Network Defense Management

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)

An organization is aligning its defenses with the NIST SP 800-53 Rev. 5 'Access Control (AC)' control family. Which THREE controls are core requirements within this family? (Choose three)

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

An enterprise is reviewing its Disaster Recovery (DR) and Business Continuity (BC) policies. During a risk assessment, the team calculates the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical database systems. Which THREE factors directly influence these metrics? (Choose three)

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

During a network security audit, the auditor requests evidence that the principle of least privilege is enforced for administrative access to core network infrastructure routers. Which artifact should the network administrator provide to demonstrate compliance?

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?

A security manager is designing a comprehensive security governance program for a multinational financial institution. Which TWO activities are fundamental responsibilities of security governance? (Choose TWO)

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

A CND analyst at a healthcare provider is asked to classify a new data set containing patient appointment notes, physician referrals, and insurance billing codes. The organization follows a four-tier internal classification scheme (Public, Internal, Confidential, Restricted). Which classification level BEST fits this data set?

A CND engineer is reviewing the organization's incident response plan. The plan states that after containment and eradication, the team must validate that the affected systems are clean before restoring normal operations. Which activity BEST fulfills this validation requirement?

A CND engineer is implementing continuous network defense monitoring for a demilitarized zone that hosts public web servers. The team wants to detect both network-level and host-level anomalies in near real time. Which TWO technologies should be deployed to meet this requirement? (Choose two.)

A CND engineer is preparing for an internal audit of the organization's security awareness program. The auditor wants evidence that employees can recognize and report phishing attempts. Which artifact BEST demonstrates the effectiveness of the program?