CND Network Perimeter Protection — Timed 15 Questions

Question 1

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

15 minute time limit — choose an answer to begin.

Accepted Answer

access-list INSIDE_IN extended permit tcp any any eq www and access-list INSIDE_IN extended permit tcp any any eq 443, applied via access-group INSIDE_IN in interface inside. The correct construct is an access-list applied inbound on the inside interface that permits TCP traffic to any destination on ports 80 (www) and 443. Because the ASA is stateful, return traffic is automatically allowed without an explicit inbound rule on the outside interface.

Answer

access-list OUTBOUND extended permit tcp any any eq 80 and access-group OUTBOUND in interface outside

Answer

static (inside,outside) tcp interface 80 192.168.1.10 80 netmask 255.255.255.255

Answer

object network WEB_PORTS; range 80 443; nat (inside,outside) dynamic interface

Question 2

An administrator implementing Suricata as an IDS/IPS needs to enable offline analysis of a stored PCAP file containing suspicious network captures. Which command-line switch should be used to read from a PCAP file?

Accepted Answer

suricata -r suspect_traffic.pcap. Suricata uses the -r switch to read packets from a PCAP file.

Answer

suricata -T

Answer

suricata --daemon

Question 3

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

Accepted Answer

Cowrie. Cowrie is a medium-to-low interaction SSH and Telnet honeypot designed to log brute-force attacks and shell interactions. It emulates a vulnerable system, captures login attempts, and records attacker commands in a controlled environment. It is open-source and specifically built for the task of mimicking SSH, Telnet, and FTP services to gather threat intelligence.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 4

An administrator is deploying a Snort 3 Intrusion Detection System on an enterprise gateway segment. To detect a specific exploit payload containing the exact ASCII string \x41\x41\x41\x41 without relying on preprocessors, which rule option should be implemented?

Accepted Answer

content:"|41 41 41 41|";. In Snort 3 (and Snort 2), the content option is the correct keyword for matching a literal byte pattern in the packet payload, and hexadecimal bytes are specified inside pipes: content:"|41 41 41 41|";. This matches the exact ASCII string 'AAAA' (0x41 is 'A') without relying on preprocessors, which is exactly what the question requires. The content option is the fundamental payload inspection keyword in Snort rule syntax.

Answer

pattern:"AAAA";

Answer

search:"AAAA";

Answer

payload_match:"\x41\x41\x41\x41";

Question 5

An enterprise perimeter firewall is experiencing a volumetric SYN flood denial-of-service attack. The network administrator wants to mitigate the attack at the firewall level without dropping legitimate client connections or modifying the internal server TCP stack configurations. Which specialized firewall feature should be activated?

Accepted Answer

SYN Cookies. SYN cookies are the specialized firewall feature that mitigates SYN floods without dropping legitimate connections or altering server TCP stacks. When the SYN queue is under pressure, the firewall responds to each SYN with a SYN-ACK containing a cryptographic cookie as the sequence number, and only allocates state when the client returns the ACK, validating the handshake.

Answer

TCP Selective Acknowledgments (SACK)

Answer

TCP Window Scaling

Answer

Reverse Path Forwarding (RPF) strict mode

Question 6

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 7

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

Accepted Answer

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. The conntrack match extension with --ctstate ESTABLISHED,RELATED tells iptables to accept packets that belong to connections already tracked by the kernel's connection-tracking subsystem, or that are related to such connections (e.g., FTP data channels, ICMP errors). Placing this rule early in the INPUT chain ensures return traffic for outbound-initiated sessions is permitted without re-evaluating later rules, which is the canonical stateful-firewall pattern.

Answer

iptables -A INPUT -m limit --limit 5/min -j LOG

Answer

iptables -A FORWARD -p tcp --dport 80 -j REJECT

Answer

iptables -A INPUT -m state --state NEW -j DROP

Question 8

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

Accepted Answer

External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.. In a dual-firewall DMZ architecture, the external firewall should inspect and restrict traffic from the internet to the DMZ, while the internal firewall should restrict traffic from the DMZ to the internal network to only required service ports. This implements defense-in-depth: the external firewall protects the DMZ from internet threats, and the internal firewall prevents a compromised DMZ host from pivoting into the internal network. This segmentation is a security best practice.

Answer

External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.

Answer

External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.

Answer

External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.

Question 9

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

Accepted Answer

alert tcp any any -> any 80 (msg:"Directory Traversal Attempt"; content:"../../etc/passwd"; sid:1000001; rev:1;). The correct Snort rule must match TCP traffic destined to port 80 (HTTP) and inspect the payload for the directory traversal string. Option C uses the proper header 'alert tcp any any -> any 80' with a content match on '../../etc/passwd', which is exactly the signature required to detect this attack. The 'sid' and 'rev' fields provide unique identification and revision tracking, completing a valid Snort rule.

Answer

log icmp any any -> any any (msg:"ICMP Ping Detected"; itype:8; sid:1000003;)

Answer

drop udp external any -> $HOME_NET 53 (content:"passwd"; sid:1000002;)

Answer

pass ip any any -> any any (content:"GET /index.html"; sid:1000004;)

Question 10

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (Inspection) is the feature that allows an NGFW to decrypt encrypted traffic, inspect the plaintext payload against DPI signatures, and then re-encrypt it before forwarding. Without this, HTTPS traffic remains encrypted and DPI cannot see inside, so malicious payloads bypass detection. This is essential for enforcing security policies on encrypted sessions.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 11

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 12

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

Accepted Answer

Demilitarized Zone (DMZ). A Demilitarized Zone (DMZ) is a network segment that sits between the internal trusted network and the untrusted internet. It is designed to host publicly accessible services like web servers while isolating them from the internal corporate network. This isolation limits the impact if the server is compromised, as attackers cannot directly access internal resources.

Answer

Internal LAN

Answer

Management VLAN

Answer

Virtual Private Network (VPN) pool

Question 13

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a Cisco IOS feature that allows administrators to apply a QoS policy to traffic destined for the router's control plane (the CPU). It rate-limits or drops excessive control-plane traffic, such as routing protocol updates, ICMP, and management access, preventing CPU exhaustion attacks from external floods. By protecting the control plane, CoPP ensures the router remains stable and available even under attack.

Answer

Spanning Tree Root Guard

Answer

Port Security

Answer

Dynamic ARP Inspection (DAI)

Question 14

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

Accepted Answer

The firewall encodes connection parameters into the sequence number (SYN cookie) without allocating memory state until the client responds with an ACK.. SYN cookies mitigate TCP SYN flood attacks by encoding connection parameters (such as source/destination IP and port, and a secret) into the initial sequence number (ISN) of the SYN-ACK. The server does not allocate any state for the half-open connection until it receives the final ACK from the client, which contains the cookie. This prevents the server's connection table from being exhausted by a flood of SYN packets. The firewall/router can implement SYN cookies to protect downstream servers.

Answer

The firewall drops all incoming SYN packets immediately.

Answer

The firewall resets the TCP window size to zero for all external connections.

Answer

The firewall proxies the TCP handshake by establishing a full connection before forwarding traffic to the server.

Question 15

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

Accepted Answer

Stateful Inspection Firewall. A Stateful Inspection Firewall operates at Layer 3 (network) and Layer 4 (transport) to inspect packet headers and maintain a state table of established connections. It makes dynamic forwarding decisions based on the context of the traffic — for example, allowing return traffic for an outbound session without an explicit rule. This stateful behavior distinguishes it from stateless packet filters.

Answer

Unmanaged Layer 2 Switch

Answer

Patch Panel

Answer

Hub