Font size
WorksheetsWeek 6: Network Resilience and Security
Total questions: 89
Worksheet time: 45mins
An organisation wants to minimise downtime to a few seconds when its main data centre fails. Which recovery site type best meets this requirement?
Warm site
Cold site
Cloud site
Hot site
Portable site
An analyst is reviewing failures of network switches that cannot be repaired once they fail. Which reliability metric applies?
MTBF
MTTR
RTO
MTTF
RPO
A company plans to replicate data every 4 hours. This frequency directly impacts which metric?
MTTR
RPO
MTD
RTO
MTBF
An attacker sends unsolicited ARP replies to impersonate the gateway. What attack is this?
DNS poisoning
VLAN hopping
ARP spoofing
DoS flooding
Rogue DHCP
A network engineer deploys multiple fibre connections between two servers to guarantee connectivity in case one fails. Which concept is this?
Trunking
Load balancing
Multipathing
Port mirroring
Loop protection
A web application receives traffic through a device that decides how to distribute client requests across multiple servers. Which device is being used?
Router
Firewall
Load balancer
Proxy server
Switch
A company defines that after an outage, the service must be restored within 3 hours. Which metric is this?
MTBF
MTTR
RPO
MTD
RTO
A cybercriminal uses multiple compromised systems to overwhelm a victim’s bandwidth. This describes a:
Rogue AP
DDoS attack
VLAN hopping
Spoofing error
Port scan
A technician bundles four Ethernet cables into a single logical link for higher bandwidth and redundancy. Which protocol supports this?
HSRP
CARP
LACP
VRRP
STP
A company wants its backup generator to automatically take over when power fails. What must still be present?
Load balancer
Firewall
UPS
DHCP server
Solar panel
A malicious actor intercepts traffic between two endpoints without detection. Which attack is this?
Evil twin
DNS poisoning
MitM
DDoS
Ransomware
A user reports a fake Wi-Fi network named similar to the legitimate one. What attack is this?
Rogue DHCP
Evil twin
MitM
ARP spoof
VLAN hopping
A device caches configuration settings in battery-backed memory to protect against sudden loss. This feature is known as:
RPO
UPS runtime
Battery-backed cache
Flash mirroring
Warm failover
A server cluster where all nodes actively process traffic simultaneously is known as:
Active-active
Passive-passive
Backup-only
Failover-only
VRRP cluster
A network admin restricts each switchport to a single MAC address to prevent rogue devices. What technique is used?
DHCP Snooping
Port Security
DAI
PVLAN
802.11X
A threat actor modifies the HOSTS file on a victim’s device so specific domain names resolve incorrectly. This is a:
DNS server poisoning
Client-side DNS poisoning
Rogue gateway
Cache amplification
Port redirection attack
A business wants side-to-side separation of devices within one VLAN. Which technology enables this?
Trunking
PVLAN
STP
SNMPv3
LAG
Password hashes stored insecurely are at risk of which attack?
VLAN hopping
Botnet injection
Hash cracking
ARP poisoning
Ransom payment redirection
A company wants to ensure that a default gateway is always reachable without reconfiguring hosts. What protocol supports this?
STP
HSRP
RIP
OSPF
PPPoE
A system admin reviews the total operational hours of a device divided by the number of failures. This metric is:
MTTR
RPO
MTBF
RTO
MTD
An attacker sets up a DHCP server that gives victims a malicious default gateway. What attack is this?
Rogue DHCP
ARP poisoning
HSRP spoofing
DNS tunnelling
VLAN hopping
A company plans to restore full operations after an outage, including administrative tasks. The total time includes RTO plus WRT. What is the name of this combined period?
MTTR
MTD
MTBF
RPO
RTF
Which site requires the longest time to restore operations after a disaster?
Warm site
Hot site
Cloud site
Cold site
Hybrid site
An admin configures a trunk to use a unique native VLAN to reduce risk. This follows best practice for preventing:
Ransomware
VLAN hopping
DNS spoofing
Rogue APs
DDoS
An organisation deploys a system where a backup router uses a priority system to take over if the active router fails. Which protocol describes this?
CARP
VRRP
LACP
HSRP
GLBP
A system has a high MTTR. What does this typically indicate?
Failures are frequent
Repairs take longer
The RPO is strict
Ransomware risk is high
Backups are not configured
A company wants to prevent devices from using unauthorized wireless networks. Which measure helps?
ARP refresh
Geofencing
LACP
RAID
SNMP alerts
A botnet controller sends commands to infected hosts. The network that manages this is known as:
Shadow VLAN
Split tunnel
C2 network
MitM
ARP domain
A system must never lose more than 30 minutes of data if a failure occurs. Which metric sets this?
RTO
MTTR
RPO
WRT
MTD
A firewall applies rules from top to bottom and blocks anything not explicitly allowed. This is known as:
Explicit permit
First-hop redundancy
Implicit deny
Route policing
NAT exclusion
A device that filters and stabilises power while allowing remote power monitoring is called a:
Generator
PDU
Patch panel
UPS
Inverter
A technician detects an employee plugging an unauthorized laptop into a free switchport. Which defence applies?
MTBF tracking
Port security
DNSSEC
HSRP
Multipathing
Multiple ISPs with physically separate entry points to a building are used to ensure:
Cache prevention
Physical path diversity
VLAN convergence
Native VLAN isolation
Ransomware mitigation
A firewall admin configures INPUT, OUTPUT, and FORWARD chains. Which tool is being used?
SNMPv3
iptables
OpenVPN
NetFlow
Syslog
Malware that encrypts files and demands payment is known as:
Trojan
Rootkit
Worm
Ransomware
RAT
An organisation defines that a service can be unavailable for up to 8 hours without severe impact. Which concept is this?
MTD
RTO
RPO
MTBF
Hot standby
An attacker uses double tagging to access a VLAN they shouldn’t. What attack is this?
DNS spoofing
Rogue DHCP
VLAN hopping
ARP broadcast
SMURF reflection
Which power problem describes a prolonged reduction in voltage?
Surge
Blackout
Brownout
Spike
Ripple
A technician needs a backup of a device’s running configuration for rollback. This is a:
Bare metal backup
State backup
Config file backup
Cluster snapshot
Disk image
A wireless admin wants to isolate connected clients so they cannot communicate with one another. This is called:
Client isolation
HSRP isolation
VLAN shifting
Beacon limiting
PVLAN routing
If a component is repairable, which metric tracks average repair time?
MTBF
MTTR
MTD
RPO
WRT
When an attacker sends large numbers of DNS queries using a spoofed source IP, this is:
Evil twin
DNS amplification
Rogue AP
ARP flooding
Port scanning
A network admin implements control plane rate-limiting to protect the router CPU. This is:
PVLAN
Control plane policing
Firewall bypass
VLAN pruning
MTTR reduction
Which fire suppression system uses water to extinguish fires?
Halon
CO2
Sprinkler system
Inergen
Dry aerosol
A user sees a fake login pop-up mimicking a real OS window. What malware does this?
RAT
Crypto-malware
Botnet
A network's uptime is measured over a year and expressed as a percentage. This identifies its:
MTBF
High availability
WRT
MTD
MTTR
A malicious person follows an employee through a secured door without authentication. This is:
Shoulder surfing
Piggybacking
VLAN hopping
Rogue DHCP
DNS poisoning
A warm site typically takes how long to activate?
Seconds
Minutes
Hours
Days
Weeks
A cluster that shares one external address between nodes uses what?
Static NAT
Virtual IP
LACP
VRRP
PVLAN
Users are disconnected from Wi‑Fi suddenly due to a targeted attack. What caused this?
Rogue DHCP
Deauthentication attack
Evil twin
VLAN hopping
C2 command
A company wants systems to remain online even if individual servers fail. Which technology supports this?
DNSSEC
Clustering
ARP caching
NAT
RAID 0 only
Attackers try every possible password until one works. This is:
Dictionary attack
Hash poisoning
Brute force
Rainbow flooding
Credential masking
A generator must always be paired with which component?
PVLAN
Load balancer
UPS
DDoS filter
Battery cache
An organisation deploys a web portal that forces users to accept terms before connecting wirelessly. This is:
EAP
Captive portal
PSK
ARP request
Rogue login
A power event where voltage spikes momentarily is called a:
Brownout
Surge
Blackout
Drain
Ripple
A backup method capturing the whole system state including applications and OS is:
Config‑only
Bare metal
Clustered copy
Hot spare
Differential sync
An attacker spoofs a trusted DNS record on a server. This is:
VLAN injection
Rogue gateway
Server‑side DNS poisoning
Evil twin
Load balancing attack
A technician assigns unused switchports to a black hole VLAN. This is an example of:
Attack amplification
Endpoint security
Rogue DHCP prevention
HSRP tuning
PVLAN tunnelling
A laptop overheats in a poorly ventilated room. Which infrastructure support system helps prevent this?
UPS
HVAC
C2 network
LACP
MTBF tracking
Malware that hides itself deeply inside the OS to avoid detection is a:
Worm
Rootkit
Trojan
Botnet
PUP
Switching between multiple active uplinks to improve performance best describes:
RAID 5
LAG
HSRP
PVLAN
VRRP
A technician enforcing strong password length is performing:
VLAN provisioning
Device hardening
MitM prevention
Native VLAN change
DNS caching
In a failover scenario, the time taken to restore normal application operation plus cleanup is:
RPO
WRT
MTTR
MTBF
MTD
An employee viewing another’s PIN over their shoulder is an example of:
Spoofing
Shoulder surfing
Piggybacking
VLAN intrusion
ARP manipulation
A malicious AP installed in the building by an attacker is called:
Rogue AP
Evil twin
Fake DHCP
DNS hijacker
HSRP mirror
A user gets redirected to a fake website although the URL is correct. What attack is likely?
VLAN hopping
DNS poisoning
RAID desync
UPS failure
EAP misconfiguration
Devices with identical MAC addresses on a switch indicate which attack?
Rogue DHCP
MAC spoofing
DDoS
PVLAN
Hot standby
Tools that check vendor updates for embedded IoT devices support:
VLAN tagging
Patch management
Flow control
Multipathing
Power conditioning
When a device loses power for a short period due to grid failure, it experienced a:
Spike
Surge
Brownout
Blackout
Ripple
A hacker uses social engineering via email to trick employees. This is:
Tailgating
Phishing
Botnet seeding
ARP flooding
VLAN injection
An attacker overwhelms a firewall’s state table with SYN packets. This is a form of:
DoS
Evil twin
IPv6 RA guard
Keylogging
MTTR reduction
A network backup that records multiple versions of a configuration allows:
ARP isolation
Version rollback
Rate limiting
PVLAN mapping
Multipath pruning
An admin uses ND Inspection to protect against rogue IPv6 devices. This protects which protocol layer?
Application
IPv6 Neighbor Discovery
ARP
DNSSEC
DHCPv4
To prevent wireless coverage leakage outside a building, an admin adjusts:
VLAN ID
Power levels
STP timers
LACP
MTBF
A node in a cluster that only becomes active during failure is:
Active-active
Active-passive
Fully redundant
Multipath node
Virtual gateway
A system’s operational hours divided by its number of failures measures:
MTTR
MTBF
RTO
MTD
MTDS
A pop-up program that appears legitimate but installs malware is a:
RAT
Trojan
Botnet
DAI
Rogue DHCP
Which wireless security technique isolates guest devices from internal networks?
WPA3
Guest network isolation
ND inspection
VLAN hopping
Hot spare
A device that replaces grid power for long periods is:
PDU
Generator
UPS
Rectifier
Inverter
A malicious actor using a fake MAC address is performing:
MTD
MAC spoofing
Rogue DHCP
DNS tunnelling
ARP restriction
A switch feature that validates ARP packets against DHCP snooping tables is:
Port security
DAI
VRRP
PSK
LACP
The complete loss of power describes a:
Spike
Brownout
Blackout
Surge
Ripple
A configuration where multiple nodes process traffic and share a virtual address describes:
LACP
Active-active cluster
PVLAN
DNSSEC
WAN failover
When an OS forces the user to accept automatic updates for security patches, this is part of:
Multipathing
Patch management
VLAN provisioning
Link aggregation
RTO calculation
Allowing only authorised MAC addresses to use a wireless network is:
Evil twin protection
MAC filtering
Rogue AP
PVLAN
DHCP snooping
A company requires that hosts keep the same IP address for their gateway even during failover. Which technology supports this?
DNSSEC
Virtual IP
LACP
RPO
MTD
A company restricts access to IoT devices to a separate monitoring network. This is:
ARP suppression
Traffic isolation
LAG
RTO alignment
Cold site
A malicious actor broadcasting many gratuitous ARP replies is attempting:
ARP spoofing
RA guard
DHCP starvation
VLAN juggling
VRRP takeover
A sudden increase in voltage that lasts only milliseconds describes a:
Surge
Spike
Brownout
Blackout
Overdraw
