Network Security Architecture Flashcards

Which of the following BEST describes a software-defined perimeter (SDP)?

Answer: A dynamic, identity-based access control that hides resources until authenticated

SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.

What does the concept of 'network resilience' mean in the context of CNDA?

Answer: The capacity to withstand and recover from disruptions while maintaining security

Network resilience combines redundancy, fault tolerance, and rapid recovery to ensure security controls remain effective during disruptions.

Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Answer: RFC 1918 private addressing with NAT

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?

Answer: When IP re-addressing of existing segments is impractical

A transparent firewall operates at Layer 2 and can be inserted into an existing network without changing IP addressing.

Which design principle ensures that a compromised single component does not grant full network access?

Answer: Principle of least privilege combined with segmentation

Least privilege limits what each component can access, and segmentation enforces those limits at the network level.

What is the role of a network access control (NAC) system in security architecture?

Answer: To enforce security posture checks before granting network access

NAC validates device compliance (patch level, AV status, certificates) before allowing it onto the network.