Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: During a forensic investigation, which principle ensures the integrity of digital evidence?

Storing evidence on a shared network drive
Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
Deleting unnecessary files before imaging
Using the original media for all analysis

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 2: Which technique allows a host-based IDS (HIDS) to detect file system tampering?

Signature scanning of running processes
Network packet capture
File integrity monitoring (FIM) using cryptographic hashes (Correct answer)
Protocol analysis

Correct answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 3: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To document the security controls implemented for a specific information system (Correct answer)
To outline the organization's marketing strategy
To list all known vulnerabilities
To define employee compensation

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 4: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To complete regulatory reporting
To assign blame for the incident
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
To calculate the financial cost of the breach

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 5: Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Heuristic detection
Anomaly-based detection
Signature-based detection (Correct answer)
Behavioral analysis

Correct answer: Signature-based detection

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

Question 6: What is the primary purpose of a network baseline in security architecture?

To define maximum allowed bandwidth
To configure default gateway settings
To establish normal behavior for anomaly detection (Correct answer)
To document all IP addresses

Correct answer: To establish normal behavior for anomaly detection

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Question 7: An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

A vulnerability scan report
A penetration test report
An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official (Correct answer)
An audit finding

Correct answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Question 8: Which encryption protocol replaced TKIP in WPA2 and provides stronger confidentiality through AES in counter mode?

LEAP (Lightweight Extensible Authentication Protocol)
CCMP (Counter Mode CBC-MAC Protocol) (Correct answer)
GCMP (Galois/Counter Mode Protocol)
WRAP (Wireless Robust Authenticated Protocol)

Correct answer: CCMP (Counter Mode CBC-MAC Protocol)

CCMP uses AES in Counter Mode for encryption and CBC-MAC for integrity, making it the mandatory strong cipher suite in WPA2.

Question 9: Which IPsec mode encapsulates the entire original IP packet, including the header, and is used for gateway-to-gateway VPNs?

Transport mode
Tunnel mode (Correct answer)
Aggressive mode
Quick mode

Correct answer: Tunnel mode

Tunnel mode wraps the entire original IP packet inside a new IP packet with a new header, hiding the original source and destination.

Question 10: What is the key advantage of anomaly-based IDS over signature-based IDS?

Simpler rule management
Lower false positive rate
Ability to detect zero-day and previously unknown attacks (Correct answer)
Faster processing speed

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 11: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

CIS Controls
ISO 27001
NIST SP 800-53
NIST Cybersecurity Framework (CSF) (Correct answer)

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 12: Which log source is MOST valuable for detecting privilege escalation on a Windows system?

DNS query logs
Web server access logs
Network flow data
Windows Security Event Log (Event ID 4672 - Special Privileges Assigned) (Correct answer)

Correct answer: Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

Question 13: What firewall feature prevents internal hosts from using unauthorized DNS servers?

DNSSEC validation
DNS sinkholing
DNS proxy or DNS inspection policy (Correct answer)
Split DNS

Correct answer: DNS proxy or DNS inspection policy

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

Question 14: In a third-party risk management program, what document formally defines the security obligations of a vendor?

SOW (Statement of Work)
SLA (Service Level Agreement)
NDA (Non-disclosure agreement)
BAA (Business Associate Agreement) or security addendum (Correct answer)

Correct answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Question 15: Which IPS deployment mode allows it to actively block malicious traffic inline?

Out-of-band mode
Passive (promiscuous) mode
Inline mode between network segments (Correct answer)
Port mirroring mode

Correct answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 16: What does 'mean time to detect' (MTTD) measure in a security operations context?

Time to patch a vulnerability after discovery
Time to respond to a detected alert
The average time between an attacker gaining access and the defender detecting the intrusion (Correct answer)
Time to restore systems after an incident

Correct answer: The average time between an attacker gaining access and the defender detecting the intrusion

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

Question 17: Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?

CVSS score
Indicator of Compromise (IoC) such as a malicious IP or domain (Correct answer)
CVE identifier
CIS benchmark control

Correct answer: Indicator of Compromise (IoC) such as a malicious IP or domain

IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.

Question 18: Which design principle ensures that a compromised single component does not grant full network access?

DHCP snooping
Single sign-on
Principle of least privilege combined with segmentation (Correct answer)
Network address translation

Correct answer: Principle of least privilege combined with segmentation

Least privilege limits what each component can access, and segmentation enforces those limits at the network level.

Question 19: A CNDA wants to protect against unauthorized wireless access points. Which control is MOST appropriate?

Disabling SSID broadcast
Implementing MAC address filtering
Deploying a wireless intrusion prevention system (WIPS) (Correct answer)
Increasing WPA2 key complexity

Correct answer: Deploying a wireless intrusion prevention system (WIPS)

A WIPS actively detects and can contain rogue access points that appear on the network.

Question 20: Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Stateless filtering
Implicit permit
Default deny (deny-all) policy (Correct answer)
Default allow policy

Correct answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

Question 21: A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Delete the user account immediately
Block all traffic from Tokyo
Ignore it as a false positive
Disable the account temporarily and contact the user to verify legitimacy (Correct answer)

Correct answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Question 22: What does 'due diligence' mean in the context of cybersecurity governance?

Running daily vulnerability scans
Researching and understanding risks before implementing security controls and business decisions (Correct answer)
Documenting all software licenses
Requiring all staff to take phishing training

Correct answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

Question 23: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)
NGFW uses only signature-based detection
NGFW only filters at Layer 3
NGFW cannot perform NAT

Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 24: Which tool is used to passively monitor for new CVEs and vendor advisories relevant to an organization's software inventory?

Nmap
Splunk SIEM
Metasploit
A vulnerability intelligence feed or Software Composition Analysis (SCA) tool (Correct answer)

Correct answer: A vulnerability intelligence feed or Software Composition Analysis (SCA) tool

SCA tools and CVE intelligence feeds continuously monitor software components against vulnerability databases and notify when a new CVE affects installed software.

Question 25: An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Quarantines the source IP
Resets the attacker's TCP session
Blocks the connection automatically
Sends an alert to the administrator (Correct answer)

Correct answer: Sends an alert to the administrator

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Question 26: What is a 'security control baseline' as used in NIST SP 800-53?

The minimum acceptable patch level for servers
The default firewall rule set
A list of denied network addresses
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 27: What is a 'threat hunting' program in the context of network defense?

Monitoring social media for threat actor chatter
Patching known CVEs before exploitation
Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Running automated vulnerability scans

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 28: A CNDA is performing a Business Impact Analysis (BIA). What are the two primary metrics gathered for each critical system?

CVSS score and patch count
RTO (Recovery Time Objective) and RPO (Recovery Point Objective) (Correct answer)
Number of users and storage capacity
Uptime percentage and bandwidth usage

Correct answer: RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO defines how quickly a system must be restored after failure, while RPO defines the maximum acceptable data loss measured in time.

Question 29: What is the difference between a CVE and a CWE?

CVE is for networks; CWE is for applications
They are identical naming conventions
CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
CVE scores severity; CWE tracks patches

Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Question 30: What is the primary difference between a vulnerability assessment and a penetration test?

Pen tests are automated; vulnerability assessments are manual
Vulnerability assessments are only run on web apps; pen tests cover networks
A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact (Correct answer)
They are identical in scope and methodology

Correct answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 31: Which fundamental cryptographic weakness made WEP completely broken and unsuitable for use?

Use of SHA-1 for integrity checking
Short 24-bit Initialization Vector reuse with RC4 (Correct answer)
Absence of certificate-based mutual authentication
Lack of a 4-way handshake

Correct answer: Short 24-bit Initialization Vector reuse with RC4

WEP's 24-bit IV space is small enough to force IV reuse within minutes on a busy network, allowing attackers to recover the key using statistical attacks on RC4 keystreams.

Question 32: During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Isolate the system on a quarantine network while capturing memory and disk images (Correct answer)
Reinstall the OS immediately
Delete all logs to prevent attacker access
Immediately power off the affected system

Correct answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds