Networking - MCQ Practice Questions

Understanding:

We need to understand the specific problem that the RTS/CTS handshake mechanism in 802.11 wireless networking is designed to solve.

Step 1: Define the hidden node problem

Two wireless clients A and C can both communicate with an access point B, but A and C cannot hear each other (they are 'hidden' from each other). If both transmit simultaneously, a collision occurs at B, but neither A nor C detects it — standard CSMA/CA fails here.

Step 2: Explain how RTS/CTS solves it

Step 3: Eliminate the other options

Answer:

RTS/CTS mitigates the hidden node problem by reserving the wireless medium before data transmission.

Quick Tip:

RTS/CTS adds overhead, so it is typically triggered only for large frames (above a configurable RTS threshold). For small frames, the overhead of RTS/CTS would outweigh the benefit.

Understanding:

We need to identify the wireless topology where devices communicate peer-to-peer without involving a central access point.

Step 1: Review wireless network modes

Step 2: Match definition to the question

The question describes direct client-to-client communication with no central AP, which precisely describes Ad hoc mode, standardized as IBSS in IEEE 802.11.

Answer:

The topology where wireless clients communicate directly without an access point is Ad hoc mode (IBSS).

Quick Tip:

Wi-Fi Direct (used in modern devices for file sharing) is a more modern peer-to-peer wireless standard that builds on ad hoc concepts but uses a soft-AP model, making it more scalable than classic IBSS.

Understanding:

We need to calculate the maximum theoretical PHY data rate for a single spatial stream in IEEE 802.11ac using:

Formula:

The PHY data rate is given by:

where $N_{\text{SD}}$ = number of data sub-carriers, $N_{\text{BPSC}}$ = bits per sub-carrier (log₂ of QAM order), $R_c$ = coding rate, $T_{\text{symbol}}$ = OFDM symbol duration.

Step 1: Identify parameters for 80 MHz channel

For an 80 MHz channel in 802.11ac:

Step 2: Substitute and calculate

Answer:

The maximum theoretical data rate for one spatial stream is 433.3 Mbps.

Quick Tip:

The 802.11ac maximum of 6.93 Gbps is achieved with 160 MHz channel width, 8 spatial streams, 256-QAM, and $\frac{5}{6}$ coding rate — each additional spatial stream multiplies the per-stream rate linearly.

Understanding:

We need to identify the specific role of Beacon frames that are periodically transmitted by an 802.11 access point.

Step 1: Define Beacon frames

Beacon frames are management frames sent by an access point at regular intervals (typically every 100 ms, known as the Target Beacon Transmission Time or TBTT). They serve as the primary advertisement mechanism for a wireless network.

Step 2: List what Beacon frames carry

A Beacon frame contains:

Step 3: Eliminate other options

Answer:

Beacon frames periodically announce the network's presence and provide synchronization information to clients.

Quick Tip:

Passive scanning relies on Beacon frames — a client listens on each channel waiting for a Beacon. Active scanning is faster — the client sends a Probe Request and the AP replies with a Probe Response containing the same information as a Beacon.

Understanding:

We need to identify the wireless security attack where an attacker creates a rogue access point mimicking a legitimate network's SSID to perform a man-in-the-middle interception.

Step 1: Define each option

Step 2: Match definition to question

The scenario precisely describes an evil twin attack — same SSID, rogue AP, traffic interception.

Answer:

The described attack is the Evil twin attack.

Quick Tip:

Connecting only to networks with WPA3 or verified certificates (in enterprise 802.1X environments) significantly reduces the risk of evil twin attacks, as the rogue AP cannot replicate the server certificate used in EAP authentication.

Understanding:

We need to identify the attack where an attacker secretly intercepts and possibly modifies communication between two parties.

Step 1: Analyse each option

A Denial of Service attack floods a target with traffic to make it unavailable — it does not intercept communication.

Step 2: Identify the correct concept

A Man-in-the-Middle (MitM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and possibly altering data in transit. Neither party is aware of the attacker's presence. Classic examples include ARP spoofing and SSL stripping.

Step 3: Eliminate remaining options

SQL Injection targets database queries through malicious input. Phishing deceives users into revealing credentials via fake websites or emails — neither involves intercepting live communication between two parties.

Answer:

The attack that involves secretly intercepting communication between two parties is the Man-in-the-Middle (MitM) attack.

Quick Tip:

MitM attacks are commonly mitigated using end-to-end encryption (e.g., TLS/SSL) and certificate pinning, which prevent attackers from decrypting or tampering with data in transit.

Understanding:

We need to identify the primary function of a firewall in network security.

Step 1: Define the concept

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic. It does so by applying a set of predefined security rules to determine whether specific packets should be allowed or blocked.

Step 2: Eliminate incorrect options

Encrypting traffic between two endpoints is the function of a VPN or TLS/SSL — not a firewall. Assigning IP addresses dynamically is performed by DHCP (Dynamic Host Configuration Protocol). Caching web content is the role of a proxy server or content delivery network (CDN).

Step 3: Confirm the correct answer

A firewall enforces access control policies at the network boundary, filtering traffic based on rules related to IP addresses, ports, and protocols.

Answer:

A firewall primarily monitors and controls network traffic based on predefined security rules.

Quick Tip:

Stateful firewalls track the state of active connections, making them more effective than simple packet-filtering firewalls, which only inspect individual packets in isolation.

Understanding:

We need to identify which security property prevents a sender from denying that they sent a message.

Step 1: Review the core security principles

The CIA triad and related principles in information security include:

Step 2: Match to the question

Non-repudiation provides proof of the origin and delivery of data, making it impossible for a sender to deny having sent a message. It is typically implemented using digital signatures, where the sender's private key is used to sign the message.

Step 3: Confirm

Confidentiality, Integrity, and Availability address different concerns and do not prevent a sender from denying an action.

Answer:

The cryptographic concept that prevents a sender from denying they sent a message is Non-repudiation.

Quick Tip:

Digital signatures are the primary technical mechanism for achieving non-repudiation — they bind the identity of the sender to the message using asymmetric cryptography.

Understanding:

We need to identify the primary purpose of a DMZ in network security design.

Step 1: Define DMZ

A Demilitarized Zone (DMZ) is a physical or logical subnetwork that separates an organisation's internal local area network (LAN) from untrusted external networks, such as the internet.

Step 2: Explain its function

Public-facing servers such as web servers, mail servers, and DNS servers are placed in the DMZ. This way, external users can access these services without gaining direct access to the internal private network. Even if a public-facing server in the DMZ is compromised, the attacker is still blocked from reaching the sensitive internal network by an additional firewall.

Step 3: Eliminate incorrect options

Encrypting traffic is the role of VPNs or TLS. Assigning IP addresses is done by DHCP. Redundant routing is achieved through protocols like OSPF or BGP — none of these describe the DMZ.

Answer:

The primary purpose of a DMZ is to host publicly accessible services while isolating them from the internal private network.

Quick Tip:

A typical DMZ setup uses two firewalls — one between the internet and the DMZ, and another between the DMZ and the internal network — providing layered (defence-in-depth) security.

Understanding:

We need to identify the correct description of a replay attack.

Step 1: Define replay attack

A replay attack occurs when an attacker intercepts a valid data transmission (such as authentication credentials or session tokens) and later retransmits the captured data to trick the receiver into accepting it as legitimate. The attacker does not need to decrypt the data — simply resending it is sufficient.

Step 2: Compare with other attacks

Step 3: Confirm

A replay attack specifically involves capturing and retransmitting valid authentication or session data to gain unauthorised access.

Answer:

A replay attack involves capturing valid data transmissions and retransmitting them to gain unauthorised access.

Quick Tip:

Replay attacks are commonly prevented using timestamps, nonces (numbers used only once), and session tokens that expire after a single use — these make retransmitted data invalid.

Understanding:

We need to identify the protocol that operates at the Transport layer and is widely used to secure HTTP traffic.

Step 1: Analyse each option

IPSec operates at the Network layer (Layer 3) of the OSI model and is used to secure IP communications, typically for VPNs.

Step 2: Identify TLS

TLS (Transport Layer Security) operates at the Transport layer and provides encryption, authentication, and integrity for data in transit. When TLS is used with HTTP, the combination is called HTTPS — the standard for secure web browsing.

Step 3: Eliminate remaining options

SSH (Secure Shell) operates at the Application layer and is used for secure remote command-line access, not for securing HTTP traffic. RADIUS is an Authentication, Authorisation, and Accounting (AAA) protocol used for network access control, not for encrypting web traffic.

Answer:

TLS operates at the Transport layer and is the standard protocol used to secure HTTP traffic (forming HTTPS).

Quick Tip:

TLS replaced the older SSL (Secure Sockets Layer) protocol. TLS 1.3, the latest version, removed weak cipher suites and significantly improved handshake performance compared to TLS 1.2.

Understanding:

We need to identify which key is used to encrypt a message so that only the intended recipient can decrypt it.

Step 1: Recall asymmetric cryptography fundamentals

In public key (asymmetric) cryptography, each party has a key pair:

Step 2: Apply encryption rules

For confidential communication:

Step 3: Eliminate incorrect options

Using the recipient's private key to encrypt would mean only the recipient can encrypt — defeating the purpose of secure communication. Using the sender's keys would not ensure only the recipient can decrypt.

Answer:

To send a confidential message, the sender encrypts it using the recipient's public key, which only the recipient's private key can decrypt.

Quick Tip:

Remember the two uses of asymmetric keys: (1) Encrypt with recipient's public key for confidentiality. (2) Sign with sender's private key for authentication and non-repudiation.

Understanding:

We need to identify the attack that originates from a single source and overwhelms a server with traffic to deny service to legitimate users.

Step 1: Distinguish DoS from DDoS

A Denial of Service (DoS) attack originates from a single source and floods the target with traffic or requests, exhausting its resources so legitimate users cannot be served. A Distributed Denial of Service (DDoS) attack is launched from multiple sources (a botnet) simultaneously — the question specifically states a single source.

Step 2: Evaluate other options

A Smurf attack is a specific type of DoS that uses ICMP broadcast amplification — it is a subtype, not the general category. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake — again a specific technique, not the general description given.

Step 3: Confirm the answer

The general category for an overwhelming traffic attack from a single source is a Denial of Service (DoS) attack.

Answer:

An attack from a single source that overwhelms a server to deny service to legitimate users is a Denial of Service (DoS) attack.

Quick Tip:

The key distinction in exam questions: DoS = single source, DDoS = multiple distributed sources (botnet). Both aim to deny service, but their scale and mitigation strategies differ significantly.

Understanding:

We need to correctly define port scanning in the context of network security.

Step 1: Define port scanning

Port scanning is a reconnaissance technique in which an attacker (or security administrator) sends packets to a range of port numbers on a target host to determine which ports are open, closed, or filtered. Open ports indicate running services, which can reveal potential vulnerabilities.

Step 2: Common tools and types

Tools like Nmap are widely used for port scanning. Common scan types include TCP Connect scans, SYN (half-open) scans, and UDP scans.

Step 3: Eliminate incorrect options

Encrypting data before transmission relates to cryptography, not port scanning. Forwarding packets between segments is routing. Assigning port numbers to devices is not a standard networking operation — port numbers are defined by standards (e.g., IANA) and are not dynamically assigned to devices.

Answer:

Port scanning is a reconnaissance technique used to discover which ports are open and which services are running on a target host.

Quick Tip:

SYN scanning (half-open scanning) is stealthier than a full TCP connect scan because the three-way handshake is never completed, making it less likely to be logged by the target system.

Understanding:

We need to identify the security mechanism specifically designed to verify that data has not been tampered with during transmission.

Step 1: Define each option

Encryption ensures confidentiality by making data unreadable to unauthorised parties — it does not by itself verify that data has not been altered.

Step 2: Evaluate digital certificates

A digital certificate binds a public key to an identity and is used for authentication — it is not directly used to verify data integrity of a specific transmitted message.

Step 3: Identify the correct mechanism

A Message Authentication Code (MAC) is a short piece of information used to confirm that a message came from a stated sender and has not been altered. It is computed using a secret key and the message content, and the receiver recomputes the MAC to verify integrity and authenticity.

Step 4: Eliminate the last option

An Access Control List (ACL) defines which users or systems are permitted to access resources — it does not verify data integrity during transmission.

Answer:

A Message Authentication Code (MAC) is the mechanism used to verify that data has not been altered during transmission.

Quick Tip:

Do not confuse MAC (Message Authentication Code) with MAC (Media Access Control) address — two entirely different concepts. In security contexts, HMAC (Hash-based MAC) using SHA-256 is a very commonly tested example.

Understanding:

We need to find the minimum subnet mask (fewest borrowed bits) that provides at least 6 subnets from a /24 block.

Formula:

The number of subnets created by borrowing $n$ bits is:

Step 1: Determine bits to borrow

We need $2^n\ge 6$.

So we must borrow $n=3$ bits.

Step 2: Calculate the new prefix length

Starting from a /24 network and borrowing 3 bits:

The new subnet mask is $/27$.

Step 3: Verify host capacity

With a /27 mask, each subnet has $32-27=5$ host bits, giving $2^5-2=30$ usable hosts per subnet — reasonable for most scenarios.

Answer:

The minimum subnet mask required to create at least 6 subnets from a /24 block is /27.

Quick Tip:

Always use $2^n\ge \text{required subnets}$ and pick the smallest $n$ that satisfies the inequality. Borrowing fewer bits than needed is the most common mistake.

Understanding:

We must find the number of usable host addresses for the subnet mask $\mathrm{255.255.255.192}$.

Formula:

The number of usable hosts in a subnet is:

where $h$ is the number of host bits (the $-2$ accounts for the network address and broadcast address).

Step 1: Convert the mask to prefix notation

$\mathrm{255.255.255.192}$ in binary:

So the last octet has $2$ network bits. Total prefix length:

Step 2: Find the number of host bits

Step 3: Calculate usable hosts

Answer:

The number of usable host addresses in a /26 subnet is 62.

Quick Tip:

The octet value $192=128+64$, which corresponds to $11000000_2$ — 2 bits set. This is a quick way to read subnet masks without full binary conversion.

Understanding:

We need to find the broadcast address of the subnet $172.16.5.64/26$.

Formula:

The broadcast address is obtained by setting all host bits to $1$:

Step 1: Determine the block size

With a /26 mask, the host portion has $32-26=6$ bits.

Step 2: Identify the subnet range

The network address is $\mathrm{172.16.5.64}$. The next subnet starts at:

So this subnet spans $\mathrm{172.16.5.64}$ to $\mathrm{172.16.5.127}$.

Step 3: Identify the broadcast address

The broadcast address is the last address in the range:

Verification:

Setting all 6 host bits of $\mathrm{172.16.5.64}$ to 1:

Confirmed: $\mathrm{172.16.5.127}$.

Answer:

The broadcast address for the subnet $172.16.5.64/26$ is $\mathrm{172.16.5.127}$.

Quick Tip:

Broadcast = Network address + Block size $-1$. Here: $64+64-1=127$.

Understanding:

We must find the prefix length that gives at least $500$ usable hosts per subnet.

Formula:

where $h=32-\text{prefix length}$.

Step 1: Solve for minimum host bits

So the minimum value of $h=9$.

Step 2: Calculate the prefix length

Step 3: Verify

A /23 subnet has:

A /24 subnet has:

Answer:

The prefix length required to support at least 500 hosts per subnet is /23.

Quick Tip:

For host requirements, always find the smallest subnet (largest prefix) that still accommodates the needed count. /24 is the most common wrong answer here because it is the most familiar mask.

Understanding:

We must determine which of the given addresses falls within the subnet $192.168.1.128/25$.

Formula:

A /25 subnet has a block size of $2^{32-25}=2^7=128$.

The range of a subnet starting at network address $N$ is:

Step 1: Determine the subnet range

The network address is $\mathrm{192.168.1.128}$.

So the subnet range is $\mathrm{192.168.1.128}$ to $\mathrm{192.168.1.255}$.

Step 2: Test each option against the range $[128,255]$

Step 3: Confirm the valid host

$\mathrm{192.168.1.200}$ is a usable host address within $192.168.1.128/25$.

Answer:

The address that belongs to the subnet $192.168.1.128/25$ is $\mathrm{192.168.1.200}$.

Quick Tip:

For a /25, the two subnets within any /24 are $.0$ to $.127$ and $.128$ to $.255$. Memorising this split saves time in exams.