Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: What is a 'threat hunting' program in the context of network defense?

Running automated vulnerability scans
Patching known CVEs before exploitation
Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Monitoring social media for threat actor chatter

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 2: Which of the following BEST describes a software-defined perimeter (SDP)?

A VLAN-based segmentation strategy
A physical firewall at the network edge
A cloud load balancer
A dynamic, identity-based access control that hides resources until authenticated (Correct answer)

Correct answer: A dynamic, identity-based access control that hides resources until authenticated

SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.

Question 3: What does 'false positive' mean in the context of an IDS?

An attack that was not detected
An alert with no log entry
A rule that always matches
A legitimate activity that is incorrectly flagged as malicious (Correct answer)

Correct answer: A legitimate activity that is incorrectly flagged as malicious

A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.

Question 4: What is a 'playbook' in the context of incident response?

A documented, step-by-step procedure for responding to a specific type of incident (Correct answer)
A vendor-supplied patch guide
A network diagram
A list of authorized users

Correct answer: A documented, step-by-step procedure for responding to a specific type of incident

A playbook provides predefined, repeatable procedures so responders take consistent, effective action when a specific incident type occurs.

Question 5: What is the primary risk of placing an IDS sensor outside the perimeter firewall?

It cannot detect internal threats
It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)
It requires more storage
It will only see encrypted traffic

Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.

Question 6: Under HIPAA, what category of information must healthcare organizations protect?

Marketing contact lists
Protected Health Information (PHI) that identifies individuals (Correct answer)
All employee email
Financial transaction records

Correct answer: Protected Health Information (PHI) that identifies individuals

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Question 7: Which symmetric encryption algorithm is recommended for IPsec VPN in modern CNDA implementations due to its security and performance?

3DES
AES-256 (Correct answer)
RC4
DES

Correct answer: AES-256

AES-256 provides strong 256-bit encryption with hardware acceleration support and is the NIST-recommended standard for symmetric encryption.

Question 8: A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

SSL/TLS inspection (deep packet inspection) (Correct answer)
URL filtering
NAT overload
Geo-blocking

Correct answer: SSL/TLS inspection (deep packet inspection)

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

Question 9: Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

SSL/TLS VPN
L2TP without IPsec
PPTP
IPsec (Correct answer)

Correct answer: IPsec

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

Question 10: Which security improvement does WPA3 provide over WPA2 that prevents offline dictionary attacks on captured handshakes?

Increased IV length to 128 bits
RC4 stream cipher replacement
Simultaneous Authentication of Equals (SAE) (Correct answer)
Certificate-based client authentication

Correct answer: Simultaneous Authentication of Equals (SAE)

WPA3 uses SAE (Dragonfly handshake) instead of PSK, which provides forward secrecy and prevents attackers from capturing handshakes for offline brute-force.

Question 11: Which VPN deployment concern is addressed by using multi-factor authentication (MFA) at the VPN gateway?

Encryption strength
Certificate renewal
Credential theft or stolen VPN credentials enabling unauthorized access (Correct answer)
Tunnel stability

Correct answer: Credential theft or stolen VPN credentials enabling unauthorized access

MFA requires a second factor beyond username and password, so stolen credentials alone are insufficient to gain VPN access.

Question 12: In a CNDA context, what is 'threat normalization' as it applies to IDS?

Reassembling fragmented or evasion-altered traffic to its true form before inspection (Correct answer)
Normalizing network bandwidth
Converting logs to a standard format
Reducing alert severity ratings

Correct answer: Reassembling fragmented or evasion-altered traffic to its true form before inspection

Threat normalization reconstructs traffic that has been obfuscated through fragmentation or encoding so signatures can match it accurately.

Question 13: In network architecture, what does 'East-West traffic' refer to?

Traffic between the internet and internal servers
Traffic from branch offices to headquarters
Traffic between two different ISPs
Traffic between servers within the same data center or cloud environment (Correct answer)

Correct answer: Traffic between servers within the same data center or cloud environment

East-West traffic is server-to-server communication within a data center, which is the primary path for lateral movement after a breach.

Question 14: What is 'lateral movement' in the context of a network intrusion?

Routing traffic through multiple firewalls
Changing user permissions horizontally
An attacker traversing from the initial foothold to other systems within the network (Correct answer)
Moving files between servers

Correct answer: An attacker traversing from the initial foothold to other systems within the network

Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.

Question 15: What is the purpose of a 'stateful failover' configuration in a firewall cluster?

To load balance new connections
To synchronize firewall rules only
To back up firewall logs
To replicate connection state tables so sessions survive a failover without dropping (Correct answer)

Correct answer: To replicate connection state tables so sessions survive a failover without dropping

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Question 16: An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Blocks the connection automatically
Quarantines the source IP
Resets the attacker's TCP session
Sends an alert to the administrator (Correct answer)

Correct answer: Sends an alert to the administrator

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Question 17: What does 'mean time to detect' (MTTD) measure in a security operations context?

Time to patch a vulnerability after discovery
Time to respond to a detected alert
The average time between an attacker gaining access and the defender detecting the intrusion (Correct answer)
Time to restore systems after an incident

Correct answer: The average time between an attacker gaining access and the defender detecting the intrusion

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

Question 18: Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Risk avoidance
Risk mitigation
Risk acceptance
Risk transference (Correct answer)

Correct answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 19: Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Wireshark or tcpdump (Correct answer)
Nessus
Metasploit
Nmap

Correct answer: Wireshark or tcpdump

Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.

Question 20: Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Flat network
Hub-and-spoke topology
Defense-in-depth segmentation (Correct answer)
Full mesh topology

Correct answer: Defense-in-depth segmentation

Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.

Question 21: Which technique allows a host-based IDS (HIDS) to detect file system tampering?

File integrity monitoring (FIM) using cryptographic hashes (Correct answer)
Protocol analysis
Signature scanning of running processes
Network packet capture

Correct answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 22: What is the primary purpose of a SIEM (Security Information and Event Management) system?

To automatically patch vulnerabilities
To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
To manage user accounts and passwords
To replace firewalls and IDS

Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection

SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.

Question 23: What does 'due diligence' mean in the context of cybersecurity governance?

Running daily vulnerability scans
Documenting all software licenses
Requiring all staff to take phishing training
Researching and understanding risks before implementing security controls and business decisions (Correct answer)

Correct answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

Question 24: Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Default allow policy
Default deny (deny-all) policy (Correct answer)
Stateless filtering
Implicit permit

Correct answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

Question 25: Which protocol is used to provide out-of-band management access to network devices?

Telnet
Console via dedicated OOB network (Correct answer)
HTTP
SNMP

Correct answer: Console via dedicated OOB network

Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.

Question 26: A wireless IDS (WIDS) has flagged a large number of deauthentication frames targeting all clients on an AP. What is the most likely intent of this activity?

Forcing clients to reassociate to capture the 4-way WPA2 handshake (Correct answer)
Testing AP load balancing
RF spectrum analysis
Triggering 802.11r fast BSS transition

Correct answer: Forcing clients to reassociate to capture the 4-way WPA2 handshake

Attackers send spoofed deauthentication frames to disconnect clients, forcing them to reauthenticate so the WPA2 4-way handshake can be captured for offline cracking.

Question 27: Which security governance concept requires that multiple people must collaborate to perform sensitive actions, preventing unilateral misuse?

Two-person integrity (dual control) (Correct answer)
Separation of duties
Least privilege
Need to know

Correct answer: Two-person integrity (dual control)

Two-person integrity (dual control) requires two authorized individuals to be present or act together for sensitive operations, such as accessing cryptographic keys.

Question 28: What is the MITRE ATT&CK framework used for in incident response?

Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs) (Correct answer)
Defining patch management schedules
Scoring vulnerability severity
Auditing firewall rules

Correct answer: Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

Question 29: What is the key advantage of anomaly-based IDS over signature-based IDS?

Simpler rule management
Ability to detect zero-day and previously unknown attacks (Correct answer)
Lower false positive rate
Faster processing speed

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 30: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To document the security controls implemented for a specific information system (Correct answer)
To define employee compensation
To list all known vulnerabilities
To outline the organization's marketing strategy

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 31: Which vulnerability management concept involves knowing exactly what software is running in your environment?

Threat hunting
Asset inventory and Software Bill of Materials (SBOM) (Correct answer)
Penetration testing
Log correlation

Correct answer: Asset inventory and Software Bill of Materials (SBOM)

A complete asset inventory and SBOM is the foundation of vulnerability management — you cannot protect or patch what you don't know you have.

Question 32: A CNDA wants to protect against unauthorized wireless access points. Which control is MOST appropriate?

Increasing WPA2 key complexity
Implementing MAC address filtering
Disabling SSID broadcast
Deploying a wireless intrusion prevention system (WIPS) (Correct answer)

Correct answer: Deploying a wireless intrusion prevention system (WIPS)

A WIPS actively detects and can contain rogue access points that appear on the network.

Question 33: Which type of firewall architecture uses a separate proxy process for each application protocol?

Deep packet inspection engine
Application proxy (circuit-level gateway) (Correct answer)
Packet filter
Stateful firewall

Correct answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 34: What cryptographic property ensures that a sender cannot deny having sent a message?

Availability
Non-repudiation (Correct answer)
Integrity
Confidentiality

Correct answer: Non-repudiation

Non-repudiation, achieved through digital signatures, provides proof of origin that the sender cannot later deny.

Question 35: A firewall rule set should follow which ordering principle for efficiency and security?

Most permissive rules first
Deny-all at the top, allow rules at the bottom
Most specific rules first, with a deny-all at the bottom (Correct answer)
Rules in alphabetical order

Correct answer: Most specific rules first, with a deny-all at the bottom

Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.

Question 36: Which network topology provides the highest redundancy but is also the most expensive to implement?

Ring topology
Star topology
Full mesh topology (Correct answer)
Bus topology

Correct answer: Full mesh topology

A full mesh topology connects every node to every other node, eliminating single points of failure but requiring the most links.

Question 37: Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?

CEF (Common Event Format)
STIX (Structured Threat Information eXpression) (Correct answer)
LEEF (Log Event Extended Format)
NetFlow

Correct answer: STIX (Structured Threat Information eXpression)

STIX is an open standard for representing CTI, including threat actors, malware, attack patterns, and IoCs in a structured format.

Question 38: What does CVSS (Common Vulnerability Scoring System) measure?

The severity and characteristics of a software vulnerability on a 0-10 scale (Correct answer)
The number of systems affected by a vulnerability
The cost to remediate a vulnerability
The time required to exploit a vulnerability

Correct answer: The severity and characteristics of a software vulnerability on a 0-10 scale

CVSS scores vulnerabilities 0-10 based on attack vector, complexity, privileges required, user interaction, and impact metrics.

Question 39: Why is hiding the SSID considered an insufficient security control for wireless networks?

Hidden SSIDs disable WPA2 authentication
Clients actively probe for hidden SSIDs, revealing them in probe request frames (Correct answer)
SSID hiding is not supported on 5 GHz bands
Hidden SSIDs still appear in beacon frames at full power

Correct answer: Clients actively probe for hidden SSIDs, revealing them in probe request frames

Devices configured for a hidden SSID broadcast probe request frames containing the SSID name, making it trivially discoverable with passive sniffing tools.

Question 40: Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Drive-by download
Advanced Persistent Threat (APT) (Correct answer)
Opportunistic breach
Script kiddie attack

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 41: What does 'threat modeling' help a CNDA accomplish during the design phase of a new system?

Define SLA metrics
Document user requirements
Identify potential threats, attack vectors, and necessary security controls before the system is built (Correct answer)
Calculate the total cost of ownership

Correct answer: Identify potential threats, attack vectors, and necessary security controls before the system is built

Threat modeling during design is far cheaper than retrofitting security — it identifies what could go wrong and informs security requirements before code is written.

Question 42: A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Block all traffic from Tokyo
Ignore it as a false positive
Disable the account temporarily and contact the user to verify legitimacy (Correct answer)
Delete the user account immediately

Correct answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Question 43: Which regulation requires US public companies to maintain adequate internal controls over financial reporting and cybersecurity disclosures?

CCPA
SOX (Sarbanes-Oxley Act) (Correct answer)
FERPA
GLBA

Correct answer: SOX (Sarbanes-Oxley Act)

SOX Section 404 requires management and auditors to assess internal controls, and the SEC now requires timely cybersecurity incident disclosure.

Question 44: A CNDA is evaluating VPN protocols. Which modern protocol is known for minimal codebase, high performance, and use of state-of-the-art cryptography?

OpenVPN
WireGuard (Correct answer)
PPTP
IPsec IKEv1

Correct answer: WireGuard

WireGuard uses a ~4,000-line codebase, ChaCha20/Poly1305 encryption, and Curve25519 key exchange, offering simplicity and high performance.

Question 45: Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?

CVE identifier
CIS benchmark control
Indicator of Compromise (IoC) such as a malicious IP or domain (Correct answer)
CVSS score

Correct answer: Indicator of Compromise (IoC) such as a malicious IP or domain

IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.

Question 46: In a third-party risk management program, what document formally defines the security obligations of a vendor?

SLA (Service Level Agreement)
SOW (Statement of Work)
NDA (Non-disclosure agreement)
BAA (Business Associate Agreement) or security addendum (Correct answer)

Correct answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Question 47: Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

PCI-DSS (Correct answer)
ISO 27001
NIST CSF
HIPAA

Correct answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

Question 48: What is the purpose of a honeypot in a network defense architecture?

To load balance web servers
To lure and study attacker behavior in a controlled environment (Correct answer)
To speed up legitimate network traffic
To encrypt sensitive data in transit

Correct answer: To lure and study attacker behavior in a controlled environment

A honeypot is a decoy system that attracts attackers, allowing defenders to observe techniques without risk to production assets.

Question 49: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Identify, Protect, Detect, Respond
Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
Triage, Escalation, Resolution, Review
Alert, Investigate, Patch, Close

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 50: What is the primary purpose of vulnerability scanning in a CNDA security program?

To monitor network traffic for intrusions
To exploit vulnerabilities in a controlled manner
To identify and prioritize known weaknesses in systems before attackers can exploit them (Correct answer)
To inventory software licenses

Correct answer: To identify and prioritize known weaknesses in systems before attackers can exploit them

Vulnerability scanning discovers known weaknesses, misconfigurations, and missing patches so organizations can remediate the highest risks first.

Question 51: What is a bug bounty program in the context of vulnerability management?

A government grant for cybersecurity research
A tool that automatically discovers and reports bugs
A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment (Correct answer)
An internal reward for security team members who find bugs

Correct answer: A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment

Bug bounty programs create a structured channel for external security researchers to report vulnerabilities responsibly before malicious actors find them.

Question 52: A CNDA uses the STRIDE model. What does the 'T' stand for and what type of attack does it represent?

Targeting — selecting victims for attacks
Transmission — intercepting data in transit
Tampering — unauthorized modification of data or systems (Correct answer)
Tracking — monitoring user activity

Correct answer: Tampering — unauthorized modification of data or systems

In STRIDE, Tampering represents integrity threats — unauthorized modification of data, configuration, or code.

Question 53: An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

Content filtering
SYN proxy or SYN cookies (Correct answer)
Application inspection
URL filtering

Correct answer: SYN proxy or SYN cookies

A SYN proxy intercepts TCP handshakes and only forwards complete connections to the server, protecting against SYN flood attacks.

Question 54: What is the role of a network access control (NAC) system in security architecture?

To enforce security posture checks before granting network access (Correct answer)
To assign IP addresses to devices
To monitor bandwidth utilization
To manage DNS records

Correct answer: To enforce security posture checks before granting network access

NAC validates device compliance (patch level, AV status, certificates) before allowing it onto the network.

Question 55: Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Using APIPA addresses
Using public IPs on all internal servers
IPv6 link-local addresses
RFC 1918 private addressing with NAT (Correct answer)

Correct answer: RFC 1918 private addressing with NAT

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

Question 56: Which vulnerability management metric tracks the average time from a patch being available to it being deployed?

MTTD
Mean Time to Patch (MTTP) or patch cadence (Correct answer)
CVSS score
Threat exposure window

Correct answer: Mean Time to Patch (MTTP) or patch cadence

Mean Time to Patch measures the speed of an organization's patching program, with shorter times reducing the exposure window for known vulnerabilities.

Question 57: Which IR containment strategy involves blocking a malicious domain at the DNS level to prevent malware from communicating with C2?

ARP poisoning
BGP blackholing
Firewall null routing
DNS sinkholing (Correct answer)

Correct answer: DNS sinkholing

DNS sinkholing redirects queries for malicious domains to a controlled server, severing C2 communication while identifying infected hosts.

Question 58: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

DNS resolution activity
A misconfigured DHCP client
Normal NTP synchronization
A command-and-control (C2) connection from malware (Correct answer)

Correct answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Question 59: Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

SHA-256
MD5 (Correct answer)
SHA-3
SHA-512

Correct answer: MD5

MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.

Question 60: Which protocol should be disabled on managed switches to prevent VLAN hopping attacks?

LLDP
OSPF
STP
DTP (Dynamic Trunking Protocol) (Correct answer)

Correct answer: DTP (Dynamic Trunking Protocol)

Disabling DTP prevents an attacker from negotiating a trunk port and gaining access to multiple VLANs.

Question 61: Which firewall type inspects the full context of a TCP session rather than individual packets?

Proxy firewall
Next-generation firewall
Packet filter firewall
Stateful inspection firewall (Correct answer)

Correct answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Question 62: What is the difference between a CVE and a CWE?

CVE scores severity; CWE tracks patches
CVE is for networks; CWE is for applications
CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
They are identical naming conventions

Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Question 63: An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

A vulnerability scan report
An audit finding
A penetration test report
An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official (Correct answer)

Correct answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Question 64: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To complete regulatory reporting
To calculate the financial cost of the breach
To assign blame for the incident
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 65: Which IPS deployment mode allows it to actively block malicious traffic inline?

Passive (promiscuous) mode
Port mirroring mode
Out-of-band mode
Inline mode between network segments (Correct answer)

Correct answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 66: What does the Diffie-Hellman algorithm accomplish in a VPN key exchange?

It signs the VPN certificate
It compresses tunnel traffic
It allows two parties to establish a shared secret over an untrusted channel without prior shared information (Correct answer)
It encrypts the VPN payload

Correct answer: It allows two parties to establish a shared secret over an untrusted channel without prior shared information

Diffie-Hellman enables two parties to derive the same shared secret using public values exchanged over an insecure channel.

Question 67: Which design principle ensures that a compromised single component does not grant full network access?

Network address translation
DHCP snooping
Single sign-on
Principle of least privilege combined with segmentation (Correct answer)

Correct answer: Principle of least privilege combined with segmentation

Least privilege limits what each component can access, and segmentation enforces those limits at the network level.

Question 68: A CNDA is performing a Business Impact Analysis (BIA). What are the two primary metrics gathered for each critical system?

CVSS score and patch count
RTO (Recovery Time Objective) and RPO (Recovery Point Objective) (Correct answer)
Number of users and storage capacity
Uptime percentage and bandwidth usage

Correct answer: RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO defines how quickly a system must be restored after failure, while RPO defines the maximum acceptable data loss measured in time.

Question 69: What is the purpose of a Plan of Action and Milestones (POA&M)?

To schedule employee performance reviews
To define the network topology
To outline the incident response team structure
To document known security weaknesses, remediation plans, and timelines for correction (Correct answer)

Correct answer: To document known security weaknesses, remediation plans, and timelines for correction

A POA&M is a management tool that tracks security deficiencies, assigns responsibility, and establishes milestones for remediation.

Question 70: Which fundamental cryptographic weakness made WEP completely broken and unsuitable for use?

Short 24-bit Initialization Vector reuse with RC4 (Correct answer)
Use of SHA-1 for integrity checking
Absence of certificate-based mutual authentication
Lack of a 4-way handshake

Correct answer: Short 24-bit Initialization Vector reuse with RC4

WEP's 24-bit IV space is small enough to force IV reuse within minutes on a busy network, allowing attackers to recover the key using statistical attacks on RC4 keystreams.

Question 71: In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

A firewall rule priority formula
A patch priority formula
A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact (Correct answer)
A compliance scoring model

Correct answer: A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Question 72: What is a 'security control baseline' as used in NIST SP 800-53?

A list of denied network addresses
The minimum acceptable patch level for servers
The default firewall rule set
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 73: What is a threat feed and how is it used in network defense?

A log aggregation service
A continuously updated list of IoCs that is integrated into security tools to block or detect known threats (Correct answer)
A news service about cybersecurity incidents
A management dashboard for security teams

Correct answer: A continuously updated list of IoCs that is integrated into security tools to block or detect known threats

Threat feeds provide real-time IoCs (IPs, domains, hashes) that are ingested by firewalls, SIEM, and IDS to automate detection of known bad actors.

Question 74: What is a 'split tunnel' VPN configuration?

A VPN that splits encryption between two algorithms
A redundant VPN with automatic failover
A VPN with two simultaneous connections to different servers
A configuration where only traffic destined for corporate resources goes through the VPN (Correct answer)

Correct answer: A configuration where only traffic destined for corporate resources goes through the VPN

Split tunneling routes corporate-bound traffic through the encrypted VPN while internet traffic goes directly to the ISP, reducing VPN load.

Question 75: Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Signature-based detection (Correct answer)
Heuristic detection
Behavioral analysis
Anomaly-based detection

Correct answer: Signature-based detection

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

Question 76: What is the primary difference between a vulnerability assessment and a penetration test?

Pen tests are automated; vulnerability assessments are manual
They are identical in scope and methodology
A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact (Correct answer)
Vulnerability assessments are only run on web apps; pen tests cover networks

Correct answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 77: A network architect wants to prevent lateral movement after a breach. Which technique is MOST effective?

Installing antivirus on all hosts
Using longer passwords
Increasing firewall log retention
Implementing micro-segmentation with strict ACLs (Correct answer)

Correct answer: Implementing micro-segmentation with strict ACLs

Micro-segmentation restricts east-west traffic so an attacker who compromises one host cannot freely move to adjacent systems.

Question 78: What is the purpose of a Certificate Revocation List (CRL) in a VPN PKI deployment?

To list all trusted root CAs
To assign IP addresses to VPN clients
To store private keys securely
To identify certificates that have been revoked before their expiration date (Correct answer)

Correct answer: To identify certificates that have been revoked before their expiration date

A CRL allows VPN gateways to check whether a client or server certificate has been revoked due to compromise or policy change.

Question 79: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

NGFW only filters at Layer 3
NGFW cannot perform NAT
NGFW uses only signature-based detection
NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)

Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 80: During a forensic investigation, which principle ensures the integrity of digital evidence?

Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
Storing evidence on a shared network drive
Using the original media for all analysis
Deleting unnecessary files before imaging

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 81: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Fragmentation attack (Correct answer)
Replay attack
SQL injection
Man-in-the-middle attack

Correct answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.

Question 82: What US federal law requires federal agencies to implement a risk management framework for information security?

SOX
HIPAA
FISMA (Federal Information Security Modernization Act) (Correct answer)
PCI-DSS

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

Question 83: What firewall feature prevents internal hosts from using unauthorized DNS servers?

DNSSEC validation
DNS proxy or DNS inspection policy (Correct answer)
Split DNS
DNS sinkholing

Correct answer: DNS proxy or DNS inspection policy

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

Question 84: Which OSINT technique involves gathering information about an organization's internet-facing assets without active scanning?

Passive reconnaissance using tools like Shodan, DNS records, and certificate transparency logs (Correct answer)
Port scanning
Active directory enumeration
Phishing simulation

Correct answer: Passive reconnaissance using tools like Shodan, DNS records, and certificate transparency logs

Passive OSINT collects publicly available information without touching target systems, leaving no footprint and providing an attacker's-eye view of the attack surface.

Question 85: Which log source is MOST valuable for detecting privilege escalation on a Windows system?

DNS query logs
Network flow data
Web server access logs
Windows Security Event Log (Event ID 4672 - Special Privileges Assigned) (Correct answer)

Correct answer: Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

Question 86: Which VPN technology is most commonly used to provide clientless remote access through a web browser?

IPsec tunnel mode
MPLS VPN
L2TP
SSL/TLS VPN (clientless portal) (Correct answer)

Correct answer: SSL/TLS VPN (clientless portal)

SSL/TLS VPNs can provide web-based access to applications without requiring a dedicated VPN client to be installed.

Question 87: Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

RSA 1024
DH Group 1
Static key exchange
ECDH (Elliptic Curve Diffie-Hellman) (Correct answer)

Correct answer: ECDH (Elliptic Curve Diffie-Hellman)

ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.

Question 88: What is an attack surface reduction strategy that a CNDA would implement to minimize vulnerability exposure?

Using only cloud-hosted services
Maximizing the number of administrative accounts
Disabling unnecessary services, ports, and protocols across all systems (Correct answer)
Enabling all available services and ports for maximum functionality

Correct answer: Disabling unnecessary services, ports, and protocols across all systems

Reducing the attack surface by disabling unneeded services, ports, and protocols means fewer potential entry points for attackers.

Question 89: What is the primary purpose of a network baseline in security architecture?

To configure default gateway settings
To document all IP addresses
To establish normal behavior for anomaly detection (Correct answer)
To define maximum allowed bandwidth

Correct answer: To establish normal behavior for anomaly detection

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Question 90: What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

To encrypt the data payload
To negotiate and establish the Security Associations (SAs) and exchange keys (Correct answer)
To compress VPN traffic
To authenticate web certificates

Correct answer: To negotiate and establish the Security Associations (SAs) and exchange keys

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Question 91: Which of the following BEST describes quantitative risk analysis?

Categorizing risks as High, Medium, or Low
Assigning numerical monetary values to risk using metrics like ALE and SLE (Correct answer)
Using a heat map to visualize risk
Conducting stakeholder interviews

Correct answer: Assigning numerical monetary values to risk using metrics like ALE and SLE

Quantitative risk analysis uses formulas like ALE (Annual Loss Expectancy) = SLE × ARO to express risk in financial terms.

Question 92: In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Select, Implement, Assess
Categorize, Select, Implement
Assess, Select, Implement
Prepare, Categorize, Select (Correct answer)

Correct answer: Prepare, Categorize, Select

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Question 93: A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?

When dynamic routing protocols are needed
When VPN termination is required on the firewall
When NAT is required for all internal hosts
When IP re-addressing of existing segments is impractical (Correct answer)

Correct answer: When IP re-addressing of existing segments is impractical

A transparent firewall operates at Layer 2 and can be inserted into an existing network without changing IP addressing.

Question 94: During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Isolate the system on a quarantine network while capturing memory and disk images (Correct answer)
Delete all logs to prevent attacker access
Reinstall the OS immediately
Immediately power off the affected system

Correct answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

Question 95: During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Filing an insurance claim
Notifying all users of the incident
Updating the asset inventory
Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)

Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

Question 96: A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?

Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key (Correct answer)
IKEv1 cannot establish tunnels
Aggressive mode uses stronger encryption
Aggressive mode requires digital certificates

Correct answer: Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key

IKEv1 aggressive mode sends the peer's identity hash in cleartext, allowing an attacker to capture it and crack the pre-shared key offline.

Question 97: A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Internal → DMZ → Internet without firewall
Internet → DMZ → Internal without inspection
Internet → Firewall → DMZ → Firewall → Internal (Correct answer)
DMZ servers have unrestricted access to internal LAN

Correct answer: Internet → Firewall → DMZ → Firewall → Internal

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

Question 98: In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

AH (Authentication Header) (Correct answer)
IKEv2
GRE
ESP (Encapsulating Security Payload)

Correct answer: AH (Authentication Header)

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

Question 99: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

CIS Controls
ISO 27001
NIST Cybersecurity Framework (CSF) (Correct answer)
NIST SP 800-53

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 100: Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Patch deferral
Risk-based patch prioritization (Correct answer)
Universal patching
Compensating controls only

Correct answer: Risk-based patch prioritization

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Test delivery, eligibility, fees, renewal, score validity · verified Oct 2026