CND Network Defense Management — 20 Questions

Question 1

An enterprise is aligning its network defense governance model with ISO/IEC 27001. During the implementation of Clause 6 (Planning), the security team must identify information security risks. Which specific ISO/IEC 27001:2013 standard provides the catalog of controls that must be mapped to these identified risks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ISO/IEC 27002. ISO/IEC 27002 is the code of practice that provides the catalog of information security controls (the 114 controls in Annex A of ISO/IEC 27001:2013) which organizations map to risks identified during Clause 6 planning. Clause 6.1.3 requires organizations to determine controls by referencing Annex A, and 27002 explains how to implement each control. Therefore 27002 is the correct standard that supplies the control catalog for risk treatment.

Answer

ISO/IEC 27005

Answer

ISO/IEC 27701

Answer

ISO/IEC 27035

Question 2

An organization is drafting a password policy. To balance security with user usability, which requirement represents modern industry best practices aligned with NIST SP 800-63B guidelines?

Accepted Answer

Enforcing a minimum length of 8 characters and allowing password managers. NIST SP 800-63B recommends a minimum password length of 8 characters (with 15 recommended for memorized secrets), encourages the use of password managers, and explicitly discourages composition rules and arbitrary expiration. Allowing password managers supports longer, unique passwords without burdening users with memorization. This option is the only one aligned with those guidelines.

Answer

Requiring uppercase, lowercase, numbers, and symbols with 90-day rotations

Answer

Banning passphrases in favor of 6-character complex alphanumeric strings

Answer

Mandating password changes every 30 days regardless of compromise

Question 3

An organization is conducting a security audit of its wireless network infrastructure. The auditor verifies that WPA3-Enterprise is deployed with Protected Extensible Authentication Protocol (PEAP). Which governance objective is primarily achieved by this configuration?

Accepted Answer

Strong mutual authentication and cryptographic protection of wireless user sessions. WPA3-Enterprise with PEAP provides strong mutual authentication (server certificate validated by client, user credentials validated by server via MSCHAPv2 inside a TLS tunnel) and cryptographic protection of the wireless session using AES-CCMP or GCMP under 802.11w/SAE-derived keys. This directly satisfies the governance objective of ensuring confidentiality and authenticity of wireless user traffic. The configuration is a technical control that maps to access control and data protection objectives in security governance frameworks.

Answer

Automated patching of endpoint operating system kernels

Answer

Prevention of physical layer cable tapping and electromagnetic emissions

Answer

Enforcement of BGP route validation and origin autonomy

Question 4

A network defense manager is preparing for a SOC 2 Type II audit. Which THREE operational practices must the organization demonstrate to prove ongoing compliance with Security Trust Services criteria? (Choose three)

Accepted Answer

Periodic review of user access privileges and removal of terminated employee accounts. Option B is correct because SOC 2 Security criteria require access control monitoring, including periodic user access reviews and timely deprovisioning of terminated employees to prevent unauthorized access. Option D is correct because formal change management with tracked tickets and documented approvals demonstrates that changes to systems are authorized, tested, and auditable under the CC8 change management criteria. Option E is correct because continuous vulnerability scanning and a documented patch management lifecycle show proactive identification and remediation of security weaknesses, supporting the CC7 system operations criteria. Option A is incorrect because exposing internal router passwords publicly is a severe security violation that would fail confidentiality and access control requirements. Option C is incorrect because disabling auditing and log generation eliminates the audit trail needed for SOC 2 monitoring, incident detection, and evidence collection.

Answer

Public exposure of all internal router passwords on corporate websites

Answer

Disabling all system auditing and log generation to maximize server CPU performance

Question 5

A security compliance engineer is configuring an enterprise vulnerability management program using CVSS v3.1. When calculating the Environmental Metric Group to contextualize vulnerability severity for specific organizational assets, which THREE metrics must be evaluated? (Choose three)

Accepted Answer

Security Requirements (Confidentiality Requirement, Integrity Requirement, Availability Requirement). CVSS v3.1 Environmental metrics include Modified Base Metrics, Collateral Damage Potential (CDP), and Requirements for Confidentiality, Integrity, and Availability (CR, IR, AR).

Answer

Remediation Level (RL) of official vendor security patches

Answer

Exploit Code Maturity (ECM) of public exploit kits

Question 6

A financial services firm must comply with PCI-DSS v4.0 while maintaining a flat, single-VLAN campus network of 2,400 endpoints. The CISO wants to reduce the cardholder data environment (CDE) audit scope without re-architecting the entire physical topology. Which control should the network defense team implement FIRST to logically isolate the CDE and shrink the audit boundary?

Accepted Answer

Insert a stateful next-generation firewall between the CDE segment and the rest of the campus, enforcing default-deny between zones.. Inserting a stateful next-generation firewall between the CDE and the rest of the campus establishes a documented, inspectable trust boundary. PCI-DSS v4.0 allows organizations to reduce CDE scope when segmentation is enforced and verifiable. A firewall provides both the enforcement and the audit evidence an assessor needs, whereas access-layer authentication, PVLANs, and stateless ACLs do not create a clear, stateful boundary that excludes non-CDE systems from scope.

Answer

Enable private VLANs (PVLANs) on the core switches to prevent lateral movement between CDE hosts and user workstations.

Answer

Deploy 802.1X with EAP-TLS on all access switch ports and place CDE devices into a dedicated RADIUS-returned VLAN.

Answer

Configure ACLs on the existing core switches to permit only CDE-to-CDE traffic and deny all other inter-VLAN communication.

Question 7

A CND analyst is building a risk register for the network operations center. For a given asset, the team has calculated the likelihood of a specific threat exploiting a vulnerability and the resulting business impact. Which metric is the analyst deriving when combining these two values?

Accepted Answer

Risk exposure. Combining the likelihood of a threat exploiting a vulnerability with the resulting business impact produces risk exposure, the core value used to rank and prioritize risks in a register. Residual risk reflects post-treatment state, annualized loss expectancy is a monetary derivative requiring frequency and loss data, and control gap measures missing safeguards rather than combined risk.

Answer

Annualized loss expectancy

Answer

Control gap

Answer

Residual risk

Question 8

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

Accepted Answer

Identifying and cataloging all network assets, data flows, and current vulnerabilities. The Assessment and Analysis phase of the Network Defense Lifecycle is the discovery and baseline phase: you must inventory assets, map data flows, and identify current vulnerabilities before you can design or deploy defenses. Without this baseline, subsequent phases (design, implementation, monitoring) lack the context to prioritize controls. This aligns with frameworks like NIST CSF's Identify function and the CND methodology's emphasis on situational awareness first.

Answer

Conducting incident containment following a zero-day breach

Answer

Deploying next-generation firewalls across core network segments

Answer

Decommissioning obsolete routers and end-of-life switches

Question 9

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

Accepted Answer

At least every 6 months and after any significant infrastructure modification. PCI-DSS v4.0 Requirement 11.3.1 mandates that external penetration testing be performed at least once every 6 months and after any significant change to the CDE infrastructure or applications. This cadence ensures that newly exposed services or configuration changes are validated against real-world attack techniques. The other options misstate the frequency or scope.

Answer

Every 30 days continuously across all internal subnets

Answer

Annually following the completion of the fiscal budget review

Answer

Only upon the initial deployment of the cardholder data environment

Question 10

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

Accepted Answer

User Responsibilities and Data Sharing. The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Answer

Physical Security Controls

Answer

Disaster Recovery Protocols

Answer

Network Infrastructure Redundancy

Question 11

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

Accepted Answer

SR (Supply Chain Risk Management). NIST SP 800-53 Revision 5 introduced the SR (Supply Chain Risk Management) control family specifically to address supply chain risk governance, including processes for identifying, assessing, and mitigating risks from suppliers and third parties. The NIST CSF v2.0 Govern function's supply chain risk management outcomes map directly to the SR family controls.

Answer

PL (Planning)

Answer

CA (Assessment, Authorization, and Monitoring)

Answer

SC (System and Communications Protection)

Question 12

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

Accepted Answer

Active Directory Account Access Logs and Group Memberships. To verify that administrative accounts are not sharing credentials and to validate individual accountability, the auditor must inspect Active Directory account access logs and group memberships. These artifacts show which accounts exist, who is a member of privileged groups, and when each account was used to log on. If multiple administrators are using the same account, the logon events will show the same account name from different workstations or at overlapping times, which is the evidence of shared credentials.

Answer

BGP Routing Table Summaries

Answer

Network Switch Port VLAN Assignments

Answer

DNS Zone File Configurations

Question 13

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

Accepted Answer

Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs. The principle of least privilege requires that firewall rules between the DMZ and the internal application tier follow an implicit deny posture, permitting only the specific destination ports and IP addresses required for legitimate application traffic. This limits lateral movement if the DMZ is compromised, since an attacker cannot reach arbitrary internal hosts or services. Explicitly enumerating allowed flows also produces an auditable rule set that supports network defense lifecycle management (design, implement, monitor, maintain).

Answer

Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic

Answer

Disable firewall packet filtering on internal interfaces to maximize application throughput

Answer

Permit all internal traffic by default, blocking only known malicious signatures

Question 14

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

Accepted Answer

Information Security Policy. An Information Security Policy is the top-level, umbrella document that establishes the organization's overall security objectives, scope, roles, and principles — including how data is classified, handled, and disposed of. All other policies (patch management, remote access, firewall configuration) derive from and must align with it. Drafting it first creates the baseline expectations that subordinate policies implement.

Answer

Patch Management Policy

Answer

Remote Access Policy

Answer

Firewall Configuration Policy

Question 15

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

Accepted Answer

XCCDF (Extensible Configuration Checklist Description Format). XCCDF is the SCAP standard for expressing security configuration checklists and vulnerability assessments in a machine-readable XML format. OpenSCAP consumes XCCDF documents (often paired with OVAL definitions) to perform automated compliance scans. It is the correct data format for authoring SCAP-compliant checklists.

Answer

Syslog RFC 5424

Answer

CSV (Comma-Separated Values)

Answer

SNMP MIB (Management Information Base)

Question 16

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

Accepted Answer

Establishing the CSIRT, defining escalation paths, and drafting incident response procedures. ISO/IEC 27035's 'Planning and Preparation' phase is about building the incident management capability before incidents occur — establishing the CSIRT, defining escalation paths, and drafting incident response procedures. These governance activities ensure that when a major breach happens, roles, communication channels, and playbooks are already in place. The other options describe actions taken during detection, response, or post-incident phases.

Answer

Isolating compromised VLANs from the core routing backbone during an active attack

Answer

Restoring critical database backups from immutable offsite storage vaults

Answer

Performing root-cause analysis on active command-and-control channels

Question 17

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

Accepted Answer

Audit and Accountability Retention Policy Violation. The scenario describes security audit logs being purged after 7 days when compliance requires 365-day retention. This is a direct failure of the audit and accountability retention policy — the organization's logging retention controls do not meet the mandated retention period. The control family (Audit and Accountability) and the specific failure (retention policy violation) match exactly.

Answer

Configuration Management Baseline Drift

Answer

Network Redundancy Fault Tolerance Failure

Answer

Access Control Discretionary Discrepancy

Question 18

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

Accepted Answer

Annualized Loss Expectancy (ALE). Annualized Loss Expectancy (ALE) is the correct answer because it quantifies financial exposure in monetary terms by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). This allows a CISO to translate technical risk into a dollar figure that a board of directors can directly understand and use for budget and risk-acceptance decisions. It is the standard quantitative risk metric used in executive risk reporting.

Answer

Packet drop rate on enterprise core firewalls

Answer

Common Vulnerability Scoring System (CVSS) base score

Answer

Active directory domain controller CPU utilization

Question 19

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping SIEM logs to MITRE ATT&CK enriches alerts with context about which adversary tactic or technique the observed behavior represents (e.g., T1059 Command and Scripting Interpreter). This lets defenders prioritize, correlate, and communicate incidents in a shared vocabulary tied to real-world threat actor behavior. It transforms raw log events into actionable intelligence aligned to the kill chain, improving detection engineering and response.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 20

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

Accepted Answer

SSH (Secure Shell) version 2. SSH version 2 provides strong encryption for all traffic, including authentication and command-line sessions, using algorithms like AES and Diffie-Hellman key exchange. This satisfies the policy requirement for an encrypted tunnel during remote administration. Telnet, TFTP, and HTTP transmit data in cleartext, offering no confidentiality. Therefore, SSHv2 is the only listed protocol that meets the encryption mandate.

Answer

TFTP (Trivial File Transfer Protocol)

Answer

HTTP over port 80

Answer

Telnet over port 23