CND Practice Test 9 — 10 Questions

Question 1

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Full-tunnel VPN. A Full-Tunnel VPN routes all client traffic through the encrypted VPN tunnel to the corporate gateway, regardless of whether the destination is internal or on the public internet.

Answer

Clientless SSL VPN

Answer

Split-tunnel VPN

Answer

Transport mode IPsec VPN

Question 2

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) provides a secure, encrypted channel for remote administrative access, replacing insecure legacy protocols like Telnet, rlogin, and rsh.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 3

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

Accepted Answer

Stateful Inspection Firewall. Stateful inspection firewalls track the state of active connections and make decisions based on context.

Answer

Unmanaged Layer 2 Switch

Answer

Patch Panel

Answer

Hub

Question 4

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

Accepted Answer

Application Gateway (Proxy Firewall). Application-layer firewalls (Proxy firewalls or NGFWs) understand Layer 7 protocols.

Answer

Unmanaged Switch

Answer

Packet Filtering Firewall

Answer

Hub

Question 5

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Accepted Answer

Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection). Threat prevention profiles (antivirus, vulnerability protection, antispyware) are attached directly to Security Policy rules that permit traffic.

Answer

Zone Protection Profile attached to the external zone

Answer

NAT Policy translation destination field

Answer

Network Interfaces configuration tab

Question 6

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The ufw allow command accepts rules specifying source subnets and ports.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 7

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

Accepted Answer

Enhanced enforcement of granular access control policies between zones. Network segmentation improves security by containing breaches and limiting lateral movement.

Answer

Elimination of the need for any firewalls or security monitoring

Answer

Guaranteed prevention of all zero-day malware infections on endpoints

Answer

Automatic encryption of all data at rest without performance overhead

Question 8

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Accepted Answer

Application awareness and identification (App-ID). NGFWs add application awareness (App-ID) and deep user identification/inspection beyond traditional Layer 3/4 stateful filtering.

Answer

Strict restriction to operating exclusively at Layer 2 (Data Link layer)

Answer

Inability to inspect encrypted HTTPS traffic under any circumstances

Answer

Exclusive reliance on static MAC address filtering for access control

Question 9

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a decoy system designed to attract and trap attackers.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 10

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). IDPS engines primarily use signature-based (pattern matching) and anomaly-based (behavioral) detection methods.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours