Study. uk . com
  1. Home
  2. All questions
  3. Network security

CISSP study material: Network security

73 questions of the 500 in the CISSP — Certified Information Systems Security Professional quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

  1. 22. A retailer is redesigning access after a breach in which an intruder who reached one internal subnet moved freely between servers. The architects want the model described in NIST SP 800-207 zero trust architecture. Which principle should drive the redesign?
  2. 29. A federal agency hardens a public web service and its internal client tooling against NIST SP 800-52 Rev. 2. Both endpoints currently negotiate TLS 1.2 and offer FIPS-approved cipher suites only. The architect asks what further protocol support the guidance obliges the agency to provide.
  3. 32. A manufacturer is rebuilding remote access around a zero trust architecture. Engineers argue that company-issued laptops sitting on the plant's internal LAN should reach the production historian directly, since both the hardware and the segment are corporate property. The security architect rejects this. Which statement reflects the model the architect is applying?
  4. 33. A network architect is numbering an isolated test range that must stay unroutable on the public internet, and wants only address space set aside for private internets. Four candidate blocks appear in the addressing plan. Which blocks are reserved for private internets? Choose three.
  5. 34. An enterprise peers with an upstream provider and mistakenly advertises routes for its internal 10.0.0.0/8 space. The provider's router silently drops the advertisement, and the enterprise operations team raises a ticket claiming the peer is generating routing protocol errors. How should this behaviour be characterised?
  6. 35. A procurement team is comparing two IPsec gateways for a site-to-site deployment. One vendor implements Encapsulating Security Payload (ESP) only and calls that sufficient for a conforming implementation, while a reviewer insists Authentication Header (AH) is required so integrity-only protection remains available. Which position is correct?
  7. 36. An engineer is documenting the security associations required for a bidirectional IPsec tunnel carrying ordinary request and response traffic. A colleague proposes one association covering both directions and binding Authentication Header (AH) and Encapsulating Security Payload (ESP) together. How should the engineer describe the actual requirement?
  8. 37. A firewall team operates an IPsec security gateway that terminates site-to-site tunnels and also receives Simple Network Management Protocol (SNMP) polling addressed to the gateway itself. An auditor asserts that every association on the box must use tunnel mode because a security gateway is an endpoint. Which case still permits transport mode?
  9. 38. A security engineer is building the ordered policy table an IPsec implementation consults for every packet crossing the boundary, and a reviewer wants the test plan to cover every outcome a policy lookup can produce. Which dispositions can a lookup return? Choose three.
  10. 39. A team is migrating a payment gateway to TLS 1.3 and asks why its static RSA key exchange and its CBC-mode cipher preferences must be replaced by authenticated encryption with associated data (AEAD) suites. Which statements describe the changes made in TLS 1.3? Choose two.
  11. 40. A vendor is certifying a TLS 1.3 stack for a government customer and must document the minimum algorithm support a conforming implementation owes. To save code space the team proposes shipping ChaCha20-Poly1305 as the only bulk option. Which cipher suite does a conforming implementation have to support?
  12. 41. To cut handshake cost on a heavily loaded TLS 1.3 service, a platform team configures its servers to issue resumption tickets advertising a thirty-day lifetime. A reviewer warns that clients will ignore the advertised value long before then. Which description of ticket lifetime handling is correct?
  13. 42. A telemetry platform holds long-lived TLS 1.3 connections that stream millions of small records per session under AES-GCM, and some clients also send early data on resumption. An engineer asks what an endpoint owes as the record count climbs, and how early data is handled. Which response is correct?
  14. 56. During an authorised penetration test of a retailer's payment portal, the assessors gain a shell on a web host and immediately find stored credentials for a second server they had never enumerated. Which action matches the staged methodology they are following?
  15. 80. An architect is rewriting the transport security standard for a bank's public APIs ahead of an audit. Legacy clients still negotiate TLS 1.0 and cipher block chaining (CBC) suites, and the bank holds customer records that must stay confidential for decades. Under OWASP's 2025 cryptographic guidance, which two requirements belong in the standard? Choose two.
  16. 194. A design grants unauthenticated access to a records service for any host on the corporate LAN, on the grounds that the LAN sits behind the firewall. Which zero trust tenet does this breach?
  17. 200. A design places zero trust component communication on the same network segment as application traffic. Which separation does SP 800-207 describe?
  18. 203. An architect writing a zero trust network plan asks what posture to adopt toward the enterprise's own private network. What does SP 800-207 assume?
  19. 204. A field engineer connects a corporate laptop to a hotel network. What posture does SP 800-207 tell that remote asset to take?
  20. 257. A border router applies access control lists that permit or deny packets by address and port. The security team asks why it cannot recognise that a reply belongs to a request it saw a moment earlier. What explains this?
  21. 258. Which pieces of information does a basic packet filter use to make its decision? Choose three.
  22. 259. A network team wants to stop compromised internal hosts sending traffic with forged source addresses out to the internet. Which measure does NIST SP 800-41 describe?
  23. 260. An architect argues that a stateless filter is adequate because it will catch spoofed packets and abusive header options. Which two limitations does NIST SP 800-41 identify? Choose two.
  24. 261. Which three states does a stateful inspection firewall track for TCP traffic, according to NIST SP 800-41? Choose three.
  25. 262. An engineer inspects a firewall's state table and expects to find only addresses. Which further items does NIST SP 800-41 say such an entry typically holds? Choose two.
  26. 263. A stateful firewall permits an inbound DNS response from an external server. On what basis does it do so, and what limits its handling of that traffic?
  27. 264. An attacker sends a packet whose header claims membership of an established connection, hoping to pass the firewall. Which two mechanisms does NIST SP 800-41 describe that defeat this? Choose two.
  28. 265. A firewall administrator configures the device to drop all fragmented packets, arguing fragments are only used in attacks. Which two objections does NIST SP 800-41 raise? Choose two.
  29. 266. A firewall is configured to reassemble fragments before passing them inward. Which two consequences does NIST SP 800-41 note? Choose two.
  30. 267. A design document lists network address translation among the firewall technologies it relies on for security. How does NIST SP 800-41 classify translation?
  31. 268. A compliance requirement demands that outbound web activity be attributed to named users and logged per user. Which firewall capability does NIST SP 800-41 say is needed?
  32. 269. A policy draft proposes writing most firewall rules against media access control addresses. What does NIST SP 800-41 observe about the data link layer?
  33. 270. A diagram labels a firewall's outside interface unprotected and its inside interface protected. Why does NIST SP 800-41 describe this labelling as often inappropriate?
  34. 271. Which two fragmentation behaviours does NIST SP 800-41 identify as characteristic of attacks rather than normal traffic? Choose two.
  35. 272. A procurement specification demands that an IPsec implementation support both AH and ESP as mandatory. What does RFC 4301 actually require, and why?
  36. 273. A design uses the authentication header to keep a management protocol's contents secret in transit. Why does this fail?
  37. 274. An engineer expects AH to cover every field of the IP header. Why does RFC 4302 describe its protection of the header as piecemeal?
  38. 275. An architect asks why AH became optional when it uniquely provides integrity without encryption. What does RFC 4301 say?
  39. 276. A deployment enables ESP encryption but disables its integrity service to save cycles. What does RFC 4303 say about this configuration?
  40. 277. Where does the ESP header sit in transport mode compared with tunnel mode?
  41. 278. A packet arrives at an IPsec boundary and matches no rule requiring protection. Which three outcomes does the security policy database allow for traffic at that boundary? Choose three.
  42. 279. Two hosts need bidirectional IPsec-protected traffic with both AH and ESP applied. How many security associations are involved, and why?
  43. 280. An engineer assumes the security parameters index alone is always enough to identify a security association. When does RFC 4301 say that is not so?
  44. 281. Which two statements about IPsec key management match RFC 4301? Choose two.
  45. 282. An organisation proposes to run RFC 4301-conformant IPsec using IKEv1. Which two capabilities does the document say IKEv1 lacks? Choose two.
  46. 283. An IPsec deployment relies on anti-replay protection but the receiving implementation never inspects sequence numbers. What does RFC 4302 say about the result?
  47. 284. How does ESP provide limited traffic flow confidentiality, and where is that most useful?
  48. 285. A network team asks how finely IPsec protection can be scoped between two sites. What does RFC 4301 permit?
  49. 286. Between which pairs of endpoints can IPsec security services be provided? Choose three.
  50. 287. A team proposes DNSSEC to stop an eavesdropper reading which sites employees look up. Why does this fail?
  51. 288. How is a DNSSEC authentication chain built, according to RFC 4033?
  52. 289. A validating resolver must report the security state of an answer. Which four states does RFC 4033 define?
  53. 290. A resolver receives an answer for a domain in a part of the namespace covered by no trust anchor it holds. Which DNSSEC state applies, and what is notable about it?
  54. 291. A resolver holds a trust anchor and a secure delegation, but the answer's signatures have expired. Which DNSSEC state results, and which other conditions produce it? Choose two.
  55. 292. An administrator plans to rely on DNSSEC to protect zone transfers and dynamic updates between name servers. What does RFC 4033 say?
  56. 293. A non-validating stub resolver asks a security-aware server for a record whose data is bogus. How is that communicated, and how is verified data signalled? Choose two.
  57. 294. A site sends a Strict-Transport-Security header carrying only the includeSubDomains directive. Why is the header incomplete?
  58. 295. A site needs to stop browsers enforcing its HSTS policy, having moved a service to a subdomain that cannot yet serve HTTPS. What effect does sending max-age of zero have?
  59. 296. An engineer asks what value should be given to the includeSubDomains directive to enable it. What does RFC 6797 specify?
  60. 297. A page on a known HSTS host contains an image referenced over plain HTTP. What does a conformant browser do before fetching it?
  61. 298. A user visits a known HSTS host whose certificate has just expired and wants to proceed anyway. What does RFC 6797 require of the browser?
  62. 299. A site emits its Strict-Transport-Security header on both its HTTP and HTTPS responses so that first-time visitors pick up the policy sooner. What does RFC 6797 say?
  63. 300. An office runs one wireless network for staff, guests and contractors alike, arguing that authentication separates them adequately. What does NIST SP 800-153 recommend?
  64. 301. A laptop is docked to the wired network while its wireless adapter remains associated with an external access point. What risk does NIST SP 800-153 identify, and what does it ask for?
  65. 302. A policy addresses only the case of a device connected to both wired and wireless networks at once. Which broader risk does NIST SP 800-153 identify?
  66. 303. Wireless clients at a manufacturing site need to reach two application servers on the wired network. What does NIST SP 800-153 recommend for their access?
  67. 304. A security team monitors its wireless networks for wireless-specific attacks but performs no patching or configuration verification on the wireless components. Which two expectations from NIST SP 800-153 are unmet? Choose two.
  68. 305. An organisation performs a wireless security assessment every two years and has no continuous monitoring. What cadence does NIST SP 800-153 expect?
  69. 306. Each site configures its own access points by hand. Which three benefits does NIST SP 800-153 attribute to standardising, automating and centralising that configuration instead? Choose three.
  70. 307. Which fields does the fixed IPv6 header carry before the source and destination addresses? Choose three.
  71. 308. An engineer computes an IPv6 packet's payload length excluding its extension headers. Why is that wrong?
  72. 309. A RADIUS deployment is reviewed for how it protects the exchange between the network access server and the RADIUS server. Which two properties does RFC 2865 describe? Choose two.
  73. 310. A misconfigured network device sends Access-Requests to a RADIUS server that holds no shared secret for it. What must the server do?