CNDA Network Security Architecture 2

Question 1

Which of the following BEST describes a software-defined perimeter (SDP)?

Accepted Answer

A dynamic, identity-based access control that hides resources until authenticated

Answer

SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.

Question 2

What does the concept of 'network resilience' mean in the context of CNDA?

Accepted Answer

The capacity to withstand and recover from disruptions while maintaining security

Answer

Network resilience combines redundancy, fault tolerance, and rapid recovery to ensure security controls remain effective during disruptions.

Question 3

Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Accepted Answer

RFC 1918 private addressing with NAT

Answer

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

Question 4

A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?

Accepted Answer

When IP re-addressing of existing segments is impractical

Answer

A transparent firewall operates at Layer 2 and can be inserted into an existing network without changing IP addressing.

Question 5

Which design principle ensures that a compromised single component does not grant full network access?

Accepted Answer

Principle of least privilege combined with segmentation

Answer

Least privilege limits what each component can access, and segmentation enforces those limits at the network level.

CNDA - Certified Network Defense Architect Practice Test