CND Network Security Controls & Protocols 4 — Questions and Answers
Question 1: Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?
- Dual-homed gateway
- Screened subnet (DMZ) (Correct answer)
- Bastion host
- Proxy firewall
Correct answer: Screened subnet (DMZ)
A screened subnet (DMZ) isolates public-facing servers so a compromise does not directly expose the internal network.
Question 2: What does OSPF use to authenticate routing updates in a secure network deployment?
- Pre-shared keys or MD5/SHA HMAC (Correct answer)
- RSA digital certificates only
- WPA2 passphrase
- RADIUS shared secret
Correct answer: Pre-shared keys or MD5/SHA HMAC
OSPF supports plain-text passwords and cryptographic authentication using MD5 or SHA HMAC to validate routing neighbors.
Question 3: A CND analyst wants to ensure DNS responses are cryptographically validated. Which technology should be deployed?
- DNS over HTTPS (DoH)
- DNSSEC (Correct answer)
- DANE
- DNS Sinkholes
Correct answer: DNSSEC
DNSSEC uses digital signatures to allow resolvers to verify that DNS responses have not been tampered with.
Question 4: Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?
- DAC (Discretionary Access Control)
- MAC (Mandatory Access Control)
- RBAC (Role-Based Access Control) (Correct answer)
- ABAC (Attribute-Based Access Control)
Correct answer: RBAC (Role-Based Access Control)
RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.
Question 5: What is the primary security risk mitigated by enabling BPDU Guard on an access port?
- MAC flooding
- Rogue switch insertion and Spanning Tree topology manipulation (Correct answer)
- ARP spoofing
- VLAN hopping via double-tagging
Correct answer: Rogue switch insertion and Spanning Tree topology manipulation
BPDU Guard disables a port that receives a Bridge Protocol Data Unit, preventing unauthorized switches from influencing STP topology.
Question 6: Which protocol is used by network devices to synchronize clocks, which is critical for accurate log correlation during incident response?
- SNMP
- NTP (Correct answer)
- Syslog
- LDAP
Correct answer: NTP
NTP (Network Time Protocol) synchronizes device clocks, ensuring log timestamps are consistent across the network for accurate forensic analysis.
Question 7: An organization implements a proxy that intercepts all outbound HTTP/HTTPS connections and scans content. What type of control is this?
- Intrusion Detection System
- Unified Threat Management
- Forward Proxy with SSL inspection (Correct answer)
- Reverse Proxy
Correct answer: Forward Proxy with SSL inspection
A forward proxy with SSL inspection decrypts, inspects, and re-encrypts outbound traffic to enforce content policies and detect threats.
CND Network Security Controls & Protocols 4
Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?