CND Network Security Controls Protocols And Devices — 25 Questions

Question 1

A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) and explicitly set access ports to non-trunking mode. To prevent VLAN hopping via switch spoofing and double tagging, user access ports must be explicitly configured as non-trunking (access ports) and the native VLAN on trunks should be changed from the default VLAN 1.

Answer

Enable dynamic trunking protocol (DTP) on all ports and set the native VLAN to VLAN 1

Answer

Enable spanning-tree portfast and BPDU guard on all trunk ports

Answer

Configure port security with sticky MAC addresses and maximum limit of one

Question 2

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

Accepted Answer

Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses. Tuning or relocating the IDS sensor by filtering out authorized internal scanner source IPs from the monitoring profile or moving the span port configuration to exclude trusted management subnets reduces false positives. Alternatively, tuning the signature rules to whitelist specific source IPs is standard practice.

Answer

Upgrade the IDS hardware to process higher bandwidth capacity

Answer

Convert the IDS into an inline IPS

Answer

Move the IDS from a switch SPAN port to an inline routing position

Question 3

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

Accepted Answer

Full-tunnel VPN. A Full-Tunnel VPN routes all client traffic through the encrypted VPN tunnel to the corporate gateway, regardless of whether the destination is internal or on the public internet.

Answer

Clientless SSL VPN

Answer

Split-tunnel VPN

Answer

Transport mode IPsec VPN

Question 4

A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?

Accepted Answer

Encapsulating Security Payload (ESP). The Encapsulating Security Payload (ESP) protocol provides origin authenticity, integrity, and confidentiality protection of packets. The Authentication Header (AH) provides integrity and authentication only, without confidentiality.

Answer

Security Association Database (SAD)

Answer

Authentication Header (AH)

Answer

Internet Key Exchange (IKE)

Question 5

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 6

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

Accepted Answer

On the internal network boundary between the Finance and Guest VLANs. To enforce policies and filter traffic between two distinct internal subnets or zones, the security device must be placed at the internal routing boundary, typically on an internal firewall interface acting as the default gateway for those subnets.

Answer

At the perimeter boundary directly connected to the ISP modem

Answer

On the local loopback interface of each end-user workstation

Answer

Inside the ISP core routing infrastructure

Question 7

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

Accepted Answer

Three-legged firewall architecture creating separate internal, external, and DMZ zones. A three-legged firewall configuration (or dual-firewall DMZ architecture) places public servers in a DMZ zone separate from both the untrusted external internet and the trusted internal LAN, requiring traffic between zones to be inspected.

Answer

Placing all web and database servers on the same internal VLAN protected by host firewalls

Answer

Single-firewall dual-homed architecture with a software loopback filter

Answer

Direct flat bridging between the external router and the internal core switch

Question 8

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

Accepted Answer

TLS 1.3 separates key exchange parameters from cipher suites, simplifying options to AEAD algorithms. TLS 1.3 decouples key exchange algorithms from authentication algorithms and removes obsolete static RSA and static DH cipher suites, supporting only AEAD (Authenticated Encryption with Associated Data) ciphers and modern key exchange methods.

Answer

TLS 1.3 eliminates symmetric encryption in favor of asynchronous cryptographic operations for all data payloads

Answer

TLS 1.3 requires all connections to use legacy RSA key transport mechanisms

Answer

TLS 1.3 mandates the use of pre-shared keys (PSKs) exclusively for all sessions

Question 9

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at Layer 7 and is specifically designed to inspect HTTP/HTTPS traffic and protect web applications against attacks like SQL injection and cross-site scripting.

Answer

Network Intrusion Prevention System (NIPS)

Answer

Packet filtering router

Answer

Traditional Stateful Packet Inspection Firewall

Question 10

A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?

Accepted Answer

The server initiates a connection back to a random client port, which is blocked unless an Application Layer Gateway (ALG) dynamically opens the port.. In passive FTP, the client initiates both the control and data connections, but the server dictates the dynamic high-port number for the data channel. Stateful firewalls use an application layer gateway (ALG) inspect the FTP control channel negotiation to dynamically open the required high-port for the data connection.

Answer

The firewall must permanently open all ports above 1024 to allow inbound FTP file transfers.

Answer

Passive FTP encrypts the control channel by default, preventing the firewall from inspecting port numbers.

Answer

The client uses UDP port 69, which requires disabling stateful inspection for TFTP traffic.

Question 11

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

Accepted Answer

Configure MAC Authentication Bypass (MAB) with a specific device profiling and authorization profile on the RADIUS server.. For non-supplicant devices like IoT equipment, switch ports can be configured with MAC Authentication Bypass (MAB), which uses the device's MAC address as credentials against a RADIUS server, combined with a restricted VLAN.

Answer

Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

Answer

Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

Answer

Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.

Question 12

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

Accepted Answer

Using a distributed virtual firewall configured at the hypervisor switch layer. Micro-segmentation is best implemented using distributed firewall rules directly at the hypervisor virtual switch level (or host firewall) to control traffic between virtual machines on the same physical host or VLAN.

Answer

By modifying the DNS records of the database server to point to a sinkhole

Answer

On the core router's default gateway interface for the entire data center

Answer

On the perimeter firewall facing the internet gateway

Question 13

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

Accepted Answer

Resource Public Key Infrastructure (RPKI) with Route Origin Validation (ROV). Resource Public Key Infrastructure (RPKP) allows resource holders to cryptographically associate IP address blocks with their legitimate Autonomous System Number (ASN) via Route Origin Authorizations (ROAs), preventing BGP hijacking.

Answer

DNSSEC zone signing across all authoritative name servers

Answer

OSPFv3 authentication trailers using HMAC-SHA-256

Answer

IPsec Transport Mode with pre-shared keys

Question 14

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) provides a secure, encrypted channel for remote administrative access, replacing insecure legacy protocols like Telnet, rlogin, and rsh.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 15

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

Accepted Answer

Distributed across the physical office space as dedicated RF monitoring sensors or dual-band access points. WIPS sensors should be distributed throughout the physical office space to effectively monitor all 802.11 radio frequency channels and detect rogue access points or ad-hoc connections.

Answer

Installed directly on the core router's uplink interface facing the ISP

Answer

Configured as a virtual machine inside the cloud data center hypervisor cluster

Answer

Attached as a tap on the primary corporate database server's storage area network (SAN)

Question 16

A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?

Accepted Answer

Deploy an internal Enterprise CA-signed forward proxy decryption certificate to all managed endpoints' trusted root stores.. To inspect HTTPS traffic without causing SSL/TLS warnings, the NGFW must perform SSL/TLS decryption (Forward Proxy) and be configured to issue dynamically generated certificates signed by the organization's internal Enterprise Root Certificate Authority, which is pre-installed on all corporate endpoints.

Answer

Disable certificate validation checks on all user web browsers via group policy.

Answer

Configure the firewall in passive tap mode using asymmetric decryption keys derived from the public web server's private key.

Answer

Install a self-signed certificate generated by the firewall onto the firewall itself.

Question 17

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

Accepted Answer

Stateful session synchronization (State Sync / HA heartbeat link). Stateful failover (or session synchronization/state sync) synchronizes connection tables, NAT mappings, and IPsec security associations from the active firewall to the standby firewall in real-time, preventing dropped sessions during a failover.

Answer

Network Address Translation (NAT) pool overloading

Answer

Asymmetric routing bypass mode

Answer

Dynamic DNS update propagation

Question 18

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Accepted Answer

SNMPv3. SNMPv3 provides essential security features including message confidentiality (encryption via DES or AES), integrity (via HMAC-MD5 or SHA), and authentication (usm user-based security model). SNMPv1 and SNMPv2c lack encryption.

Answer

SNMPv2c

Answer

SNMPv1

Answer

SNMPv2u

Question 19

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

Accepted Answer

Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key exchanges. Perfect Forward Secrecy (PFS) ensures that session keys derived from Diffie-Hellman key exchanges are independent of long-term root secret keys, meaning compromise of the master keys does not compromise past session data.

Answer

Authenticated Encryption with Associated Data (AEAD) using GCM mode

Answer

Anti-replay protection using sequence number windows

Answer

RSA signature-based peer authentication

Question 20

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

Accepted Answer

Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs. To prevent DNS tunneling, organizations should restrict outbound DNS queries so that internal hosts can only query authorized, internal DNS resolvers (such as corporate DNS forwarders), which then inspect or proxy external requests, blocking direct external port 53 traffic to arbitrary IPs.

Answer

Block all outbound TCP and UDP port 53 traffic globally across the entire perimeter firewall

Answer

Implement an HTTP web proxy to inspect all DNS packets at Layer 7

Answer

Enable spanning-tree root guard on all switch access ports