Mixed Deck — All CND Topics Flashcards

What is the role of penetration testing in threat assessment?

Answer: To simulate attacks and identify vulnerabilities in a network or system

Penetration testing, often called ethical hacking, involves authorized simulated cyberattacks against a computer system, network, or web application. Its purpose is to identify exploitable vulnerabilities and security weaknesses that an attacker could leverage. This proactive testing helps organizations understand their security posture and improve defenses before real attacks occur.

The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?

Answer: The 8-digit PIN is validated in two halves independently, reducing the keyspace

WPS validates the first 4 digits of the PIN separately from the last 4 (minus a checksum digit), reducing the brute-force space from 10^8 to roughly 10^4 + 10^3 = ~11,000 guesses.

Which foundational principle is MOST important for success in the Certified Network Defender profession?

Answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?

Answer: Dynamic analysis (sandboxing)

Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.

What distinguishes a Certified Network Defender certified professional from a non-certified practitioner?

Answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

What does OSPF use to authenticate routing updates in a secure network deployment?

Answer: Pre-shared keys or MD5/SHA HMAC

OSPF supports plain-text passwords and cryptographic authentication using MD5 or SHA HMAC to validate routing neighbors.

What is the goal of threat mitigation in network security?

Answer: To reduce the likelihood and impact of potential threats through preventive measures

Threat mitigation aims to implement controls and measures that either reduce the probability of a threat occurring or lessen its negative impact if it does occur. This involves a range of strategies, including implementing security technologies, enforcing policies, and educating users. The goal is to proactively minimize the overall risk posed by identified threats.

What distinguishes a Certified Network Defender certified professional from a non-certified practitioner?

Answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Which network monitoring technique captures a copy of all traffic passing through a network segment for analysis without impacting traffic flow?

Answer: Passive network sniffing via SPAN/mirror port

A SPAN (Switched Port Analyzer) or mirror port copies traffic from monitored ports to an analysis port, allowing security tools to inspect all traffic passively without affecting network performance.

Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?

Answer: Screened subnet (DMZ)

A screened subnet (DMZ) isolates public-facing servers so a compromise does not directly expose the internal network.

A honeypot deployed in a network serves which primary defensive security function?

Answer: Luring and detecting attackers to study their techniques

A honeypot is a decoy system intentionally made to appear vulnerable to attract attackers, allowing defenders to detect intrusions and study attacker behavior without risking real assets.

An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?

Answer: A facility with hardware and connectivity pre-installed but requiring data restoration before use

A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.

What is the first step in the incident response process?

Answer: Identification of the incident

The first step in any incident response process is the identification of the incident. This involves detecting that a security event has occurred, confirming it is indeed an incident, and understanding its initial scope. Without proper identification, an organization cannot begin to respond, contain, or recover from the breach.

A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Answer: Run a dictionary or brute-force attack against the captured handshake offline

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

What does the term 'chain of custody' mean in the context of network forensics?

Answer: Documented handling of evidence from collection to court presentation

Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.

What is the PRIMARY benefit of using data-driven decision making in Certified Network Defender management?

Answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decision making provides objective evidence that supports more informed decisions, helps reduce personal bias, and enables tracking of outcomes to evaluate effectiveness. It complements, rather than replaces, professional judgment.

What is the primary purpose of firewalls in network security?

Answer: To act as a barrier and filter network traffic based on security rules

Firewalls are fundamental network security devices that monitor and control incoming and outgoing network traffic. They establish a barrier between a trusted internal network and untrusted external networks, filtering data packets based on predefined security rules. This ensures only authorized traffic can pass, protecting the network from unauthorized access and malicious attacks.

Which EAP method provides the strongest security by requiring both the client and the authentication server to present digital certificates?

Answer: EAP-TLS

EAP-TLS requires mutual certificate-based authentication — both the supplicant and the RADIUS server present X.509 certificates — making it immune to password-based attacks and the most secure EAP method.

A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?

Answer: Identification

The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.

In risk management, the 'residual risk' is best described as:

Answer: Risk that remains after security controls have been applied

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.