Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: What is the primary risk of placing an IDS sensor outside the perimeter firewall?

It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)
It will only see encrypted traffic
It requires more storage
It cannot detect internal threats

Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.

Question 2: Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

ECDH (Elliptic Curve Diffie-Hellman) (Correct answer)
Static key exchange
DH Group 1
RSA 1024

Correct answer: ECDH (Elliptic Curve Diffie-Hellman)

ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.

Question 3: What is the primary difference between a vulnerability assessment and a penetration test?

A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact (Correct answer)
Pen tests are automated; vulnerability assessments are manual
They are identical in scope and methodology
Vulnerability assessments are only run on web apps; pen tests cover networks

Correct answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 4: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To complete regulatory reporting
To calculate the financial cost of the breach
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
To assign blame for the incident

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 5: Which network topology provides the highest redundancy but is also the most expensive to implement?

Bus topology
Ring topology
Star topology
Full mesh topology (Correct answer)

Correct answer: Full mesh topology

A full mesh topology connects every node to every other node, eliminating single points of failure but requiring the most links.

Question 6: During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Updating the asset inventory
Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)
Notifying all users of the incident
Filing an insurance claim

Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

Question 7: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Replay attack
SQL injection
Fragmentation attack (Correct answer)
Man-in-the-middle attack

Correct answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.

Question 8: Which encryption protocol replaced TKIP in WPA2 and provides stronger confidentiality through AES in counter mode?

CCMP (Counter Mode CBC-MAC Protocol) (Correct answer)
GCMP (Galois/Counter Mode Protocol)
WRAP (Wireless Robust Authenticated Protocol)
LEAP (Lightweight Extensible Authentication Protocol)

Correct answer: CCMP (Counter Mode CBC-MAC Protocol)

CCMP uses AES in Counter Mode for encryption and CBC-MAC for integrity, making it the mandatory strong cipher suite in WPA2.

Question 9: What is the key advantage of anomaly-based IDS over signature-based IDS?

Simpler rule management
Lower false positive rate
Faster processing speed
Ability to detect zero-day and previously unknown attacks (Correct answer)

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 10: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

A command-and-control (C2) connection from malware (Correct answer)
DNS resolution activity
Normal NTP synchronization
A misconfigured DHCP client

Correct answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Question 11: What is the purpose of a Plan of Action and Milestones (POA&M)?

To document known security weaknesses, remediation plans, and timelines for correction (Correct answer)
To define the network topology
To outline the incident response team structure
To schedule employee performance reviews

Correct answer: To document known security weaknesses, remediation plans, and timelines for correction

A POA&M is a management tool that tracks security deficiencies, assigns responsibility, and establishes milestones for remediation.

Question 12: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

CIS Controls
NIST Cybersecurity Framework (CSF) (Correct answer)
ISO 27001
NIST SP 800-53

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 13: What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

To encrypt the data payload
To authenticate web certificates
To negotiate and establish the Security Associations (SAs) and exchange keys (Correct answer)
To compress VPN traffic

Correct answer: To negotiate and establish the Security Associations (SAs) and exchange keys

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Question 14: What is the purpose of a 'stateful failover' configuration in a firewall cluster?

To back up firewall logs
To load balance new connections
To synchronize firewall rules only
To replicate connection state tables so sessions survive a failover without dropping (Correct answer)

Correct answer: To replicate connection state tables so sessions survive a failover without dropping

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Question 15: Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Risk avoidance
Risk mitigation
Risk transference (Correct answer)
Risk acceptance

Correct answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 16: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

NGFW cannot perform NAT
NGFW only filters at Layer 3
NGFW uses only signature-based detection
NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)

Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 17: Which technique allows a host-based IDS (HIDS) to detect file system tampering?

Signature scanning of running processes
Network packet capture
File integrity monitoring (FIM) using cryptographic hashes (Correct answer)
Protocol analysis

Correct answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 18: What US federal law requires federal agencies to implement a risk management framework for information security?

PCI-DSS
FISMA (Federal Information Security Modernization Act) (Correct answer)
SOX
HIPAA

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

Question 19: An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

A vulnerability scan report
An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official (Correct answer)
An audit finding
A penetration test report

Correct answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Question 20: Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Defense-in-depth segmentation (Correct answer)
Flat network
Full mesh topology
Hub-and-spoke topology

Correct answer: Defense-in-depth segmentation

Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.

Question 21: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Triage, Escalation, Resolution, Review
Identify, Protect, Detect, Respond
Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
Alert, Investigate, Patch, Close

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 22: Which VPN deployment concern is addressed by using multi-factor authentication (MFA) at the VPN gateway?

Credential theft or stolen VPN credentials enabling unauthorized access (Correct answer)
Encryption strength
Tunnel stability
Certificate renewal

Correct answer: Credential theft or stolen VPN credentials enabling unauthorized access

MFA requires a second factor beyond username and password, so stolen credentials alone are insufficient to gain VPN access.

Question 23: During a forensic investigation, which principle ensures the integrity of digital evidence?

Storing evidence on a shared network drive
Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
Using the original media for all analysis
Deleting unnecessary files before imaging

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 24: What is the role of a network access control (NAC) system in security architecture?

To enforce security posture checks before granting network access (Correct answer)
To manage DNS records
To assign IP addresses to devices
To monitor bandwidth utilization

Correct answer: To enforce security posture checks before granting network access

NAC validates device compliance (patch level, AV status, certificates) before allowing it onto the network.

Question 25: Which IPS deployment mode allows it to actively block malicious traffic inline?

Out-of-band mode
Passive (promiscuous) mode
Inline mode between network segments (Correct answer)
Port mirroring mode

Correct answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 26: What is the MITRE ATT&CK framework used for in incident response?

Auditing firewall rules
Defining patch management schedules
Scoring vulnerability severity
Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs) (Correct answer)

Correct answer: Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

Question 27: What is a 'threat hunting' program in the context of network defense?

Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Running automated vulnerability scans
Monitoring social media for threat actor chatter
Patching known CVEs before exploitation

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 28: What is a 'security control baseline' as used in NIST SP 800-53?

The minimum acceptable patch level for servers
A list of denied network addresses
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)
The default firewall rule set

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 29: Which type of firewall architecture uses a separate proxy process for each application protocol?

Packet filter
Application proxy (circuit-level gateway) (Correct answer)
Deep packet inspection engine
Stateful firewall

Correct answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 30: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To outline the organization's marketing strategy
To document the security controls implemented for a specific information system (Correct answer)
To list all known vulnerabilities
To define employee compensation

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 31: Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Advanced Persistent Threat (APT) (Correct answer)
Opportunistic breach
Drive-by download
Script kiddie attack

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 32: Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Using public IPs on all internal servers
IPv6 link-local addresses
RFC 1918 private addressing with NAT (Correct answer)
Using APIPA addresses

Correct answer: RFC 1918 private addressing with NAT

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds