CND Network Defense Management Practice Test 2 — 15 Questions

Question 1

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing the CSIRT, defining escalation paths, and drafting incident response procedures. ISO/IEC 27035's 'Planning and Preparation' phase is about building the incident management capability before incidents occur — establishing the CSIRT, defining escalation paths, and drafting incident response procedures. These governance activities ensure that when a major breach happens, roles, communication channels, and playbooks are already in place. The other options describe actions taken during detection, response, or post-incident phases.

Answer

Isolating compromised VLANs from the core routing backbone during an active attack

Answer

Restoring critical database backups from immutable offsite storage vaults

Answer

Performing root-cause analysis on active command-and-control channels

Question 2

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

Accepted Answer

Audit and Accountability Retention Policy Violation. The scenario describes security audit logs being purged after 7 days when compliance requires 365-day retention. This is a direct failure of the audit and accountability retention policy — the organization's logging retention controls do not meet the mandated retention period. The control family (Audit and Accountability) and the specific failure (retention policy violation) match exactly.

Answer

Configuration Management Baseline Drift

Answer

Network Redundancy Fault Tolerance Failure

Answer

Access Control Discretionary Discrepancy

Question 3

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

Accepted Answer

Annualized Loss Expectancy (ALE). Annualized Loss Expectancy (ALE) is the correct answer because it quantifies financial exposure in monetary terms by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). This allows a CISO to translate technical risk into a dollar figure that a board of directors can directly understand and use for budget and risk-acceptance decisions. It is the standard quantitative risk metric used in executive risk reporting.

Answer

Packet drop rate on enterprise core firewalls

Answer

Common Vulnerability Scoring System (CVSS) base score

Answer

Active directory domain controller CPU utilization

Question 4

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping SIEM logs to MITRE ATT&CK enriches alerts with context about which adversary tactic or technique the observed behavior represents (e.g., T1059 Command and Scripting Interpreter). This lets defenders prioritize, correlate, and communicate incidents in a shared vocabulary tied to real-world threat actor behavior. It transforms raw log events into actionable intelligence aligned to the kill chain, improving detection engineering and response.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 5

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

Accepted Answer

SSH (Secure Shell) version 2. SSH version 2 provides strong encryption for all traffic, including authentication and command-line sessions, using algorithms like AES and Diffie-Hellman key exchange. This satisfies the policy requirement for an encrypted tunnel during remote administration. Telnet, TFTP, and HTTP transmit data in cleartext, offering no confidentiality. Therefore, SSHv2 is the only listed protocol that meets the encryption mandate.

Answer

TFTP (Trivial File Transfer Protocol)

Answer

HTTP over port 80

Answer

Telnet over port 23

Question 6

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

Accepted Answer

Documenting the business justification, performing risk assessment, and obtaining CAB approval. Firewall rule changes in production require documented business justification, a risk assessment of the change's impact, and approval from the Change Advisory Board (CAB) before deployment. This ensures the change is authorized, auditable, and aligned with the organization's risk appetite. Skipping any of these steps violates ITIL-aligned change management and can introduce security gaps or outages.

Answer

Deleting all existing firewall rules to ensure a clean rulebase state

Answer

Immediately pushing the rule via automated script without prior peer review to minimize downtime

Answer

Disabling change logging to save disk space on the management server

Question 7

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

Accepted Answer

Conducting automated authenticated vulnerability scans of all internal and external assets on a regular schedule. CIS Control 4 (Continuous Vulnerability Management) requires automated, authenticated vulnerability scanning of all internal and external assets on a regular schedule, with remediation tracked. Authenticated scans provide deeper visibility into installed software and missing patches than unauthenticated scans. This is the core activity auditors look for to demonstrate compliance with Control 4.

Answer

Performing manual penetration testing once every five years

Answer

Deploying hardware token multi-factor authentication for VPN users

Answer

Restricting administrative access to local console connections only

Question 8

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

Accepted Answer

Implementing strict network segmentation and firewall micro-perimeter isolation around the legacy host. When immediate replacement of an end-of-life OS is impossible, best practice is to isolate the legacy host using strict network segmentation and firewall micro-perimeter controls. This limits the attack surface and prevents lateral movement, even if the host is compromised. Segmentation buys time until a replacement can be deployed.

Answer

Exposing the legacy host directly to the public internet for easier monitoring

Answer

Disabling the system logging service to prevent disk space exhaustion

Answer

Granting full local administrator privileges to all domain users

Question 9

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

Accepted Answer

Design Phase. Threat modeling is most effective when integrated during the Design Phase because that is when architectural decisions, data flows, and trust boundaries are defined. Identifying threats at this stage allows flaws to be remediated before code is written, which is far cheaper than fixing them later. This aligns with SSDLC best practices (e.g., Microsoft SDL, OWASP SAMM).

Answer

Retirement Phase

Answer

Maintenance Phase

Answer

Deployment Phase

Question 10

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

Accepted Answer

LLMNR/NBT-NS poisoning and credential relay attacks. Disabling LLMNR mitigates LLMNR/NBT-NS poisoning and credential relay attacks, where an attacker responds to broadcast name resolution requests to impersonate a legitimate host and capture NTLMv2 hashes for offline cracking or relay. LLMNR is a multicast protocol (224.0.0.252, ff02::1:3) that Windows uses as a fallback when DNS fails, and tools like Responder exploit it. Disabling it forces resolution through DNS, reducing the attack surface.

Answer

SQL injection vulnerabilities in web application forms

Answer

BGP prefix hijacking and route table poisoning

Answer

DNS zone transfer enumeration via nslookup

Question 11

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

Accepted Answer

Full Disk Encryption (such as BitLocker or FileVault). Full Disk Encryption (FDE) technologies like BitLocker (Windows) and FileVault (macOS) encrypt the entire storage volume at rest, ensuring that if a laptop is lost or stolen, the data cannot be read without the decryption key. This directly satisfies the policy requirement that sensitive data at rest on laptops be cryptographically protected. FDE operates below the file system, protecting OS files, swap space, and user data uniformly.

Answer

Transport Layer Security (TLS) version 1.3

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Intrusion Detection System (IDS) signature files

Question 12

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

Accepted Answer

Remediation VLAN / Quarantine Network. Non-compliant endpoints in a NAC governance policy should be placed in a remediation VLAN or quarantine network, which is an isolated segment designed to restrict access while allowing remediation resources (e.g., antivirus updates, patch servers). This prevents compromised or non-compliant devices from accessing sensitive internal resources.

Answer

Unrestricted guest wireless broadcast zone

Answer

Core router management loopback subnet

Answer

DMZ (Demilitarized Zone) web server farm

Question 13

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

Accepted Answer

Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows. Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows provides continuous, automated log review that satisfies ISO/IEC 27001 A.12.4.1. The SIEM aggregates logs, correlates events, and generates alerts for analyst review, ensuring regular monitoring and governance. This is the most effective automated practice for meeting the control's requirement for regular review.

Answer

Disabling log verbosity to prevent storage overhead on the central syslog collector

Answer

Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter

Answer

Relying entirely on end users to manually report anomalous log entries via email

Question 14

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

Accepted Answer

Board of Directors and Executive Management. The Board of Directors and Executive Management hold ultimate legal and fiduciary responsibility for an organization's information security posture and risk management decisions. This is because they are accountable to shareholders, regulators, and other stakeholders for the overall governance of the organization, including cybersecurity risk. They set the tone at the top, approve security strategies, and ensure adequate resources are allocated to mitigate risks. While other roles may implement or assess security controls, the ultimate accountability cannot be delegated.

Answer

Junior Firewall Configuration Engineer

Answer

Third-Party External Penetration Testing Consultant

Answer

Lead Network Helpdesk Support Technician

Question 15

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

Accepted Answer

TACACS+ for device administration and RADIUS for dial-in/remote user access. TACACS+ and RADIUS together represent the industry-standard AAA combination for network device administration. TACACS+ is preferred for device administration because it separates authentication, authorization, and accounting into distinct functions and encrypts the entire payload, while RADIUS is commonly used for dial-in and remote user access with its UDP-based, attribute-value pair model. This split is a long-standing Cisco and general networking best practice.

Answer

DNSSEC for device privilege authorization

Answer

HTTP Basic Authentication for router console access

Answer

SNMPv1 for authentication and TFTP for accounting