CNDA Network Security Architecture 2

Question 1

Which of the following BEST describes a software-defined perimeter (SDP)?

Accepted Answer

A dynamic, identity-based access control that hides resources until authenticated

Answer

A physical firewall at the network edge

Answer

A VLAN-based segmentation strategy

Answer

A cloud load balancer

Question 2

What does the concept of 'network resilience' mean in the context of CNDA?

Accepted Answer

The capacity to withstand and recover from disruptions while maintaining security

Answer

The ability to block all inbound traffic

Answer

Using redundant antivirus solutions

Answer

Encrypting all data at rest

Question 3

Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Accepted Answer

RFC 1918 private addressing with NAT

Answer

Using public IPs on all internal servers

Answer

IPv6 link-local addresses

Answer

Using APIPA addresses

Question 4

A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?

Accepted Answer

When IP re-addressing of existing segments is impractical

Answer

When NAT is required for all internal hosts

Answer

When dynamic routing protocols are needed

Answer

When VPN termination is required on the firewall

Question 5

Which design principle ensures that a compromised single component does not grant full network access?

Accepted Answer

Principle of least privilege combined with segmentation

Answer

Single sign-on

Answer

Network address translation

Answer

DHCP snooping

Question 6

What is the role of a network access control (NAC) system in security architecture?

Accepted Answer

To enforce security posture checks before granting network access

Answer

To assign IP addresses to devices

Answer

To monitor bandwidth utilization

Answer

To manage DNS records