This set examines network-level defences: packet filtering, stateful and application-level firewalls, DMZ design, signature and anomaly based IDS and IPS, VPNs, IPsec with AH, ESP, transport and tunnel modes, the SSL/TLS handshake and HTTPS, and Kerberos ticket-based authentication. It is designed for university semester exams, GATE and UGC NET network security questions, and interview rounds for network, cloud and security roles.
How to practise: read each question and tap the option you think is correct. You will see right away whether you got it, along with a short explanation, and your score is tracked at the bottom of the screen. This set has 18 questions.
Topics covered in this set
- Packet filter, stateful and proxy firewalls
- DMZ and screened subnet design
- Signature vs anomaly IDS, IDS vs IPS
- IPsec AH, ESP, transport and tunnel modes
- SSL/TLS handshake and HTTPS
- Kerberos AS, TGS and tickets
Cyber Security MCQs with answers and explanations
Q1. A stateless packet-filtering firewall makes decisions mainly based on:
a) Header fields such as source/destination IP, port and protocol of each packet
b) The full application payload of each session
c) The user's login credentials
d) The history of the TCP connection the packet belongs to
Q2. Which type of firewall acts as an intermediary that terminates the client connection and opens a separate connection to the server, understanding protocols like HTTP?
a) Stateless packet filter
b) Application-level gateway (proxy firewall)
c) Circuit-level gateway
d) Network address translator
Q3. Public-facing web and mail servers are commonly placed in a DMZ (screened subnet) so that:
a) They can bypass the firewall for speed
b) Internal users cannot reach them
c) A compromise of those servers does not give direct access to the internal network
d) They do not need patching
Q4. A signature-based IDS is weakest at detecting:
a) Well-known worm traffic
b) Port scans with known patterns
c) Attacks that match published rules
d) Novel (zero-day) attacks for which no signature exists
Q5. The key difference between an IDS and an IPS is that an IPS:
a) Only analyses logs after an incident
b) Sits inline and can block malicious traffic in real time
c) Never generates false positives
d) Works only on host machines, not networks
Q6. A host-based IDS (HIDS) is especially useful compared with a network IDS because it can:
a) Monitor activity after traffic is decrypted on the host, such as file integrity and system calls
b) Inspect all traffic on the network segment without any host agent
c) Prevent DDoS attacks at the ISP level
d) Replace the need for a firewall
Q7. Which IPsec protocol provides confidentiality through encryption?
a) Authentication Header (AH)
b) Internet Key Exchange (IKE)
c) Security Association Database (SAD)
d) Encapsulating Security Payload (ESP)
Q8. AH is generally incompatible with NAT because:
a) AH encrypts the IP header so NAT cannot read it
b) AH runs only over UDP
c) AH authenticates the outer IP header including addresses, which NAT modifies
d) AH requires IPv6
Q9. In IPsec tunnel mode, which statement is correct?
a) The entire original IP packet is encapsulated inside a new IP packet with a new header
b) Only the payload is protected and the original IP header is reused
c) No encryption is ever applied
d) It is used only for host-to-host traffic on the same LAN
Q10. In IPsec, what does a Security Association (SA) represent?
a) A two-way TCP session between two routers
b) A certificate issued to an IPsec gateway
c) A one-way logical connection defining the algorithms, keys and parameters used for protection
d) A list of blocked IP addresses
Q11. In TLS, what is the main purpose of the handshake protocol?
a) To compress application data
b) To authenticate the server (and optionally the client) and agree on algorithms and shared keys
c) To fragment records into packets
d) To route traffic between networks
Q12. Which statement about TLS 1.3 compared with TLS 1.2 is correct?
a) It added support for RC4 and MD5
b) It requires three round trips for a full handshake
c) It no longer uses certificates
d) It removed static RSA key exchange, so all key exchanges provide forward secrecy
Q13. HTTPS on its default port protects web traffic by running HTTP over TLS. What is the default port?
a) 80
b) 8080
c) 443
d) 22
Q14. The HSTS (HTTP Strict Transport Security) header helps defend against:
a) SQL injection
b) Brute-force password guessing
c) Buffer overflows in the browser
d) SSL stripping attacks that downgrade users from HTTPS to HTTP
Q15. In Kerberos, which component issues the Ticket-Granting Ticket (TGT) after initial login?
a) Authentication Server (AS)
b) Ticket-Granting Server (TGS)
c) The application server
d) The client workstation
Q16. Kerberos requires reasonably synchronised clocks across participants mainly because:
a) Tickets are encrypted with the current time as key
b) Authenticators carry timestamps used to detect and reject replayed messages
c) Clocks determine which server holds the KDC
d) It uses time-based one-time passwords for all users
Q17. A key design goal of Kerberos is that the user's password:
a) Is sent once, encrypted with the server's public key
b) Is stored inside every service ticket
c) Is shared with each application server
d) Is never sent across the network
Q18. A remote-access VPN mainly provides:
a) Faster internet speed by bypassing the ISP
b) An encrypted tunnel over an untrusted network so remote users can reach internal resources securely
c) Antivirus scanning of all downloaded files
d) Physical isolation of the corporate LAN
Quick revision notes
- Firewall types: stateless packet filter, stateful inspection, circuit-level gateway, application proxy, next-generation firewall.
- DMZ (screened subnet) hosts public servers between external and internal firewalls.
- IDS: signature (known attacks, low false positives) vs anomaly (unknown attacks, more false positives); IPS is inline.
- IPsec: AH = integrity + authentication (no encryption); ESP = encryption + optional integrity.
- Transport mode protects payload; tunnel mode encapsulates the whole IP packet.
- SA is one-way, identified by SPI + destination IP + protocol; IKE negotiates SAs.
- TLS 1.3: 1-RTT handshake, ephemeral (EC)DHE only, AEAD ciphers; HTTPS default port 443.
- Kerberos: AS issues TGT, TGS issues service tickets; relies on timestamps and a trusted KDC.
Frequently asked questions
What is the difference between AH and ESP in IPsec?
AH provides data integrity and origin authentication, covering parts of the IP header, but does not encrypt. ESP encrypts the payload and can also provide integrity, which is why most VPNs use ESP.
How is an IPS different from a firewall?
A firewall mainly enforces access rules based on addresses, ports, protocols and state. An IPS inspects traffic content and behaviour for attack patterns and blocks malicious flows, even on ports the firewall allows.
Why does Kerberos use tickets?
Tickets let a user authenticate once to the KDC and then access many services without re-entering or sending their password. Each ticket is encrypted with the target service's key and has a limited lifetime.
Comments
Post a Comment