Question 240
A contractor can reach all internal services after connecting to an enterprise VPN. Which response best addresses the central security requirement with a defensible, risk-based design?
- Treat possession of a VPN IP as permanent authorization
- Expose every service through one unrestricted internal router
- Filter accepted prefixes and validate routing policy with origin/path protections where available
- Broker access per application based on identity, device posture and context instead of trusting network adjacency
Explanation
Correct Answer
D:Resource-specific access reduces implicit lateral privilege.
Incorrect Answers
A:Network address does not prove continued entitlement.
B:Wide routing increases attack paths.
C:Routing control security constrains who can steer destinations. Broker access per application based on identity, device posture and context instead of trusting network adjacency.
Question 241
A company still uses a shared WPA2 passphrase among all employees and contractors. Which response best addresses the central security requirement with a defensible, risk-based design?
- Move to WPA3-Enterprise or supported 802.1X per-user authentication and segmented authorization
- Apply authenticated port/VLAN assignment and layer-3 access policies between segments
- Hide the SSID while continuing to share the passphrase
- Change the shared password only once a year
Explanation
Correct Answer
A:Individual credentials enable attribution and targeted revocation.
Incorrect Answers
B:VLAN membership alone does not forbid inter-VLAN routing. Move to WPA3-Enterprise or supported 802.1X per-user authentication and segmented authorization.
C:SSID hiding does not enforce identity.
D:Shared secrets remain difficult to revoke for one user.
Question 242
A software-defined network controller can reprogram every production route but uses an unrestricted shared admin API key. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate chain, name, validity and revocation as appropriate for mutually authenticated secure sessions
- Assume control/data-plane separation automatically authenticates API callers
- Harden and isolate the SDN controller with scoped authentication, changes and monitoring
- Enable more overlay tunnels without protecting the controller
Explanation
Correct Answer
C:Centralized programmable control planes are high-value targets.
Incorrect Answers
A:Encryption without peer authentication remains vulnerable to impostor endpoints. Harden and isolate the SDN controller with scoped authentication, changes and monitoring.
B:Logical separation is not authorization.
D:Additional virtual paths can inherit central compromise.
Question 243
Two departments are on different VLAN IDs but a switch trunks both with unrestricted router forwarding. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use VLAN 1 for all devices to simplify controls
- Assume different VLAN numbers enforce all traffic isolation
- Apply authenticated port/VLAN assignment and layer-3 access policies between segments
- Validate IPsec traffic selectors, security associations, routing and protected subnets
Explanation
Correct Answer
C:VLAN membership alone does not forbid inter-VLAN routing.
Incorrect Answers
A:A single flat domain destroys segmentation.
B:A router may forward between VLANs.
D:IKE negotiation alone does not prove correct packet encapsulation for the intended networks. Apply authenticated port/VLAN assignment and layer-3 access policies between segments.
Question 244
A network accepts unauthorized BGP prefixes from an external partner and traffic takes a suspicious path. Which response best addresses the central security requirement with a defensible, risk-based design?
- Filter accepted prefixes and validate routing policy with origin/path protections where available
- Trust all partner advertisements by default
- Change application passwords to stop prefix leaks
- Move to WPA3-Enterprise or supported 802.1X per-user authentication and segmented authorization
Explanation
Correct Answer
A:Routing control security constrains who can steer destinations.
Incorrect Answers
B:A misconfigured peer can leak or hijack routes.
C:App secrets do not control routing.
D:Individual credentials enable attribution and targeted revocation. Filter accepted prefixes and validate routing policy with origin/path protections where available.
Question 245
Sensitive workstations can upload any content to arbitrary public file-sharing sites. Which response best addresses the central security requirement with a defensible, risk-based design?
- Focus exclusively on inbound port scanning
- Apply controlled egress policies, approved destinations and telemetry appropriate to data sensitivity
- Allow every HTTPS destination since traffic is encrypted
- Isolate transport reachability and handshake state before testing TLS application authentication
Explanation
Correct Answer
B:Outbound traffic is an exfiltration path, not automatically benign.
Incorrect Answers
A:Inbound filtering misses outbound theft.
C:TLS hides content from simple port-based policies.
D:The OSI/TCP-IP layers help distinguish routing or TCP failure from upper-layer TLS negotiation. Apply controlled egress policies, approved destinations and telemetry appropriate to data sensitivity.
Question 246
A SOC has backbone bandwidth charts but cannot link suspicious flows to source and destination identities. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume total interface bytes identify a malicious caller
- Store unsynchronized logs without timestamps
- Harden and isolate the SDN controller with scoped authentication, changes and monitoring
- Correlate network flow data, DNS and identity events under synchronized timestamps
Explanation
Correct Answer
D:Network monitoring is valuable when it supports investigation and anomaly detection.
Incorrect Answers
A:Aggregate utilization lacks per-flow attribution.
B:Correlation becomes unreliable.
C:Centralized programmable control planes are high-value targets. Correlate network flow data, DNS and identity events under synchronized timestamps.
Question 247
A lateral attacker exploits IPv4 ARP spoofing to redirect traffic inside a local subnet. Which response best addresses the central security requirement with a defensible, risk-based design?
- Increase IP packet TTL to stop rogue ARP responses
- Enable appropriate switch dynamic ARP inspection and trusted DHCP snooping bindings on the affected segment
- Validate IPsec traffic selectors, security associations, routing and protected subnets
- Renew the TLS certificate as the only response to ARP poisoning
Explanation
Correct Answer
B:Layer-two address resolution trust cannot be repaired by changing web-layer credentials.
Incorrect Answers
A:TTL does not authenticate Ethernet ARP messages.
C:IKE negotiation alone does not prove correct packet encapsulation for the intended networks. Enable appropriate switch dynamic ARP inspection and trusted DHCP snooping bindings on the affected segment.
D:TLS may protect application data but does not prevent redirect via forged ARP mappings.
Question 248
IPv6-enabled endpoints accept a rogue router advertisement and select an attacker-controlled default gateway. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume IPv6 privacy addresses validate routers
- Enable appropriate RA Guard with tested port roles and complementary first-hop protections
- Disable only IPv4 DHCP
- Filter accepted prefixes and validate routing policy with origin/path protections where available
Explanation
Correct Answer
B:IPv6 router advertisements can change default route trust at layer three.
Incorrect Answers
A:Address privacy does not authenticate announcements.
C:IPv4 DHCP does not govern IPv6 RA processing.
D:Routing control security constrains who can steer destinations. Enable appropriate RA Guard with tested port roles and complementary first-hop protections.
Question 249
A web gateway accepts a certificate with the right subject name even after the issuing CA has revoked it. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust any self-signed certificate with a familiar common name
- Ignore expiration if the TLS cipher is strong
- Enforce appropriate certificate chain, validity, status and hostname checks for the client threat model
- Apply controlled egress policies, approved destinations and telemetry appropriate to data sensitivity
Explanation
Correct Answer
C:Identity validation requires more than matching one certificate name.
Incorrect Answers
A:Anyone can create a matching untrusted certificate.
B:Confidentiality of transport does not establish present identity.
D:Outbound traffic is an exfiltration path, not automatically benign. Enforce appropriate certificate chain, validity, status and hostname checks for the client threat model.
Question 250
Two partner sites negotiate IPsec but unexpectedly accept weak fallback suites with obsolete ciphers. Which response best addresses the central security requirement with a defensible, risk-based design?
- Allow any crypto suite so the tunnel always connects
- Replace strong IKE authentication with a shared spreadsheet secret
- Apply authenticated port/VLAN assignment and layer-3 access policies between segments
- Restrict IKE and ESP proposals to approved authenticated encryption, key exchange and lifetime profiles
Explanation
Correct Answer
D:Confidential tunnel negotiation can downgrade if permissive proposals remain.
Incorrect Answers
A:Availability through weak algorithms is not adequate security.
B:Unprotected keys undermine mutual authentication.
C:VLAN membership alone does not forbid inter-VLAN routing. Restrict IKE and ESP proposals to approved authenticated encryption, key exchange and lifetime profiles.
Certified Information Systems Security Professional (CISSP) Practice Tests