CND Network Security Controls & Protocols Practice Questions — Questions and Answers
Question 1: Which protocol provides hop-by-hop authentication and integrity for IPv6 packets?
- AH (Authentication Header) (Correct answer)
- ESP (Encapsulating Security Payload)
- GRE
- PPTP
Correct answer: AH (Authentication Header)
AH provides hop-by-hop authentication and integrity checking for IPv6 but does not provide confidentiality.
Question 2: What is the primary purpose of 802.1X port-based access control?
- Encrypt wireless traffic
- Authenticate devices before granting network access (Correct answer)
- Assign VLANs to switch ports
- Prevent MAC flooding attacks
Correct answer: Authenticate devices before granting network access
802.1X enforces authentication via EAP before a port is authorized, preventing unauthorized device access.
Question 3: A network engineer wants to prevent rogue DHCP servers on a LAN. Which switch feature should be enabled?
- Port Security
- DHCP Snooping (Correct answer)
- Dynamic ARP Inspection
- Storm Control
Correct answer: DHCP Snooping
DHCP Snooping validates DHCP messages and restricts DHCP server responses to trusted ports only.
Question 4: Which TLS handshake message is used by the client to prove possession of a private key during mutual authentication?
- ClientHello
- Certificate
- CertificateVerify (Correct answer)
- Finished
Correct answer: CertificateVerify
The CertificateVerify message contains a digital signature over handshake data, proving the client holds the private key.
Question 5: What does a stateful firewall track that a stateless packet filter does not?
- Source and destination IP addresses
- TCP/UDP port numbers
- Connection state and session context (Correct answer)
- Protocol type in the IP header
Correct answer: Connection state and session context
Stateful firewalls maintain a state table tracking active connections, allowing return traffic without explicit rules.
Question 6: Which SNMPv3 security level provides both authentication and encryption?
- noAuthNoPriv
- authNoPriv
- authPriv (Correct answer)
- privNoAuth
Correct answer: authPriv
authPriv uses HMAC for authentication and DES/AES for encryption, providing the highest SNMPv3 security level.
Question 7: An attacker sends packets with the SYN flag set to exhaust server connection resources. Which control best mitigates this?
- Rate limiting ICMP packets
- Enabling SYN cookies on the server (Correct answer)
- Disabling UDP on the perimeter firewall
- Implementing DNSSEC
Correct answer: Enabling SYN cookies on the server
SYN cookies allow the server to respond to SYN packets without allocating resources until the handshake completes.
Question 8: Which protocol replaces Telnet with encrypted remote management and supports public key authentication?
- RDP
- SSH (Correct answer)
- HTTPS
- SFTP
Correct answer: SSH
SSH (Secure Shell) encrypts all traffic and supports password or public-key authentication for remote CLI access.
Question 9: What is the role of a Certificate Revocation List (CRL) in PKI?
- Store issued certificates
- List certificates no longer trusted before expiry (Correct answer)
- Encrypt private keys
- Validate certificate chain length
Correct answer: List certificates no longer trusted before expiry
A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.
Question 10: Which network segmentation control isolates traffic by assigning logical broadcast domains on a physical switch?
- ACL
- VLAN (Correct answer)
- NAT
- PAT
Correct answer: VLAN
VLANs (Virtual Local Area Networks) segment broadcast domains logically, limiting lateral movement between device groups.
Question 11: A security engineer needs to ensure data integrity without confidentiality for routing protocol updates. Which IPsec mode is most appropriate?
- ESP in Tunnel mode
- AH in Transport mode (Correct answer)
- ESP in Transport mode
- IKEv1 Aggressive mode
Correct answer: AH in Transport mode
AH in Transport mode authenticates the packet payload and IP header without encrypting data, providing integrity only.
Question 12: What is the function of Network Address Translation (NAT) as a security control?
- Encrypts outbound traffic
- Hides internal IP address space from external networks (Correct answer)
- Blocks malicious URLs
- Provides authentication for web sessions
Correct answer: Hides internal IP address space from external networks
NAT maps private internal IP addresses to a public address, obscuring the internal network topology from external observers.
Question 13: Which wireless security protocol introduced CCMP as its mandatory encryption algorithm?
- WEP
- WPA (TKIP)
- WPA2 (Correct answer)
- WPA3-Personal
Correct answer: WPA2
WPA2 mandates CCMP (Counter Mode CBC-MAC Protocol) based on AES, replacing the weaker TKIP used by WPA.
Question 14: During a penetration test, a tester captures a WPA2 4-way handshake. What is the tester attempting?
- Decrypt AES-CCMP traffic in real time
- Perform an offline dictionary attack against the pre-shared key (Correct answer)
- Inject deauthentication frames
- Exploit the KRACK vulnerability
Correct answer: Perform an offline dictionary attack against the pre-shared key
The 4-way handshake contains enough information to perform an offline brute-force or dictionary attack against the WPA2 PSK.
Question 15: Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?
- Dual-homed gateway
- Screened subnet (DMZ) (Correct answer)
- Bastion host
- Proxy firewall
Correct answer: Screened subnet (DMZ)
A screened subnet (DMZ) isolates public-facing servers so a compromise does not directly expose the internal network.
Question 16: What does OSPF use to authenticate routing updates in a secure network deployment?
- Pre-shared keys or MD5/SHA HMAC (Correct answer)
- RSA digital certificates only
- WPA2 passphrase
- RADIUS shared secret
Correct answer: Pre-shared keys or MD5/SHA HMAC
OSPF supports plain-text passwords and cryptographic authentication using MD5 or SHA HMAC to validate routing neighbors.
Question 17: A CND analyst wants to ensure DNS responses are cryptographically validated. Which technology should be deployed?
- DNS over HTTPS (DoH)
- DNSSEC (Correct answer)
- DANE
- DNS Sinkholes
Correct answer: DNSSEC
DNSSEC uses digital signatures to allow resolvers to verify that DNS responses have not been tampered with.
Question 18: Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?
- DAC (Discretionary Access Control)
- MAC (Mandatory Access Control)
- RBAC (Role-Based Access Control) (Correct answer)
- ABAC (Attribute-Based Access Control)
Correct answer: RBAC (Role-Based Access Control)
RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.
Question 19: What is the primary security risk mitigated by enabling BPDU Guard on an access port?
- MAC flooding
- Rogue switch insertion and Spanning Tree topology manipulation (Correct answer)
- ARP spoofing
- VLAN hopping via double-tagging
Correct answer: Rogue switch insertion and Spanning Tree topology manipulation
BPDU Guard disables a port that receives a Bridge Protocol Data Unit, preventing unauthorized switches from influencing STP topology.
Question 20: Which protocol is used by network devices to synchronize clocks, which is critical for accurate log correlation during incident response?
- SNMP
- NTP (Correct answer)
- Syslog
- LDAP
Correct answer: NTP
NTP (Network Time Protocol) synchronizes device clocks, ensuring log timestamps are consistent across the network for accurate forensic analysis.
Question 21: An organization implements a proxy that intercepts all outbound HTTP/HTTPS connections and scans content. What type of control is this?
- Intrusion Detection System
- Unified Threat Management
- Forward Proxy with SSL inspection (Correct answer)
- Reverse Proxy
Correct answer: Forward Proxy with SSL inspection
A forward proxy with SSL inspection decrypts, inspects, and re-encrypts outbound traffic to enforce content policies and detect threats.
