Networking - MCQ Practice Questions

Understanding:

We need to identify the attack where an attacker secretly intercepts and possibly modifies communication between two parties.

Step 1: Analyse each option

A Denial of Service attack floods a target with traffic to make it unavailable — it does not intercept communication.

Step 2: Identify the correct concept

A Man-in-the-Middle (MitM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and possibly altering data in transit. Neither party is aware of the attacker's presence. Classic examples include ARP spoofing and SSL stripping.

Step 3: Eliminate remaining options

SQL Injection targets database queries through malicious input. Phishing deceives users into revealing credentials via fake websites or emails — neither involves intercepting live communication between two parties.

Answer:

The attack that involves secretly intercepting communication between two parties is the Man-in-the-Middle (MitM) attack.

Quick Tip:

MitM attacks are commonly mitigated using end-to-end encryption (e.g., TLS/SSL) and certificate pinning, which prevent attackers from decrypting or tampering with data in transit.

Understanding:

We need to identify the primary function of a firewall in network security.

Step 1: Define the concept

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic. It does so by applying a set of predefined security rules to determine whether specific packets should be allowed or blocked.

Step 2: Eliminate incorrect options

Encrypting traffic between two endpoints is the function of a VPN or TLS/SSL — not a firewall. Assigning IP addresses dynamically is performed by DHCP (Dynamic Host Configuration Protocol). Caching web content is the role of a proxy server or content delivery network (CDN).

Step 3: Confirm the correct answer

A firewall enforces access control policies at the network boundary, filtering traffic based on rules related to IP addresses, ports, and protocols.

Answer:

A firewall primarily monitors and controls network traffic based on predefined security rules.

Quick Tip:

Stateful firewalls track the state of active connections, making them more effective than simple packet-filtering firewalls, which only inspect individual packets in isolation.

Understanding:

We need to identify which security property prevents a sender from denying that they sent a message.

Step 1: Review the core security principles

The CIA triad and related principles in information security include:

Step 2: Match to the question

Non-repudiation provides proof of the origin and delivery of data, making it impossible for a sender to deny having sent a message. It is typically implemented using digital signatures, where the sender's private key is used to sign the message.

Step 3: Confirm

Confidentiality, Integrity, and Availability address different concerns and do not prevent a sender from denying an action.

Answer:

The cryptographic concept that prevents a sender from denying they sent a message is Non-repudiation.

Quick Tip:

Digital signatures are the primary technical mechanism for achieving non-repudiation — they bind the identity of the sender to the message using asymmetric cryptography.

Understanding:

We need to identify the primary purpose of a DMZ in network security design.

Step 1: Define DMZ

A Demilitarized Zone (DMZ) is a physical or logical subnetwork that separates an organisation's internal local area network (LAN) from untrusted external networks, such as the internet.

Step 2: Explain its function

Public-facing servers such as web servers, mail servers, and DNS servers are placed in the DMZ. This way, external users can access these services without gaining direct access to the internal private network. Even if a public-facing server in the DMZ is compromised, the attacker is still blocked from reaching the sensitive internal network by an additional firewall.

Step 3: Eliminate incorrect options

Encrypting traffic is the role of VPNs or TLS. Assigning IP addresses is done by DHCP. Redundant routing is achieved through protocols like OSPF or BGP — none of these describe the DMZ.

Answer:

The primary purpose of a DMZ is to host publicly accessible services while isolating them from the internal private network.

Quick Tip:

A typical DMZ setup uses two firewalls — one between the internet and the DMZ, and another between the DMZ and the internal network — providing layered (defence-in-depth) security.

Understanding:

We need to identify the correct description of a replay attack.

Step 1: Define replay attack

A replay attack occurs when an attacker intercepts a valid data transmission (such as authentication credentials or session tokens) and later retransmits the captured data to trick the receiver into accepting it as legitimate. The attacker does not need to decrypt the data — simply resending it is sufficient.

Step 2: Compare with other attacks

Step 3: Confirm

A replay attack specifically involves capturing and retransmitting valid authentication or session data to gain unauthorised access.

Answer:

A replay attack involves capturing valid data transmissions and retransmitting them to gain unauthorised access.

Quick Tip:

Replay attacks are commonly prevented using timestamps, nonces (numbers used only once), and session tokens that expire after a single use — these make retransmitted data invalid.

Understanding:

We need to identify the protocol that operates at the Transport layer and is widely used to secure HTTP traffic.

Step 1: Analyse each option

IPSec operates at the Network layer (Layer 3) of the OSI model and is used to secure IP communications, typically for VPNs.

Step 2: Identify TLS

TLS (Transport Layer Security) operates at the Transport layer and provides encryption, authentication, and integrity for data in transit. When TLS is used with HTTP, the combination is called HTTPS — the standard for secure web browsing.

Step 3: Eliminate remaining options

SSH (Secure Shell) operates at the Application layer and is used for secure remote command-line access, not for securing HTTP traffic. RADIUS is an Authentication, Authorisation, and Accounting (AAA) protocol used for network access control, not for encrypting web traffic.

Answer:

TLS operates at the Transport layer and is the standard protocol used to secure HTTP traffic (forming HTTPS).

Quick Tip:

TLS replaced the older SSL (Secure Sockets Layer) protocol. TLS 1.3, the latest version, removed weak cipher suites and significantly improved handshake performance compared to TLS 1.2.

Understanding:

We need to identify which key is used to encrypt a message so that only the intended recipient can decrypt it.

Step 1: Recall asymmetric cryptography fundamentals

In public key (asymmetric) cryptography, each party has a key pair:

Step 2: Apply encryption rules

For confidential communication:

Step 3: Eliminate incorrect options

Using the recipient's private key to encrypt would mean only the recipient can encrypt — defeating the purpose of secure communication. Using the sender's keys would not ensure only the recipient can decrypt.

Answer:

To send a confidential message, the sender encrypts it using the recipient's public key, which only the recipient's private key can decrypt.

Quick Tip:

Remember the two uses of asymmetric keys: (1) Encrypt with recipient's public key for confidentiality. (2) Sign with sender's private key for authentication and non-repudiation.

Understanding:

We need to identify the attack that originates from a single source and overwhelms a server with traffic to deny service to legitimate users.

Step 1: Distinguish DoS from DDoS

A Denial of Service (DoS) attack originates from a single source and floods the target with traffic or requests, exhausting its resources so legitimate users cannot be served. A Distributed Denial of Service (DDoS) attack is launched from multiple sources (a botnet) simultaneously — the question specifically states a single source.

Step 2: Evaluate other options

A Smurf attack is a specific type of DoS that uses ICMP broadcast amplification — it is a subtype, not the general category. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake — again a specific technique, not the general description given.

Step 3: Confirm the answer

The general category for an overwhelming traffic attack from a single source is a Denial of Service (DoS) attack.

Answer:

An attack from a single source that overwhelms a server to deny service to legitimate users is a Denial of Service (DoS) attack.

Quick Tip:

The key distinction in exam questions: DoS = single source, DDoS = multiple distributed sources (botnet). Both aim to deny service, but their scale and mitigation strategies differ significantly.

Understanding:

We need to correctly define port scanning in the context of network security.

Step 1: Define port scanning

Port scanning is a reconnaissance technique in which an attacker (or security administrator) sends packets to a range of port numbers on a target host to determine which ports are open, closed, or filtered. Open ports indicate running services, which can reveal potential vulnerabilities.

Step 2: Common tools and types

Tools like Nmap are widely used for port scanning. Common scan types include TCP Connect scans, SYN (half-open) scans, and UDP scans.

Step 3: Eliminate incorrect options

Encrypting data before transmission relates to cryptography, not port scanning. Forwarding packets between segments is routing. Assigning port numbers to devices is not a standard networking operation — port numbers are defined by standards (e.g., IANA) and are not dynamically assigned to devices.

Answer:

Port scanning is a reconnaissance technique used to discover which ports are open and which services are running on a target host.

Quick Tip:

SYN scanning (half-open scanning) is stealthier than a full TCP connect scan because the three-way handshake is never completed, making it less likely to be logged by the target system.

Understanding:

We need to identify the security mechanism specifically designed to verify that data has not been tampered with during transmission.

Step 1: Define each option

Encryption ensures confidentiality by making data unreadable to unauthorised parties — it does not by itself verify that data has not been altered.

Step 2: Evaluate digital certificates

A digital certificate binds a public key to an identity and is used for authentication — it is not directly used to verify data integrity of a specific transmitted message.

Step 3: Identify the correct mechanism

A Message Authentication Code (MAC) is a short piece of information used to confirm that a message came from a stated sender and has not been altered. It is computed using a secret key and the message content, and the receiver recomputes the MAC to verify integrity and authenticity.

Step 4: Eliminate the last option

An Access Control List (ACL) defines which users or systems are permitted to access resources — it does not verify data integrity during transmission.

Answer:

A Message Authentication Code (MAC) is the mechanism used to verify that data has not been altered during transmission.

Quick Tip:

Do not confuse MAC (Message Authentication Code) with MAC (Media Access Control) address — two entirely different concepts. In security contexts, HMAC (Hash-based MAC) using SHA-256 is a very commonly tested example.

Understanding:

We need to find the minimum subnet mask (fewest borrowed bits) that provides at least 6 subnets from a /24 block.

Formula:

The number of subnets created by borrowing $n$ bits is:

Step 1: Determine bits to borrow

We need $2^n\ge 6$.

So we must borrow $n=3$ bits.

Step 2: Calculate the new prefix length

Starting from a /24 network and borrowing 3 bits:

The new subnet mask is $/27$.

Step 3: Verify host capacity

With a /27 mask, each subnet has $32-27=5$ host bits, giving $2^5-2=30$ usable hosts per subnet — reasonable for most scenarios.

Answer:

The minimum subnet mask required to create at least 6 subnets from a /24 block is /27.

Quick Tip:

Always use $2^n\ge \text{required subnets}$ and pick the smallest $n$ that satisfies the inequality. Borrowing fewer bits than needed is the most common mistake.

Understanding:

We must find the number of usable host addresses for the subnet mask $\mathrm{255.255.255.192}$.

Formula:

The number of usable hosts in a subnet is:

where $h$ is the number of host bits (the $-2$ accounts for the network address and broadcast address).

Step 1: Convert the mask to prefix notation

$\mathrm{255.255.255.192}$ in binary:

So the last octet has $2$ network bits. Total prefix length:

Step 2: Find the number of host bits

Step 3: Calculate usable hosts

Answer:

The number of usable host addresses in a /26 subnet is 62.

Quick Tip:

The octet value $192=128+64$, which corresponds to $11000000_2$ — 2 bits set. This is a quick way to read subnet masks without full binary conversion.

Understanding:

We need to find the broadcast address of the subnet $172.16.5.64/26$.

Formula:

The broadcast address is obtained by setting all host bits to $1$:

Step 1: Determine the block size

With a /26 mask, the host portion has $32-26=6$ bits.

Step 2: Identify the subnet range

The network address is $\mathrm{172.16.5.64}$. The next subnet starts at:

So this subnet spans $\mathrm{172.16.5.64}$ to $\mathrm{172.16.5.127}$.

Step 3: Identify the broadcast address

The broadcast address is the last address in the range:

Verification:

Setting all 6 host bits of $\mathrm{172.16.5.64}$ to 1:

Confirmed: $\mathrm{172.16.5.127}$.

Answer:

The broadcast address for the subnet $172.16.5.64/26$ is $\mathrm{172.16.5.127}$.

Quick Tip:

Broadcast = Network address + Block size $-1$. Here: $64+64-1=127$.

Understanding:

We must find the prefix length that gives at least $500$ usable hosts per subnet.

Formula:

where $h=32-\text{prefix length}$.

Step 1: Solve for minimum host bits

So the minimum value of $h=9$.

Step 2: Calculate the prefix length

Step 3: Verify

A /23 subnet has:

A /24 subnet has:

Answer:

The prefix length required to support at least 500 hosts per subnet is /23.

Quick Tip:

For host requirements, always find the smallest subnet (largest prefix) that still accommodates the needed count. /24 is the most common wrong answer here because it is the most familiar mask.

Understanding:

We must determine which of the given addresses falls within the subnet $192.168.1.128/25$.

Formula:

A /25 subnet has a block size of $2^{32-25}=2^7=128$.

The range of a subnet starting at network address $N$ is:

Step 1: Determine the subnet range

The network address is $\mathrm{192.168.1.128}$.

So the subnet range is $\mathrm{192.168.1.128}$ to $\mathrm{192.168.1.255}$.

Step 2: Test each option against the range $[128,255]$

Step 3: Confirm the valid host

$\mathrm{192.168.1.200}$ is a usable host address within $192.168.1.128/25$.

Answer:

The address that belongs to the subnet $192.168.1.128/25$ is $\mathrm{192.168.1.200}$.

Quick Tip:

For a /25, the two subnets within any /24 are $.0$ to $.127$ and $.128$ to $.255$. Memorising this split saves time in exams.

Understanding:

We need a subnet mask that simultaneously satisfies:

Formula:

where $n$ = subnet bits borrowed, $h$ = host bits remaining, and $n+h=8$ (since we start with a /24).

Step 1: Find required subnet bits

Step 2: Find required host bits

Step 3: Check feasibility with $n+h=8$

With $n=2$ and $h=6$: $2+6=8$ ✓

Both conditions are satisfied.

Step 4: Calculate the subnet mask

Prefix length $=24+2=26$.

The last octet of the mask has $2$ bits set:

Subnet mask $=\mathrm{255.255.255.192}$.

Verification:

With /27 ($n=3,h=5$): usable hosts $=2^5-2=30<50$ — insufficient.

Answer:

The most efficient subnet mask is $\mathrm{255.255.255.192}$, providing 4 subnets with 62 usable hosts each.

Quick Tip:

Always verify BOTH constraints — subnets and hosts. A /27 gives more subnets but fails the host requirement, making it a common trap.

Understanding:

We start with a /16 network and apply a /20 mask.

Formula:

Step 1: Calculate the number of subnets

Step 2: Calculate usable hosts per subnet

Verification:

Total addresses: $2^{16}=65536$. Each /20 subnet holds $2^{12}=4096$ addresses. $16\times 4096=65536$ ✓

Answer:

Subnetting $10.10.0.0/16$ with a /20 mask yields 16 subnets with 4094 usable hosts each.

Quick Tip:

The number of borrowed bits is always (new prefix $-$ original prefix). Borrowing 4 bits from a /16 gives $2^4=16$ subnets, each with $2^{12}-2=4094$ hosts.

Understanding:

We must identify the class and the classful default subnet mask of the IP address $\mathrm{192.168.1.1}$.

Formula:

Classful IP address ranges:

Step 1: Identify the class

The first octet of $\mathrm{192.168.1.1}$ is $192$.

Step 2: Apply the default mask

Class C networks have a 24-bit network portion:

Step 3: Confirm it is a private address

$192.168.0.0/16$ is the private address space for Class C, confirming the classification.

Answer:

The IP address $\mathrm{192.168.1.1}$ is a Class C address with default subnet mask $\mathrm{255.255.255.0}$.

Quick Tip:

The leading bits determine the class: Class A starts with $0$, Class B with $10$, Class C with $110$. Since $192=11000000_2$, the leading bits are $110$ — confirming Class C.

Understanding:

We need to find the starting network address of the subnet immediately after $192.168.20.0/26$.

Formula:

In VLSM, the next subnet begins immediately after the broadcast address of the current subnet:

where:

Step 1: Calculate the block size of the /26 subnet

Step 2: Find the broadcast address of the first subnet

Step 3: Find the next network address

Verification:

The /26 subnet $192.168.20.0/26$ spans addresses $.0$ to $.63$. The address $.64$ is the first address of the next available block, making it a valid network address for the next subnet.

Answer:

The next available subnet immediately after $192.168.20.0/26$ starts at $\mathrm{192.168.20.64}$.

Quick Tip:

In VLSM, always add the block size to the current network address to get the next subnet's network address. The block size for /26 is 64, so subnets start at $.0$, $.64$, $.128$, $.192$.