CND Network Security Controls Protocols And Devices — Timed 10 Questions

Question 1

A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?

10 minute time limit — choose an answer to begin.

Accepted Answer

Encapsulating Security Payload (ESP). ESP (Encapsulating Security Payload) provides confidentiality, data integrity, and authentication for the inner packet — its integrity check value (ICV) is computed using the negotiated authentication algorithm (e.g., HMAC-SHA256). A mismatch in that checksum algorithm between peers causes the receiver to fail ICV verification, producing the 'ESP packet decryption failed' error.

Answer

Security Association Database (SAD)

Answer

Authentication Header (AH)

Answer

Internet Key Exchange (IKE)

Question 2

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 3

A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?

Accepted Answer

The server initiates a connection back to a random client port, which is blocked unless an Application Layer Gateway (ALG) dynamically opens the port.. In passive FTP, the client initiates the control connection to the server on port 21, but then the server opens a random high port and tells the client to connect to it for data transfer. This reverses the typical client-server data connection direction, so a stateful firewall that only allows inbound traffic for established connections will block the server's incoming connection attempt. An Application Layer Gateway (ALG) inspects the FTP control channel, extracts the dynamic port number, and temporarily opens that port to permit the data connection, maintaining security while enabling passive FTP.

Answer

The firewall must permanently open all ports above 1024 to allow inbound FTP file transfers.

Answer

Passive FTP encrypts the control channel by default, preventing the firewall from inspecting port numbers.

Answer

The client uses UDP port 69, which requires disabling stateful inspection for TFTP traffic.

Question 4

A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?

Accepted Answer

Deploy an internal Enterprise CA-signed forward proxy decryption certificate to all managed endpoints' trusted root stores.. SSL/TLS inspection (forward proxy decryption) works by having the firewall terminate the client's TLS session, inspect the plaintext, then re-encrypt to the destination server. For managed endpoints to trust the firewall's dynamically generated certificates without browser warnings, the firewall's CA certificate must be installed in each endpoint's Trusted Root store — typically pushed via Group Policy or MDM. An internal Enterprise CA-signed certificate is the cleanest approach because it chains to an already-trusted root.

Answer

Disable certificate validation checks on all user web browsers via group policy.

Answer

Configure the firewall in passive tap mode using asymmetric decryption keys derived from the public web server's private key.

Answer

Install a self-signed certificate generated by the firewall onto the firewall itself.

Question 5

A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) and explicitly set access ports to non-trunking mode. To prevent VLAN hopping via switch spoofing and double tagging, user access ports must be explicitly configured as non-trunking (access ports) and the native VLAN on trunks should be changed from the default VLAN 1.

Answer

Enable dynamic trunking protocol (DTP) on all ports and set the native VLAN to VLAN 1

Answer

Enable spanning-tree portfast and BPDU guard on all trunk ports

Answer

Configure port security with sticky MAC addresses and maximum limit of one

Question 6

A network security analyst is reviewing NetFlow records and notices an unusually high volume of small UDP packets originating from a single internal host destined to various random external IP addresses on ephemeral ports. What type of network attack or anomaly does this signature indicate?

Accepted Answer

UDP flood Denial of Service attack. A high volume of small UDP packets from one internal host to many random external IPs on ephemeral ports is the classic signature of a UDP flood DoS attack. The attacker sends spoofed or random-destination UDP datagrams to exhaust bandwidth and force the victim to generate ICMP port-unreachable replies. NetFlow captures this as many short-lived, low-byte flows with no established session.

Answer

ARP cache poisoning spoofing attack

Answer

TCP SYN flood attack against internal servers

Answer

DNS zone transfer enumeration (AXFR)

Question 7

A security architect is designing a Zero Trust Network Access (ZTNA) solution to replace a legacy remote access VPN. Unlike traditional VPNs that grant network-level access upon initial authentication, how does a true service-initiated ZTNA architecture handle application access for a remote user?

Accepted Answer

It authenticates the user, verifies device posture, and brokers a secure, single-application connection without exposing the network layer.. True service-initiated ZTNA (also called client-initiated or service-initiated depending on vendor terminology) establishes a per-application tunnel after authenticating the user and validating device posture, rather than granting broad network access. The ZTNA broker acts as a mediating gateway that connects the user only to the specific application, never exposing the underlying network layer (no IP-level reachability to other resources). This aligns with Zero Trust principles of least privilege and micro-segmentation, where access is granted per session and per service, not per network segment.

Answer

It extends the corporate VLAN directly to the user's laptop via an encrypted tunnel.

Answer

It relies on static firewall access control lists pre-configured with the user's home IP address.

Answer

It assigns a private IP address from a DHCP pool managed by the internal core router.

Question 8

An organization is hardening its wireless network infrastructure to prevent unauthorized client association and eavesdropping. Which TWO wireless security mechanisms should be enforced according to modern enterprise standards? (Choose two)

Accepted Answer

IEEE 802.1X port-based authentication backed by a RADIUS server infrastructure. Option A is correct because IEEE 802.1X provides port-based network access control that requires each client to authenticate against a RADIUS server (e.g., via EAP) before being granted network access, which prevents unauthorized client association and supports per-user credentials and dynamic keying. Option D is correct because WPA3-Enterprise with PEAP or TLS authentication enforces strong, certificate- or credential-based authentication and uses SAE/192-bit cryptographic suites, delivering modern protection against eavesdropping and offline dictionary attacks. Option B is not appropriate because WPA2-Personal relies on a shared PSK that, if exposed on a whiteboard, allows anyone to associate and derive the same encryption keys, defeating the hardening goal. Option C is not appropriate because open authentication with a captive portal provides no link-layer encryption or client authentication, leaving traffic vulnerable to eavesdropping. Option E is not appropriate because WEP uses static shared keys and weak RC4-based encryption with known flaws, making it trivially crackable and unsuitable for modern enterprise standards.

Answer

WPA2-Personal with a shared pre-shared key (PSK) written on the office whiteboard

Answer

Open authentication with a captive portal for guest acceptance of terms

Answer

Legacy WEP encryption with static 128-bit shared keys

Question 9

A network administrator is deploying a new 802.1X-based Network Access Control (NAC) solution on Cisco Catalyst switches to authenticate employee laptops before granting them access to the corporate VLAN. The security policy requires that the switches themselves validate user credentials against the corporate Active Directory and then dynamically assign the correct VLAN based on the user's role. Which 802.1X component must be configured on the switches to fulfill this requirement?

Accepted Answer

RADIUS client. For 802.1X on switches, the switch acts as the authenticator and must be configured as a RADIUS client to communicate with the authentication server. The server validates credentials against Active Directory and returns authorization attributes such as VLAN assignment. The switch then enforces those attributes on the port. This satisfies the policy requirement for dynamic VLAN assignment based on user role.

Answer

Authentication server

Answer

Authenticator

Answer

Supplicant

Question 10

A network security administrator is configuring a demilitarized zone (DMZ) firewall rule set. The policy states that external users must reach a public web server on TCP 443, but the web server must never initiate connections to the internal network. The firewall is a stateful inspection device with three interfaces: outside, DMZ, and inside. Which rule set best enforces this policy?

Accepted Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; permit inside to DMZ TCP 22 and TCP 443; permit inside to outside any. The policy requires external access to the DMZ web server on TCP 443, no DMZ-initiated connections to the internal network, and operational management from inside. Permitting outside-to-DMZ TCP 443, denying DMZ-to-inside any, and allowing only specific management ports from inside to DMZ enforces least privilege and containment. The other options either allow DMZ-to-inside traffic, block all management access, or permit overly broad inside-to-DMZ access.

Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Answer

Permit outside to DMZ TCP 443; permit DMZ to inside any; deny inside to DMZ any; permit inside to outside any

Answer

Permit outside to DMZ TCP 443; deny DMZ to inside any; permit inside to DMZ any; permit inside to outside any