CND Network Security Controls Protocols And Devices Practice Test 2 — 15 Questions

Question 1

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at Layer 7 and inspects HTTP/HTTPS requests for application-layer attacks like SQL injection, XSS, and command injection, dropping malicious requests before they reach the web server. It understands HTTP semantics (headers, parameters, cookies, bodies) and can apply signature-based and anomaly-based rules specifically tuned for web applications.

Answer

Network Intrusion Prevention System (NIPS)

Answer

Packet filtering router

Answer

Traditional Stateful Packet Inspection Firewall

Question 2

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

Accepted Answer

Configure MAC Authentication Bypass (MAB) with a specific device profiling and authorization profile on the RADIUS server.. MAC Authentication Bypass (MAB) is the correct solution because it allows the switch to authenticate devices that lack an 802.1X supplicant by using the device's MAC address as the credential against the RADIUS server. Combined with device profiling and an authorization profile, the camera can be placed into a restricted VLAN or given limited ACLs, achieving both authentication and isolation. This is the standard Cisco ISE/switch design pattern for headless devices like cameras, printers, and IoT sensors.

Answer

Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

Answer

Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

Answer

Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.

Question 3

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

Accepted Answer

Using a distributed virtual firewall configured at the hypervisor switch layer. Micro-segmentation for a virtualized workload is best enforced at the hypervisor virtual switch layer using a distributed virtual firewall (e.g., VMware NSX Distributed Firewall, Cisco ACI/AVS). This places the enforcement point directly on the vNIC of the database VM, so policy follows the workload regardless of physical topology, and east-west traffic between VMs on the same host is filtered without hairpinning to a physical appliance. This provides optimal granularity and performance.

Answer

By modifying the DNS records of the database server to point to a sinkhole

Answer

On the core router's default gateway interface for the entire data center

Answer

On the perimeter firewall facing the internet gateway

Question 4

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

Accepted Answer

Resource Public Key Infrastructure (RPKI) with Route Origin Validation (ROV). RPKI with Route Origin Validation (ROV) is the cryptographic mechanism that binds IP prefixes to their authorized origin AS numbers via signed Route Origin Authorizations (ROAs). Edge routers performing ROV query RPKI validators (e.g., Routinator, OctoRPKI) and mark BGP announcements as Valid, Invalid, or NotFound, allowing operators to drop Invalid routes and prevent prefix hijacking. This directly addresses origin authentication of BGP announcements.

Answer

DNSSEC zone signing across all authoritative name servers

Answer

OSPFv3 authentication trailers using HMAC-SHA-256

Answer

IPsec Transport Mode with pre-shared keys

Question 5

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for secure remote management of Linux servers, providing encrypted authentication and session transport over untrusted networks. It replaces insecure protocols like Telnet by encrypting all traffic, including credentials and commands. SSH operates on TCP port 22 by default and supports key-based authentication for stronger security.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 6

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

Accepted Answer

Distributed across the physical office space as dedicated RF monitoring sensors or dual-band access points. A WIPS sensor must monitor the RF (radio frequency) spectrum to detect rogue APs, evil twins, and unauthorized devices broadcasting corporate SSIDs. Deploying dedicated RF sensors or dual-band APs throughout the physical office space ensures full wireless coverage and accurate detection. Wired or virtual placements cannot see over-the-air threats.

Answer

Installed directly on the core router's uplink interface facing the ISP

Answer

Configured as a virtual machine inside the cloud data center hypervisor cluster

Answer

Attached as a tap on the primary corporate database server's storage area network (SAN)

Question 7

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

Accepted Answer

Stateful session synchronization (State Sync / HA heartbeat link). Stateful session synchronization replicates the connection state table between the active and standby firewalls over the HA heartbeat/sync link, so that when failover occurs the standby already knows about every established TCP session. This preserves sequence numbers, session timers, and NAT translations, allowing existing sessions to continue without forcing users to re-authenticate. VRRP handles the virtual IP failover, but it does not carry session state — that is the job of state sync.

Answer

Network Address Translation (NAT) pool overloading

Answer

Asymmetric routing bypass mode

Answer

Dynamic DNS update propagation

Question 8

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Accepted Answer

SNMPv3. SNMPv3 is the only version that provides both encryption (via DES, 3DES, AES) and authentication (via MD5, SHA). It introduces the User-based Security Model (USM) to secure management queries and responses. SNMPv1 and v2c offer only community string authentication, which is sent in cleartext.

Answer

SNMPv2c

Answer

SNMPv1

Answer

SNMPv2u

Question 9

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

Accepted Answer

Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key exchanges. Perfect Forward Secrecy (PFS) ensures that session keys are derived from ephemeral Diffie-Hellman exchanges and are not recoverable from long-term keys. Even if an attacker later compromises the preshared key or private key, past session keys cannot be reconstructed, so captured traffic remains undecryptable. This is exactly the property the security team requires.

Answer

Authenticated Encryption with Associated Data (AEAD) using GCM mode

Answer

Anti-replay protection using sequence number windows

Answer

RSA signature-based peer authentication

Question 10

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

Accepted Answer

Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs. The correct mitigation is to force all internal clients to use designated internal DNS resolvers and block direct outbound UDP/TCP 53 to external IPs at the perimeter. This prevents internal hosts from establishing arbitrary DNS tunnels to attacker-controlled authoritative servers while still allowing legitimate recursive resolution through controlled resolvers that can be monitored and filtered.

Answer

Block all outbound TCP and UDP port 53 traffic globally across the entire perimeter firewall

Answer

Implement an HTTP web proxy to inspect all DNS packets at Layer 7

Answer

Enable spanning-tree root guard on all switch access ports

Question 11

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

Accepted Answer

Windows Defender Firewall with Advanced Security. Windows Defender Firewall with Advanced Security supports application-based (program-based) rules in addition to port/protocol rules. Each rule can specify the executable path (e.g., C:\Program Files\App\app.exe), and the firewall evaluates inbound/outbound traffic against that program identity. This satisfies the requirement of filtering by application executable name rather than only IP/port.

Answer

Windows User Account Control (UAC)

Answer

Windows BitLocker Drive Encryption

Answer

Windows Subsystem for Linux (WSL)

Question 12

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

Accepted Answer

Configure a Decryption Exclusion / Bypass rule for specific trusted destination URL categories or domains. Configuring a Decryption Exclusion or Bypass rule for specific trusted destination URL categories or domains allows the NGFW to skip SSL decryption for those destinations while continuing to decrypt and inspect all other TLS traffic. This satisfies privacy regulations without disabling overall inspection.

Answer

Create an outbound NAT rule mapping banking IP addresses to a loopback interface.

Answer

Configure a static route directing banking traffic through an uninspected bypass interface.

Answer

Disable all Layer 7 application inspection signatures globally for TCP port 443.

Question 13

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

Accepted Answer

Deploying the IPS inline equipped with hardware fail-open optical/electrical bypass tap modules. Deploying the IPS inline with hardware fail-open bypass modules ensures that traffic is actively inspected in the data path, but if the IPS fails or loses power, the bypass module physically bridges the connection to maintain network uptime. This provides both intrusion prevention (blocking malicious traffic) and high availability, meeting the requirement of minimizing latency and avoiding a single point of failure. Hardware bypass operates at the physical layer, so it does not rely on software or external power to fail open.

Answer

Configuring the IPS as an out-of-band active response server using SNMP traps.

Answer

Placing the IPS behind a load balancer using round-robin DNS routing.

Answer

Deploying the IPS in passive tap mode using a network packet broker span session.

Question 14

A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?

Accepted Answer

TUN mode operates at Layer 3 (Network Layer) routing IP packets without layer 2 broadcast traffic.. TUN mode is a Layer 3 (Network Layer) virtual interface that routes IP packets between the client and the VPN server, carrying only unicast IP traffic and no Layer 2 broadcast or multicast frames. This makes it ideal for remote-access VPNs where clients need routed access to corporate subnets, not bridged LAN access. TAP mode, by contrast, operates at Layer 2 and carries Ethernet frames including broadcasts.

Answer

TUN mode only supports TCP transport and cannot function over UDP connections.

Answer

TUN mode operates at Layer 2 (Data Link Layer) handling Ethernet frames and broadcasts.

Answer

TUN mode requires the use of MAC-level bridging across all connected client interfaces.

Question 15

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

Accepted Answer

Layer 3 router or multilayer switch. VLANs are logically separate Layer 2 broadcast domains, so traffic between the Marketing VLAN and the Sales VLAN cannot be switched at Layer 2 — it must be routed. A Layer 3 router or multilayer switch performs inter-VLAN routing by terminating each VLAN's SVI (or subinterface) and forwarding packets between the two IP subnets. This is the only device class in the options that operates at Layer 3 and can make forwarding decisions based on IP addressing.

Answer

Layer 2 unmanaged switch

Answer

Hub

Answer

Wireless range extender