CND Network Defense Infrastructure Flashcards

What is the purpose of Network Address Translation (NAT) from a security perspective?

Answer: It hides internal IP addresses from external networks

NAT translates private internal IP addresses to a public IP address, effectively hiding the internal network topology from external observers.

Which firewall rule processing model checks rules sequentially and stops at the first match?

Answer: First-match rule base

Most firewalls use a first-match (first-fit) rule processing model where rules are evaluated top-to-bottom and the first matching rule is applied, making rule ordering critical.

A honeypot deployed in a network serves which primary defensive security function?

Answer: Luring and detecting attackers to study their techniques

A honeypot is a decoy system intentionally made to appear vulnerable to attract attackers, allowing defenders to detect intrusions and study attacker behavior without risking real assets.

What is the purpose of implementing network access control (NAC) in an enterprise environment?

Answer: To ensure only compliant and authorized devices connect to the network

NAC enforces security policies on endpoints before granting network access, verifying device compliance (e.g., updated AV, patched OS) and user authentication.

Which protocol is used by 802.1X network access control to authenticate devices before they are allowed onto the network?

Answer: EAP (Extensible Authentication Protocol)

802.1X uses EAP over LAN (EAPOL) to authenticate supplicants (clients) via an authenticator (switch/AP) to an authentication server (typically RADIUS).

What does a next-generation firewall (NGFW) provide that a traditional stateful firewall does not?

Answer: Deep packet inspection and application awareness

NGFWs add deep packet inspection, application identification, user-identity awareness, and integrated threat intelligence beyond the port/protocol filtering of traditional stateful firewalls.