Common network protocols and vulnerabilities in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

Identify the primary purpose of the TCP protocol

Which of the following best describes the main function of the TCP protocol in networking?

A It provides a connection-oriented communication ensuring reliable data transfer

B It assigns IP addresses dynamically to devices on a network

C It encrypts data to secure communication between devices

D It is used for broadcasting messages to all devices on a network

💡 Hint

Think about how TCP manages data packets between sender and receiver.

TCP (Transmission Control Protocol) establishes a connection and ensures data is delivered reliably and in order.

🧠 Conceptual

intermediate

Understanding the vulnerability of the DNS protocol

What is a common vulnerability associated with the DNS protocol that attackers exploit?

A DNS cache poisoning, where false DNS data is inserted to redirect users

B Man-in-the-middle attacks due to encrypted DNS queries

C Buffer overflow caused by oversized DNS packets

D SQL injection through DNS query parameters

💡 Hint

Consider how attackers can manipulate DNS responses to mislead users.

DNS cache poisoning involves inserting fake DNS entries into a resolver's cache, causing users to be redirected to malicious sites.

🔍 Analysis

advanced

Analyzing the impact of a SYN flood attack

What is the primary effect of a SYN flood attack on a network server?

A It exploits software bugs to gain unauthorized access to server files

B It exhausts server resources by initiating many half-open TCP connections, causing denial of service

C It injects malicious code into DNS responses to redirect traffic

D It intercepts and decrypts encrypted traffic between clients and servers

💡 Hint

Think about how TCP connection requests can be abused to overwhelm a server.

SYN flood attacks send many TCP connection requests without completing the handshake, using up server resources and preventing legitimate connections.

❓ Comparison

advanced

Comparing HTTP and HTTPS protocols

Which statement correctly distinguishes HTTPS from HTTP?

A HTTPS does not support cookies, HTTP does

B HTTP uses port 443 by default, HTTPS uses port 80

C HTTPS encrypts data using TLS/SSL, while HTTP sends data in plain text

D HTTP requires authentication, HTTPS does not

💡 Hint

Consider how data security differs between these two protocols.

HTTPS adds encryption with TLS/SSL to secure data transfer, unlike HTTP which sends data unencrypted.

❓ Reasoning

expert

Determining the vulnerability exploited by ARP spoofing

ARP spoofing attacks exploit which fundamental weakness in network protocols?

A The inability of ARP to resolve IPv6 addresses leading to address conflicts

B The encryption flaws in ARP messages that expose data to interception

C The use of static IP addresses that cannot be changed dynamically

D The lack of authentication in the ARP protocol allowing attackers to associate their MAC address with another IP

💡 Hint

Think about how ARP works and what security it lacks.

ARP does not verify the authenticity of replies, so attackers can send fake ARP messages to redirect traffic.

Practice

1. Which protocol is primarily used to securely browse websites by encrypting data between your browser and the server?

easy

A. HTTPS

B. FTP

C. HTTP

D. DNS

Solution

1. Step 1: Understand the purpose of HTTPS

   HTTPS stands for HyperText Transfer Protocol Secure and encrypts data to protect privacy.

2. Step 2: Compare with other protocols

   HTTP is not secure, FTP is for file transfer, and DNS resolves domain names, none encrypt data like HTTPS.

3. Final Answer:

   HTTPS -> Option A

4. Quick Check:

   Secure web browsing = HTTPS [OK]

Hint: Secure web browsing uses HTTPS, not HTTP or FTP [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Thinking FTP encrypts web data
• Assuming DNS secures browsing

2. Which of the following is the correct port number for the FTP protocol by default?

easy

A. 80

B. 21

C. 443

D. 53

Solution

1. Step 1: Recall default FTP port

   FTP (File Transfer Protocol) uses port 21 by default for control commands.

2. Step 2: Identify other ports

   Port 80 is for HTTP, 443 for HTTPS, and 53 for DNS, so they are incorrect for FTP.

3. Final Answer:

   21 -> Option B

4. Quick Check:

   FTP default port = 21 [OK]

Hint: FTP control commands use port 21 by default [OK]

Common Mistakes:

• Choosing port 80 (HTTP) for FTP
• Confusing HTTPS port 443 with FTP
• Selecting DNS port 53

3. Consider this simplified code snippet simulating a DNS query response check:

response = {'status': 'NOERROR', 'data': '1.2.3.4'}
if response['status'] == 'NOERROR':
    print('Valid IP:', response['data'])
else:
    print('Error in DNS response')

What will be printed?

medium

A. Valid IP: 1.2.3.4

B. KeyError

C. Valid IP: NOERROR

D. Error in DNS response

Solution

1. Step 1: Check the condition on response status

   The code checks if response['status'] equals 'NOERROR', which it does.

2. Step 2: Determine the printed output

   Since condition is true, it prints 'Valid IP:' followed by response['data'], which is '1.2.3.4'.

3. Final Answer:

   Valid IP: 1.2.3.4 -> Option A

4. Quick Check:

   response['status'] == 'NOERROR' prints IP [OK]

Hint: Check condition first; if true, print IP from data key [OK]

Common Mistakes:

• Confusing status with data value
• Expecting error when none occurs
• Assuming KeyError without missing keys

4. A network administrator notices that FTP traffic is being intercepted and credentials stolen. Which vulnerability is most likely being exploited?

medium

A. SQL Injection

B. DNS Spoofing

C. Man-in-the-Middle Attack

D. Cross-Site Scripting

Solution

1. Step 1: Identify the nature of the attack

   Intercepting FTP traffic and stealing credentials indicates someone is spying on communication.

2. Step 2: Match with known vulnerabilities

   Man-in-the-Middle (MitM) attacks intercept and alter communication between two parties, fitting this scenario.

3. Final Answer:

   Man-in-the-Middle Attack -> Option C

4. Quick Check:

   Intercepted FTP = Man-in-the-Middle [OK]

Hint: Intercepted communication usually means Man-in-the-Middle attack [OK]

Common Mistakes:

• Confusing with DNS Spoofing
• Thinking SQL Injection affects FTP
• Mixing with Cross-Site Scripting

5. You want to secure a company's email communication. Which protocol should you use to encrypt emails during transmission to prevent eavesdropping?

hard

A. FTP

B. Telnet

C. HTTP

D. SMTP with STARTTLS

Solution

1. Step 1: Identify email transmission protocols

   SMTP is the standard protocol for sending emails, but by default it is unencrypted.

2. Step 2: Choose encryption method for SMTP

   STARTTLS upgrades SMTP to use encryption, protecting emails from eavesdropping during transmission.

3. Step 3: Exclude other protocols

   FTP is for file transfer, HTTP is for web browsing, and Telnet is insecure remote access; none encrypt email.

4. Final Answer:

   SMTP with STARTTLS -> Option D

5. Quick Check:

   Email encryption during send = SMTP + STARTTLS [OK]

Hint: Use SMTP with STARTTLS to encrypt email sending [OK]

Common Mistakes:

• Choosing FTP or HTTP for email
• Ignoring encryption in SMTP
• Selecting Telnet which is insecure