CND Practice Test 8 — 10 Questions

Question 1

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

Accepted Answer

Dynamic ARP Inspection (DAI) leveraging the DHCP snooping database to drop spoofed ARP packets.. Layer 2 hardening includes Port Security (limiting MAC addresses), DHCP Snooping (blocking rogue DHCP), and Dynamic ARP Inspection (stopping ARP poisoning).

Answer

Border Gateway Protocol (BGP) Route Flap Damping to stabilize wide-area inter-domain routing.

Answer

Web Application Firewall (WAF) rule sets for HTTP parameter parsing and inspection.

Question 2

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

Accepted Answer

Monitoring and Evaluation. The Network Defense Lifecycle generally encompasses phases such as Assessment/Planning, Implementation, and Monitoring/Review. Options A, B, and E represent recognized phases in security lifecycle management.

Answer

Unregulated Hardware Decommissioning and Scraping

Answer

Unrestricted Open Source Code Distribution

Question 3

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

Accepted Answer

Insecure Management APIs lacking proper authentication, rate limiting, and input validation.. According to cloud security frameworks (such as the OWASP Cloud Top 10 and CSA), Insecure APIs and Insecure IAM / Excessive Privileges are primary cloud threat vectors.

Answer

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Answer

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Answer

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Question 4

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Accepted Answer

Optical Network Tap (Test Access Point). NIDS sensors are deployed passively using switch SPAN/mirror ports or optical network taps.

Answer

Inline active blocking mechanism that terminates malicious TCP sessions directly

Answer

Directly modifying the TCP/IP stack of external client operating systems

Answer

Using DHCP broadcast packets to rewrite routing tables

Question 5

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

Accepted Answer

Immediately isolate infected endpoints from the network by disconnecting physical links or invoking EDR containment features.. When ransomware strikes, immediate network isolation of infected hosts prevents lateral movement, and disabling compromised user credentials stops ongoing encryption sessions.

Answer

Immediately format all backup tape repositories to delete potentially corrupted backup indexes.

Answer

Delete all firewall access control lists to allow unrestricted threat intelligence sharing.

Answer

Pay the ransom immediately to obtain decryption keys before beginning forensic analysis.

Question 6

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

Accepted Answer

VRRP (Virtual Router Redundancy Protocol). VRRP (Virtual Router Redundancy Protocol) and HSRP are standard redundancy protocols used to provide virtual IP failover.

Answer

RADIUS

Answer

BGP (Border Gateway Protocol)

Answer

DHCP (Dynamic Host Configuration Protocol)

Question 7

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Accepted Answer

Perimeter firewalls controlling traffic entering and leaving the zone. A DMZ typically hosts public-facing servers (like web or mail servers) and relies on perimeter firewalls to control traffic flow.

Answer

Unprotected hubs connecting all corporate workstations

Answer

Internal active directory domain controllers serving workstation logins

Answer

Unrestricted direct fiber connections to employee home routers

Question 8

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (or Inbound/Outbound Inspection) allows the NGFW to decrypt traffic, inspect it for threats, and re-encrypt it.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 9

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 10

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

Accepted Answer

Cowrie. Cowrie is a medium-to-high interaction SSH/Telnet honeypot designed to log brute-force attacks and shell interaction. (Alternatively, Honeyd emulates multiple hosts/services). Let's evaluate options.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap