CND Network Security Controls & Protocols 4

Question 1

Which firewall architecture places publicly accessible servers in a network segment separated from both the internet and the internal LAN?

Accepted Answer

Screened subnet (DMZ)

Answer

A screened subnet (DMZ) isolates public-facing servers so a compromise does not directly expose the internal network.

Question 2

What does OSPF use to authenticate routing updates in a secure network deployment?

Accepted Answer

Pre-shared keys or MD5/SHA HMAC

Answer

OSPF supports plain-text passwords and cryptographic authentication using MD5 or SHA HMAC to validate routing neighbors.

Question 3

A CND analyst wants to ensure DNS responses are cryptographically validated. Which technology should be deployed?

Accepted Answer

DNSSEC

Answer

DNSSEC uses digital signatures to allow resolvers to verify that DNS responses have not been tampered with.

Question 4

Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?

Accepted Answer

RBAC (Role-Based Access Control)

Answer

RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.

Question 5

What is the primary security risk mitigated by enabling BPDU Guard on an access port?

Accepted Answer

Rogue switch insertion and Spanning Tree topology manipulation

Answer

BPDU Guard disables a port that receives a Bridge Protocol Data Unit, preventing unauthorized switches from influencing STP topology.

(CND) Certified Network Defender Practice Test