Networking - MCQ Practice Questions
Computer networks MCQs — OSI, TCP/IP, routing & protocols.
168 questions | 100% Free
Which type of attack involves an attacker intercepting and possibly altering communication between two parties without either party knowing?
Understanding:
We need to identify the attack where an attacker secretly intercepts and possibly modifies communication between two parties.
Step 1: Analyse each option
A Denial of Service attack floods a target with traffic to make it unavailable — it does not intercept communication.
Step 2: Identify the correct concept
A Man-in-the-Middle (MitM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and possibly altering data in transit. Neither party is aware of the attacker's presence. Classic examples include ARP spoofing and SSL stripping.
Step 3: Eliminate remaining options
SQL Injection targets database queries through malicious input. Phishing deceives users into revealing credentials via fake websites or emails — neither involves intercepting live communication between two parties.
Answer:
The attack that involves secretly intercepting communication between two parties is the Man-in-the-Middle (MitM) attack.
Quick Tip:
MitM attacks are commonly mitigated using end-to-end encryption (e.g., TLS/SSL) and certificate pinning, which prevent attackers from decrypting or tampering with data in transit.
In network security, what does the term 'firewall' primarily refer to?
Understanding:
We need to identify the primary function of a firewall in network security.
Step 1: Define the concept
A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic. It does so by applying a set of predefined security rules to determine whether specific packets should be allowed or blocked.
Step 2: Eliminate incorrect options
Encrypting traffic between two endpoints is the function of a VPN or TLS/SSL — not a firewall. Assigning IP addresses dynamically is performed by DHCP (Dynamic Host Configuration Protocol). Caching web content is the role of a proxy server or content delivery network (CDN).
Step 3: Confirm the correct answer
A firewall enforces access control policies at the network boundary, filtering traffic based on rules related to IP addresses, ports, and protocols.
Answer:
A firewall primarily monitors and controls network traffic based on predefined security rules.
Quick Tip:
Stateful firewalls track the state of active connections, making them more effective than simple packet-filtering firewalls, which only inspect individual packets in isolation.
Which cryptographic concept ensures that a sender cannot deny having sent a message?
Understanding:
We need to identify which security property prevents a sender from denying that they sent a message.
Step 1: Review the core security principles
The CIA triad and related principles in information security include:
Step 2: Match to the question
Non-repudiation provides proof of the origin and delivery of data, making it impossible for a sender to deny having sent a message. It is typically implemented using digital signatures, where the sender's private key is used to sign the message.
Step 3: Confirm
Confidentiality, Integrity, and Availability address different concerns and do not prevent a sender from denying an action.
Answer:
The cryptographic concept that prevents a sender from denying they sent a message is Non-repudiation.
Quick Tip:
Digital signatures are the primary technical mechanism for achieving non-repudiation — they bind the identity of the sender to the message using asymmetric cryptography.
What is the primary purpose of a Demilitarized Zone (DMZ) in network security architecture?
Understanding:
We need to identify the primary purpose of a DMZ in network security design.
Step 1: Define DMZ
A Demilitarized Zone (DMZ) is a physical or logical subnetwork that separates an organisation's internal local area network (LAN) from untrusted external networks, such as the internet.
Step 2: Explain its function
Public-facing servers such as web servers, mail servers, and DNS servers are placed in the DMZ. This way, external users can access these services without gaining direct access to the internal private network. Even if a public-facing server in the DMZ is compromised, the attacker is still blocked from reaching the sensitive internal network by an additional firewall.
Step 3: Eliminate incorrect options
Encrypting traffic is the role of VPNs or TLS. Assigning IP addresses is done by DHCP. Redundant routing is achieved through protocols like OSPF or BGP — none of these describe the DMZ.
Answer:
The primary purpose of a DMZ is to host publicly accessible services while isolating them from the internal private network.
Quick Tip:
A typical DMZ setup uses two firewalls — one between the internet and the DMZ, and another between the DMZ and the internal network — providing layered (defence-in-depth) security.
Which of the following best describes a 'replay attack' in network security?
Understanding:
We need to identify the correct description of a replay attack.
Step 1: Define replay attack
A replay attack occurs when an attacker intercepts a valid data transmission (such as authentication credentials or session tokens) and later retransmits the captured data to trick the receiver into accepting it as legitimate. The attacker does not need to decrypt the data — simply resending it is sufficient.
Step 2: Compare with other attacks
Step 3: Confirm
A replay attack specifically involves capturing and retransmitting valid authentication or session data to gain unauthorised access.
Answer:
A replay attack involves capturing valid data transmissions and retransmitting them to gain unauthorised access.
Quick Tip:
Replay attacks are commonly prevented using timestamps, nonces (numbers used only once), and session tokens that expire after a single use — these make retransmitted data invalid.
Which of the following network security protocols operates at the Transport layer and is commonly used to secure HTTP traffic?
Understanding:
We need to identify the protocol that operates at the Transport layer and is widely used to secure HTTP traffic.
Step 1: Analyse each option
IPSec operates at the Network layer (Layer 3) of the OSI model and is used to secure IP communications, typically for VPNs.
Step 2: Identify TLS
TLS (Transport Layer Security) operates at the Transport layer and provides encryption, authentication, and integrity for data in transit. When TLS is used with HTTP, the combination is called HTTPS — the standard for secure web browsing.
Step 3: Eliminate remaining options
SSH (Secure Shell) operates at the Application layer and is used for secure remote command-line access, not for securing HTTP traffic. RADIUS is an Authentication, Authorisation, and Accounting (AAA) protocol used for network access control, not for encrypting web traffic.
Answer:
TLS operates at the Transport layer and is the standard protocol used to secure HTTP traffic (forming HTTPS).
Quick Tip:
TLS replaced the older SSL (Secure Sockets Layer) protocol. TLS 1.3, the latest version, removed weak cipher suites and significantly improved handshake performance compared to TLS 1.2.
In public key cryptography, which key is used to encrypt a message that only the intended recipient can decrypt?
Understanding:
We need to identify which key is used to encrypt a message so that only the intended recipient can decrypt it.
Step 1: Recall asymmetric cryptography fundamentals
In public key (asymmetric) cryptography, each party has a key pair:
Step 2: Apply encryption rules
For confidential communication:
Step 3: Eliminate incorrect options
Using the recipient's private key to encrypt would mean only the recipient can encrypt — defeating the purpose of secure communication. Using the sender's keys would not ensure only the recipient can decrypt.
Answer:
To send a confidential message, the sender encrypts it using the recipient's public key, which only the recipient's private key can decrypt.
Quick Tip:
Remember the two uses of asymmetric keys: (1) Encrypt with recipient's public key for confidentiality. (2) Sign with sender's private key for authentication and non-repudiation.
What type of attack attempts to overwhelm a target server by sending a massive volume of traffic from a single source, making it unavailable to legitimate users?
Understanding:
We need to identify the attack that originates from a single source and overwhelms a server with traffic to deny service to legitimate users.
Step 1: Distinguish DoS from DDoS
A Denial of Service (DoS) attack originates from a single source and floods the target with traffic or requests, exhausting its resources so legitimate users cannot be served. A Distributed Denial of Service (DDoS) attack is launched from multiple sources (a botnet) simultaneously — the question specifically states a single source.
Step 2: Evaluate other options
A Smurf attack is a specific type of DoS that uses ICMP broadcast amplification — it is a subtype, not the general category. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake — again a specific technique, not the general description given.
Step 3: Confirm the answer
The general category for an overwhelming traffic attack from a single source is a Denial of Service (DoS) attack.
Answer:
An attack from a single source that overwhelms a server to deny service to legitimate users is a Denial of Service (DoS) attack.
Quick Tip:
The key distinction in exam questions: DoS = single source, DDoS = multiple distributed sources (botnet). Both aim to deny service, but their scale and mitigation strategies differ significantly.
Which of the following is the correct definition of 'port scanning' in the context of network security?
Understanding:
We need to correctly define port scanning in the context of network security.
Step 1: Define port scanning
Port scanning is a reconnaissance technique in which an attacker (or security administrator) sends packets to a range of port numbers on a target host to determine which ports are open, closed, or filtered. Open ports indicate running services, which can reveal potential vulnerabilities.
Step 2: Common tools and types
Tools like Nmap are widely used for port scanning. Common scan types include TCP Connect scans, SYN (half-open) scans, and UDP scans.
Step 3: Eliminate incorrect options
Encrypting data before transmission relates to cryptography, not port scanning. Forwarding packets between segments is routing. Assigning port numbers to devices is not a standard networking operation — port numbers are defined by standards (e.g., IANA) and are not dynamically assigned to devices.
Answer:
Port scanning is a reconnaissance technique used to discover which ports are open and which services are running on a target host.
Quick Tip:
SYN scanning (half-open scanning) is stealthier than a full TCP connect scan because the three-way handshake is never completed, making it less likely to be logged by the target system.
Which of the following security mechanisms is used to verify that data has not been altered during transmission?
Understanding:
We need to identify the security mechanism specifically designed to verify that data has not been tampered with during transmission.
Step 1: Define each option
Encryption ensures confidentiality by making data unreadable to unauthorised parties — it does not by itself verify that data has not been altered.
Step 2: Evaluate digital certificates
A digital certificate binds a public key to an identity and is used for authentication — it is not directly used to verify data integrity of a specific transmitted message.
Step 3: Identify the correct mechanism
A Message Authentication Code (MAC) is a short piece of information used to confirm that a message came from a stated sender and has not been altered. It is computed using a secret key and the message content, and the receiver recomputes the MAC to verify integrity and authenticity.
Step 4: Eliminate the last option
An Access Control List (ACL) defines which users or systems are permitted to access resources — it does not verify data integrity during transmission.
Answer:
A Message Authentication Code (MAC) is the mechanism used to verify that data has not been altered during transmission.
Quick Tip:
Do not confuse MAC (Message Authentication Code) with MAC (Media Access Control) address — two entirely different concepts. In security contexts, HMAC (Hash-based MAC) using SHA-256 is a very commonly tested example.