CSS CSS Network Security & Architecture 1 — Questions and Answers
Question 1: Which network segmentation technique isolates critical assets by placing them in a separate zone with strict access controls?
- DMZ (Demilitarized Zone) (Correct answer)
- VLAN hopping
- Port mirroring
- NAT overload
Correct answer: DMZ (Demilitarized Zone)
A DMZ places public-facing services in an isolated network zone, protecting internal assets from direct exposure.
Question 2: What is the primary purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?
- Deep packet inspection and application-layer filtering (Correct answer)
- Faster packet forwarding speeds
- Support for IPv6 only
- Hardware-based encryption offloading
Correct answer: Deep packet inspection and application-layer filtering
NGFWs add deep packet inspection and application-layer awareness beyond the port/protocol filtering of stateful firewalls.
Question 3: Which protocol is used to encrypt DNS queries to prevent eavesdropping and tampering?
- DNS over HTTPS (DoH) (Correct answer)
- DNSSEC
- LLMNR
- mDNS
Correct answer: DNS over HTTPS (DoH)
DNS over HTTPS encrypts DNS queries within HTTPS traffic, preventing interception by third parties.
Question 4: What does a Zero Trust network architecture assume about users and devices?
- No user or device is trusted by default, even inside the network perimeter (Correct answer)
- Internal users are always trusted
- VPN users bypass all security controls
- Perimeter firewalls are sufficient for protection
Correct answer: No user or device is trusted by default, even inside the network perimeter
Zero Trust assumes breach and requires continuous verification of every user, device, and connection regardless of location.
Question 5: Which type of attack exploits weakly configured routers to redirect traffic through an attacker-controlled path?
- BGP hijacking (Correct answer)
- SYN flooding
- ARP spoofing
- DNS amplification
Correct answer: BGP hijacking
BGP hijacking manipulates Border Gateway Protocol routes to redirect internet traffic through malicious infrastructure.
Question 6: What is the function of a network access control (NAC) system in enterprise security?
- Enforces security policy compliance before granting network access (Correct answer)
- Blocks all external traffic at the perimeter
- Encrypts all internal network communications
- Monitors DNS queries for malicious domains
Correct answer: Enforces security policy compliance before granting network access
NAC systems assess endpoint health and policy compliance, granting or restricting network access based on the results.
CSS CSS Network Security & Architecture 1
Which network segmentation technique isolates critical assets by placing them in a separate zone with strict access controls?