CND CND Network Defense Infrastructure

Question 1

Which type of firewall inspects the state of active connections and uses this information to determine which network packets to allow through?

Accepted Answer

Stateful inspection firewall

Answer

A stateful inspection firewall tracks the state of active network connections and makes filtering decisions based on context, not just individual packets.

Question 2

What is the primary purpose of a DMZ (Demilitarized Zone) in network architecture?

Accepted Answer

To isolate public-facing servers from the internal network

Answer

A DMZ is a network segment that isolates publicly accessible servers (like web and mail servers) from the trusted internal network, limiting exposure if those servers are compromised.

Question 3

Which VPN protocol is widely considered the most secure for site-to-site enterprise VPN connections due to its robust authentication and encryption?

Accepted Answer

IPSec IKEv2

Answer

IPSec with IKEv2 provides strong mutual authentication, perfect forward secrecy, and is highly resilient to network changes, making it the preferred choice for enterprise VPNs.

Question 4

What network segmentation technique uses logical partitioning within a single physical network to separate traffic by function or department?

Accepted Answer

VLAN

Answer

VLANs (Virtual Local Area Networks) allow a single physical switch infrastructure to be logically divided into multiple isolated broadcast domains, limiting lateral movement of threats.

Question 5

An IDS placed in-line with network traffic that can actively block detected threats is best described as:

Accepted Answer

IPS

Answer

An Intrusion Prevention System (IPS) sits inline in the traffic path and can automatically drop malicious packets or block connections, unlike a passive IDS that only detects and alerts.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND CND Network Defense Infrastructure