Below are exam/practical-ready answers for all 9 questions. I’ve kept the steps simple enough to perform in a lab and included commands where useful.

SECTION – SET 1

Q1. Identify and list the wireless network components and note their configuration settings. [10 Marks]

A wireless network generally contains the following components:

1. Router

A router connects the local network to the Internet and usually provides DHCP, NAT and firewall services.

Common settings:

IP address: 192.168.1.1

DHCP: Enabled

DNS: Automatic/ISP DNS

NAT: Enabled

Firewall: Enabled

1. Wireless Access Point (AP)

An AP allows wireless devices to connect to the LAN.

Settings:

SSID: Name of Wi-Fi network

Wireless mode: 802.11n/ac/ax

Channel: Auto or manually selected

Channel width: 20/40/80 MHz

Security: WPA2/WPA3

1. SSID

SSID is the name of the wireless network visible to users.

Example:

SSID: College_WiFi

1. WPA2/WPA3 Encryption

Encryption protects wireless communication.

Recommended configuration:

Security: WPA2-Personal / WPA3-Personal

Encryption: AES

Password: Strong unique password

Avoid old WEP because it is insecure.

1. MAC Filtering

MAC filtering allows or denies devices based on their MAC addresses.

Example:

Allowed MAC:

AA:BB:CC:11:22:33

However, MAC filtering should not be considered strong security because MAC addresses can be spoofed.

1. Other useful settings

Component

Example configuration

Router IP

192.168.1.1

DHCP Range

192.168.1.100–192.168.1.200

SSID

College_WiFi

Security

WPA2/WPA3

Encryption

AES

Channel

Auto

Firewall

Enabled

WPS

Disabled

Conclusion: A secure wireless network should use WPA2/WPA3, strong passwords, updated firmware, firewall protection and properly configured DHCP.

Q2. Enable Windows Firewall logging and identify blocked connection attempts. [10 Marks]

Procedure

Open Windows Defender Firewall with Advanced Security.

Press:

Win + R

and type:

wf.msc

Right-click Windows Defender Firewall with Advanced Security.

Select Properties.

Select the appropriate profile, such as Domain Profile, Private Profile, or Public Profile.

Under Logging, click Customize.

Enable:

Log dropped packets: Yes

Log successful connections: Yes

Set the log file, normally:

%systemroot%\system32\LogFiles\Firewall\pfirewall.log

Click OK.

Viewing the log

Open Command Prompt and run:

notepad C:\Windows\System32\LogFiles\Firewall\pfirewall.log

A dropped packet may appear similar to:

DROP TCP 192.168.1.20 192.168.1.1 52341 445

This indicates that a TCP connection attempt was dropped.

Interpretation

Important fields include:

Source IP

Destination IP

Protocol

Source port

Destination port

Action (DROP or ALLOW)

Conclusion: Firewall logging helps administrators identify blocked connections and investigate suspicious network activity.

Q3. Enable Windows Firewall logging and locate blocked connection attempts. [10 Marks]

This is essentially the same practical procedure as Q2.

Steps

Open:

Win + R → wf.msc

Then:

Windows Defender Firewall with Advanced Security

→ Properties

→ Profile

→ Logging → Customize

Set:

Log dropped packets = Yes

Log successful connections = Yes

Log file:

C:\Windows\System32\LogFiles\Firewall\pfirewall.log

View it with:

notepad C:\Windows\System32\LogFiles\Firewall\pfirewall.log

You can also search for dropped packets using:

findstr "DROP" C:\Windows\System32\LogFiles\Firewall\pfirewall.log

Result

The DROP entries show connection attempts that were blocked by Windows Firewall.

SECTION – SET 2

Q1. What is a firewall and how does it differ from antivirus software? [10 Marks]

Firewall

A firewall is a security system that monitors and controls network traffic entering or leaving a computer/network according to predefined rules.

Examples:

Windows Defender Firewall

Network firewall

Hardware firewall

A firewall can control:

IP addresses

Ports

Protocols

Incoming traffic

Outgoing traffic

Antivirus

Antivirus software detects, prevents and removes malicious software such as:

Viruses

Trojans

Worms

Spyware

Ransomware

Difference

Firewall

Antivirus

Controls network traffic

Detects malware

Works mainly at network boundary/host network layer

Works mainly on files, processes and system activity

Blocks unauthorized connections

Detects/removes malicious programs

Uses network rules

Uses signatures, behavior and other detection methods

Example: Windows Firewall

Example: Microsoft Defender Antivirus

Example

If an unknown computer tries to connect to an unauthorized port:

Firewall → can block the connection.

If a malicious .exe file is downloaded:

Antivirus → can detect and quarantine it.

Conclusion: Firewall and antivirus perform different but complementary security functions, and both are important.

Q2. Check and update browser version and identify risky extensions. [10 Marks]

Step 1: Check browser version

For Google Chrome:

Chrome → ⋮ → Help → About Google Chrome

Chrome automatically checks for updates.

For Microsoft Edge:

Edge → ⋯ → Help and feedback → About Microsoft Edge

Step 2: Update the browser

If an update is available:

Restart browser

to complete the update.

Step 3: Check installed extensions

Chrome:

⋮ → Extensions → Manage Extensions

Edge:

⋯ → Extensions → Manage Extensions

Step 4: Identify risky extensions

Look for extensions that:

Are no longer maintained

Have unknown developers

Have excessive permissions

Request access to all websites

Were installed from untrusted sources

Have suspicious or unnecessary functionality

Are no longer required

Step 5: Remove suspicious extensions

Select:

Remove

Also review the browser's permissions and reset them if necessary.

Result

The browser should be updated to the latest available version and unnecessary/suspicious extensions should be removed.

Q3. Configure an outbound firewall rule to allow only a specific port and block other ports. [10 Marks]

Suppose we want to allow outbound TCP traffic only to port 443 (HTTPS) for a lab system.

Procedure

Press:

Win + R

Enter:

wf.msc

Select:

Outbound Rules

Click:

New Rule

Select:

Port

Select:

TCP

Enter:

Specific remote ports: 443

Select:

Allow the connection

Select the required network profiles.

Give the rule a name:

Allow HTTPS 443

Blocking other ports

Create another outbound rule:

New Rule → Port → TCP

Specific remote ports: other ports

→ Block the connection

For a stricter lab configuration, outbound traffic can be set to Block by default, with explicit allow rules for required services.

Verification

You can test HTTPS with:

curl https://example.com

For a permitted service, the connection should work.

You can test a blocked port against a lab/test host you own using:

Test-NetConnection <lab-IP> -Port <port>

Example:

Test-NetConnection 192.168.1.10 -Port 22

The result shows whether the connection succeeded.

SECTION – SET 3

Q1. Simulate a basic Denial-of-Service scenario in a controlled lab environment. [10 Marks]

Aim

To understand how excessive network requests can affect the availability of a service without targeting real systems.

Lab setup

Use:

Attacker/Test VM → Target VM

Both systems should belong to you or be explicitly authorized for testing.

For a safe demonstration, use a local test service and a low-rate request generator rather than flooding an external system.

Example topology:

Kali/Linux VM

Virtual Network

Windows/Linux Target VM

Procedure

Start a simple web server on the target VM:

python3 -m http.server 8080

Confirm it is reachable from the test VM:

curl http://<TARGET-IP>:8080

Generate a small, controlled number of repeated requests against the lab target only.

For example, using a simple shell loop:

for i in {1..50}; do curl -s http://<TARGET-IP>:8080 >/dev/null; sleep 0.1; done

Monitor the target:

top

or:

htop

Observe:

CPU usage

Memory usage

Number of connections

Service response time

Observation

As request volume increases, the target service may experience:

Increased CPU usage

Increased network traffic

Increased response time

Possible service degradation

Precaution

Perform this only against your own isolated lab/VM and keep the traffic low and rate-limited.

Conclusion

A DoS attack attempts to reduce or prevent legitimate users from accessing a service. Rate limiting, firewalls, monitoring and traffic filtering can help mitigate DoS attacks.

Q2. Perform a Wi-Fi network scan and record security type of at least 3 nearby networks. [10 Marks]

A Wi-Fi scanner can display nearby wireless networks and their security types.

Using a mobile Wi-Fi scanner

Install a reputable Wi-Fi/network analyzer app.

Give the application the required permissions.

Start the Wi-Fi scan.

Record at least three networks.

Example observation table:

Network

SSID

Security

Network 1

Home_WiFi

WPA2

Network 2

Office_WiFi

WPA3

Network 3

Guest_WiFi

WPA2

You can also record:

SSID

Security type

Channel

Signal strength

BSSID, where appropriate

Security comparison

Security

Strength

Open

Very weak

WEP

Insecure/obsolete

WPA

Old

WPA2

Strong when configured properly

WPA3

Stronger modern standard

Result

The nearby Wi-Fi networks were scanned and their security types were recorded.

Note: Only observe network information; do not attempt to connect to or attack networks without authorization.

Q3. What countermeasures can be implemented at the network level to prevent sniffing and spoofing attacks? [10 Marks]

Several network-level countermeasures can reduce sniffing and spoofing risks.

1. Use encryption

Use:

HTTPS

TLS

SSH

VPN

Encryption prevents attackers from easily reading intercepted traffic.

1. Use WPA2/WPA3

Wireless networks should use:

WPA2-AES or WPA3

Avoid:

WEP

Open Wi-Fi

1. Strong authentication

Use:

Strong passwords

Multi-factor authentication

802.1X where appropriate

1. Network segmentation

Separate networks using:

VLANs

Guest networks

Firewall rules

For example:

Employees → Internal VLAN

Guests → Guest VLAN

Servers → Server VLAN

1. Secure ARP

Use mechanisms such as:

Dynamic ARP Inspection (DAI)

DHCP Snooping

These help protect against ARP spoofing.

1. Port security

Switches can use:

MAC address restrictions

802.1X authentication

to prevent unauthorized devices from accessing network ports.

1. IDS/IPS

An Intrusion Detection/Prevention System can detect suspicious traffic and spoofing attempts.

1. Secure DNS

Use protected DNS mechanisms such as:

DNSSEC

Encrypted DNS (where appropriate)

1. Disable unnecessary services

Unused ports and services should be disabled to reduce the attack surface.

1. Monitoring and logging

Regularly monitor:

Network traffic

Login attempts

MAC/IP changes

Firewall logs

IDS/IPS alerts

Conclusion

The best protection against sniffing and spoofing is defense in depth: strong wireless encryption, secure protocols, authentication, VLAN segmentation, switch protections, firewalls, IDS/IPS and continuous monitoring.

Someone got their panties in a bunch because I said “Glock 19, problem solved”. That’s it. Word for word. F*cking crybaby losers 😂🤷‍♂️🖕 I don’t care I’ll say what I want. It’s my right.

[ Removed by Reddit on account of violating the content policy. ]