CNDA Network Security Architecture

Question 1

Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Accepted Answer

Defense-in-depth segmentation

Answer

Flat network

Answer

Hub-and-spoke topology

Answer

Full mesh topology

Question 2

A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Accepted Answer

Internet → Firewall → DMZ → Firewall → Internal

Answer

Internet → DMZ → Internal without inspection

Answer

Internal → DMZ → Internet without firewall

Answer

DMZ servers have unrestricted access to internal LAN

Question 3

What is the primary purpose of a network baseline in security architecture?

Accepted Answer

To establish normal behavior for anomaly detection

Answer

To define maximum allowed bandwidth

Answer

To document all IP addresses

Answer

To configure default gateway settings

Question 4

Which protocol is used to provide out-of-band management access to network devices?

Accepted Answer

Console via dedicated OOB network

Answer

SNMP

Answer

Telnet

Answer

HTTP

Question 5

In a zero-trust architecture, what is the guiding principle for granting network access?

Accepted Answer

Never trust, always verify regardless of location

Answer

Trust all internal users by default

Answer

Grant access based on IP address

Answer

Perimeter security is sufficient

Question 6

A network architect wants to prevent lateral movement after a breach. Which technique is MOST effective?

Accepted Answer

Implementing micro-segmentation with strict ACLs

Answer

Installing antivirus on all hosts

Answer

Increasing firewall log retention

Answer

Using longer passwords