CND Network Perimeter Protection Practice Test 3 — 15 Questions

Question 1

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Accepted Answer

Perimeter firewalls controlling traffic entering and leaving the zone. Option A is correct because a DMZ is by definition a segmented perimeter network, and perimeter firewalls (often deployed as an external firewall facing the Internet and an internal firewall facing the trusted LAN) enforce the access-control policy that governs traffic entering and leaving the zone. Option D is correct because the classic purpose of a DMZ is to host public-facing services such as web, mail, DNS, or reverse-proxy servers that must be reachable from untrusted networks while being isolated from the internal corporate network. Option B is incorrect because hubs are legacy, unswitched devices that broadcast all traffic to every port and provide no segmentation or access control, making them unsuitable for any security zone, let alone a DMZ. Option C is incorrect because internal Active Directory domain controllers authenticate users and hold sensitive directory data, so placing them in a DMZ would expose the core identity infrastructure to Internet-facing threats; DMZ hosts should use separate, isolated identity services if needed. Option E is incorrect because unrestricted direct fiber links to employee home routers would bypass perimeter firewalls and create an unmonitored, unauthenticated path into the enterprise network, violating DMZ segmentation principles.

Answer

Unprotected hubs connecting all corporate workstations

Answer

Internal active directory domain controllers serving workstation logins

Answer

Unrestricted direct fiber connections to employee home routers

Question 2

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

Accepted Answer

Throughput capacity and latency impact under peak load. Option A is correct because an inline IPS sits directly in the traffic path, so its throughput capacity and added latency under peak load determine whether it can inspect every packet without becoming a bottleneck or causing timeouts. Option B is correct because inline IPS devices must define fail-open versus fail-closed behavior (often via hardware bypass NICs or external bypass switches) so that a power or software failure either preserves connectivity or intentionally blocks traffic according to policy. Option E is correct because poorly tuned signatures generate false positives that drop legitimate production traffic, so signature tuning and threshold adjustment are essential to avoid self-inflicted outages. Option C is incorrect because an IPS is not a DNS root server and has no role in authoritative DNS resolution. Option D is incorrect because cable color is a physical labeling convention with no bearing on IPS operation or network disruption.

Answer

Configuring the IPS to act as an authoritative DNS root server

Answer

The physical cable color used for connection to the core switch

Question 3

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

Accepted Answer

Deploying zone protection or flood protection profiles against SYN and UDP floods. Option A is correct because zone protection and flood protection profiles (e.g., on Palo Alto or equivalent firewalls) apply SYN flood, UDP flood, and ICMP flood thresholds to drop volumetric attack traffic before it exhausts session tables. Option B is correct because exposing SSH/HTTPS management on the untrusted external interface invites brute-force and exploitation attempts; management should be restricted to a trusted internal interface or out-of-band path. Option C is correct because unicast Reverse Path Forwarding (uRPF) validates the source address against the routing table, dropping packets with spoofed source IPs commonly used in reconnaissance and reflection attacks. Option D is wrong because default administrator credentials are publicly known and must always be changed during hardening. Option E is wrong because permitting all inbound ICMP echo requests without rate limiting enables ping sweeps, ICMP floods, and tunneling, so ICMP should be rate-limited or selectively filtered.

Answer

Leaving default administrator credentials unchanged for rapid access

Answer

Permitting all inbound ICMP echo requests without rate limiting

Question 4

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

Accepted Answer

It consists of multiple interconnected decoy systems simulating an entire network environment.. Option D is correct because a honeynet is by definition a collection of two or more honeypots deployed together and interconnected to emulate a realistic network segment, complete with servers, services, and topology, rather than a single isolated decoy host. Option E is correct because this multi-system design lets defenders observe attacker behavior across hosts, including reconnaissance, pivoting, and lateral movement, yielding richer threat intelligence than a lone honeypot can provide. The unmarked options do not belong: A is wrong because honeynets are heavily instrumented with logging, monitoring, and often IDS/IPS sensors, and are typically placed in a controlled DMZ or isolated segment rather than the unprotected core internal network; B is wrong because a honeynet is a deception and threat-intelligence tool, not a production database cluster; and C is wrong because a honeynet is a complementary detection layer and never replaces firewalls or perimeter defenses.

Answer

It is deployed on the core internal network without any logging or monitoring.

Answer

It is used exclusively as a high-performance database cluster for enterprise clients.

Answer

It replaces the need for any firewalls or perimeter security defenses.

Question 5

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). Signature-based detection is a core IDPS methodology: the sensor compares packet payloads and headers against a database of known attack patterns, byte sequences, and Snort/Suricata-style rules, generating an alert when a match occurs. Option E is also correct because anomaly-based detection builds a statistical or behavioral baseline of normal traffic (protocols, ports, bandwidth, connection rates) and flags deviations from that baseline as potential intrusions, which allows it to catch novel or previously unseen attacks. The remaining options are not IDPS detection methods: A describes illicit exploit acquisition, not traffic inspection; B is a nonsensical signal-conversion idea unrelated to packet analysis; and D is a manual network-availability action, not a detection technique.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours

Question 6

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

Accepted Answer

Configuring a management IP address on a management interface or BVI (Bridge Virtual Interface) for device access. In Transparent (Layer 2) mode, the firewall forwards frames between interfaces in the same bridge domain without acting as a Layer 3 hop, so option D is correct: a management IP must be assigned to a dedicated management interface or a BVI so administrators can reach the device for configuration, monitoring, and updates, since the data interfaces themselves carry no routable addresses. Option E is also correct because the participating interfaces must be bound into a common bridge group (or equivalent Layer 2 zone) so the firewall can bridge traffic between them and apply policy to the bridged flows. Option A is wrong because assigning Layer 3 IPs to every data interface is characteristic of Routed mode, not Transparent mode, where data interfaces remain unnumbered. Option B is wrong because BGP peering requires Layer 3 adjacency and is irrelevant to a Layer 2 bridge deployment. Option C is wrong because transparent firewalls still enforce security rules on bridged traffic; Layer 2 operation does not disable filtering.

Answer

Assigning Layer 3 IP addresses to every data interface participating in packet routing

Answer

Configuring dynamic BGP peering on all client-facing ports

Answer

Removing all security rules since Layer 2 devices cannot filter traffic

Question 7

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

Accepted Answer

iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP. The --tcp-flags option takes two arguments: a mask of flags to examine and a comparison list of flags that must be set. 'SYN,FIN SYN,FIN' means 'examine the SYN and FIN bits, and match only if both are set,' which precisely targets the malformed SYN+FIN combination. The -j DROP then discards matching packets.

Answer

iptables -A INPUT -p tcp --syn --fin -j DROP

Answer

iptables -A INPUT -p tcp --flags ALL SYN,FIN -j DROP

Answer

iptables -A INPUT -p tcp --match flags --syn-fin -j DROP

Question 8

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Accepted Answer

Never allow direct, uninspected traffic from the external zone to pass straight through the DMZ into the internal network.. Option B is correct because a core DMZ design rule is that traffic from the external/untrusted zone must never be permitted to traverse the DMZ and reach the internal network without being terminated, inspected, or proxied by a security control; this prevents attackers from using the DMZ as a pivot point. Option C is correct because public-facing services such as web and DNS servers are the classic DMZ residents — they must be reachable from the internet, so placing them in the DMZ isolates them from the protected internal network. Option D is correct because least privilege applied through granular firewall rules between the DMZ and the internal network limits lateral movement; only specific, required flows (for example, a web server initiating a single TCP port to a specific backend database) should be allowed. Option A is incorrect because granting internal users unrestricted, unmonitored access to DMZ administrative portals violates least privilege and monitoring requirements, turning the DMZ into an unmanaged attack path. Option E is incorrect because disabling perimeter firewall logging destroys the audit trail needed for detection, incident response, and compliance; logging should be retained and tuned, not turned off.

Answer

Allow internal users unrestricted, unmonitored access to all DMZ administrative portals by default.

Answer

Disable all logging on perimeter firewalls to conserve CPU cycles.

Question 9

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

Accepted Answer

Traceroute / ping utilities to test end-to-end path connectivity and TTL expiration. Option A is correct because traceroute and ping utilities test end-to-end path connectivity and reveal where TTL expiration or ICMP unreachables occur, helping localize the hop or firewall at which packets stop traversing the path. Option B is correct because packet analyzers such as tcpdump or Wireshark capturing on the firewall's ingress and egress interfaces show whether packets actually arrive, are malformed, or are dropped before/after inspection, providing ground-truth evidence of the drop point. Option C is correct because firewall packet flow tracing/debug tools like Cisco ASA packet-tracer or Palo Alto's global packet diagnostic simulate or follow a specific flow through the policy, NAT, and inspection stages, explicitly reporting the rule or stage that drops the packet. Option D does not belong because reformatting the firewall disk and reinstalling BIOS firmware is a destructive hardware/firmware recovery action, not a diagnostic method for identifying where traffic is dropped. Option E does not belong because permanently disconnecting all internal switch uplinks would cause an outage and remove the traffic needed for diagnosis rather than help identify the drop cause.

Answer

Reformatting the firewall hard drive and reinstalling the BIOS firmware

Answer

Disconnecting all internal switch uplinks permanently

Question 10

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

Accepted Answer

Enable Deep Packet Inspection (DPI) with protocol decoding for FTP to dynamically open pinholes for data channels.. To support active FTP, the firewall must inspect the FTP control channel (port 21) and dynamically open ephemeral data ports based on the PORT/PASV commands. This requires Deep Packet Inspection (DPI) with an FTP protocol decoder, which allows the firewall to understand FTP signaling and create temporary pinholes. Enabling DPI for FTP is the correct mechanism to handle the dynamic nature of FTP data connections.

Answer

Implement an explicit HTTP Proxy service with SSL/TLS decryption enabled.

Answer

Configure a static Destination NAT (DNAT) rule mapping port 21 to an internal range of ephemeral ports.

Answer

Disable stateful tracking for FTP traffic and rely strictly on stateless packet filtering access control lists.

Question 11

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

Accepted Answer

Honeyd. Honeyd is a low-interaction honeypot framework that emulates virtual hosts and services at the network level, letting defenders detect scanning and probing without exposing a real OS. It responds to connection attempts with simulated service banners, so there is no actual system to compromise.

Answer

Kali Linux Metasploitable

Answer

Snort IDS

Answer

Wireshark

Question 12

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

Accepted Answer

Demilitarized Zone (DMZ). The Demilitarized Zone (DMZ) is the segmented network zone designed to host public-facing services such as web servers, mail relays, and reverse proxies. It sits between the untrusted internet and the trusted internal LAN, with distinct firewall contexts controlling traffic in each direction, so a compromise of a public server does not grant direct access to internal systems.

Answer

Management VLAN

Answer

Internal Trusted Zone

Answer

Guest Wireless Zone

Question 13

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

Accepted Answer

NGFWs can identify applications regardless of port numbers using Deep Packet Inspection and heuristic analysis.. Option B is correct because NGFWs use Deep Packet Inspection (DPI) and heuristic/behavioral analysis to identify applications by their traffic signatures and behavior, allowing them to recognize applications even when they run on non-standard ports or tunnel over HTTP/HTTPS, which traditional port-based firewalls cannot do. Option E is correct because NGFWs integrate user identity awareness, typically via Active Directory or LDAP integration, so access control policies can be written against users and groups rather than only IP addresses, adding an identity dimension to enforcement. Option A is wrong because it reverses the roles: traditional firewalls operate at layers 3 and 4, while NGFWs add layer 7 application inspection. Option C is wrong because static ACLs based only on source/destination IP and TCP/UDP ports describe traditional firewalls, not NGFWs. Option D is wrong because NGFWs commonly perform SSL/TLS decryption and inspection themselves, and traditional firewalls do not require external proxy servers for that purpose.

Answer

Traditional firewalls inspect layer 7 payloads while NGFWs are strictly restricted to layer 3 and layer 4 filtering.

Answer

NGFWs rely exclusively on static access control lists based strictly on source IP, destination IP, and TCP/UDP ports.

Answer

Traditional firewalls require external proxy servers to perform SSL/TLS decryption, whereas NGFWs cannot inspect encrypted traffic.

Question 14

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

Accepted Answer

Active Response / Process Termination. When a HIPS detects an injection attack and immediately terminates the offending process, it is performing an active response — a proactive preventive action that stops the attack in real time rather than merely logging it. Process termination is a classic active-response capability of host-based IPS tools such as OSSEC, Wazuh, or commercial HIPS platforms.

Answer

DNS Sinkholing

Answer

Passive Log Alerting

Answer

Vulnerability Patch Management

Question 15

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Accepted Answer

Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.. Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks. Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Answer

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Answer

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.