CND Network Security Controls & Protocols 5 — Questions and Answers
Question 1: Which security protocol is used by RADIUS to encrypt only the user password field in authentication packets?
- AES-256
- MD5 with a shared secret (Correct answer)
- SHA-256 HMAC
- RC4 with a session key
Correct answer: MD5 with a shared secret
RADIUS encrypts only the password using MD5 XOR with a shared secret, while the rest of the packet is sent in cleartext.
Question 2: What is the key difference between IDS and IPS deployment in a network?
- IDS encrypts traffic; IPS does not
- IPS is placed inline and can block traffic; IDS passively monitors (Correct answer)
- IDS requires agent installation; IPS is agentless
- IPS only detects known signatures; IDS uses anomaly detection
Correct answer: IPS is placed inline and can block traffic; IDS passively monitors
IPS is deployed inline in the traffic path and can drop or modify packets, while IDS monitors a copy of traffic and only alerts.
Question 3: Which VPN protocol operates at Layer 2 and is commonly used to extend VLANs across WAN connections?
- IPsec
- L2TP (Correct answer)
- OpenVPN
- MPLS
Correct answer: L2TP
L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 and is often paired with IPsec for security to create secure tunnels.
Question 4: A network defender discovers an unauthorized device is responding to ARP requests for the default gateway IP. Which attack is occurring?
- DHCP Starvation
- ARP Spoofing/Poisoning (Correct answer)
- DNS Cache Poisoning
- IP Spoofing
Correct answer: ARP Spoofing/Poisoning
ARP Spoofing involves sending fake ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.
Question 5: Which feature of Next-Generation Firewalls (NGFW) differentiates them from traditional stateful firewalls?
- Ability to filter by IP address
- Deep packet inspection with application awareness (Correct answer)
- Support for NAT and PAT
- Stateful connection tracking
Correct answer: Deep packet inspection with application awareness
NGFWs perform deep packet inspection to identify applications regardless of port, enabling application-layer policy enforcement.
Question 6: What is the purpose of implementing a honeypot in a network security architecture?
- Encrypt sensitive data at rest
- Deceive and study attackers while detecting unauthorized access (Correct answer)
- Provide redundant authentication services
- Balance load across web servers
Correct answer: Deceive and study attackers while detecting unauthorized access
A honeypot is a decoy system designed to attract attackers, allowing defenders to observe techniques and gather threat intelligence.
Question 7: Which protocol provides centralized AAA (Authentication, Authorization, and Accounting) services and is commonly used with network devices via TCP port 49?
- RADIUS
- TACACS+ (Correct answer)
- Kerberos
- LDAP
Correct answer: TACACS+
TACACS+ uses TCP port 49 and separates authentication, authorization, and accounting into distinct processes for granular control.
CND Network Security Controls & Protocols 5
Which security protocol is used by RADIUS to encrypt only the user password field in authentication packets?