CND Network Defense Infrastructure Flashcards

In the context of network defense, what is the purpose of a bastion host?

Answer: A hardened host providing a single access point between public and private networks

A bastion host is a specially hardened system exposed to the internet that acts as a gateway into an internal network, minimizing the attack surface through strict configuration.

Which network design principle advocates for limiting each network component's access to only the resources it needs to perform its function?

Answer: Principle of least privilege

The principle of least privilege minimizes the attack surface by ensuring systems, accounts, and services only have the minimum permissions necessary to fulfill their intended function.

What is the main advantage of an out-of-band (OOB) management network for network device administration?

Answer: It keeps management traffic separate so devices remain accessible during attacks or outages

An out-of-band management network uses separate physical interfaces or dedicated networks, ensuring administrators can access and control devices even when the production network is compromised or down.

Which technology can be used to detect ARP spoofing attacks on a switched network?

Answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection validates ARP packets against a DHCP snooping binding table, dropping ARP replies that don't match the legitimate IP-to-MAC mappings.

What is the function of a web application firewall (WAF) in network defense?

Answer: To inspect and filter HTTP/HTTPS traffic to protect web applications from attacks like SQLi and XSS

A WAF operates at Layer 7, analyzing HTTP/HTTPS traffic to detect and block web-specific attacks including SQL injection, cross-site scripting, and OWASP Top 10 threats.

Port security on a network switch is primarily used to defend against which type of attack?

Answer: MAC flooding attacks

Port security limits the number of MAC addresses allowed on a switch port, preventing MAC flooding attacks that attempt to overflow the CAM table and cause the switch to broadcast all traffic.