Home AP® Cybersecurity Networking Basics Readiness check AP® Cybersecurity · Unit 3 Primer
Readiness check: are you ready for Unit 3? Ten questions from all three primer sessions, mixed together, about 10 minutes. Answer from memory first. Your result shows each session separately, so you know exactly what to review before Unit 3.
Nothing you answer leaves this browser. To hand in your result, print it or save it as a PDF at the end.
Readiness check · 10 questions
Are you ready for Unit 3? Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
A laptop at 192.168.10.37/24 sends a file to a printer at 192.168.10.80. A minute later, it opens a website at 203.0.113.25. 1 Which device must forward the website traffic but not the printer traffic? background A The switch, because it forwards frames only to other networks B The router, because only the website is on another network C The wireless access point, because the printer uses a cable D The DNS server, because it forwards every packet that leaves
Show answer
Answer: B. The printer is inside 192.168.10.0/24, the same network as the laptop, so the switch delivers that traffic by MAC address and no router is involved. The website at 203.0.113.25 is on another network, so its packets must go through the router. A switch works inside one LAN, and a DNS server only answers name lookups; it does not forward traffic.
Try again An adversary plans a smurf attack. The spoofed ICMP echo requests carry the victim's IP address as their source, and the adversary wants every host on the network 172.16.40.0/24 to reply to the victim. 2 To which destination address does the adversary send the requests? 3.1.A.4 A 172.16.40.0 B 172.16.40.1 C 172.16.40.255 D 172.16.255.255
Show answer
Answer: C. In a /24 network the first three numbers stay fixed and the last number runs from 0 to 255. The last address, 172.16.40.255, is the broadcast address, so a request sent there reaches every host. 172.16.40.0 names the network, 172.16.40.1 is one host (often the default gateway), and 172.16.255.255 would be the broadcast address of a /16 network, not this /24 one.
Try again During a walk-through, a technician finds a small wireless access point plugged into a wall data port behind a classroom cabinet. The school's technology team did not install it. 3 What is this device, and why is it a risk? 3.1.B.6 A A rogue access point: it gives wireless access to the LAN from behind the boundary firewall B An evil twin: it copies the school's SSID so users join it instead of the real network C A rogue access point: it jams the school's Wi-Fi so that no device can connect D An evil twin: it fills the switch's MAC address table so frames go to every port
Show answer
Answer: A. An unauthorized access point plugged into the organization's own network port is a rogue access point. Anyone in range who can join it, possibly even outside the building, reaches the LAN from behind the boundary firewall, which never sees their traffic to devices inside the LAN. How far they get depends on the design (port security, device authentication and internal segmentation can limit it). An evil twin is a separate access point that imitates a network's SSID; jamming and MAC flooding are different attacks.
Try again On an open cafe network, an adversary captures the packets of a student who is logged in to a homework site over HTTPS (hypertext transfer protocol secure). 4 Which information can the adversary read in the captured packets? background A The student's password, because passwords travel in the packet headers B Nothing at all, because HTTPS encrypts the headers along with the payload C The homework text, because HTTPS encrypts only the page with the login D The source and destination IP addresses and ports, because headers stay readable
Show answer
Answer: D. HTTPS encrypts the payload, which holds the password and the page content. The headers must stay readable so that switches and routers can deliver the packets, so anyone who captures them still sees the IP addresses, the ports and the protocol.
Try again ARP table on the default gateway (192.168.10.1) 192.168.10.23 is a teacher's laptop. 192.168.10.44 is a student's laptop. 192.168.10.80 is a printer.
5 Which conclusion does the ARP table best support? 3.1.A.1, 3.5.E.3 A The device at 192.168.10.44 is likely poisoning ARP to receive the laptop's traffic B The printer at 192.168.10.80 is flooding the switch with fake MAC addresses C The gateway's DNS server has been poisoned and now returns a fake address D The table is normal, because every entry in it was learned dynamically
Show answer
Answer: A. Two IP addresses, the teacher's laptop's address and 192.168.10.44, are paired with one MAC address in the gateway's table. That is the CED's warning sign of ARP poisoning: most likely the device at 192.168.10.44 sent falsified ARP packets, so the gateway now delivers traffic meant for the laptop to that device, an on-path attack. It is evidence to investigate, not proof: analysts confirm by finding which switch port uses that MAC address. Dynamic only means the entries were learned from ARP messages, and ARP does not verify those messages.
Try again A cafe's Wi-Fi has no password and no sign-in page. 6 Why does this make it easier for an adversary to attack other customers? 3.1.B.5 A Open networks send no beacon frames, so the adversary cannot be seen B Without a password, the access point becomes a rogue access point C Anyone in range can join and launch attacks from inside the network D Without a password, the router sends every packet to every network
Show answer
Answer: C. A network that does not authenticate devices or users lets anyone within range of the signal join it, and from inside the network the adversary can reach other customers' devices. Open networks still send beacon frames, and a rogue access point is an unauthorized device plugged into an organization's own network, not a missing password.
Try again A visitor plugs a laptop into a wall data port in an empty classroom, and the laptop joins the school LAN. 7 Which control on the network would have most directly stopped this? 3.1.B.3 A Encrypting the payload of every packet with HTTPS B Enabling port security on the switch C Disabling beacon frames on the access points D Adding a second router at the internet boundary
Show answer
Answer: B. The laptop reached the LAN through a switch port. Port security on the switch controls which devices may use each port, so an unknown device would be blocked. HTTPS protects data in transit, beacon frames are a wireless setting, and a router at the internet boundary does nothing about a device already plugged in inside.
Try again Students who type their school portal's name reach a copy of its sign-in page hosted at 198.51.100.7. Students who type the portal's real IP address reach the real portal, which is unchanged. 8 What is the most likely cause? 3.1.A.3 A The portal's web server was replaced by the adversary's copy B The switch's MAC address table is full and broadcasts frames C A smurf attack is flooding the portal with ICMP echo replies D A fake DNS record pairs the portal's name with another address
Show answer
Answer: D. Only the name leads to the fake page, and the real server still answers at its own IP address, so the lookup from name to address is what changed. That is DNS poisoning, and the copied sign-in page is there to harvest credentials. The real web server was not touched, and MAC flooding or a smurf attack would not send users to a different address.
Try again Network settings on a laptop 9 The laptop sends a packet to a server at 203.0.113.50. The frame on the first link carries a destination MAC address. Whose MAC address is it? background A The server at 203.0.113.50 B The switch the laptop is plugged into C The default gateway at 10.20.4.1 D The DNS server at 10.20.4.2
Show answer
Answer: C. The server is on another network, so the laptop hands the packet to its default gateway, the router at 10.20.4.1. The frame on the first link is addressed to the gateway's MAC address, while the packet inside keeps the server's IP address. The router then wraps the packet in a new frame for the next link. A switch forwards frames but is not their destination.
Try again A school disables beacon frame broadcasting on its staff wireless network. 10 Which statement about the result is accurate? 3.2.B.1 A The network is harder to find, but devices that join it still reveal its name B No one outside the building can see or join the network from now on C Traffic on the network is now encrypted, because the SSID is hidden D Staff devices must now connect by cable, because the access point is off
Show answer
Answer: A. Disabling beacon frame broadcasting makes the network harder to find, not invisible. In real equipment the access point usually keeps beaconing with the name left blank, and staff devices that join still send the network's name, so a determined adversary within range can learn it. Hiding the SSID does not encrypt anything, and the access point keeps working.
Try again Reset checkpoint LockInCS · Unit 3 Primer readiness checkName: ____________________ Class: __________ Date:
Your result
Your result appears here once you answer all 10 questions. It counts first tries only. To score it yourself, count your first-try answers that were right for each session:
None wrong or one wrong in a session: you are ready for it. Two or more wrong: redo that session, then take the check again in 2 days.
© LockInCS · https://lockincs.com/ap-cybersecurity/networking-basics/readiness-check/ · Free AP® study notes and practice at lockincs.com