CNDA Network Security Architecture

Question 1

Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Accepted Answer

Defense-in-depth segmentation

Answer

Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.

Question 2

A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Accepted Answer

Internet → Firewall → DMZ → Firewall → Internal

Answer

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

Question 3

What is the primary purpose of a network baseline in security architecture?

Accepted Answer

To establish normal behavior for anomaly detection

Answer

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Question 4

Which protocol is used to provide out-of-band management access to network devices?

Accepted Answer

Console via dedicated OOB network

Answer

Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.

Question 5

In a zero-trust architecture, what is the guiding principle for granting network access?

Accepted Answer

Never trust, always verify regardless of location

Answer

Zero trust requires continuous verification of identity and device posture before granting access to any resource, internal or external.

CNDA - Certified Network Defense Architect Practice Test