CND CND Network Defense Infrastructure 1 — Questions and Answers
Question 1: Which type of firewall inspects the state of active connections and uses this information to determine which network packets to allow through?
- Packet filtering firewall
- Stateful inspection firewall (Correct answer)
- Application-layer firewall
- Circuit-level gateway
Correct answer: Stateful inspection firewall
A stateful inspection firewall tracks the state of active network connections and makes filtering decisions based on context, not just individual packets.
Question 2: What is the primary purpose of a DMZ (Demilitarized Zone) in network architecture?
- To encrypt internal traffic
- To isolate public-facing servers from the internal network (Correct answer)
- To monitor user activity logs
- To provide redundant routing paths
Correct answer: To isolate public-facing servers from the internal network
A DMZ is a network segment that isolates publicly accessible servers (like web and mail servers) from the trusted internal network, limiting exposure if those servers are compromised.
Question 3: Which VPN protocol is widely considered the most secure for site-to-site enterprise VPN connections due to its robust authentication and encryption?
- PPTP
- L2TP/IPSec
- IPSec IKEv2 (Correct answer)
- SSTP
Correct answer: IPSec IKEv2
IPSec with IKEv2 provides strong mutual authentication, perfect forward secrecy, and is highly resilient to network changes, making it the preferred choice for enterprise VPNs.
Question 4: What network segmentation technique uses logical partitioning within a single physical network to separate traffic by function or department?
- NAT
- VLAN (Correct answer)
- Proxy
- Load balancing
Correct answer: VLAN
VLANs (Virtual Local Area Networks) allow a single physical switch infrastructure to be logically divided into multiple isolated broadcast domains, limiting lateral movement of threats.
Question 5: An IDS placed in-line with network traffic that can actively block detected threats is best described as:
- NIDS
- HIDS
- IPS (Correct answer)
- SIEM
Correct answer: IPS
An Intrusion Prevention System (IPS) sits inline in the traffic path and can automatically drop malicious packets or block connections, unlike a passive IDS that only detects and alerts.
Question 6: Which proxy server type hides the identity of internal clients by substituting its own IP address in outbound requests?
- Transparent proxy
- Reverse proxy
- Forward proxy (Correct answer)
- SOCKS proxy
Correct answer: Forward proxy
A forward proxy acts on behalf of internal clients making outbound requests, masking their identities and providing content filtering, caching, and access control.
CND CND Network Defense Infrastructure 1
Which type of firewall inspects the state of active connections and uses this information to determine which network packets to allow through?