CNDA Network Security Architecture 1 — Questions and Answers
Question 1: Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?
- Flat network
- Defense-in-depth segmentation (Correct answer)
- Hub-and-spoke topology
- Full mesh topology
Correct answer: Defense-in-depth segmentation
Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.
Question 2: A CNDA is designing a DMZ. Which traffic flow is considered best practice?
- Internet → DMZ → Internal without inspection
- Internal → DMZ → Internet without firewall
- Internet → Firewall → DMZ → Firewall → Internal (Correct answer)
- DMZ servers have unrestricted access to internal LAN
Correct answer: Internet → Firewall → DMZ → Firewall → Internal
A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.
Question 3: What is the primary purpose of a network baseline in security architecture?
- To define maximum allowed bandwidth
- To establish normal behavior for anomaly detection (Correct answer)
- To document all IP addresses
- To configure default gateway settings
Correct answer: To establish normal behavior for anomaly detection
A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.
Question 4: Which protocol is used to provide out-of-band management access to network devices?
- SNMP
- Telnet
- Console via dedicated OOB network (Correct answer)
- HTTP
Correct answer: Console via dedicated OOB network
Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.
Question 5: In a zero-trust architecture, what is the guiding principle for granting network access?
- Trust all internal users by default
- Never trust, always verify regardless of location (Correct answer)
- Grant access based on IP address
- Perimeter security is sufficient
Correct answer: Never trust, always verify regardless of location
Zero trust requires continuous verification of identity and device posture before granting access to any resource, internal or external.
Question 6: A network architect wants to prevent lateral movement after a breach. Which technique is MOST effective?
- Installing antivirus on all hosts
- Implementing micro-segmentation with strict ACLs (Correct answer)
- Increasing firewall log retention
- Using longer passwords
Correct answer: Implementing micro-segmentation with strict ACLs
Micro-segmentation restricts east-west traffic so an attacker who compromises one host cannot freely move to adjacent systems.
CNDA Network Security Architecture 1
Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?