CNDA Network Security Architecture 2 — Questions and Answers
Question 1: Which of the following BEST describes a software-defined perimeter (SDP)?
- A physical firewall at the network edge
- A dynamic, identity-based access control that hides resources until authenticated (Correct answer)
- A VLAN-based segmentation strategy
- A cloud load balancer
Correct answer: A dynamic, identity-based access control that hides resources until authenticated
SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.
Question 2: What does the concept of 'network resilience' mean in the context of CNDA?
- The ability to block all inbound traffic
- The capacity to withstand and recover from disruptions while maintaining security (Correct answer)
- Using redundant antivirus solutions
- Encrypting all data at rest
Correct answer: The capacity to withstand and recover from disruptions while maintaining security
Network resilience combines redundancy, fault tolerance, and rapid recovery to ensure security controls remain effective during disruptions.
Question 3: Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?
- Using public IPs on all internal servers
- RFC 1918 private addressing with NAT (Correct answer)
- IPv6 link-local addresses
- Using APIPA addresses
Correct answer: RFC 1918 private addressing with NAT
RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.
Question 4: A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?
- When IP re-addressing of existing segments is impractical (Correct answer)
- When NAT is required for all internal hosts
- When dynamic routing protocols are needed
- When VPN termination is required on the firewall
Correct answer: When IP re-addressing of existing segments is impractical
A transparent firewall operates at Layer 2 and can be inserted into an existing network without changing IP addressing.
Question 5: Which design principle ensures that a compromised single component does not grant full network access?
- Single sign-on
- Principle of least privilege combined with segmentation (Correct answer)
- Network address translation
- DHCP snooping
Correct answer: Principle of least privilege combined with segmentation
Least privilege limits what each component can access, and segmentation enforces those limits at the network level.
Question 6: What is the role of a network access control (NAC) system in security architecture?
- To assign IP addresses to devices
- To enforce security posture checks before granting network access (Correct answer)
- To monitor bandwidth utilization
- To manage DNS records
Correct answer: To enforce security posture checks before granting network access
NAC validates device compliance (patch level, AV status, certificates) before allowing it onto the network.
CNDA Network Security Architecture 2
Which of the following BEST describes a software-defined perimeter (SDP)?