CND Network Perimeter Protection Practice Test 2 — 15 Questions

Question 1

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for encrypted remote command-line management of network devices, replacing plaintext Telnet on port 23. SSH operates on TCP port 22 and provides confidentiality, integrity, and authentication via cryptographic key exchange, making it the correct choice for secure CLI management of perimeter devices.

Answer

HTTP

Answer

SNMPv1

Answer

TFTP

Question 2

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

Accepted Answer

IEEE 802.1Q. IEEE 802.1Q is the standard that defines VLAN tagging on Ethernet frames, inserting a 4-byte tag into the frame header that carries the VLAN ID (12 bits, supporting 4094 usable VLANs). On a trunk link between switches, 802.1Q tags each frame so the receiving switch knows which VLAN the frame belongs to, enabling logical segmentation of the finance and HR departments across shared physical infrastructure.

Answer

IEEE 802.1X

Answer

IEEE 802.3ad

Answer

IEEE 802.11i

Question 3

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Accepted Answer

Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection). In Palo Alto Networks PAN-OS, threat profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis) are attached to a Security Policy rule under the Actions tab in the Profile Setting section. This is where the firewall applies content inspection to traffic matching the rule, enabling signature-based malware detection and vulnerability exploit prevention.

Answer

Zone Protection Profile attached to the external zone

Answer

NAT Policy translation destination field

Answer

Network Interfaces configuration tab

Question 4

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

Accepted Answer

Change the specific offending signature action from block/drop to alert (log-only) mode.. The immediate, surgical fix is to change the specific offending signature's action from block/drop to alert (log-only) so the false-positive traffic flows while the IPS still inspects and logs it. This preserves perimeter visibility and detection coverage for all other signatures, and gives the team time to tune the signature or write an exception for the custom protocol. It is the standard 'tune, don't disable' response to IPS false positives.

Answer

Change the firewall default gateway to the backup ISP.

Answer

Disable the entire IPS inspection engine globally.

Answer

Bypass the IPS by moving it from inline mode to out-of-band monitoring mode.

Question 5

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

Accepted Answer

To passively monitor and analyze network traffic copies for malicious signatures and anomalies.. A NIDS deployed in promiscuous mode on a SPAN/mirror port receives copies of all traffic traversing the monitored segment, allowing it to passively inspect packets for malicious signatures and anomalies without affecting traffic flow. Promiscuous mode lets the NIC accept frames not addressed to it, which is essential for seeing all mirrored traffic.

Answer

To actively block and drop malicious packets inline.

Answer

To act as the default gateway for the DMZ network.

Answer

To perform Network Address Translation for internal hosts.

Question 6

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

Accepted Answer

VRRP (Virtual Router Redundancy Protocol). VRRP (Virtual Router Redundancy Protocol) is designed to provide first-hop redundancy by allowing multiple routers or firewalls to share a virtual IP address and MAC address. The active device owns the virtual IP and forwards traffic, while the standby takes over seamlessly if the active fails, ensuring continuous availability for hosts that use the virtual IP as their default gateway.

Answer

RADIUS

Answer

BGP (Border Gateway Protocol)

Answer

DHCP (Dynamic Host Configuration Protocol)

Question 7

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

Accepted Answer

nft add table inet filter; nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }. The correct nftables command sequence creates a table named 'filter' in the inet family, adds a base chain named 'input' with type filter, hook input, priority 0, and policy drop. This sets up packet filtering with a default drop policy for incoming traffic.

Answer

nftables create filter-table --default-drop

Answer

iptables -P INPUT DROP

Answer

ufw default deny incoming

Question 8

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

Accepted Answer

Stateful Session Synchronization (Cluster State Sync). Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Answer

Strict TCP handshake validation

Answer

Unicast RPF (Reverse Path Forwarding)

Answer

NAT hairpinning

Question 9

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

Accepted Answer

Application Gateway (Proxy Firewall). An Application Gateway (Proxy Firewall) operates at Layer 7 (application) and understands specific application protocols like HTTP, FTP, and SIP. It acts as an intermediary, terminating client connections and initiating new ones to the server, allowing deep inspection of application-layer payloads for granular filtering. This is also known as a proxy firewall or application-level gateway.

Answer

Unmanaged Switch

Answer

Packet Filtering Firewall

Answer

Hub

Question 10

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

Accepted Answer

Network Segmentation. Network segmentation is the practice of dividing a large network into smaller, isolated subnetworks (segments) using VLANs, subnets, firewalls, or SDN policies to limit the blast radius of a breach and restrict lateral movement. It is a foundational zero-trust and defense-in-depth control.

Answer

Packet Fragmentation

Answer

Network Bridging

Answer

Network Flooding

Question 11

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

Accepted Answer

Reverse Path Forwarding (RPF) / uRPF. Reverse Path Forwarding (RPF) or unicast RPF (uRPF) is a feature that checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface that the router would use to send traffic back to that source. If the packet arrives on a different interface, it is dropped, which prevents IP spoofing. This is exactly what the question describes.

Answer

Proxy ARP

Answer

Spanning Tree Protocol (STP)

Answer

Network Address Translation (NAT)

Question 12

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Accepted Answer

Optical Network Tap (Test Access Point). Option A (Optical Network Tap, or Test Access Point) is correct because a passive optical tap splits the light signal so a copy of the traffic is sent to the NIDS while the original traffic continues uninterrupted, which is a standard out-of-band collection method. Option D (Switch Port Analyzer, or SPAN/Mirror Port) is correct because SPAN copies frames from one or more switch ports or VLANs to a monitoring port where the NIDS sensor is connected, making it a common way to collect traffic for analysis. Option B is not a collection method but an inline active blocking mechanism, which describes IPS functionality rather than NIDS traffic capture. Option C is incorrect because modifying external client TCP/IP stacks is not a deployment mode for collecting traffic and would be an endpoint-based approach, not a NIDS collection method. Option E is incorrect because DHCP broadcasts are used for address assignment, not for rewriting routing tables to collect traffic for a NIDS.

Answer

Inline active blocking mechanism that terminates malicious TCP sessions directly

Answer

Directly modifying the TCP/IP stack of external client operating systems

Answer

Using DHCP broadcast packets to rewrite routing tables

Question 13

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

Accepted Answer

Enhanced enforcement of granular access control policies between zones. Option B is correct because network segmentation divides the enterprise into distinct zones (e.g., DMZ, internal, PCI, guest) separated by firewalls or ACLs, which allows granular, zone-to-zone access control policies to be enforced rather than relying on a flat network with broad trust. Option E is correct because segmentation limits an attacker's ability to move laterally after compromising a host; by restricting east-west traffic between segments, a breach is contained within its zone, reducing blast radius and dwell time. The unmarked options do not belong: A is false because segmentation complements, not replaces, firewalls and monitoring; C is false because no architecture guarantees prevention of all zero-day malware on endpoints; and D is false because segmentation does not automatically encrypt data at rest, nor does encryption come without performance overhead.

Answer

Elimination of the need for any firewalls or security monitoring

Answer

Guaranteed prevention of all zero-day malware infections on endpoints

Answer

Automatic encryption of all data at rest without performance overhead

Question 14

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Accepted Answer

Application awareness and identification (App-ID). Option A is correct because Enterprise NGFWs use deep packet inspection and application signatures (e.g., Palo Alto App-ID, Cisco NBAR) to identify applications regardless of port or protocol, which traditional stateful firewalls cannot do since they only track TCP/UDP sessions and ports. Option E is correct because NGFWs integrate user identification (e.g., User-ID via Active Directory, LDAP, or Captive Portal) to enforce policies based on user or group identity rather than just IP addresses, a capability absent from traditional stateful firewalls. Option B is incorrect because NGFWs operate at Layers 3 through 7, not exclusively at Layer 2. Option C is incorrect because NGFWs commonly decrypt and inspect HTTPS traffic via SSL/TLS decryption. Option D is incorrect because NGFWs use identity, application, and content-based controls, not static MAC address filtering.

Answer

Strict restriction to operating exclusively at Layer 2 (Data Link layer)

Answer

Inability to inspect encrypted HTTPS traffic under any circumstances

Answer

Exclusive reliance on static MAC address filtering for access control

Question 15

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.