CND CND Network Defense Infrastructure 2 — Questions and Answers
Question 1: What is the purpose of Network Address Translation (NAT) from a security perspective?
- It encrypts network traffic between hosts
- It hides internal IP addresses from external networks (Correct answer)
- It authenticates users before granting network access
- It monitors packets for malicious signatures
Correct answer: It hides internal IP addresses from external networks
NAT translates private internal IP addresses to a public IP address, effectively hiding the internal network topology from external observers.
Question 2: Which firewall rule processing model checks rules sequentially and stops at the first match?
- Round-robin processing
- First-match rule base (Correct answer)
- Best-match rule base
- Weighted priority processing
Correct answer: First-match rule base
Most firewalls use a first-match (first-fit) rule processing model where rules are evaluated top-to-bottom and the first matching rule is applied, making rule ordering critical.
Question 3: A honeypot deployed in a network serves which primary defensive security function?
- Encrypting sensitive data at rest
- Luring and detecting attackers to study their techniques (Correct answer)
- Balancing traffic across multiple servers
- Filtering spam email before delivery
Correct answer: Luring and detecting attackers to study their techniques
A honeypot is a decoy system intentionally made to appear vulnerable to attract attackers, allowing defenders to detect intrusions and study attacker behavior without risking real assets.
Question 4: What is the purpose of implementing network access control (NAC) in an enterprise environment?
- To encrypt data traversing the network
- To ensure only compliant and authorized devices connect to the network (Correct answer)
- To monitor DNS queries for malicious domains
- To compress network traffic for bandwidth savings
Correct answer: To ensure only compliant and authorized devices connect to the network
NAC enforces security policies on endpoints before granting network access, verifying device compliance (e.g., updated AV, patched OS) and user authentication.
Question 5: Which protocol is used by 802.1X network access control to authenticate devices before they are allowed onto the network?
- SNMP
- EAP (Extensible Authentication Protocol) (Correct answer)
- ICMP
- ARP
Correct answer: EAP (Extensible Authentication Protocol)
802.1X uses EAP over LAN (EAPOL) to authenticate supplicants (clients) via an authenticator (switch/AP) to an authentication server (typically RADIUS).
Question 6: What does a next-generation firewall (NGFW) provide that a traditional stateful firewall does not?
- Basic packet filtering
- Deep packet inspection and application awareness (Correct answer)
- Static routing capabilities
- Physical port-based filtering
Correct answer: Deep packet inspection and application awareness
NGFWs add deep packet inspection, application identification, user-identity awareness, and integrated threat intelligence beyond the port/protocol filtering of traditional stateful firewalls.
CND CND Network Defense Infrastructure 2
What is the purpose of Network Address Translation (NAT) from a security perspective?