CND Network Security Controls Protocols And Devices — 15 Questions

Question 1

A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encapsulating Security Payload (ESP). ESP (Encapsulating Security Payload) provides confidentiality, data integrity, and authentication for the inner packet — its integrity check value (ICV) is computed using the negotiated authentication algorithm (e.g., HMAC-SHA256). A mismatch in that checksum algorithm between peers causes the receiver to fail ICV verification, producing the 'ESP packet decryption failed' error.

Answer

Security Association Database (SAD)

Answer

Authentication Header (AH)

Answer

Internet Key Exchange (IKE)

Question 2

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 3

A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?

Accepted Answer

The server initiates a connection back to a random client port, which is blocked unless an Application Layer Gateway (ALG) dynamically opens the port.. In passive FTP, the client initiates the control connection to the server on port 21, but then the server opens a random high port and tells the client to connect to it for data transfer. This reverses the typical client-server data connection direction, so a stateful firewall that only allows inbound traffic for established connections will block the server's incoming connection attempt. An Application Layer Gateway (ALG) inspects the FTP control channel, extracts the dynamic port number, and temporarily opens that port to permit the data connection, maintaining security while enabling passive FTP.

Answer

The firewall must permanently open all ports above 1024 to allow inbound FTP file transfers.

Answer

Passive FTP encrypts the control channel by default, preventing the firewall from inspecting port numbers.

Answer

The client uses UDP port 69, which requires disabling stateful inspection for TFTP traffic.

Question 4

A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?

Accepted Answer

Deploy an internal Enterprise CA-signed forward proxy decryption certificate to all managed endpoints' trusted root stores.. SSL/TLS inspection (forward proxy decryption) works by having the firewall terminate the client's TLS session, inspect the plaintext, then re-encrypt to the destination server. For managed endpoints to trust the firewall's dynamically generated certificates without browser warnings, the firewall's CA certificate must be installed in each endpoint's Trusted Root store — typically pushed via Group Policy or MDM. An internal Enterprise CA-signed certificate is the cleanest approach because it chains to an already-trusted root.

Answer

Disable certificate validation checks on all user web browsers via group policy.

Answer

Configure the firewall in passive tap mode using asymmetric decryption keys derived from the public web server's private key.

Answer

Install a self-signed certificate generated by the firewall onto the firewall itself.

Question 5

A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) and explicitly set access ports to non-trunking mode. To prevent VLAN hopping via switch spoofing and double tagging, user access ports must be explicitly configured as non-trunking (access ports) and the native VLAN on trunks should be changed from the default VLAN 1.

Answer

Enable dynamic trunking protocol (DTP) on all ports and set the native VLAN to VLAN 1

Answer

Enable spanning-tree portfast and BPDU guard on all trunk ports

Answer

Configure port security with sticky MAC addresses and maximum limit of one

Question 6

A network security analyst is reviewing NetFlow records and notices an unusually high volume of small UDP packets originating from a single internal host destined to various random external IP addresses on ephemeral ports. What type of network attack or anomaly does this signature indicate?

Accepted Answer

UDP flood Denial of Service attack. A high volume of small UDP packets from one internal host to many random external IPs on ephemeral ports is the classic signature of a UDP flood DoS attack. The attacker sends spoofed or random-destination UDP datagrams to exhaust bandwidth and force the victim to generate ICMP port-unreachable replies. NetFlow captures this as many short-lived, low-byte flows with no established session.

Answer

ARP cache poisoning spoofing attack

Answer

TCP SYN flood attack against internal servers

Answer

DNS zone transfer enumeration (AXFR)

Question 7

A security architect is designing a Zero Trust Network Access (ZTNA) solution to replace a legacy remote access VPN. Unlike traditional VPNs that grant network-level access upon initial authentication, how does a true service-initiated ZTNA architecture handle application access for a remote user?

Accepted Answer

It authenticates the user, verifies device posture, and brokers a secure, single-application connection without exposing the network layer.. True service-initiated ZTNA (also called client-initiated or service-initiated depending on vendor terminology) establishes a per-application tunnel after authenticating the user and validating device posture, rather than granting broad network access. The ZTNA broker acts as a mediating gateway that connects the user only to the specific application, never exposing the underlying network layer (no IP-level reachability to other resources). This aligns with Zero Trust principles of least privilege and micro-segmentation, where access is granted per session and per service, not per network segment.

Answer

It extends the corporate VLAN directly to the user's laptop via an encrypted tunnel.

Answer

It relies on static firewall access control lists pre-configured with the user's home IP address.

Answer

It assigns a private IP address from a DHCP pool managed by the internal core router.

Question 8

An organization is hardening its wireless network infrastructure to prevent unauthorized client association and eavesdropping. Which TWO wireless security mechanisms should be enforced according to modern enterprise standards? (Choose two)

Accepted Answer

IEEE 802.1X port-based authentication backed by a RADIUS server infrastructure. Option A is correct because IEEE 802.1X provides port-based network access control that requires each client to authenticate against a RADIUS server (e.g., via EAP) before being granted network access, which prevents unauthorized client association and supports per-user credentials and dynamic keying. Option D is correct because WPA3-Enterprise with PEAP or TLS authentication enforces strong, certificate- or credential-based authentication and uses SAE/192-bit cryptographic suites, delivering modern protection against eavesdropping and offline dictionary attacks. Option B is not appropriate because WPA2-Personal relies on a shared PSK that, if exposed on a whiteboard, allows anyone to associate and derive the same encryption keys, defeating the hardening goal. Option C is not appropriate because open authentication with a captive portal provides no link-layer encryption or client authentication, leaving traffic vulnerable to eavesdropping. Option E is not appropriate because WEP uses static shared keys and weak RC4-based encryption with known flaws, making it trivially crackable and unsuitable for modern enterprise standards.

Answer

WPA2-Personal with a shared pre-shared key (PSK) written on the office whiteboard

Answer

Open authentication with a captive portal for guest acceptance of terms

Answer

Legacy WEP encryption with static 128-bit shared keys

Question 9

A network administrator is deploying a new 802.1X-based Network Access Control (NAC) solution on Cisco Catalyst switches to authenticate employee laptops before granting them access to the corporate VLAN. The security policy requires that the switches themselves validate user credentials against the corporate Active Directory and then dynamically assign the correct VLAN based on the user's role. Which 802.1X component must be configured on the switches to fulfill this requirement?

Accepted Answer

RADIUS client. For 802.1X on switches, the switch acts as the authenticator and must be configured as a RADIUS client to communicate with the authentication server. The server validates credentials against Active Directory and returns authorization attributes such as VLAN assignment. The switch then enforces those attributes on the port. This satisfies the policy requirement for dynamic VLAN assignment based on user role.

Answer

Authentication server

Answer

Authenticator

Answer

Supplicant

Question 10

A network security administrator is configuring a demilitarized zone (DMZ) firewall rule set. The policy states that external users must reach a public web server on TCP 443, but the web server must never initiate connections to the internal network. The firewall is a stateful inspection device with three interfaces: outside, DMZ, and inside. Which rule set best enforces this policy?

Accepted Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; permit inside to DMZ TCP 22 and TCP 443; permit inside to outside any. The policy requires external access to the DMZ web server on TCP 443, no DMZ-initiated connections to the internal network, and operational management from inside. Permitting outside-to-DMZ TCP 443, denying DMZ-to-inside any, and allowing only specific management ports from inside to DMZ enforces least privilege and containment. The other options either allow DMZ-to-inside traffic, block all management access, or permit overly broad inside-to-DMZ access.

Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Answer

Permit outside to DMZ TCP 443; permit DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; permit inside to DMZ any; permit inside to outside any

Question 11

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

Accepted Answer

Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses. Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.

Answer

Upgrade the IDS hardware to process higher bandwidth capacity

Answer

Convert the IDS into an inline IPS

Answer

Move the IDS from a switch SPAN port to an inline routing position

Question 12

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

Accepted Answer

Full-tunnel VPN. A full-tunnel VPN routes all client traffic — including internet-bound traffic — through the VPN tunnel to the corporate data center, where it is inspected by the security stack before reaching the internet. This ensures consistent policy enforcement and prevents split-tunnel bypass. Split-tunnel VPN, by contrast, sends only corporate traffic through the tunnel while internet traffic goes directly.

Answer

Clientless SSL VPN

Answer

Split-tunnel VPN

Answer

Transport mode IPsec VPN

Question 13

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

Accepted Answer

On the internal network boundary between the Finance and Guest VLANs. To enforce ACLs between two internal zones (Finance and Guest), the security device must sit inline on the path between those VLANs — i.e., at the internal boundary where inter-VLAN routing occurs. Placing it there ensures all Finance-to-Guest traffic is inspected and controlled before it can traverse the internal network.

Answer

At the perimeter boundary directly connected to the ISP modem

Answer

On the local loopback interface of each end-user workstation

Answer

Inside the ISP core routing infrastructure

Question 14

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

Accepted Answer

Three-legged firewall architecture creating separate internal, external, and DMZ zones. A three-legged firewall architecture (also called a tri-homed firewall) uses three separate network interfaces to create distinct security zones: external (internet), internal (trusted LAN), and DMZ (public-facing services). This enforces segmentation so that compromised public web servers in the DMZ cannot directly reach internal database servers, and all traffic between zones must pass through the firewall's inspection policy. It directly satisfies the requirement for an intermediary inspection zone between public web servers and internal databases.

Answer

Placing all web and database servers on the same internal VLAN protected by host firewalls

Answer

Single-firewall dual-homed architecture with a software loopback filter

Answer

Direct flat bridging between the external router and the internal core switch

Question 15

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

Accepted Answer

TLS 1.3 separates key exchange parameters from cipher suites, simplifying options to AEAD algorithms. In TLS 1.3, cipher suites no longer include key exchange and authentication algorithms; they only specify AEAD (Authenticated Encryption with Associated Data) algorithms like AES-GCM or ChaCha20-Poly1305. Key exchange is negotiated separately via extensions like supported_groups, and authentication is handled by the certificate and signature algorithms. This simplifies cipher suite configuration.

Answer

TLS 1.3 eliminates symmetric encryption in favor of asynchronous cryptographic operations for all data payloads

Answer

TLS 1.3 requires all connections to use legacy RSA key transport mechanisms

Answer

TLS 1.3 mandates the use of pre-shared keys (PSKs) exclusively for all sessions