Network Vulnerabilities 2
What type of attack involves intercepting communication between two parties without their knowledge?