Topic in Computer Networks & Cloud Computing
Network security is the practice of protecting data in transit and the network infrastructure from unauthorised access, misuse, interception and disruption. Items test how packet-filtering firewalls, stateful firewalls and application-level gateways differ, and where intrusion detection and prevention systems sit. Attack questions cover DoS and DDoS, ARP spoofing, man-in-the-middle, IP spoofing and SQL injection. Protocol topics include IPsec with its AH and ESP headers and tunnel versus transport modes, TLS for secure web traffic, VPNs, and AAA services such as RADIUS. Symmetric and public-key cryptography, digital certificates, patching and password policies round out the material.
Below are 30 practice questions from a pool of 210 Network Security (Network Perspective) MCQs, one of 10 topics in Computer Networks & Cloud Computing. Each shows the correct answer with an explanation; when you are ready, take a timed quiz to test recall under exam conditions.
Each question below shows the correct answer with a full explanation. Use these to build conceptual understanding before attempting a timed quiz.
Q1. What is a VPN?
A VPN (Virtual Private Network) creates a secure, encrypted tunnel over a public network (like the Internet), allowing remote users to access private network resources securely.
Q2. What is a DDoS attack?
A DDoS (Distributed Denial of Service) attack floods a target system with traffic from many compromised sources, making it unavailable to legitimate users.
Q3. What does encryption do?
Encryption converts readable data (plaintext) into an unreadable format (ciphertext) using a key, protecting data confidentiality from unauthorized access.
Q4. What is a firewall?
A firewall is a network security device or software that monitors and filters incoming and outgoing network traffic based on predefined security rules.
Q5. What is the purpose of an IDS (Intrusion Detection System)?
An IDS monitors network traffic for suspicious activity and alerts administrators when potential threats are detected, but it does not actively block traffic.
Q6. What is phishing?
Phishing is a social engineering attack where attackers send fraudulent communications (often emails) that appear to come from trusted sources to steal sensitive information.
Q7. What does SSL/TLS provide?
SSL/TLS (Secure Sockets Layer / Transport Layer Security) provides encryption, authentication, and data integrity for communications over networks, commonly used in HTTPS.
Q8. What is the TLS 1.3 handshake improvement over TLS 1.2?
TLS 1.3 reduces the handshake from 2 round trips (TLS 1.2) to 1 round trip, and supports 0-RTT resumption for previously connected clients, significantly reducing latency.
Q9. What is the BGP hijacking attack?
BGP hijacking occurs when an attacker announces IP prefixes they do not own through BGP, causing Internet traffic to be misrouted through the attacker's network for interception or disruption.
Q10. What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses the same key for encryption and decryption (e.g., AES). Asymmetric uses a public key for encryption and a private key for decryption (e.g., RSA).
Q11. What is perfect forward secrecy (PFS) in cryptographic protocols?
PFS ensures that each session uses unique ephemeral keys. Even if the server's long-term private key is compromised, past session keys cannot be derived, protecting previously recorded traffic.
Q12. What is the purpose of a DMZ (Demilitarized Zone) in network security?
A DMZ is a perimeter network segment that hosts public-facing services (web servers, email servers) while protecting the internal network from direct external access.
Q13. What is the difference between signature-based and anomaly-based intrusion detection?
Signature-based IDS matches traffic against a database of known attack signatures (fast but cannot detect new attacks). Anomaly-based IDS learns normal behavior and flags deviations (can detect unknown attacks but may have more false positives).
Q14. What is the purpose of IPSec?
IPSec (Internet Protocol Security) provides security at the network layer through authentication (AH), encryption (ESP), and key exchange (IKE) for secure IP communications.
Q15. What is two-factor authentication (2FA)?
2FA requires two different authentication factors (something you know like a password, something you have like a phone, or something you are like a fingerprint) to verify identity.
Q16. What is a man-in-the-middle (MITM) attack?
In a MITM attack, an attacker secretly intercepts communication between two parties, potentially reading, modifying, or injecting data without either party's knowledge.
Q17. What is malware?
Malware (malicious software) is any software intentionally designed to cause damage, including viruses, worms, trojans, ransomware, and spyware.
Q18. What is the purpose of SIEM (Security Information and Event Management)?
SIEM collects and analyzes log data from various sources (firewalls, IDS, servers) in real-time, correlating events to detect security threats, generate alerts, and support compliance reporting.
Q19. What is a honeypot in network security?
A honeypot is a deliberately vulnerable system deployed to attract attackers, allowing security teams to study attack methods, gather intelligence, and divert attacks from real systems.
Q20. What is the function of a WAF (Web Application Firewall)?
A WAF protects web applications by filtering, monitoring, and blocking malicious HTTP/HTTPS traffic, protecting against attacks like SQL injection, XSS, and CSRF.
Q21. What is the difference between stateful and stateless firewalls?
Stateful firewalls maintain a table of active connections and make decisions based on the context of traffic flows. Stateless firewalls evaluate each packet independently based on rules.
Q22. What is DNS cache poisoning?
DNS cache poisoning injects false DNS records into a resolver's cache, causing users to be redirected to malicious IP addresses when querying the poisoned domain name.
Q23. What is the principle of zero trust security?
Zero trust security assumes no implicit trust based on network location. Every access request is fully authenticated, authorized, and encrypted, whether from inside or outside the network.
Q24. What is the difference between IDS and IPS?
IDS (Intrusion Detection System) monitors and alerts. IPS (Intrusion Prevention System) monitors and actively takes action to block or prevent detected threats in real-time.
Q25. What is a zero-day vulnerability?
A zero-day vulnerability is a software flaw unknown to the vendor that attackers exploit before a patch is available. The term 'zero-day' refers to zero days of patch availability.
Q26. What is port scanning?
Port scanning sends packets to specific ports on a target to determine which ports are open, closed, or filtered, helping identify available services and potential vulnerabilities.
Q27. What is ARP spoofing?
ARP spoofing sends fake ARP messages to associate the attacker's MAC address with a legitimate IP address, enabling traffic interception (man-in-the-middle) on a LAN.
Q28. What is the difference between IPSec tunnel mode and transport mode?
In tunnel mode, the entire original IP packet is encrypted and encapsulated with a new IP header (used in VPNs). In transport mode, only the payload is encrypted while the original IP header remains intact.
Q29. What is a digital certificate?
A digital certificate is an electronic document issued by a Certificate Authority (CA) that binds a public key to an entity's identity, enabling secure communications.
Q30. What is network segmentation and why is it important for security?
Network segmentation divides a network into isolated segments, each with its own security policies. This limits an attacker's ability to move laterally across the network if one segment is compromised.
Take a timed quiz drawn from 210+ questions on this topic. No signup required — your progress saves in your browser.
Start Network Security (Network Perspective) Quiz