Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: What is the primary purpose of a SIEM (Security Information and Event Management) system?

To manage user accounts and passwords
To replace firewalls and IDS
To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
To automatically patch vulnerabilities

Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection

SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.

Question 2: Which network topology provides the highest redundancy but is also the most expensive to implement?

Star topology
Full mesh topology (Correct answer)
Bus topology
Ring topology

Correct answer: Full mesh topology

A full mesh topology connects every node to every other node, eliminating single points of failure but requiring the most links.

Question 3: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To outline the organization's marketing strategy
To list all known vulnerabilities
To define employee compensation
To document the security controls implemented for a specific information system (Correct answer)

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 4: What does the Diffie-Hellman algorithm accomplish in a VPN key exchange?

It encrypts the VPN payload
It compresses tunnel traffic
It allows two parties to establish a shared secret over an untrusted channel without prior shared information (Correct answer)
It signs the VPN certificate

Correct answer: It allows two parties to establish a shared secret over an untrusted channel without prior shared information

Diffie-Hellman enables two parties to derive the same shared secret using public values exchanged over an insecure channel.

Question 5: What is 'lateral movement' in the context of a network intrusion?

An attacker traversing from the initial foothold to other systems within the network (Correct answer)
Changing user permissions horizontally
Moving files between servers
Routing traffic through multiple firewalls

Correct answer: An attacker traversing from the initial foothold to other systems within the network

Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.

Question 6: A CNDA is evaluating VPN protocols. Which modern protocol is known for minimal codebase, high performance, and use of state-of-the-art cryptography?

PPTP
IPsec IKEv1
OpenVPN
WireGuard (Correct answer)

Correct answer: WireGuard

WireGuard uses a ~4,000-line codebase, ChaCha20/Poly1305 encryption, and Curve25519 key exchange, offering simplicity and high performance.

Question 7: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

NGFW cannot perform NAT
NGFW only filters at Layer 3
NGFW uses only signature-based detection
NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)

Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 8: A wireless IDS (WIDS) has flagged a large number of deauthentication frames targeting all clients on an AP. What is the most likely intent of this activity?

Testing AP load balancing
Triggering 802.11r fast BSS transition
Forcing clients to reassociate to capture the 4-way WPA2 handshake (Correct answer)
RF spectrum analysis

Correct answer: Forcing clients to reassociate to capture the 4-way WPA2 handshake

Attackers send spoofed deauthentication frames to disconnect clients, forcing them to reauthenticate so the WPA2 4-way handshake can be captured for offline cracking.

Question 9: Which of the following BEST describes a software-defined perimeter (SDP)?

A physical firewall at the network edge
A dynamic, identity-based access control that hides resources until authenticated (Correct answer)
A cloud load balancer
A VLAN-based segmentation strategy

Correct answer: A dynamic, identity-based access control that hides resources until authenticated

SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.

Question 10: What is the primary difference between a vulnerability assessment and a penetration test?

Pen tests are automated; vulnerability assessments are manual
Vulnerability assessments are only run on web apps; pen tests cover networks
A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact (Correct answer)
They are identical in scope and methodology

Correct answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 11: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To complete regulatory reporting
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
To calculate the financial cost of the breach
To assign blame for the incident

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 12: Which log source is MOST valuable for detecting privilege escalation on a Windows system?

Web server access logs
DNS query logs
Network flow data
Windows Security Event Log (Event ID 4672 - Special Privileges Assigned) (Correct answer)

Correct answer: Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

Question 13: An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Blocks the connection automatically
Resets the attacker's TCP session
Sends an alert to the administrator (Correct answer)
Quarantines the source IP

Correct answer: Sends an alert to the administrator

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Question 14: Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Using APIPA addresses
RFC 1918 private addressing with NAT (Correct answer)
Using public IPs on all internal servers
IPv6 link-local addresses

Correct answer: RFC 1918 private addressing with NAT

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

Question 15: Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

DH Group 1
ECDH (Elliptic Curve Diffie-Hellman) (Correct answer)
Static key exchange
RSA 1024

Correct answer: ECDH (Elliptic Curve Diffie-Hellman)

ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.

Question 16: A penetration tester uses a wireless adapter in monitor mode to capture 802.11 frames without associating to any AP. This technique is called what?

Passive sniffing (Correct answer)
Active scanning
Promiscuous mode capture
SSID enumeration

Correct answer: Passive sniffing

Passive sniffing (monitor mode) captures all 802.11 frames in range without transmitting, making it undetectable to standard WIDS that look for association attempts.

Question 17: What is the key advantage of anomaly-based IDS over signature-based IDS?

Simpler rule management
Faster processing speed
Ability to detect zero-day and previously unknown attacks (Correct answer)
Lower false positive rate

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 18: What is the MITRE ATT&CK framework used for in incident response?

Auditing firewall rules
Defining patch management schedules
Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs) (Correct answer)
Scoring vulnerability severity

Correct answer: Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

Question 19: What is a 'security control baseline' as used in NIST SP 800-53?

The minimum acceptable patch level for servers
The default firewall rule set
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)
A list of denied network addresses

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 20: What does 'threat modeling' help a CNDA accomplish during the design phase of a new system?

Define SLA metrics
Identify potential threats, attack vectors, and necessary security controls before the system is built (Correct answer)
Document user requirements
Calculate the total cost of ownership

Correct answer: Identify potential threats, attack vectors, and necessary security controls before the system is built

Threat modeling during design is far cheaper than retrofitting security — it identifies what could go wrong and informs security requirements before code is written.

Question 21: Which VPN deployment concern is addressed by using multi-factor authentication (MFA) at the VPN gateway?

Certificate renewal
Tunnel stability
Encryption strength
Credential theft or stolen VPN credentials enabling unauthorized access (Correct answer)

Correct answer: Credential theft or stolen VPN credentials enabling unauthorized access

MFA requires a second factor beyond username and password, so stolen credentials alone are insufficient to gain VPN access.

Question 22: Which firewall type inspects the full context of a TCP session rather than individual packets?

Packet filter firewall
Stateful inspection firewall (Correct answer)
Next-generation firewall
Proxy firewall

Correct answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Question 23: Which Bluetooth security mode requires both devices to authenticate and encrypt all communications, making it the most secure pairing option?

Security Mode 4 (SSP — Secure Simple Pairing) (Correct answer)
Security Mode 2 (Service-Level Enforced)
Security Mode 3 (Link-Level Enforced)
Security Mode 1 (Non-Secure)

Correct answer: Security Mode 4 (SSP — Secure Simple Pairing)

Bluetooth Security Mode 4 (Secure Simple Pairing) uses ECDH key exchange for mutual authentication and mandatory encryption, providing the strongest protection against eavesdropping.

Question 24: What does 'due diligence' mean in the context of cybersecurity governance?

Documenting all software licenses
Running daily vulnerability scans
Researching and understanding risks before implementing security controls and business decisions (Correct answer)
Requiring all staff to take phishing training

Correct answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

Question 25: Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Risk acceptance
Risk transference (Correct answer)
Risk avoidance
Risk mitigation

Correct answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 26: An organization is deploying wireless in a high-security environment. Which 802.11 amendment introduced the robust security network (RSN) framework that WPA2 is based on?

802.11a
802.11n
802.11w
802.11i (Correct answer)

Correct answer: 802.11i

IEEE 802.11i introduced the Robust Security Network (RSN) framework, defining CCMP/AES encryption and the 4-way handshake that became the foundation of WPA2.

Question 27: Which tool is used to passively monitor for new CVEs and vendor advisories relevant to an organization's software inventory?

A vulnerability intelligence feed or Software Composition Analysis (SCA) tool (Correct answer)
Splunk SIEM
Nmap
Metasploit

Correct answer: A vulnerability intelligence feed or Software Composition Analysis (SCA) tool

SCA tools and CVE intelligence feeds continuously monitor software components against vulnerability databases and notify when a new CVE affects installed software.

Question 28: What does 'mean time to detect' (MTTD) measure in a security operations context?

Time to restore systems after an incident
Time to patch a vulnerability after discovery
The average time between an attacker gaining access and the defender detecting the intrusion (Correct answer)
Time to respond to a detected alert

Correct answer: The average time between an attacker gaining access and the defender detecting the intrusion

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

Question 29: Which type of firewall architecture uses a separate proxy process for each application protocol?

Packet filter
Application proxy (circuit-level gateway) (Correct answer)
Deep packet inspection engine
Stateful firewall

Correct answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 30: What is the purpose of a 'stateful failover' configuration in a firewall cluster?

To load balance new connections
To back up firewall logs
To synchronize firewall rules only
To replicate connection state tables so sessions survive a failover without dropping (Correct answer)

Correct answer: To replicate connection state tables so sessions survive a failover without dropping

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Question 31: Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Heuristic detection
Behavioral analysis
Signature-based detection (Correct answer)
Anomaly-based detection

Correct answer: Signature-based detection

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

Question 32: In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Prepare, Categorize, Select (Correct answer)
Assess, Select, Implement
Select, Implement, Assess
Categorize, Select, Implement

Correct answer: Prepare, Categorize, Select

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Question 33: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

Normal NTP synchronization
A command-and-control (C2) connection from malware (Correct answer)
DNS resolution activity
A misconfigured DHCP client

Correct answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Question 34: What is the role of a network access control (NAC) system in security architecture?

To assign IP addresses to devices
To monitor bandwidth utilization
To enforce security posture checks before granting network access (Correct answer)
To manage DNS records

Correct answer: To enforce security posture checks before granting network access

NAC validates device compliance (patch level, AV status, certificates) before allowing it onto the network.

Question 35: Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?

CIS benchmark control
CVE identifier
Indicator of Compromise (IoC) such as a malicious IP or domain (Correct answer)
CVSS score

Correct answer: Indicator of Compromise (IoC) such as a malicious IP or domain

IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.

Question 36: In a zero-trust architecture, what is the guiding principle for granting network access?

Grant access based on IP address
Trust all internal users by default
Never trust, always verify regardless of location (Correct answer)
Perimeter security is sufficient

Correct answer: Never trust, always verify regardless of location

Zero trust requires continuous verification of identity and device posture before granting access to any resource, internal or external.

Question 37: What is the difference between a CVE and a CWE?

CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
CVE is for networks; CWE is for applications
They are identical naming conventions
CVE scores severity; CWE tracks patches

Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Question 38: Which protocol replaces PPTP and provides stronger security when combined with IPsec?

OpenVPN
L2TP/IPsec (Correct answer)
GRE
WireGuard

Correct answer: L2TP/IPsec

L2TP provides tunneling while IPsec adds encryption and authentication, making L2TP/IPsec a more secure replacement for PPTP.

Question 39: What is a zero-day vulnerability?

A vulnerability in zero-trust architecture
A vulnerability that has been public for zero days before patching
A vulnerability with a CVSS score of zero
A vulnerability unknown to the vendor for which no patch exists (Correct answer)

Correct answer: A vulnerability unknown to the vendor for which no patch exists

A zero-day is a previously unknown vulnerability that the vendor has had zero days to patch, making it especially dangerous since no fix exists.

Question 40: What is a 'playbook' in the context of incident response?

A list of authorized users
A vendor-supplied patch guide
A documented, step-by-step procedure for responding to a specific type of incident (Correct answer)
A network diagram

Correct answer: A documented, step-by-step procedure for responding to a specific type of incident

A playbook provides predefined, repeatable procedures so responders take consistent, effective action when a specific incident type occurs.

Question 41: Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Implicit permit
Default deny (deny-all) policy (Correct answer)
Default allow policy
Stateless filtering

Correct answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

Question 42: The KRACK (Key Reinstallation Attack) vulnerability targeted which phase of the WPA2 protocol?

The 4-way handshake nonce and key reinstallation (Correct answer)
RADIUS server CHAP authentication
TKIP MIC (Michael) integrity check
EAP-TLS certificate exchange

Correct answer: The 4-way handshake nonce and key reinstallation

KRACK manipulates the 4-way handshake to force nonce reuse by replaying handshake messages, allowing attackers to decrypt, replay, or forge frames.

Question 43: Which security governance concept requires that multiple people must collaborate to perform sensitive actions, preventing unilateral misuse?

Need to know
Two-person integrity (dual control) (Correct answer)
Separation of duties
Least privilege

Correct answer: Two-person integrity (dual control)

Two-person integrity (dual control) requires two authorized individuals to be present or act together for sensitive operations, such as accessing cryptographic keys.

Question 44: What US federal law requires federal agencies to implement a risk management framework for information security?

FISMA (Federal Information Security Modernization Act) (Correct answer)
HIPAA
PCI-DSS
SOX

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

Question 45: In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

A compliance scoring model
A firewall rule priority formula
A patch priority formula
A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact (Correct answer)

Correct answer: A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Question 46: Which IPS deployment mode allows it to actively block malicious traffic inline?

Out-of-band mode
Passive (promiscuous) mode
Port mirroring mode
Inline mode between network segments (Correct answer)

Correct answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 47: Which technique allows a host-based IDS (HIDS) to detect file system tampering?

File integrity monitoring (FIM) using cryptographic hashes (Correct answer)
Network packet capture
Protocol analysis
Signature scanning of running processes

Correct answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 48: Which vulnerability management concept involves knowing exactly what software is running in your environment?

Log correlation
Threat hunting
Asset inventory and Software Bill of Materials (SBOM) (Correct answer)
Penetration testing

Correct answer: Asset inventory and Software Bill of Materials (SBOM)

A complete asset inventory and SBOM is the foundation of vulnerability management — you cannot protect or patch what you don't know you have.

Question 49: During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Immediately power off the affected system
Isolate the system on a quarantine network while capturing memory and disk images (Correct answer)
Delete all logs to prevent attacker access
Reinstall the OS immediately

Correct answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

Question 50: A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?

IKEv1 cannot establish tunnels
Aggressive mode requires digital certificates
Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key (Correct answer)
Aggressive mode uses stronger encryption

Correct answer: Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key

IKEv1 aggressive mode sends the peer's identity hash in cleartext, allowing an attacker to capture it and crack the pre-shared key offline.

Question 51: Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Opportunistic breach
Advanced Persistent Threat (APT) (Correct answer)
Script kiddie attack
Drive-by download

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 52: An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

URL filtering
Content filtering
Application inspection
SYN proxy or SYN cookies (Correct answer)

Correct answer: SYN proxy or SYN cookies

A SYN proxy intercepts TCP handshakes and only forwards complete connections to the server, protecting against SYN flood attacks.

Question 53: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Triage, Escalation, Resolution, Review
Alert, Investigate, Patch, Close
Identify, Protect, Detect, Respond
Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 54: What is the purpose of a Plan of Action and Milestones (POA&M)?

To schedule employee performance reviews
To outline the incident response team structure
To define the network topology
To document known security weaknesses, remediation plans, and timelines for correction (Correct answer)

Correct answer: To document known security weaknesses, remediation plans, and timelines for correction

A POA&M is a management tool that tracks security deficiencies, assigns responsibility, and establishes milestones for remediation.

Question 55: Which of the following BEST describes quantitative risk analysis?

Categorizing risks as High, Medium, or Low
Assigning numerical monetary values to risk using metrics like ALE and SLE (Correct answer)
Using a heat map to visualize risk
Conducting stakeholder interviews

Correct answer: Assigning numerical monetary values to risk using metrics like ALE and SLE

Quantitative risk analysis uses formulas like ALE (Annual Loss Expectancy) = SLE × ARO to express risk in financial terms.

Question 56: What is a bug bounty program in the context of vulnerability management?

A tool that automatically discovers and reports bugs
A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment (Correct answer)
An internal reward for security team members who find bugs
A government grant for cybersecurity research

Correct answer: A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment

Bug bounty programs create a structured channel for external security researchers to report vulnerabilities responsibly before malicious actors find them.

Question 57: A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Internet → DMZ → Internal without inspection
Internal → DMZ → Internet without firewall
DMZ servers have unrestricted access to internal LAN
Internet → Firewall → DMZ → Firewall → Internal (Correct answer)

Correct answer: Internet → Firewall → DMZ → Firewall → Internal

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

Question 58: What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

To compress VPN traffic
To encrypt the data payload
To authenticate web certificates
To negotiate and establish the Security Associations (SAs) and exchange keys (Correct answer)

Correct answer: To negotiate and establish the Security Associations (SAs) and exchange keys

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Question 59: A network defender detects an access point broadcasting the corporate SSID but with a different BSSID and stronger signal. This is most likely which type of attack?

Evil twin attack (Correct answer)
Beacon flooding
Deauthentication attack
SSID squatting

Correct answer: Evil twin attack

An evil twin is a rogue AP mimicking a legitimate SSID/BSSID to lure clients into connecting so the attacker can intercept traffic.

Question 60: What is the primary purpose of a network baseline in security architecture?

To establish normal behavior for anomaly detection (Correct answer)
To configure default gateway settings
To document all IP addresses
To define maximum allowed bandwidth

Correct answer: To establish normal behavior for anomaly detection

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Question 61: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Replay attack
SQL injection
Fragmentation attack (Correct answer)
Man-in-the-middle attack

Correct answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.

Question 62: Which protocol should be disabled on managed switches to prevent VLAN hopping attacks?

LLDP
STP
OSPF
DTP (Dynamic Trunking Protocol) (Correct answer)

Correct answer: DTP (Dynamic Trunking Protocol)

Disabling DTP prevents an attacker from negotiating a trunk port and gaining access to multiple VLANs.

Question 63: What is a 'threat hunting' program in the context of network defense?

Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Patching known CVEs before exploitation
Running automated vulnerability scans
Monitoring social media for threat actor chatter

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 64: In network architecture, what does 'East-West traffic' refer to?

Traffic from branch offices to headquarters
Traffic between two different ISPs
Traffic between the internet and internal servers
Traffic between servers within the same data center or cloud environment (Correct answer)

Correct answer: Traffic between servers within the same data center or cloud environment

East-West traffic is server-to-server communication within a data center, which is the primary path for lateral movement after a breach.

Question 65: What does CVSS (Common Vulnerability Scoring System) measure?

The time required to exploit a vulnerability
The cost to remediate a vulnerability
The number of systems affected by a vulnerability
The severity and characteristics of a software vulnerability on a 0-10 scale (Correct answer)

Correct answer: The severity and characteristics of a software vulnerability on a 0-10 scale

CVSS scores vulnerabilities 0-10 based on attack vector, complexity, privileges required, user interaction, and impact metrics.

Question 66: What is a threat feed and how is it used in network defense?

A log aggregation service
A news service about cybersecurity incidents
A management dashboard for security teams
A continuously updated list of IoCs that is integrated into security tools to block or detect known threats (Correct answer)

Correct answer: A continuously updated list of IoCs that is integrated into security tools to block or detect known threats

Threat feeds provide real-time IoCs (IPs, domains, hashes) that are ingested by firewalls, SIEM, and IDS to automate detection of known bad actors.

Question 67: During a forensic investigation, which principle ensures the integrity of digital evidence?

Using the original media for all analysis
Deleting unnecessary files before imaging
Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
Storing evidence on a shared network drive

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 68: What does 'false positive' mean in the context of an IDS?

A rule that always matches
An attack that was not detected
An alert with no log entry
A legitimate activity that is incorrectly flagged as malicious (Correct answer)

Correct answer: A legitimate activity that is incorrectly flagged as malicious

A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.

Question 69: During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Filing an insurance claim
Notifying all users of the incident
Updating the asset inventory
Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)

Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

Question 70: What firewall feature prevents internal hosts from using unauthorized DNS servers?

Split DNS
DNS sinkholing
DNSSEC validation
DNS proxy or DNS inspection policy (Correct answer)

Correct answer: DNS proxy or DNS inspection policy

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

Question 71: When conducting a wireless security assessment, what does a 'karma attack' exploit?

RC4 keystream reuse in WEP networks
WPS PIN brute force using split-PIN validation
Auto-connect behavior where clients accept connections from APs responding to their probe requests (Correct answer)
ARP poisoning over wireless to redirect traffic

Correct answer: Auto-connect behavior where clients accept connections from APs responding to their probe requests

The karma attack involves an attacker's AP responding to any client probe request with a matching SSID, exploiting the client's auto-connect behavior to force an association.

Question 72: A WIDS alert indicates 'beacon flooding' on the wireless network. What is the primary impact of this attack?

Forced downgrade from WPA3 to WPA2
Exhaustion of DHCP address pool
Denial of service by overwhelming client scanning queues with thousands of fake SSIDs (Correct answer)
Capture of WPA2 4-way handshakes from all clients

Correct answer: Denial of service by overwhelming client scanning queues with thousands of fake SSIDs

Beacon flooding generates thousands of fake SSID beacons, overwhelming the scanning and display capabilities of wireless clients and potentially causing DoS conditions.

Question 73: What does 'perfect forward secrecy' (PFS) protect against in a VPN?

DNS leaks in VPN tunnels
Eavesdropping on the initial handshake
Replay attacks
Compromise of the long-term private key exposing past session keys (Correct answer)

Correct answer: Compromise of the long-term private key exposing past session keys

PFS generates ephemeral session keys so that compromising the long-term key does not allow decryption of previously recorded sessions.

Question 74: Which vulnerability management metric tracks the average time from a patch being available to it being deployed?

Threat exposure window
MTTD
CVSS score
Mean Time to Patch (MTTP) or patch cadence (Correct answer)

Correct answer: Mean Time to Patch (MTTP) or patch cadence

Mean Time to Patch measures the speed of an organization's patching program, with shorter times reducing the exposure window for known vulnerabilities.

Question 75: Which type of threat intelligence is MOST actionable for a SOC analyst responding to an active incident?

Operational intelligence (specific indicators like malicious IPs and hashes) (Correct answer)
Tactical intelligence (TTPs of threat actors targeting your sector)
Strategic intelligence (geopolitical threat landscape)
Technical intelligence (vulnerability details)

Correct answer: Operational intelligence (specific indicators like malicious IPs and hashes)

Operational intelligence provides specific, immediately actionable IoCs such as malicious IPs, domains, and file hashes that can be directly used in detection tools.

Question 76: An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

A penetration test report
A vulnerability scan report
An audit finding
An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official (Correct answer)

Correct answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Question 77: A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

URL filtering
NAT overload
Geo-blocking
SSL/TLS inspection (deep packet inspection) (Correct answer)

Correct answer: SSL/TLS inspection (deep packet inspection)

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

Question 78: Why is hiding the SSID considered an insufficient security control for wireless networks?

SSID hiding is not supported on 5 GHz bands
Hidden SSIDs disable WPA2 authentication
Clients actively probe for hidden SSIDs, revealing them in probe request frames (Correct answer)
Hidden SSIDs still appear in beacon frames at full power

Correct answer: Clients actively probe for hidden SSIDs, revealing them in probe request frames

Devices configured for a hidden SSID broadcast probe request frames containing the SSID name, making it trivially discoverable with passive sniffing tools.

Question 79: Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Nessus
Wireshark or tcpdump (Correct answer)
Metasploit
Nmap

Correct answer: Wireshark or tcpdump

Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.

Question 80: Which protocol is used to provide out-of-band management access to network devices?

Console via dedicated OOB network (Correct answer)
HTTP
SNMP
Telnet

Correct answer: Console via dedicated OOB network

Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.

Question 81: A CNDA is performing a Business Impact Analysis (BIA). What are the two primary metrics gathered for each critical system?

RTO (Recovery Time Objective) and RPO (Recovery Point Objective) (Correct answer)
Number of users and storage capacity
Uptime percentage and bandwidth usage
CVSS score and patch count

Correct answer: RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO defines how quickly a system must be restored after failure, while RPO defines the maximum acceptable data loss measured in time.

Question 82: What is the primary risk of placing an IDS sensor outside the perimeter firewall?

It cannot detect internal threats
It will only see encrypted traffic
It requires more storage
It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)

Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.

Question 83: Management frame protection (MFP), standardized in 802.11w, defends against which class of wireless attack?

WEP IV reuse attacks
RADIUS server impersonation
Spoofed deauthentication and disassociation frame attacks (Correct answer)
Passive traffic interception on open networks

Correct answer: Spoofed deauthentication and disassociation frame attacks

802.11w cryptographically protects management frames (including deauthentication and disassociation), preventing attackers from spoofing these frames to disconnect clients.

Question 84: In a CNDA context, what is 'threat normalization' as it applies to IDS?

Converting logs to a standard format
Normalizing network bandwidth
Reducing alert severity ratings
Reassembling fragmented or evasion-altered traffic to its true form before inspection (Correct answer)

Correct answer: Reassembling fragmented or evasion-altered traffic to its true form before inspection

Threat normalization reconstructs traffic that has been obfuscated through fragmentation or encoding so signatures can match it accurately.

Question 85: Which design principle ensures that a compromised single component does not grant full network access?

Network address translation
Single sign-on
Principle of least privilege combined with segmentation (Correct answer)
DHCP snooping

Correct answer: Principle of least privilege combined with segmentation

Least privilege limits what each component can access, and segmentation enforces those limits at the network level.

Question 86: Under HIPAA, what category of information must healthcare organizations protect?

Marketing contact lists
Financial transaction records
All employee email
Protected Health Information (PHI) that identifies individuals (Correct answer)

Correct answer: Protected Health Information (PHI) that identifies individuals

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Question 87: A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Ignore it as a false positive
Block all traffic from Tokyo
Disable the account temporarily and contact the user to verify legitimacy (Correct answer)
Delete the user account immediately

Correct answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Question 88: Which IR containment strategy involves blocking a malicious domain at the DNS level to prevent malware from communicating with C2?

Firewall null routing
ARP poisoning
BGP blackholing
DNS sinkholing (Correct answer)

Correct answer: DNS sinkholing

DNS sinkholing redirects queries for malicious domains to a controlled server, severing C2 communication while identifying infected hosts.

Question 89: What cryptographic property ensures that a sender cannot deny having sent a message?

Integrity
Availability
Confidentiality
Non-repudiation (Correct answer)

Correct answer: Non-repudiation

Non-repudiation, achieved through digital signatures, provides proof of origin that the sender cannot later deny.

Question 90: Which regulation requires US public companies to maintain adequate internal controls over financial reporting and cybersecurity disclosures?

GLBA
FERPA
CCPA
SOX (Sarbanes-Oxley Act) (Correct answer)

Correct answer: SOX (Sarbanes-Oxley Act)

SOX Section 404 requires management and auditors to assess internal controls, and the SEC now requires timely cybersecurity incident disclosure.

Question 91: MAC address filtering as a wireless security control is ineffective primarily because of what reason?

Modern operating systems randomize MACs every connection
Access points cannot store more than 255 MAC addresses
MAC filtering disables WPA2 CCMP encryption
MAC addresses are transmitted in cleartext and can be spoofed by an attacker (Correct answer)

Correct answer: MAC addresses are transmitted in cleartext and can be spoofed by an attacker

MAC addresses are visible in plaintext 802.11 frame headers even on encrypted networks, allowing attackers to clone an authorized MAC using freely available tools.

Question 92: Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Compensating controls only
Universal patching
Patch deferral
Risk-based patch prioritization (Correct answer)

Correct answer: Risk-based patch prioritization

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

Question 93: A network architect wants to isolate guest Wi-Fi users from the corporate LAN. Which design approach is most effective?

Enable client isolation only on the corporate SSID
Deploy a captive portal without VLAN segmentation
Assign guest users to a separate VLAN with ACLs blocking internal subnets (Correct answer)
Use SSID hiding on the corporate network

Correct answer: Assign guest users to a separate VLAN with ACLs blocking internal subnets

Placing guest users in a dedicated VLAN with ACLs preventing access to corporate subnets provides network-layer isolation independent of AP configuration.

Question 94: Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

NIST CSF
ISO 27001
PCI-DSS (Correct answer)
HIPAA

Correct answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

Question 95: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

CIS Controls
NIST Cybersecurity Framework (CSF) (Correct answer)
NIST SP 800-53
ISO 27001

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 96: Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

MD5 (Correct answer)
SHA-3
SHA-512
SHA-256

Correct answer: MD5

MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.

Question 97: Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

PPTP
IPsec (Correct answer)
SSL/TLS VPN
L2TP without IPsec

Correct answer: IPsec

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

Question 98: A firewall rule set should follow which ordering principle for efficiency and security?

Most specific rules first, with a deny-all at the bottom (Correct answer)
Deny-all at the top, allow rules at the bottom
Rules in alphabetical order
Most permissive rules first

Correct answer: Most specific rules first, with a deny-all at the bottom

Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.

Question 99: In a third-party risk management program, what document formally defines the security obligations of a vendor?

BAA (Business Associate Agreement) or security addendum (Correct answer)
NDA (Non-disclosure agreement)
SOW (Statement of Work)
SLA (Service Level Agreement)

Correct answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Question 100: In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

ESP (Encapsulating Security Payload)
AH (Authentication Header) (Correct answer)
IKEv2
GRE

Correct answer: AH (Authentication Header)

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds