Mixed Deck — All CNDA Topics Flashcards

A network defender detects an access point broadcasting the corporate SSID but with a different BSSID and stronger signal. This is most likely which type of attack?

Answer: Evil twin attack

An evil twin is a rogue AP mimicking a legitimate SSID/BSSID to lure clients into connecting so the attacker can intercept traffic.

A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Which vulnerability management metric tracks the average time from a patch being available to it being deployed?

Answer: Mean Time to Patch (MTTP) or patch cadence

Mean Time to Patch measures the speed of an organization's patching program, with shorter times reducing the exposure window for known vulnerabilities.

In a third-party risk management program, what document formally defines the security obligations of a vendor?

Answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Under HIPAA, what category of information must healthcare organizations protect?

Answer: Protected Health Information (PHI) that identifies individuals

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Answer: Risk-based patch prioritization

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

Which network topology provides the highest redundancy but is also the most expensive to implement?

Answer: Full mesh topology

A full mesh topology connects every node to every other node, eliminating single points of failure but requiring the most links.

Which IPS deployment mode allows it to actively block malicious traffic inline?

Answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

What is a 'security control baseline' as used in NIST SP 800-53?

Answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

What is the primary difference between a site-to-site VPN and a remote-access VPN?

Answer: Site-to-site connects two networks permanently; remote access connects individual users dynamically

Site-to-site VPNs create a persistent encrypted tunnel between two network gateways, while remote access VPNs connect individual clients to a corporate network.

Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

Answer: IPsec

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

Which protocol should be disabled on managed switches to prevent VLAN hopping attacks?

Answer: DTP (Dynamic Trunking Protocol)

Disabling DTP prevents an attacker from negotiating a trunk port and gaining access to multiple VLANs.

In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

Answer: AH (Authentication Header)

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

What does 'perfect forward secrecy' (PFS) protect against in a VPN?

Answer: Compromise of the long-term private key exposing past session keys

PFS generates ephemeral session keys so that compromising the long-term key does not allow decryption of previously recorded sessions.

What is the purpose of a honeypot in a network defense architecture?

Answer: To lure and study attacker behavior in a controlled environment

A honeypot is a decoy system that attracts attackers, allowing defenders to observe techniques without risk to production assets.

Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

Answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Which firewall type inspects the full context of a TCP session rather than individual packets?

Answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

What does 'due diligence' mean in the context of cybersecurity governance?

Answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.