Advanced Network Attacks and Defence

1. What is "TCP SYN flooding"?

• A. Completing TCP connections rapidly
• B. Sending a large number of SYN packets without completing the three-way handshake to exhaust server resources ✓
• C. A type of port scanning
• D. Encrypting TCP connections

💡 TCP SYN flooding sends many SYN requests without completing handshakes, filling the server's connection table and denying service to legitimate users.

2. What is "egress filtering"?

• A. Filtering incoming network traffic
• B. Filtering outbound network traffic to prevent data exfiltration and unauthorized outbound connections ✓
• C. A type of IDS
• D. A firewall configuration only

💡 Egress filtering monitors and controls outbound traffic, preventing data exfiltration, botnet C2 communication, and unauthorized outbound connections.

3. What is "wardriving"?

• A. Driving to a data center
• B. Driving around with wireless equipment to detect and map Wi-Fi networks ✓
• C. A type of social engineering
• D. A physical security technique

💡 Wardriving involves driving through areas with a laptop and wireless adapter to discover, map, and potentially exploit Wi-Fi networks.

4. What is "SPF" in email security?

• A. Secure Packet Filter
• B. Sender Policy Framework — a DNS record specifying which mail servers are authorized to send email for a domain ✓
• C. Security Protocol Framework
• D. Simple Packet Forwarding

💡 SPF records in DNS list authorized mail servers for a domain, helping receiving servers detect and reject spoofed sender addresses.

5. What is "BGP hijacking"?

• A. A type of DDoS attack
• B. Illegitimately claiming ownership of IP address blocks by corrupting BGP routing tables ✓
• C. A type of DNS attack
• D. A firewall bypass technique

💡 BGP hijacking manipulates routing tables to redirect internet traffic through attacker-controlled infrastructure, enabling interception or blackholing.

6. What is "microsegmentation" in modern security?

• A. A type of data classification
• B. Granular network segmentation extending to individual workloads or applications for fine-grained access control ✓
• C. A network monitoring tool
• D. A type of firewall rule

💡 Microsegmentation creates security zones at the individual workload level in data centers, enforcing least-privilege access between applications.

7. What is "Pass-the-Hash" attack?

• A. A password cracking technique
• B. Using a captured NTLM hash to authenticate to a system without knowing the actual password ✓
• C. A type of rainbow table attack
• D. A Kerberos attack

💡 Pass-the-Hash captures NTLM authentication hashes and uses them directly for authentication without needing to crack the actual password.

8. What is "VLAN hopping"?

• A. Jumping between physical networks
• B. An attack allowing traffic to be sent from one VLAN to another by exploiting switch misconfigurations ✓
• C. A type of ARP spoofing
• D. A routing attack

💡 VLAN hopping exploits switch trunk configurations (double tagging or switch spoofing) to send packets to VLANs the attacker should not access.

9. What is "return-oriented programming" (ROP)?

• A. A programming paradigm
• B. An exploit technique chaining existing code snippets (gadgets) to execute malicious payloads without injecting new code ✓
• C. A type of memory management
• D. A secure coding practice

💡 ROP chains together small existing code sequences (gadgets) already in memory to perform malicious actions, bypassing DEP/NX protections.

10. What is "DNSSEC"?

• A. Domain Name Security Certification
• B. DNS Security Extensions — adding cryptographic signatures to DNS records to prevent DNS spoofing ✓
• C. A type of DoH
• D. A DNS load balancing protocol

💡 DNSSEC adds digital signatures to DNS records, allowing resolvers to verify authenticity and detect DNS cache poisoning attacks.

11. What is "DKIM" in email security?

• A. Domain Key Integrity Method
• B. DomainKeys Identified Mail — a digital signature method allowing receivers to verify email authenticity ✓
• C. Dynamic Key Infrastructure Management
• D. Domain Knowledge Identification Method

💡 DKIM adds a cryptographic signature to outgoing emails, allowing receiving servers to verify the email came from the claimed domain and was not altered.

12. What is "lateral movement" in cyber attacks?

• A. Moving attack tools to a new location
• B. Techniques used by attackers to progressively move through a network after initial compromise ✓
• C. A type of privilege escalation
• D. A data exfiltration technique

💡 Lateral movement allows attackers who have gained initial access to move through a network, compromising additional systems and gaining deeper access.

13. What is "STARTTLS"?

• A. A type of TLS certificate
• B. An opportunistic encryption command upgrading a plain text connection to encrypted TLS ✓
• C. A type of firewall
• D. A VPN protocol

💡 STARTTLS is a protocol command upgrading an existing insecure connection to TLS encryption, used in email protocols like SMTP and IMAP.

14. What is "ICMP tunneling"?

• A. A type of DDoS attack
• B. Covertly encapsulating arbitrary data within ICMP packets to bypass firewalls ✓
• C. A network monitoring technique
• D. A type of VPN

💡 ICMP tunneling embeds arbitrary data in ICMP echo request/reply packets, allowing data to be smuggled past firewalls that permit ICMP.

15. What is "DNS sinkholing"?

• A. A type of DNS attack
• B. Redirecting DNS queries for malicious domains to controlled servers to neutralize malware communication ✓
• C. A DNS caching technique
• D. A type of DoH

💡 DNS sinkholing intercepts DNS queries to known malicious domains and redirects them to benign servers, disrupting malware C2 communications.

16. What is "802.1X" in network security?

• A. A Wi-Fi speed standard
• B. A port-based network access control standard requiring authentication before network access ✓
• C. A type of firewall
• D. A routing protocol

💡 IEEE 802.1X is a standard for port-based network access control, requiring devices to authenticate (via RADIUS) before being granted network access.

17. What is "Kerberoasting"?

• A. A network scanning technique
• B. An attack extracting service account password hashes from Active Directory for offline cracking ✓
• C. A type of MITM attack
• D. A DDoS technique

💡 Kerberoasting requests Kerberos service tickets for service accounts and cracks their encrypted tickets offline to reveal weak passwords.

18. What is "DNS over HTTPS" (DoH)?

• A. A faster DNS protocol
• B. Encrypting DNS queries over HTTPS to prevent eavesdropping and DNS manipulation ✓
• C. A type of DNS attack
• D. A CDN technology

💡 DoH encrypts DNS queries inside HTTPS traffic, preventing ISPs and attackers from monitoring or manipulating DNS lookups.

19. What is "network segmentation" used for in security?

• A. Speeding up network traffic
• B. Dividing a network into isolated segments to limit lateral movement and contain breaches ✓
• C. A type of load balancing
• D. Increasing bandwidth

💡 Network segmentation isolates network zones so a breach in one segment cannot easily spread to others, containing the blast radius of attacks.

20. What is "SSRF" (Server-Side Request Forgery)?

• A. A type of XSS attack
• B. An attack tricking a server into making requests to internal resources on the attacker's behalf ✓
• C. A SQL injection variant
• D. A type of CSRF attack

💡 SSRF forces a server to make HTTP requests to internal resources, potentially exposing internal services, cloud metadata, or internal APIs.