91. What is ARP poisoning (ARP spoofing)?
- A method of compressing ARP tables to save memory
- A cyber attack where a malicious actor sends fake ARP replies to link their MAC address to a legitimate IP address
- A technique used to speed up ARP resolution on large networks
- A process of updating outdated ARP cache entries
Answer : B Explanation: ARP poisoning (or ARP spoofing) is a network attack where an attacker sends falsified ARP (Address Resolution Protocol) messages over a local network. This links the attacker’s MAC address with the IP address of a legitimate host, causing traffic intended for that host to be sent to the attacker instead. This enables man-in-the-middle attacks, traffic interception, and denial of service. Dynamic ARP Inspection (DAI) on switches can help prevent this attack.
92. What is network address and how is it different from a host address?
- A network address identifies individual devices; a host address identifies the network
- A network address identifies the entire subnet; a host address identifies a specific device within that subnet
- They are the same thing with different names
- A network address is always 127.0.0.1; a host address is any other IP
Answer : B Explanation: A network address is the first IP address in a subnet and identifies the entire network or subnet — it cannot be assigned to a host. For example, in 192.168.1.0/24, the network address is 192.168.1.0. A host address is any valid IP address within that subnet assigned to a specific device. The last address (192.168.1.255 in this example) is the broadcast address, also not assignable to hosts.
93. What is the function of the ipconfig (or ifconfig) command?
- To test connectivity between two hosts
- To display and manage the IP configuration of a network interface on a device
- To display the route packets take across a network
- To list all connected devices on the network
Answer : B Explanation: ipconfig (Windows) and ifconfig (Linux/Mac) are command-line tools used to display and manage the IP configuration of network interfaces on a device. They show information such as the IP address, subnet mask, default gateway, and MAC address. ipconfig /all provides detailed information including DHCP server and DNS server addresses. ipconfig /release and /renew are used to release and request a new DHCP-assigned IP address.
94. What is the difference between a virus and a worm in network security?
- A virus spreads automatically across networks; a worm requires a host file to spread
- A virus requires a host file or program to attach to; a worm is self-replicating and spreads automatically across networks without needing a host file
- There is no difference — both terms refer to the same type of malware
- A worm only affects wireless networks; a virus only affects wired networks
Answer : B Explanation: A computer virus attaches itself to a legitimate host file or program and spreads when that infected file is executed or shared. A worm is a standalone malware that replicates itself and spreads automatically across networks without needing a host file — often exploiting network vulnerabilities. Worms can cause significant network congestion and damage at scale. The famous WannaCry ransomware (2017) used worm-like behavior to spread across networks.
95. What is phishing in the context of network security?
- A method of testing network speed
- A social engineering attack where attackers impersonate trusted entities to steal sensitive information
- A technique for filtering unwanted network traffic
- A protocol for secure file transfer
Answer : B Explanation: Phishing is a type of social engineering attack where attackers impersonate legitimate organizations (banks, government agencies, popular websites) through emails, fake websites, or messages to trick users into revealing sensitive information such as passwords, credit card numbers, or login credentials. Spear phishing is a targeted version aimed at specific individuals. Best defenses include user education, multi-factor authentication, and email filtering tools.
96. What does the nslookup command do?
- It displays the routing table of a network device
- It queries DNS servers to look up domain name to IP address mappings and troubleshoot DNS issues
- It shows all open network connections on a device
- It tests the speed of a network connection
Answer : B Explanation: The nslookup (Name Server Lookup) command is a network administration tool used to query DNS servers and retrieve domain name-to-IP address mappings (forward lookup) or IP address-to-domain name mappings (reverse lookup). It is commonly used to troubleshoot DNS resolution issues, verify DNS records (A, MX, CNAME, TXT), and identify which DNS server is being used. It is available on Windows, Linux, and macOS.
97. What is the difference between TCP port 80 and port 443?
- Port 80 is for FTP; port 443 is for SMTP
- Port 80 is for unencrypted HTTP web traffic; port 443 is for encrypted HTTPS web traffic
- Port 80 is for outgoing traffic; port 443 is for incoming traffic
- Port 80 is used by servers; port 443 is used by clients only
Answer : B Explanation: Port 80 is the default port for HTTP (HyperText Transfer Protocol), which transmits web traffic in plain text — making it vulnerable to interception. Port 443 is the default port for HTTPS (HTTP Secure), which encrypts web traffic using SSL/TLS. Modern websites use port 443 to ensure secure communication. Browsers automatically display a padlock icon when a site uses HTTPS on port 443. Google also prioritizes HTTPS sites in search rankings.
98. What is a cookie in web networking and what is it used for?
- A type of malware that steals user credentials
- A small piece of data stored by a web browser to remember user preferences, sessions, and tracking information
- A protocol used for secure data transfer between web servers
- A network packet used for testing web server performance
Answer : B Explanation: A cookie is a small text file that a web server sends to a user’s browser, which stores it locally. Cookies are used for session management (keeping users logged in), personalization (storing user preferences), and tracking (monitoring browsing behavior for analytics or advertising). Session cookies are deleted when the browser closes; persistent cookies remain until they expire or are manually deleted. Secure and HttpOnly cookie flags improve security.
99. What is the purpose of the netstat command in networking?
- To display the network speed of an interface
- To display active network connections, listening ports, and network statistics on a device
- To configure the IP address of a network interface
- To test connectivity between two remote hosts
Answer : B Explanation: The netstat (Network Statistics) command displays active TCP/UDP connections, listening ports, routing tables, and network interface statistics on a device. It is a powerful tool for network troubleshooting and security auditing — for example, identifying suspicious open ports or unauthorized connections. The command “netstat -an” shows all active connections and listening ports with numerical addresses. It is available on Windows, Linux, and macOS.
100. What is Quality of Service (QoS) in computer networking?
- A measure of how many users can connect to a network simultaneously
- A set of techniques used to prioritize certain types of network traffic to ensure performance for critical applications
- A standard that defines the maximum speed of a network connection
- A security protocol that encrypts high-priority network traffic
Answer : B Explanation: QoS (Quality of Service) refers to a set of network management techniques used to prioritize certain types of traffic over others to meet specific performance requirements. For example, VoIP and video conferencing traffic can be given higher priority over regular file downloads to prevent choppy calls. QoS is critical in enterprise networks where latency-sensitive applications like video calls, online gaming, and real-time monitoring must share bandwidth with bulk traffic.
