CND Network Security Controls & Protocols 2 — Questions and Answers
Question 1: Which protocol provides hop-by-hop authentication and integrity for IPv6 packets?
- AH (Authentication Header) (Correct answer)
- ESP (Encapsulating Security Payload)
- GRE
- PPTP
Correct answer: AH (Authentication Header)
AH provides hop-by-hop authentication and integrity checking for IPv6 but does not provide confidentiality.
Question 2: What is the primary purpose of 802.1X port-based access control?
- Encrypt wireless traffic
- Authenticate devices before granting network access (Correct answer)
- Assign VLANs to switch ports
- Prevent MAC flooding attacks
Correct answer: Authenticate devices before granting network access
802.1X enforces authentication via EAP before a port is authorized, preventing unauthorized device access.
Question 3: A network engineer wants to prevent rogue DHCP servers on a LAN. Which switch feature should be enabled?
- Port Security
- DHCP Snooping (Correct answer)
- Dynamic ARP Inspection
- Storm Control
Correct answer: DHCP Snooping
DHCP Snooping validates DHCP messages and restricts DHCP server responses to trusted ports only.
Question 4: Which TLS handshake message is used by the client to prove possession of a private key during mutual authentication?
- ClientHello
- Certificate
- CertificateVerify (Correct answer)
- Finished
Correct answer: CertificateVerify
The CertificateVerify message contains a digital signature over handshake data, proving the client holds the private key.
Question 5: What does a stateful firewall track that a stateless packet filter does not?
- Source and destination IP addresses
- TCP/UDP port numbers
- Connection state and session context (Correct answer)
- Protocol type in the IP header
Correct answer: Connection state and session context
Stateful firewalls maintain a state table tracking active connections, allowing return traffic without explicit rules.
Question 6: Which SNMPv3 security level provides both authentication and encryption?
- noAuthNoPriv
- authNoPriv
- authPriv (Correct answer)
- privNoAuth
Correct answer: authPriv
authPriv uses HMAC for authentication and DES/AES for encryption, providing the highest SNMPv3 security level.
Question 7: An attacker sends packets with the SYN flag set to exhaust server connection resources. Which control best mitigates this?
- Rate limiting ICMP packets
- Enabling SYN cookies on the server (Correct answer)
- Disabling UDP on the perimeter firewall
- Implementing DNSSEC
Correct answer: Enabling SYN cookies on the server
SYN cookies allow the server to respond to SYN packets without allocating resources until the handshake completes.
CND Network Security Controls & Protocols 2
Which protocol provides hop-by-hop authentication and integrity for IPv6 packets?