CND Practice Test 4 — 25 Questions

Question 1

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VRRP (Virtual Router Redundancy Protocol). VRRP (Virtual Router Redundancy Protocol) and HSRP are standard redundancy protocols used to provide virtual IP failover.

Answer

RADIUS

Answer

BGP (Border Gateway Protocol)

Answer

DHCP (Dynamic Host Configuration Protocol)

Question 2

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Accepted Answer

Perimeter firewalls controlling traffic entering and leaving the zone. A DMZ typically hosts public-facing servers (like web or mail servers) and relies on perimeter firewalls to control traffic flow.

Answer

Unprotected hubs connecting all corporate workstations

Answer

Internal active directory domain controllers serving workstation logins

Answer

Unrestricted direct fiber connections to employee home routers

Question 3

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (or Inbound/Outbound Inspection) allows the NGFW to decrypt traffic, inspect it for threats, and re-encrypt it.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 4

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 5

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

Accepted Answer

Cowrie. Cowrie is a medium-to-high interaction SSH/Telnet honeypot designed to log brute-force attacks and shell interaction. (Alternatively, Honeyd emulates multiple hosts/services). Let's evaluate options.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 6

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

Accepted Answer

Full-tunnel VPN. A Full-Tunnel VPN routes all client traffic through the encrypted VPN tunnel to the corporate gateway, regardless of whether the destination is internal or on the public internet.

Answer

Clientless SSL VPN

Answer

Split-tunnel VPN

Answer

Transport mode IPsec VPN

Question 7

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) provides a secure, encrypted channel for remote administrative access, replacing insecure legacy protocols like Telnet, rlogin, and rsh.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 8

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

Accepted Answer

Stateful Inspection Firewall. Stateful inspection firewalls track the state of active connections and make decisions based on context.

Answer

Unmanaged Layer 2 Switch

Answer

Patch Panel

Answer

Hub

Question 9

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

Accepted Answer

Application Gateway (Proxy Firewall). Application-layer firewalls (Proxy firewalls or NGFWs) understand Layer 7 protocols.

Answer

Unmanaged Switch

Answer

Packet Filtering Firewall

Answer

Hub

Question 10

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Accepted Answer

Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection). Threat prevention profiles (antivirus, vulnerability protection, antispyware) are attached directly to Security Policy rules that permit traffic.

Answer

Zone Protection Profile attached to the external zone

Answer

NAT Policy translation destination field

Answer

Network Interfaces configuration tab

Question 11

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The ufw allow command accepts rules specifying source subnets and ports.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 12

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

Accepted Answer

Enhanced enforcement of granular access control policies between zones. Network segmentation improves security by containing breaches and limiting lateral movement.

Answer

Elimination of the need for any firewalls or security monitoring

Answer

Guaranteed prevention of all zero-day malware infections on endpoints

Answer

Automatic encryption of all data at rest without performance overhead

Question 13

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Accepted Answer

Application awareness and identification (App-ID). NGFWs add application awareness (App-ID) and deep user identification/inspection beyond traditional Layer 3/4 stateful filtering.

Answer

Strict restriction to operating exclusively at Layer 2 (Data Link layer)

Answer

Inability to inspect encrypted HTTPS traffic under any circumstances

Answer

Exclusive reliance on static MAC address filtering for access control

Question 14

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a decoy system designed to attract and trap attackers.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 15

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). IDPS engines primarily use signature-based (pattern matching) and anomaly-based (behavioral) detection methods.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours

Question 16

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Accepted Answer

Inline placement directly in the path of network traffic flow to allow active packet dropping.. NIPS devices are placed inline to inspect traffic in real-time and can actively drop or block malicious packets before they reach internal targets.

Answer

Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

Answer

Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

Answer

Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.

Question 17

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

Accepted Answer

Demilitarized Zone (DMZ). A Demilitarized Zone (DMZ) isolates public-facing services from the internal network.

Answer

Internal LAN

Answer

Management VLAN

Answer

Virtual Private Network (VPN) pool

Question 18

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

Accepted Answer

Configuring a management IP address on a management interface or BVI (Bridge Virtual Interface) for device access. In transparent mode, the firewall acts like a bridge, requiring bridge group interfaces and management IP addresses for administration.

Answer

Assigning Layer 3 IP addresses to every data interface participating in packet routing

Answer

Configuring dynamic BGP peering on all client-facing ports

Answer

Removing all security rules since Layer 2 devices cannot filter traffic

Question 19

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Accepted Answer

Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.. DMZ best practices include using a 3-interface firewall or multiple firewalls, avoiding direct routing between the DMZ and internal network, and disabling unnecessary services on DMZ hosts.

Answer

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Answer

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

Question 20

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

Accepted Answer

SSH (Secure Shell). SSH provides a secure, encrypted channel for remote administrative access.

Answer

HTTP

Answer

SNMPv1

Answer

TFTP