CND Network Security Controls & Protocols 3 — Questions and Answers
Question 1: Which protocol replaces Telnet with encrypted remote management and supports public key authentication?
- RDP
- SSH (Correct answer)
- HTTPS
- SFTP
Correct answer: SSH
SSH (Secure Shell) encrypts all traffic and supports password or public-key authentication for remote CLI access.
Question 2: What is the role of a Certificate Revocation List (CRL) in PKI?
- Store issued certificates
- List certificates no longer trusted before expiry (Correct answer)
- Encrypt private keys
- Validate certificate chain length
Correct answer: List certificates no longer trusted before expiry
A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.
Question 3: Which network segmentation control isolates traffic by assigning logical broadcast domains on a physical switch?
- ACL
- VLAN (Correct answer)
- NAT
- PAT
Correct answer: VLAN
VLANs (Virtual Local Area Networks) segment broadcast domains logically, limiting lateral movement between device groups.
Question 4: A security engineer needs to ensure data integrity without confidentiality for routing protocol updates. Which IPsec mode is most appropriate?
- ESP in Tunnel mode
- AH in Transport mode (Correct answer)
- ESP in Transport mode
- IKEv1 Aggressive mode
Correct answer: AH in Transport mode
AH in Transport mode authenticates the packet payload and IP header without encrypting data, providing integrity only.
Question 5: What is the function of Network Address Translation (NAT) as a security control?
- Encrypts outbound traffic
- Hides internal IP address space from external networks (Correct answer)
- Blocks malicious URLs
- Provides authentication for web sessions
Correct answer: Hides internal IP address space from external networks
NAT maps private internal IP addresses to a public address, obscuring the internal network topology from external observers.
Question 6: Which wireless security protocol introduced CCMP as its mandatory encryption algorithm?
- WEP
- WPA (TKIP)
- WPA2 (Correct answer)
- WPA3-Personal
Correct answer: WPA2
WPA2 mandates CCMP (Counter Mode CBC-MAC Protocol) based on AES, replacing the weaker TKIP used by WPA.
Question 7: During a penetration test, a tester captures a WPA2 4-way handshake. What is the tester attempting?
- Decrypt AES-CCMP traffic in real time
- Perform an offline dictionary attack against the pre-shared key (Correct answer)
- Inject deauthentication frames
- Exploit the KRACK vulnerability
Correct answer: Perform an offline dictionary attack against the pre-shared key
The 4-way handshake contains enough information to perform an offline brute-force or dictionary attack against the WPA2 PSK.
CND Network Security Controls & Protocols 3
Which protocol replaces Telnet with encrypted remote management and supports public key authentication?