Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
Alert, Investigate, Patch, Close
Triage, Escalation, Resolution, Review
Identify, Protect, Detect, Respond

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 2: In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Categorize, Select, Implement
Assess, Select, Implement
Prepare, Categorize, Select (Correct answer)
Select, Implement, Assess

Correct answer: Prepare, Categorize, Select

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Question 3: Which fundamental cryptographic weakness made WEP completely broken and unsuitable for use?

Lack of a 4-way handshake
Short 24-bit Initialization Vector reuse with RC4 (Correct answer)
Absence of certificate-based mutual authentication
Use of SHA-1 for integrity checking

Correct answer: Short 24-bit Initialization Vector reuse with RC4

WEP's 24-bit IV space is small enough to force IV reuse within minutes on a busy network, allowing attackers to recover the key using statistical attacks on RC4 keystreams.

Question 4: During a forensic investigation, which principle ensures the integrity of digital evidence?

Using the original media for all analysis
Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
Storing evidence on a shared network drive
Deleting unnecessary files before imaging

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 5: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

ISO 27001
NIST SP 800-53
NIST Cybersecurity Framework (CSF) (Correct answer)
CIS Controls

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 6: Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Advanced Persistent Threat (APT) (Correct answer)
Drive-by download
Opportunistic breach
Script kiddie attack

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 7: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To calculate the financial cost of the breach
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
To complete regulatory reporting
To assign blame for the incident

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 8: Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

HIPAA
ISO 27001
NIST CSF
PCI-DSS (Correct answer)

Correct answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

Question 9: Why is hiding the SSID considered an insufficient security control for wireless networks?

Hidden SSIDs still appear in beacon frames at full power
Hidden SSIDs disable WPA2 authentication
Clients actively probe for hidden SSIDs, revealing them in probe request frames (Correct answer)
SSID hiding is not supported on 5 GHz bands

Correct answer: Clients actively probe for hidden SSIDs, revealing them in probe request frames

Devices configured for a hidden SSID broadcast probe request frames containing the SSID name, making it trivially discoverable with passive sniffing tools.

Question 10: A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

SSL/TLS inspection (deep packet inspection) (Correct answer)
Geo-blocking
URL filtering
NAT overload

Correct answer: SSL/TLS inspection (deep packet inspection)

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

Question 11: What does the concept of 'network resilience' mean in the context of CNDA?

Using redundant antivirus solutions
Encrypting all data at rest
The capacity to withstand and recover from disruptions while maintaining security (Correct answer)
The ability to block all inbound traffic

Correct answer: The capacity to withstand and recover from disruptions while maintaining security

Network resilience combines redundancy, fault tolerance, and rapid recovery to ensure security controls remain effective during disruptions.

Question 12: Which firewall type inspects the full context of a TCP session rather than individual packets?

Stateful inspection firewall (Correct answer)
Next-generation firewall
Proxy firewall
Packet filter firewall

Correct answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Question 13: What is a 'threat hunting' program in the context of network defense?

Patching known CVEs before exploitation
Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Monitoring social media for threat actor chatter
Running automated vulnerability scans

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 14: In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

A compliance scoring model
A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact (Correct answer)
A patch priority formula
A firewall rule priority formula

Correct answer: A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Question 15: What is the primary purpose of a SIEM (Security Information and Event Management) system?

To automatically patch vulnerabilities
To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
To manage user accounts and passwords
To replace firewalls and IDS

Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection

SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.

Question 16: Which type of firewall architecture uses a separate proxy process for each application protocol?

Stateful firewall
Application proxy (circuit-level gateway) (Correct answer)
Deep packet inspection engine
Packet filter

Correct answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 17: Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?

CEF (Common Event Format)
NetFlow
LEEF (Log Event Extended Format)
STIX (Structured Threat Information eXpression) (Correct answer)

Correct answer: STIX (Structured Threat Information eXpression)

STIX is an open standard for representing CTI, including threat actors, malware, attack patterns, and IoCs in a structured format.

Question 18: During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)
Notifying all users of the incident
Filing an insurance claim
Updating the asset inventory

Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

Question 19: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To outline the organization's marketing strategy
To list all known vulnerabilities
To define employee compensation
To document the security controls implemented for a specific information system (Correct answer)

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 20: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Fragmentation attack (Correct answer)
Man-in-the-middle attack
SQL injection
Replay attack

Correct answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.

Question 21: A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Internal → DMZ → Internet without firewall
Internet → Firewall → DMZ → Firewall → Internal (Correct answer)
DMZ servers have unrestricted access to internal LAN
Internet → DMZ → Internal without inspection

Correct answer: Internet → Firewall → DMZ → Firewall → Internal

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

Question 22: In a third-party risk management program, what document formally defines the security obligations of a vendor?

SOW (Statement of Work)
SLA (Service Level Agreement)
NDA (Non-disclosure agreement)
BAA (Business Associate Agreement) or security addendum (Correct answer)

Correct answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Question 23: Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Risk mitigation
Risk avoidance
Risk transference (Correct answer)
Risk acceptance

Correct answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 24: In a CNDA context, what is 'threat normalization' as it applies to IDS?

Reducing alert severity ratings
Reassembling fragmented or evasion-altered traffic to its true form before inspection (Correct answer)
Converting logs to a standard format
Normalizing network bandwidth

Correct answer: Reassembling fragmented or evasion-altered traffic to its true form before inspection

Threat normalization reconstructs traffic that has been obfuscated through fragmentation or encoding so signatures can match it accurately.

Question 25: What is a 'security control baseline' as used in NIST SP 800-53?

The minimum acceptable patch level for servers
The default firewall rule set
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)
A list of denied network addresses

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 26: A CNDA is evaluating whether to prioritize patching based on CVSS base score alone. What is the limitation of this approach?

CVSS scores change daily
CVSS scores only apply to web vulnerabilities
CVSS base scores are not publicly available
CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls (Correct answer)

Correct answer: CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls

CVSS base scores measure severity in isolation — they do not reflect whether a vulnerability is actively exploited or whether mitigating controls reduce actual risk.

Question 27: What is the key advantage of anomaly-based IDS over signature-based IDS?

Lower false positive rate
Simpler rule management
Faster processing speed
Ability to detect zero-day and previously unknown attacks (Correct answer)

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 28: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

A misconfigured DHCP client
DNS resolution activity
Normal NTP synchronization
A command-and-control (C2) connection from malware (Correct answer)

Correct answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Question 29: What is the primary risk of placing an IDS sensor outside the perimeter firewall?

It cannot detect internal threats
It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)
It requires more storage
It will only see encrypted traffic

Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.

Question 30: Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Default allow policy
Stateless filtering
Implicit permit
Default deny (deny-all) policy (Correct answer)

Correct answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

Question 31: What is a 'split tunnel' VPN configuration?

A VPN with two simultaneous connections to different servers
A VPN that splits encryption between two algorithms
A configuration where only traffic destined for corporate resources goes through the VPN (Correct answer)
A redundant VPN with automatic failover

Correct answer: A configuration where only traffic destined for corporate resources goes through the VPN

Split tunneling routes corporate-bound traffic through the encrypted VPN while internet traffic goes directly to the ISP, reducing VPN load.

Question 32: What is the difference between a CVE and a CWE?

CVE is for networks; CWE is for applications
CVE scores severity; CWE tracks patches
CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
They are identical naming conventions

Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Test delivery, eligibility, fees, renewal, score validity · verified Oct 2026