ISC2 CC · ISC2 · Networking and Cloud Security Concepts · Bank updated 2026-11-03
ISC2 CC practice questions: Networking and Cloud Security Concepts
5 free questions from 49 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Networking and Cloud Security Concepts section of our ISC2 CC bank (49 questions on this area, which carries 21.3% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 49 Networking and Cloud Security Concepts questions and the full ISC2 CC bank: $15 one-time.
1/5 · Networking and Cloud Security Concepts
A research lab wants to deploy Class 2 Bluetooth sensors that transmit readings without link encryption. The approval request argues that the risk is low: the sensors' range is about 10 m, and every point within 10 m of them lies inside a badge-controlled area. How should the security reviewer assess this argument?
ASound: past about 10 m a Class 2 signal is too weak to decode
BSound: frequency hopping makes eavesdropping on the link impractical
CFlawed: interception is possible well beyond the designed range
DFlawed: Class 2 radios have a designed range of about 100 m
Answer: C. NIST SP 800-121 Rev. 2, Section 2.1 (Bluetooth Wireless Technology Characteristics), lists Class 2 devices with a designed operating range of up to 10 m in Table 2-1. Footnote 6 of that section states that these are designed operating ranges and that attackers may intercept communications at significantly larger distances with high-gain antennas and high-sensitivity receivers. The same section notes that frequency hopping provides minimal transmission security. Distance from the sensors is therefore not a substitute for protecting the link.
Source: ISC2 CC Exam Outline
2/5 · Networking and Cloud Security Concepts · hard
A stateful inspection firewall protects an internal network. An internal host sends a DNS query over UDP to an external resolver, and the resolver's reply arrives a moment later. UDP has no formal process for opening or closing a connection. How does the firewall handle the reply and the related state entry?
Apasses the reply after a completed TCP three-way handshake and removes the entry at the session close
Bpasses any UDP packet from the resolver's address and keeps the entry until the host restarts
Cpasses the reply after checking TCP sequence numbers and removes the entry once the reply is seen
Dpasses a reply that matches the earlier query's addresses and ports, expiring the entry on a timeout
Answer: D. For connectionless protocols such as UDP, most stateful firewalls track only source and destination IP addresses and ports. A UDP packet must match an entry in the state table to pass, so a DNS response is permitted only when a matching query was seen earlier from an internal source. Because the firewall cannot tell when the exchange has ended, the entry is removed once a preconfigured timeout is reached.
Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), SP80041r1-p14, pp. 14-15
Source: ISC2 CC Exam Outline
3/5 · Networking and Cloud Security Concepts
A branch office reports that IPsec-based VPN sessions to headquarters fail intermittently. The firewall administrator recently enabled a rule that drops every fragmented packet, intended to stop attacks that hide inside fragments. What should the administrator do?
Areplace the blanket drop with a deliberate choice to block, reassemble or pass fragments
Bkeep the blanket drop and treat the VPN failures as a branch client configuration problem
Cpass all fragments without any checking and remove the fragment-related firewall rules
Denable reassembly of every fragment at the firewall with no change to memory sizing
Answer: A. Fragmentation is allowed by TCP/IP, and today fragments often come from VPN encapsulation rather than attacks. Blocking all fragments breaks VPN interoperability, so the choice among block, reassemble and pass must be made deliberately, weighing interoperability against security and firewall resources.
Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), SP80041r1-p13 2.1.1 Packet Filtering, p. 13
Source: ISC2 CC Exam Outline
4/5 · Networking and Cloud Security Concepts · hard
A company's network has one sanctioned Internet entry point protected by a properly configured firewall. During an audit, the team finds that two departments set up their own additional Internet links on an ad hoc basis, without firewalls. What should the company do?
Aapply the same firewall policies at each ingress point of the network
Btreat the main entry firewall as sufficient for the whole network
Cprotect only the segments that hold sensitive data with extra firewalls
Dban address translation on the ad hoc links and leave them unprotected
Answer: A. Where more than one ingress exists, a properly configured firewall must protect each entry point with the same policies. Otherwise malicious traffic normally blocked at the main ingress can enter the network by other means.
Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), SP80041r1-p25 3.1 Network Layouts with Firewalls, p. 25
Source: ISC2 CC Exam Outline
5/5 · Networking and Cloud Security Concepts
A firewall team plans a policy that drops incoming ICMP packets above a certain rate and redirects connections to an inside address to a slower route when connection rates exceed a threshold. What difficulty is associated with such policies?
Athey require an application-proxy gateway to count traffic
Bwanted traffic can be lost, with failures hard to diagnose
Cthey erase state table entries for all UDP sessions
Dthey prevent the firewall from logging the affected traffic
Answer: B. Policies based on traffic rate, such as dropping ICMP above a threshold or redirecting connections to a slower route, are quite difficult to craft because they can discard desired traffic or cause transient failures that are hard to diagnose.
Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), SP80041r1-p34 4.4 Policies Based on Network Activity, p. 34
Source: ISC2 CC Exam Outline
Other ISC2 CC areas
The same kind of free sample for every other section of the ISC2 CC bank:
Practise ISC2 CC with instant feedback
6 free questions in study mode · no card · full ISC2 CC bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start ISC2 CC free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.