CND Network Defense Management — 25 Questions

Question 1

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identifying and cataloging all network assets, data flows, and current vulnerabilities. The Assessment and Analysis phase evaluates existing network assets, vulnerabilities, and baseline security posture to inform defense strategies.

Answer

Conducting incident containment following a zero-day breach

Answer

Deploying next-generation firewalls across core network segments

Answer

Decommissioning obsolete routers and end-of-life switches

Question 2

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

Accepted Answer

At least every 6 months and after any significant infrastructure modification. PCI-DSS v4.0 Requirement 11.3.1 mandates that external penetration testing be performed at least once every 6 months and after any significant infrastructure change.

Answer

Every 30 days continuously across all internal subnets

Answer

Annually following the completion of the fiscal budget review

Answer

Only upon the initial deployment of the cardholder data environment

Question 3

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

Accepted Answer

User Responsibilities and Data Sharing. The Acceptable Use Policy (AUP) explicitly defines what employees can and cannot do using company hardware and networks, including cloud collaboration tools.

Answer

Physical Security Controls

Answer

Disaster Recovery Protocols

Answer

Network Infrastructure Redundancy

Question 4

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

Accepted Answer

SR (Supply Chain Risk Management). NIST SP 800-53 Rev. 5 includes the Supply Chain Risk Management (SR) control family, which directly supports supply chain security governance.

Answer

PL (Planning)

Answer

CA (Assessment, Authorization, and Monitoring)

Answer

SC (System and Communications Protection)

Question 5

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

Accepted Answer

Active Directory Account Access Logs and Group Memberships. Account management policies and access control lists detailing individual named accounts versus shared accounts are required for individual accountability.

Answer

BGP Routing Table Summaries

Answer

Network Switch Port VLAN Assignments

Answer

DNS Zone File Configurations

Question 6

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

Accepted Answer

Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs. Least privilege requires dropping all traffic by default and explicitly permitting only required ports and IP addresses necessary for business operations.

Answer

Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic

Answer

Disable firewall packet filtering on internal interfaces to maximize application throughput

Answer

Permit all internal traffic by default, blocking only known malicious signatures

Question 7

An enterprise is aligning its network defense governance model with ISO/IEC 27001. During the implementation of Clause 6 (Planning), the security team must identify information security risks. Which specific ISO/IEC 27001:2013 standard provides the catalog of controls that must be mapped to these identified risks?

Accepted Answer

ISO/IEC 27002. ISO/IEC 27002 provides the code of practice for information security controls, serving as the companion reference for ISO/IEC 27001 risk treatment.

Answer

ISO/IEC 27005

Answer

ISO/IEC 27701

Answer

ISO/IEC 27035

Question 8

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

Accepted Answer

Information Security Policy. A corporate information security policy establishes the overarching baseline expectations and security posture for data handling across the organization.

Answer

Patch Management Policy

Answer

Remote Access Policy

Answer

Firewall Configuration Policy

Question 9

An organization is drafting a password policy. To balance security with user usability, which requirement represents modern industry best practices aligned with NIST SP 800-63B guidelines?

Accepted Answer

Enforcing a minimum length of 8 characters and allowing password managers. NIST SP 800-63B recommends favoring length over complexity, removing mandatory periodic password resets unless compromise is suspected.

Answer

Requiring uppercase, lowercase, numbers, and symbols with 90-day rotations

Answer

Banning passphrases in favor of 6-character complex alphanumeric strings

Answer

Mandating password changes every 30 days regardless of compromise

Question 10

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

Accepted Answer

XCCDF (Extensible Configuration Checklist Description Format). The Extensible Configuration Checklist Description Format (XCCDF) is an SCAP component used for writing security checklists and benchmarks.

Answer

Syslog RFC 5424

Answer

CSV (Comma-Separated Values)

Answer

SNMP MIB (Management Information Base)

Question 11

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

Accepted Answer

Establishing the CSIRT, defining escalation paths, and drafting incident response procedures. ISO/IEC 27035 requires establishing an incident management policy, forming a Computer Security Incident Response Team (CSIRT), and defining clear escalation procedures during the preparation phase.

Answer

Isolating compromised VLANs from the core routing backbone during an active attack

Answer

Restoring critical database backups from immutable offsite storage vaults

Answer

Performing root-cause analysis on active command-and-control channels

Question 12

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

Accepted Answer

Audit and Accountability Retention Policy Violation. Regulatory and compliance frameworks mandate specific log retention periods to ensure forensic recoverability and auditability.

Answer

Configuration Management Baseline Drift

Answer

Network Redundancy Fault Tolerance Failure

Answer

Access Control Discretionary Discrepancy

Question 13

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

Accepted Answer

Annualized Loss Expectancy (ALE). Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) translate technical risks into business financial terms.

Answer

Packet drop rate on enterprise core firewalls

Answer

Common Vulnerability Scoring System (CVSS) base score

Answer

Active directory domain controller CPU utilization

Question 14

An organization is conducting a security audit of its wireless network infrastructure. The auditor verifies that WPA3-Enterprise is deployed with Protected Extensible Authentication Protocol (PEAP). Which governance objective is primarily achieved by this configuration?

Accepted Answer

Strong mutual authentication and cryptographic protection of wireless user sessions. WPA3-Enterprise with 192-bit security and robust authentication ensures strong mutual authentication and encryption, satisfying enterprise access control governance.

Answer

Automated patching of endpoint operating system kernels

Answer

Prevention of physical layer cable tapping and electromagnetic emissions

Answer

Enforcement of BGP route validation and origin autonomy

Question 15

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping logs to MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques, enabling precise detection engineering and gap analysis.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 16

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

Accepted Answer

SSH (Secure Shell) version 2. SSH (Secure Shell) provides encrypted command-line management, replacing unencrypted protocols like Telnet.

Answer

TFTP (Trivial File Transfer Protocol)

Answer

HTTP over port 80

Answer

Telnet over port 23

Question 17

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

Accepted Answer

Documenting the business justification, performing risk assessment, and obtaining CAB approval. Change management requires formal peer review, security impact analysis, and change advisory board (CAB) approval prior to production deployment.

Answer

Deleting all existing firewall rules to ensure a clean rulebase state

Answer

Immediately pushing the rule via automated script without prior peer review to minimize downtime

Answer

Disabling change logging to save disk space on the management server

Question 18

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

Accepted Answer

Conducting automated authenticated vulnerability scans of all internal and external assets on a regular schedule. CIS Control 4 requires running continuous automated vulnerability scans of all assets and validating remediation patching cadences.

Answer

Performing manual penetration testing once every five years

Answer

Deploying hardware token multi-factor authentication for VPN users

Answer

Restricting administrative access to local console connections only

Question 19

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

Accepted Answer

Implementing strict network segmentation and firewall micro-perimeter isolation around the legacy host. When legacy systems cannot be replaced, compensating controls such as network micro-segmentation and strict firewall filtering must be applied.

Answer

Exposing the legacy host directly to the public internet for easier monitoring

Answer

Disabling the system logging service to prevent disk space exhaustion

Answer

Granting full local administrator privileges to all domain users

Question 20

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

Accepted Answer

Design Phase. Threat modeling should occur during the design phase of the SSDLC to identify and mitigate architectural flaws early.

Answer

Retirement Phase

Answer

Maintenance Phase

Answer

Deployment Phase