Courseiva

CCNA Network Defense Management Questions

45 questions · Network Defense Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecteasy

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

Select 2 answers
A.Network switch spanning-tree root bridge priority metrics
B.Endpoint local service status confirming antivirus daemon/service execution and recent scan logs
C.DNS root hint server IP address tables
D.Centralized EDR management console dashboard reporting active agent health and signature update status
E.BGP router autonomous system number (ASN) peering configurations
AnswersB, D

Local service status confirms the antivirus daemon is actually running, and recent scan logs evidence that detection and remediation executed on that endpoint. This provides per-workstation proof of agent function, complementing the fleet-wide view from the management console.

Why this answer

Option B is correct because checking the endpoint's local service status verifies that the antivirus daemon/service is actually running, and reviewing recent scan logs confirms the agent is performing its scanning function rather than merely being installed. Option D is correct because a centralized EDR management console dashboard aggregates agent health telemetry and signature update status across all workstations, which is the most efficient way to confirm fleet-wide functionality and compliance. Option A is incorrect because spanning-tree root bridge priority is a Layer 2 switching parameter unrelated to endpoint security agents.

Option C is incorrect because DNS root hint tables only affect name resolution and reveal nothing about antivirus or EDR operation. Option E is incorrect because BGP ASN peering configurations concern internet routing between autonomous systems, not endpoint protection status.

Exam trap

The trap is selecting network-centric artifacts (STP, DNS, BGP) that sound technical but are irrelevant to endpoint agent health; candidates must focus on host-level service state and centralized management console reporting.

Practice this question →
2
MCQeasy

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

A.Transport Layer Security (TLS) version 1.3
B.Full Disk Encryption (such as BitLocker or FileVault)
C.Dynamic Host Configuration Protocol (DHCP) snooping
D.Intrusion Detection System (IDS) signature files
AnswerB

Full disk encryption protects data at rest by encrypting the entire volume, so files are unreadable if the laptop is lost or stolen. BitLocker and FileVault satisfy the policy requiring cryptographic protection of sensitive data on mobile endpoints.

Why this answer

Full Disk Encryption (FDE) technologies like BitLocker (Windows) and FileVault (macOS) encrypt the entire storage volume at rest, ensuring that if a laptop is lost or stolen, the data cannot be read without the decryption key. This directly satisfies the policy requirement that sensitive data at rest on laptops be cryptographically protected. FDE operates below the file system, protecting OS files, swap space, and user data uniformly.

Exam trap

The trap here is conflating 'data in transit' protections like TLS with 'data at rest' protections; candidates see 'cryptographically protected' and jump to TLS without checking the 'at rest on laptops' qualifier.

How to eliminate wrong answers

Option A is wrong because TLS 1.3 protects data in transit over the network, not data at rest on a laptop's disk. Option C is wrong because DHCP snooping is a Layer 2 switch security feature that prevents rogue DHCP servers and DHCP starvation attacks; it has nothing to do with encrypting stored data. Option D is wrong because IDS signature files are detection content used to identify malicious traffic patterns, not a mechanism for encrypting data at rest.

Practice this question →
3
MCQhard

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

A.Change request ticket numbers are generated automatically by software rather than handwritten logs.
B.Change request forms require the signature of the lead network architect rather than the CISO.
C.Firewall change tickets are archived in a digital repository for only 12 months instead of 3 years.
D.Network engineers implement emergency rule modifications directly in production without pre-testing or CAB approval.
AnswerD

Unapproved, untested emergency changes pushed straight to production bypass CAB review and validation, so a faulty firewall rule can immediately disrupt availability or open unintended access. This removes the safeguards that catch errors before they affect live traffic.

Why this answer

Implementing emergency firewall rule changes directly in production without pre-testing or CAB approval represents the highest risk because it bypasses change control, potentially introducing misconfigurations that can cause outages or security breaches. This deficiency directly threatens network availability and security posture by allowing untested changes.

Exam trap

CND often tests the difference between administrative weaknesses (like retention periods) and operational weaknesses that directly impact security, so candidates may choose the retention issue thinking it's a compliance risk, when the lack of change control is the critical risk.

How to eliminate wrong answers

Option A is wrong because automatic ticket number generation is actually a strength, improving traceability and reducing human error, not a deficiency. Option B is wrong because requiring the lead network architect's signature instead of the CISO's is a process variation, not a high-risk deficiency; both are qualified approvers. Option C is wrong because archiving tickets for 12 months instead of 3 years is a records retention issue that may affect audits but does not directly impact network availability or security in real-time.

Practice this question →
4
MCQeasy

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

A.TFTP (Trivial File Transfer Protocol)
B.HTTP over port 80
C.Telnet over port 23
D.SSH (Secure Shell) version 2
AnswerD

SSH version 2 encrypts the entire session, including authentication and commands, over the network. This directly satisfies the policy requiring remote administrators to use an encrypted tunnel for command-line switch administration, unlike Telnet or unencrypted SNMP.

Why this answer

SSH version 2 provides strong encryption for all traffic, including authentication and command-line sessions, using algorithms like AES and Diffie-Hellman key exchange. This satisfies the policy requirement for an encrypted tunnel during remote administration. Telnet, TFTP, and HTTP transmit data in cleartext, offering no confidentiality.

Therefore, SSHv2 is the only listed protocol that meets the encryption mandate.

Exam trap

The trap here is confusing 'encrypted tunnel' with any remote administration protocol; candidates might incorrectly assume Telnet or HTTP can be secured with add-ons, but only SSH natively provides encryption.

How to eliminate wrong answers

Option A is wrong because TFTP is a UDP-based file transfer protocol that sends data in cleartext and lacks any encryption or authentication mechanisms. Option B is wrong because HTTP over port 80 transmits all data, including credentials, in plaintext without encryption. Option C is wrong because Telnet over port 23 sends all session data, including passwords, in cleartext, making it vulnerable to eavesdropping.

Practice this question →
5
MCQhard

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

A.Isolating compromised VLANs from the core routing backbone during an active attack
B.Restoring critical database backups from immutable offsite storage vaults
C.Establishing the CSIRT, defining escalation paths, and drafting incident response procedures
D.Performing root-cause analysis on active command-and-control channels
AnswerC

Governance during a major breach requires a defined CSIRT with clear roles, escalation paths and documented procedures. These are the core Planning and Preparation deliverables under ISO/IEC 27035, enabling coordinated detection, response and communication before an incident occurs.

Why this answer

ISO/IEC 27035's 'Planning and Preparation' phase is about building the incident management capability before incidents occur — establishing the CSIRT, defining escalation paths, and drafting incident response procedures. These governance activities ensure that when a major breach happens, roles, communication channels, and playbooks are already in place. The other options describe actions taken during detection, response, or post-incident phases.

Exam trap

The trap is that all four options sound like legitimate incident response activities — candidates must map each to the correct ISO 27035 phase and recognize that only governance/setup activities belong in Planning and Preparation.

How to eliminate wrong answers

Option A is wrong because isolating compromised VLANs is a containment action performed during the 'Detection and Reporting' or 'Assessment and Decision' phase, not during planning. Option B is wrong because restoring backups is a recovery activity that occurs after containment and eradication. Option D is wrong because root-cause analysis is a post-incident activity covered in the 'Lessons Learned' phase, not preparation.

Practice this question →
6
MCQhard

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

A.Performing manual penetration testing once every five years
B.Conducting automated authenticated vulnerability scans of all internal and external assets on a regular schedule
C.Deploying hardware token multi-factor authentication for VPN users
D.Restricting administrative access to local console connections only
AnswerB

CIS Control 4 requires continuous vulnerability management, evidenced by automated authenticated scans covering all internal and external assets on a defined recurring schedule. Authentication reveals software-level weaknesses that unauthenticated scans miss, and automation plus scheduling satisfies the continuous element.

Why this answer

CIS Control 4 (Continuous Vulnerability Management) requires automated, authenticated vulnerability scanning of all internal and external assets on a regular schedule, with remediation tracked. Authenticated scans provide deeper visibility into installed software and missing patches than unauthenticated scans. This is the core activity auditors look for to demonstrate compliance with Control 4.

Exam trap

CND often tests the mapping of activities to specific CIS Controls — candidates pick MFA or pen testing because they sound security-relevant, but Control 4 is specifically about continuous, automated vulnerability scanning and remediation.

How to eliminate wrong answers

Option A is wrong because manual penetration testing once every five years is neither continuous nor vulnerability management — it is a point-in-time assessment and does not satisfy the 'continuous' requirement. Option C is wrong because hardware token MFA for VPN users maps to CIS Control 6 (Access Control Management), not Control 4. Option D is wrong because restricting administrative access to local console maps to CIS Control 4's sibling controls around privileged access (Control 5/6), not vulnerability management.

Practice this question →
7
MCQhard

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

A.PL (Planning)
B.SR (Supply Chain Risk Management)
C.CA (Assessment, Authorization, and Monitoring)
D.SC (System and Communications Protection)
AnswerB

The SR family directly covers supply chain risk management controls, including policies, plans, and processes governing suppliers and third parties. It is the NIST SP 800-53 Rev. 5 family that operationalises the Govern function's cybersecurity supply chain risk management outcomes.

Why this answer

NIST SP 800-53 Revision 5 introduced the SR (Supply Chain Risk Management) control family specifically to address supply chain risk governance, including processes for identifying, assessing, and mitigating risks from suppliers and third parties. The NIST CSF v2.0 Govern function's supply chain risk management outcomes map directly to the SR family controls.

Exam trap

CND often tests control family mapping, so candidates pick PL or CA for supply chain governance when the dedicated SR family is the correct NIST SP 800-53 Rev. 5 answer.

How to eliminate wrong answers

Option A is wrong because the PL (Planning) family addresses security planning, rules of behavior, and system security plans, not supply chain risk management processes. Option C is wrong because CA (Assessment, Authorization, and Monitoring) covers control assessments, authorization decisions, and continuous monitoring, which are related to assurance but not the primary supply chain governance family. Option D is wrong because SC (System and Communications Protection) covers cryptographic protection, boundary defense, and network segmentation, not supply chain risk management.

Practice this question →
8
MCQmedium

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

A.Documenting the business justification, performing risk assessment, and obtaining CAB approval
B.Deleting all existing firewall rules to ensure a clean rulebase state
C.Immediately pushing the rule via automated script without prior peer review to minimize downtime
D.Disabling change logging to save disk space on the management server
AnswerA

Before production deployment, the change must be documented with business justification, risk-assessed, and approved by the Change Advisory Board. This governance gate ensures the firewall modification is authorised and its impact understood, satisfying the stem's mandatory pre-deployment step in the change lifecycle.

Why this answer

Firewall rule changes in production require documented business justification, a risk assessment of the change's impact, and approval from the Change Advisory Board (CAB) before deployment. This ensures the change is authorized, auditable, and aligned with the organization's risk appetite. Skipping any of these steps violates ITIL-aligned change management and can introduce security gaps or outages.

Exam trap

CND often tests whether candidates recognize that change management is about authorization and documentation — the trap is selecting speed-oriented options like automated pushes without review, which violate governance controls.

How to eliminate wrong answers

Option B is wrong because deleting all existing firewall rules would create a completely open or broken network, causing massive outages and security exposure — it is not a change management step at all. Option C is wrong because pushing rules via automated script without peer review bypasses the control that catches errors and malicious changes, directly violating change management principles. Option D is wrong because disabling change logging destroys the audit trail required for compliance and incident investigation, and it is never an acceptable step in change management.

Practice this question →
9
MCQmedium

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

A.Configure firewall rulebases to block all inbound traffic by default.
B.Draft the incident response playbook according to NIST SP 800-61.
C.Deploy a Security Information and Event Management (SIEM) solution for continuous monitoring.
D.Perform a comprehensive risk assessment and align the identified risks against Annex A control objectives.
AnswerD

A comprehensive risk assessment is the prerequisite for the Statement of Applicability, since ISO/IEC 27001 requires control selection and any exclusions to be justified by identified risk. Aligning findings against Annex A control objectives produces the documented rationale the CISO needs, satisfying the standard's risk-based control selection requirement.

Why this answer

ISO/IEC 27001 requires that the Statement of Applicability (SoA) be derived from the results of a formal risk assessment. The risk assessment identifies which threats and vulnerabilities apply to the organization, and Annex A controls are then selected (or excluded with justification) based on those findings. Without completing the risk assessment first, the SoA has no defensible basis for inclusion or exclusion of controls.

Exam trap

CND often tests the misconception that implementing a specific technical control (firewall, SIEM) satisfies ISO 27001 compliance, when the framework actually requires risk-assessment-driven control selection documented in the SoA.

How to eliminate wrong answers

Option A is wrong because configuring default-deny firewall rules is a technical control implementation, not the prerequisite activity that drives SoA content under ISO/IEC 27001. Option B is wrong because drafting an incident response playbook per NIST SP 800-61 is a downstream operational activity that supports Annex A.16 (incident management) but does not determine which controls belong in the SoA. Option C is wrong because deploying a SIEM is a monitoring control implementation (Annex A.12.4) and is itself selected as a result of the risk assessment, not a precursor to it.

Practice this question →
10
MCQeasy

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

A.Patch Management Policy
B.Information Security Policy
C.Remote Access Policy
D.Firewall Configuration Policy
AnswerB

An Information Security Policy is the umbrella document that defines data classification tiers, handling rules and disposal requirements, giving the administrator the baseline mandate from which standards and procedures flow. It directly satisfies the stem's need to govern classification, handling and disposal before drafting narrower supporting policies.

Why this answer

An Information Security Policy is the top-level, umbrella document that establishes the organization's overall security objectives, scope, roles, and principles — including how data is classified, handled, and disposed of. All other policies (patch management, remote access, firewall configuration) derive from and must align with it. Drafting it first creates the baseline expectations that subordinate policies implement.

Exam trap

The trap is that all four options are legitimate policy types, so candidates must recognize the hierarchy — the question asks for the foundational policy that establishes baseline expectations, not a domain-specific one.

How to eliminate wrong answers

Option A is wrong because a Patch Management Policy is a subordinate, tactical policy that addresses vulnerability remediation timelines and does not govern data classification or disposal. Option C is wrong because a Remote Access Policy governs how users connect to the network, not how data is classified and handled. Option D is wrong because a Firewall Configuration Policy is a technical control document that specifies rule standards, not an overarching governance framework.

Practice this question →
11
MCQeasy

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

A.Identifying and cataloging all network assets, data flows, and current vulnerabilities
B.Conducting incident containment following a zero-day breach
C.Deploying next-generation firewalls across core network segments
D.Decommissioning obsolete routers and end-of-life switches
AnswerA

Assessment and Analysis establishes the baseline the rest of the lifecycle depends on. Cataloguing network assets, mapping data flows and recording current vulnerabilities gives defenders the visibility needed to prioritise later protection, detection and response activities.

Why this answer

The Assessment and Analysis phase of the Network Defense Lifecycle is the discovery and baseline phase: you must inventory assets, map data flows, and identify current vulnerabilities before you can design or deploy defenses. Without this baseline, subsequent phases (design, implementation, monitoring) lack the context to prioritize controls. This aligns with frameworks like NIST CSF's Identify function and the CND methodology's emphasis on situational awareness first.

Exam trap

CND often tests the misconception that the first lifecycle phase involves deploying tools or responding to incidents — candidates confuse 'assessment' with 'implementation' or 'response,' when the correct answer is always about discovery, inventory, and baseline analysis.

How to eliminate wrong answers

Option B is wrong because incident containment belongs to the response/recovery phase, not the initial assessment phase — you cannot contain an incident before you have assessed the environment. Option C is wrong because deploying next-gen firewalls is an implementation activity that occurs after assessment and design, not during the initial analysis phase. Option D is wrong because decommissioning obsolete equipment is a lifecycle/asset management action that follows assessment findings, not the assessment itself.

Practice this question →
12
MCQhard

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

A.Configuration Management Baseline Drift
B.Audit and Accountability Retention Policy Violation
C.Network Redundancy Fault Tolerance Failure
D.Access Control Discretionary Discrepancy
AnswerB

Purging logs after 7 days breaches the retention control within the audit and accountability family, which mandates preserving security audit records for defined periods. The 365-day compliance requirement is unmet, so the failure is specifically a retention policy violation.

Why this answer

The scenario describes security audit logs being purged after 7 days when compliance requires 365-day retention. This is a direct failure of the audit and accountability retention policy — the organization's logging retention controls do not meet the mandated retention period. The control family (Audit and Accountability) and the specific failure (retention policy violation) match exactly.

Exam trap

The trap is overthinking the scenario and picking a technical control failure (configuration drift, redundancy) when the question is really about a governance/policy control — candidates must map the symptom (logs purged too soon) to the correct control family (Audit and Accountability).

How to eliminate wrong answers

Option A is wrong because configuration management baseline drift refers to systems deviating from a hardened configuration baseline, not to log retention periods. Option C is wrong because network redundancy fault tolerance failure concerns availability and failover, not log retention. Option D is wrong because access control discretionary discrepancy refers to improper discretionary access controls (e.g., file permissions), not audit log retention.

Practice this question →
13
MCQmedium

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

A.Every 30 days continuously across all internal subnets
B.Annually following the completion of the fiscal budget review
C.At least every 6 months and after any significant infrastructure modification
D.Only upon the initial deployment of the cardholder data environment
AnswerC

PCI-DSS v4.0 Requirement 11.3 mandates external penetration testing at least every six months, plus after any significant infrastructure or application change. This recurring cadence and change-triggered retest satisfy the CDE's continuous assurance obligation, rather than the annual testing some frameworks accept.

Why this answer

PCI-DSS v4.0 Requirement 11.3.1 mandates that external penetration testing be performed at least once every 6 months and after any significant change to the CDE infrastructure or applications. This cadence ensures that newly exposed services or configuration changes are validated against real-world attack techniques. The other options misstate the frequency or scope.

Exam trap

PCI-DSS often tests the distinction between external (every 6 months) and internal (annually) penetration testing frequencies — candidates who remember 'annual' from older versions or confuse the two scopes pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because continuous 30-day testing across all internal subnets is not a PCI-DSS requirement — internal penetration testing is required at least annually (11.3.2), not monthly. Option B is wrong because tying testing to a fiscal budget review is arbitrary and not part of the standard; annual testing alone is insufficient for external scope. Option D is wrong because testing only at initial deployment ignores the requirement for recurring validation and post-change testing.

Practice this question →
14
Multi-Selectmedium

An enterprise is reviewing its Disaster Recovery (DR) and Business Continuity (BC) policies. During a risk assessment, the team calculates the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical database systems. Which THREE factors directly influence these metrics? (Choose three)

Select 3 answers
A.The brand name of office breakroom coffee machines
B.Criticality of the business application and financial impact of downtime
C.The geographic color of the exterior data center facility paint
D.Frequency and type of automated database backup schedules (e.g., continuous replication vs. nightly batch)
E.Hardware restoration speed and data recovery throughput capabilities
AnswersB, D, E

Application criticality and downtime cost determine how aggressively RTO and RPO targets are set: revenue-critical systems justify near-zero objectives, while low-impact workloads tolerate longer windows. This business-driven constraint directly shapes the risk assessment's metric calculations.

Why this answer

Option B is correct because the criticality of the business application and the financial impact of downtime directly drive how aggressively RTO and RPO targets are set — a revenue-critical database demands tighter objectives than a low-impact system. Option D is correct because backup frequency and type determine the maximum data loss window (RPO): continuous replication yields near-zero RPO, while nightly batch backups allow up to 24 hours of loss. Option E is correct because hardware restoration speed and data recovery throughput determine how quickly systems can be brought back online, directly bounding the achievable RTO.

Option A is incorrect because coffee machine branding has no bearing on recovery metrics, and option C is incorrect because exterior paint color is irrelevant to RTO/RPO calculations.

Exam trap

The trap is including obviously irrelevant options, but candidates may overthink and select them if they misinterpret the question as asking for all factors, not just the relevant ones.

Practice this question →
15
Multi-Selecthard

An organization is aligning its defenses with the NIST SP 800-53 Rev. 5 'Access Control (AC)' control family. Which THREE controls are core requirements within this family? (Choose three)

Select 3 answers
A.AC-3: Access Enforcement
B.AC-2: Account Management
C.AC-5: Separation of Duties
D.PE-3: Physical Access Control
E.IR-4: Incident Handling
AnswersA, B, C

AC-3 Access Enforcement requires the system to enforce approved authorisations for logical access to information and system resources, making it a foundational control within the AC family that translates policy decisions into actual permit or deny outcomes.

Why this answer

AC-3 (Access Enforcement) is a core AC family control because it requires the system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, making it fundamental to the Access Control family. AC-2 (Account Management) is also core to AC because it governs the lifecycle of system accounts—creation, enabling, modification, disabling, and removal—which is prerequisite to enforcing access decisions. AC-5 (Separation of Duties) belongs to the AC family and is a core requirement that divides duties of individuals to prevent malevolent activity without collusion, directly addressing access control governance.

PE-3 (Physical Access Control) is not in the AC family; it belongs to the Physical and Environmental Protection (PE) family, so it does not satisfy the question. IR-4 (Incident Handling) is not in the AC family; it belongs to the Incident Response (IR) family and addresses incident handling capability rather than access control.

Exam trap

CND often tests control family identification by mixing in controls from other families (PE, IR), so candidates who do not memorize the family prefixes (AC, PE, IR) pick the wrong controls.

Practice this question →
16
MCQeasy

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

A.Detect
B.Respond
C.Identify
D.Recover
AnswerC

Asset categorisation, governance policies and risk assessments all sit within the Identify function, which establishes organisational understanding of systems, assets, data and capabilities. These activities build the asset inventory and risk picture that Protect, Detect, Respond and Recover functions subsequently rely upon.

Why this answer

The NIST CSF Identify function encompasses asset management, governance, risk assessment, and risk management strategy — exactly the activities described (categorizing assets, establishing governance policies, conducting risk assessments). Identify is the foundational function that establishes organizational understanding of cybersecurity risk.

Exam trap

CND often tests the confusion between Identify and Detect — candidates must recognize that asset categorization, governance, and risk assessment are Identify activities, while monitoring and anomaly detection are Detect activities.

How to eliminate wrong answers

Option A is wrong because Detect focuses on monitoring and anomaly detection (continuous monitoring, detection processes), not asset categorization or governance. Option B is wrong because Respond covers incident response activities (response planning, communications, analysis, mitigation), not risk assessment or governance. Option D is wrong because Recover focuses on recovery planning, improvements, and communications after an incident, not pre-incident governance and risk assessment.

Practice this question →
17
Multi-Selectmedium

A security manager is designing a comprehensive security governance program for a multinational financial institution. Which TWO activities are fundamental responsibilities of security governance? (Choose TWO)

Select 2 answers
A.Writing custom regex signatures for intrusion detection system (IDS) alert tuning.
B.Establishing accountability and oversight mechanisms for security policies and compliance.
C.Manually configuring static routing tables on core layer-3 distribution switches.
D.Aligning information security strategy with overall business goals and risk appetite.
E.Replacing failing power supply units in redundant enterprise chassis routers.
AnswersB, D

Security governance establishes accountability and oversight mechanisms so that security policies and compliance obligations are owned, monitored and enforced. This assigns clear responsibility across the organisation, a fundamental governance duty rather than a technical control implementation.

Why this answer

Option B is correct because security governance is fundamentally about defining accountability structures, oversight bodies (such as a security steering committee), and mechanisms that ensure policies and regulatory compliance are enforced across the organization. Option D is correct because governance requires that the information security strategy be derived from and continuously aligned with the enterprise's business objectives and stated risk appetite, ensuring security investments support organizational goals. Options A, C, and E are incorrect because writing IDS regex signatures, configuring static routes on distribution switches, and swapping failed power supplies are hands-on operational or technical tasks, not governance-level responsibilities, which focus on direction, oversight, and strategic alignment rather than device-level implementation.

Exam trap

CND often tests the difference between governance (strategic oversight, accountability, alignment) and hands-on technical operations, tricking candidates into selecting operational tasks as governance responsibilities.

Practice this question →
18
MCQmedium

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

A.Retirement Phase
B.Maintenance Phase
C.Design Phase
D.Deployment Phase
AnswerC

Threat modelling belongs in the design phase, where architecture and data flows are analysed to surface flaws such as missing authentication or trust boundary weaknesses before code exists. This satisfies the requirement to identify architectural security flaws prior to coding.

Why this answer

Threat modeling is most effective when integrated during the Design Phase because that is when architectural decisions, data flows, and trust boundaries are defined. Identifying threats at this stage allows flaws to be remediated before code is written, which is far cheaper than fixing them later. This aligns with SSDLC best practices (e.g., Microsoft SDL, OWASP SAMM).

Exam trap

The trap is choosing later phases (maintenance, deployment) because they seem 'when security is tested' — but threat modeling must precede coding to influence architecture, making Design the only correct phase.

How to eliminate wrong answers

Option A is wrong because the Retirement Phase deals with decommissioning and data disposal — too late to influence architecture. Option B is wrong because the Maintenance Phase addresses post-deployment patches and updates, after architectural flaws are already baked in. Option D is wrong because the Deployment Phase focuses on release and configuration, where design-level changes are costly and disruptive.

Practice this question →
19
MCQmedium

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

A.Unrestricted guest wireless broadcast zone
B.Core router management loopback subnet
C.DMZ (Demilitarized Zone) web server farm
D.Remediation VLAN / Quarantine Network
AnswerD

A remediation or quarantine VLAN is a logically isolated segment where non-compliant endpoints are placed after failing posture checks. It blocks access to production resources while permitting limited remediation traffic, directly satisfying the policy requirement that outdated-antivirus endpoints be automatically quarantined rather than admitted.

Why this answer

Non-compliant endpoints in a NAC governance policy should be placed in a remediation VLAN or quarantine network, which is an isolated segment designed to restrict access while allowing remediation resources (e.g., antivirus updates, patch servers). This prevents compromised or non-compliant devices from accessing sensitive internal resources.

Exam trap

CND often tests the misconception that any isolated network (like DMZ or guest) can serve as quarantine, but the correct answer is a dedicated remediation VLAN with restricted access.

How to eliminate wrong answers

Option A is wrong because an unrestricted guest wireless broadcast zone provides internet access and may allow lateral movement, not isolation for remediation. Option B is wrong because the core router management loopback subnet is for device management and would expose critical infrastructure to untrusted endpoints. Option C is wrong because a DMZ web server farm is designed for public-facing services, not for quarantining internal non-compliant endpoints; placing them there could expose web servers to risk.

Practice this question →
20
MCQhard

A CND engineer is preparing for an internal audit of the organization's security awareness program. The auditor wants evidence that employees can recognize and report phishing attempts. Which artifact BEST demonstrates the effectiveness of the program?

A.Completion records from the annual computer-based security training module
B.Results of simulated phishing campaigns showing click rates and report rates over time
C.A signed acknowledgment form showing each employee read the acceptable use policy
D.A list of employees who failed to complete mandatory training on time
AnswerB

Simulated phishing campaigns measure actual behavior: how many employees click, submit credentials, or report the message. Tracking click rates and report rates over successive campaigns demonstrates whether the program changes behavior and improves detection. This is the strongest evidence of effectiveness because it reflects real user response rather than attendance or acknowledgment.

Why this answer

Simulated phishing campaigns produce behavioral metrics such as click rate and report rate, which directly measure whether employees recognize and report suspicious messages. Acknowledgments, training completion, and non-completion lists are administrative records that show participation or compliance but not capability. Behavioral evidence is the strongest proof of an awareness program's effectiveness.

Exam trap

The trap here is accepting training completion records as proof of effectiveness when they only demonstrate attendance rather than changed user behavior.

Practice this question →
21
Multi-Selecthard

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

Select 3 answers
A.Total number of physical packets traversing the core external internet gateway daily.
B.Employee completion rate for mandatory annual cybersecurity awareness training.
C.Percentage of critical systems covered by active, tested disaster recovery backup policies.
D.Total gigabytes of log data stored in the centralized SIEM archival repository.
E.Percentage of high-risk vulnerabilities remediated within the defined Service Level Agreement (SLA).
AnswersB, C, E

Training completion rate measures whether the human layer of governance is actually functioning, evidencing that policy is communicated and understood. It is a leading indicator of security culture, complementing technical metrics rather than merely counting incidents after the fact.

Why this answer

Option B is correct because the employee completion rate for mandatory annual cybersecurity awareness training directly measures how effectively the governance program is reducing human-factor risk, which is a recognized indicator of security culture and policy enforcement. Option C is correct because the percentage of critical systems covered by active, tested disaster recovery backup policies demonstrates governance oversight of resilience and business continuity controls, verifying that recovery capabilities are validated rather than merely documented. Option E is correct because the percentage of high-risk vulnerabilities remediated within the defined SLA reflects the organization's ability to enforce risk-based remediation priorities and hold operational teams accountable to governance commitments.

Option A is not a governance metric because raw packet volume at the internet gateway is a capacity or traffic statistic that says nothing about policy effectiveness, risk reduction, or control performance. Option D is also not a governance metric because total gigabytes of archived SIEM log data measures storage consumption, not the quality, coverage, or timeliness of detection and response activities.

Exam trap

CND often tests the distinction between vanity/operational metrics (packet counts, log volumes) and governance effectiveness metrics (training completion, DR coverage, SLA-based remediation) — candidates must identify outcome-oriented indicators.

Practice this question →
22
MCQmedium

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

A.XCCDF (Extensible Configuration Checklist Description Format)
B.Syslog RFC 5424
C.CSV (Comma-Separated Values)
D.SNMP MIB (Management Information Base)
AnswerA

XCCDF is the SCAP language for expressing security configuration checklists and vulnerability assessments as machine-readable rules, which OpenSCAP consumes during automated compliance auditing. OVAL describes system state checks, CPE names platforms, and CVE identifies vulnerabilities, so none replaces XCCDF's checklist role.

Why this answer

XCCDF is the SCAP standard for expressing security configuration checklists and vulnerability assessments in a machine-readable XML format. OpenSCAP consumes XCCDF documents (often paired with OVAL definitions) to perform automated compliance scans. It is the correct data format for authoring SCAP-compliant checklists.

Exam trap

The trap is selecting a familiar data format (CSV, Syslog, MIB) that sounds 'standard' but lacks SCAP semantics — only XCCDF is purpose-built for machine-readable security checklists.

How to eliminate wrong answers

Option B is wrong because Syslog RFC 5424 is a logging transport format, not a checklist or vulnerability definition format — it cannot express compliance rules. Option C is wrong because CSV is a flat tabular format lacking the structure, semantics, and references required for SCAP checklists. Option D is wrong because SNMP MIBs define managed objects for network monitoring, not security configuration checklists or vulnerability definitions.

Practice this question →
23
MCQhard

During a network security audit, the auditor requests evidence that the principle of least privilege is enforced for administrative access to core network infrastructure routers. Which artifact should the network administrator provide to demonstrate compliance?

A.TACACS+ or RADIUS accounting records coupled with RBAC role definitions mapped to administrative job functions.
B.The enterprise backup policy outlining retention periods for offsite media.
C.The vulnerability scanning report listing missing security patches on network devices.
D.NetFlow export configurations showing traffic volume across core interfaces.
AnswerA

This combination proves both who accessed the device and that their command authorization was restricted according to their specific role.

Why this answer

Least privilege for administrative access is demonstrated by AAA accounting records that show exactly who logged in, when, and what commands they executed, paired with RBAC role definitions that map job functions to specific privilege levels. TACACS+ (or RADIUS) accounting logs provide the audit trail, while the RBAC documentation proves that each admin was granted only the permissions their role requires. Together they are the direct evidence an auditor needs to verify least-privilege enforcement.

Exam trap

CND often tests the misconception that any security log (vulnerability scans, NetFlow) proves least privilege — candidates must recognize that only AAA accounting plus RBAC role documentation directly evidences who can do what.

How to eliminate wrong answers

Option B is wrong because backup retention policy addresses data availability/recovery, not administrative privilege enforcement. Option C is wrong because a vulnerability scan report shows patch status and exposure, which is a vulnerability management control, not proof of least privilege. Option D is wrong because NetFlow shows traffic volume and flow patterns for capacity/security monitoring, not who has what administrative rights.

Practice this question →
24
Multi-Selecteasy

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

Select 3 answers
A.Monitoring and Evaluation
B.Unregulated Hardware Decommissioning and Scraping
C.Unrestricted Open Source Code Distribution
D.Implementation and Deployment
E.Assessment and Planning
AnswersA, D, E

Monitoring and Evaluation is a core Network Defense Lifecycle phase: it continuously measures control effectiveness, detects anomalies and feeds findings back into planning. It satisfies the stem's requirement for a recognised lifecycle stage, distinct from assessment and from implementation activities such as hardening or incident response.

Why this answer

The Network Defense Lifecycle is a continuous process that begins with Assessment and Planning (E), where the security posture is evaluated, risks are identified, and defensive strategies and policies are designed before any controls are put in place. It then moves to Implementation and Deployment (D), where the selected security controls, tools, and architectures are actually installed, configured, and integrated into the network. The cycle continues with Monitoring and Evaluation (A), where logs, alerts, and performance data are continuously analyzed to verify that defenses work as intended and to feed improvements back into planning.

Options B and C are not lifecycle stages: unregulated hardware decommissioning and scraping, and unrestricted open source code distribution, describe unsafe or uncontrolled practices rather than recognized phases of the Network Defense Lifecycle.

Exam trap

The trap is that distractor options sound like security-related activities (hardware decommissioning, open source distribution), causing candidates to select them as plausible lifecycle phases when they are not part of the recognized three-stage model.

Practice this question →
25
Multi-Selecteasy

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

Select 2 answers
A.Disabling Telnet and enabling SSH version 2 for CLI management
B.Leaving default administrator credentials unchanged for ease of initial troubleshooting
C.Disabling HTTP and enforcing HTTPS for web-based management interfaces
D.Enabling SNMPv1 community string 'public' with read-write access globally
E.Configuring all switch ports with dynamic VLAN trunking protocol (VTP) server mode by default
AnswersA, C

Telnet carries CLI credentials and session data in cleartext, so disabling it and enabling SSH version 2 secures remote administration with encrypted transport and stronger key exchange. This satisfies the management-plane hardening requirement by removing the insecure legacy protocol.

Why this answer

Option A is correct because Telnet transmits CLI credentials and session data in cleartext, so disabling it and using SSH version 2 provides encrypted, integrity-protected management access with stronger key exchange and authentication. Option C is correct because HTTP exposes web management credentials and configuration data unencrypted, whereas HTTPS (HTTP over TLS) encrypts and authenticates the management session, hardening the management plane. Option B is wrong because default administrator credentials are publicly known and must be changed immediately to prevent unauthorized access.

Option D is wrong because SNMPv1 with the 'public' community string and read-write access is insecure, cleartext, and grants broad modification rights. Option E is wrong because placing all ports in VTP server mode by default risks unintended VLAN database propagation and does not secure the management plane.

Exam trap

CND often tests the misconception that enabling any management protocol (Telnet, HTTP, SNMPv1) is acceptable if the network is 'internal' — the exam expects recognition that cleartext management protocols are never acceptable regardless of network location.

Practice this question →
26
Multi-Selecthard

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

Select 3 answers
A.Assume breach: minimize blast radius by micro-segmenting resources and assuming the network is hostile.
B.Implicitly trust all devices connected to the internal corporate LAN backbone
C.Always verify explicitly: authentication and authorization are validated continuously before every access request.
D.Rely solely on perimeter firewall packet filtering for all internal security enforcement
E.Use least privilege access: restrict user and device access with Just-In-Time (JIT) and Just-Enough-Access (JEA).
AnswersA, C, E

NIST SP 800-207 directs architects to assume the network is hostile and to limit lateral movement through micro-segmentation, so minimising blast radius by segmenting resources satisfies the assume-breach tenet required in the Zero Trust strategy.

Why this answer

Option A is correct because NIST SP 800-207's 'assume breach' tenet requires treating the network as hostile and limiting lateral movement through micro-segmentation to reduce the blast radius of any compromise. Option C is correct because the 'verify explicitly' tenet mandates that every access request be authenticated and authorized using all available data points (identity, device health, context) before granting access, rather than trusting based on network location. Option E is correct because the 'least privilege' tenet requires granting only the minimum access needed, enforced through Just-In-Time (JIT) and Just-Enough-Access (JEA) policies to limit standing permissions.

Option B is incorrect because implicit trust of internal LAN devices directly contradicts ZTA principles, which reject trust based on network location. Option D is incorrect because relying solely on perimeter firewall packet filtering reflects a traditional perimeter-based model, whereas ZTA requires identity- and context-based enforcement at every resource, not just the network edge.

Exam trap

CND often tests the misconception that Zero Trust still allows implicit trust for internal LAN devices or that perimeter firewalls suffice — candidates must recognize that ZTA rejects both location-based trust and perimeter-only enforcement.

Practice this question →
27
Multi-Selecthard

A CND engineer is implementing continuous network defense monitoring for a demilitarized zone that hosts public web servers. The team wants to detect both network-level and host-level anomalies in near real time. Which TWO technologies should be deployed to meet this requirement? (Choose two.)

Select 2 answers
A.A vulnerability scanner scheduled to run weekly against the DMZ
B.Host-based intrusion detection system agents installed on each web server
C.Network-based intrusion detection system sensors placed on a SPAN port
D.A syslog server that only stores device logs for later review
E.A firewall rule set that blocks all inbound traffic except TCP 443
AnswersB, C

Host-based agents monitor file integrity, process behavior, and system logs on the servers themselves, catching activity that never crosses the network in a detectable form, such as local privilege escalation or web shell execution. This supplies the host-level anomaly detection the scenario explicitly requires alongside network visibility.

Why this answer

Detecting both network-level and host-level anomalies in near real time requires complementary sensors. Network-based intrusion detection on a SPAN port supplies traffic visibility, while host-based agents supply file, process, and log visibility on the servers. Log storage, periodic scanning, and firewall filtering are useful supporting controls but do not by themselves deliver the continuous detection the scenario demands.

Exam trap

The trap here is substituting preventive or periodic controls, such as a restrictive firewall or a weekly scan, for the continuous detection technologies the requirement actually calls for.

Practice this question →
28
MCQmedium

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

A.DNSSEC for device privilege authorization
B.HTTP Basic Authentication for router console access
C.SNMPv1 for authentication and TFTP for accounting
D.TACACS+ for device administration and RADIUS for dial-in/remote user access
AnswerD

TACACS+ separates authentication, authorisation and accounting, and encrypts the full payload, making it the standard for granular, auditable device administration. RADIUS handles dial-in and remote user access with combined authentication and authorisation, so pairing the two satisfies the centralised AAA requirement.

Why this answer

TACACS+ and RADIUS together represent the industry-standard AAA combination for network device administration. TACACS+ is preferred for device administration because it separates authentication, authorization, and accounting into distinct functions and encrypts the entire payload, while RADIUS is commonly used for dial-in and remote user access with its UDP-based, attribute-value pair model. This split is a long-standing Cisco and general networking best practice.

Exam trap

The trap here is confusing general-purpose security protocols (DNSSEC, HTTP Basic, SNMP) with true AAA protocols — the exam expects you to know TACACS+ and RADIUS are the only real AAA options listed.

How to eliminate wrong answers

Option A is wrong because DNSSEC secures DNS responses via cryptographic signatures — it has no role in device privilege authorization. Option B is wrong because HTTP Basic Authentication sends credentials in base64 (effectively cleartext) and is not a centralized AAA protocol for router console access. Option C is wrong because SNMPv1 uses weak community-string authentication and TFTP provides no accounting or logging capability — neither is an AAA protocol.

Practice this question →
29
MCQmedium

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

A.Performing business impact analysis (BIA) to classify critical information assets.
B.Procuring hardware appliances and racking firewalls in the primary datacenter.
C.Drafting the initial high-level security governance charter for board approval.
D.Conducting periodic vulnerability assessments and reviewing SIEM alert correlation rules.
AnswerD

Monitor and Evaluate centres on ongoing situational awareness rather than building controls: vulnerability assessments test whether deployed defences still hold, while tuning SIEM correlation rules sustains detection quality. Both are continuous activities, unlike the design and implementation work of earlier phases.

Why this answer

The Monitor and Evaluate phase of the Network Defense Lifecycle focuses on ongoing situational awareness: conducting vulnerability assessments, reviewing SIEM alerts, analyzing logs, and measuring control effectiveness. Periodic vulnerability assessments and SIEM alert correlation rule reviews are continuous monitoring activities that detect changes in the threat landscape and validate that implemented controls still work.

Exam trap

CND often tests the misconception that monitoring is a one-time setup task — candidates must recognize that vulnerability assessments and SIEM rule reviews are recurring, continuous activities characteristic of the Monitor and Evaluate phase.

How to eliminate wrong answers

Option A is wrong because BIA is part of the Assess/Design phase, where critical assets are identified and classified before controls are selected. Option B is wrong because procuring and racking hardware is an Implement phase activity, not monitoring. Option C is wrong because drafting a governance charter is a Plan/Govern phase activity that precedes design and implementation.

Practice this question →
30
MCQeasy

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

A.Junior Firewall Configuration Engineer
B.Third-Party External Penetration Testing Consultant
C.Board of Directors and Executive Management
D.Lead Network Helpdesk Support Technician
AnswerC

Ultimate legal and fiduciary accountability cannot be delegated to security teams or IT management; it rests with the Board of Directors and Executive Management, who own organisational risk appetite and governance. This satisfies the stem's requirement for the party holding ultimate responsibility for overall security posture and risk management decisions.

Why this answer

The Board of Directors and Executive Management hold ultimate legal and fiduciary responsibility for an organization's information security posture and risk management decisions. This is because they are accountable to shareholders, regulators, and other stakeholders for the overall governance of the organization, including cybersecurity risk. They set the tone at the top, approve security strategies, and ensure adequate resources are allocated to mitigate risks.

While other roles may implement or assess security controls, the ultimate accountability cannot be delegated.

Exam trap

The trap here is confusing operational roles with governance roles; candidates might think the most technical person (e.g., firewall engineer) is responsible, but the exam tests that ultimate accountability lies with the board and executives.

How to eliminate wrong answers

Option A is wrong because a Junior Firewall Configuration Engineer is an operational role focused on implementing firewall rules, not on strategic governance or legal accountability. Option B is wrong because a Third-Party External Penetration Testing Consultant provides technical assessments but has no fiduciary duty or legal responsibility for the organization's security posture. Option D is wrong because a Lead Network Helpdesk Support Technician handles day-to-day technical support and troubleshooting, not high-level risk management or governance decisions.

Practice this question →
31
MCQhard

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

A.It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs)
B.It enforces static IP address allocation across dynamic DHCP scopes
C.It compresses network packet captures to reduce storage overhead
D.It automatically patches operating system zero-day vulnerabilities upon log ingestion
AnswerA

Mapping logs to MITRE ATT&CK ties each alert to documented adversary tactics, techniques and procedures, giving analysts the context to prioritise, correlate and respond. This directly supports the detection and response phases of the network defence lifecycle rather than merely storing raw events.

Why this answer

Mapping SIEM logs to MITRE ATT&CK enriches alerts with context about which adversary tactic or technique the observed behavior represents (e.g., T1059 Command and Scripting Interpreter). This lets defenders prioritize, correlate, and communicate incidents in a shared vocabulary tied to real-world threat actor behavior. It transforms raw log events into actionable intelligence aligned to the kill chain, improving detection engineering and response.

Exam trap

CND often tests the misconception that ATT&CK mapping performs operational functions like patching or compression — candidates must recognize it is purely a contextualization and threat-intelligence framework for detection and response.

How to eliminate wrong answers

Option B is wrong because static IP allocation is a DHCP server function and has nothing to do with ATT&CK mapping — ATT&CK is a knowledge base of adversary behavior, not a network configuration tool. Option C is wrong because packet capture compression is a storage/PCAP concern handled by tools like Wireshark or Zeek, not by ATT&CK mapping. Option D is wrong because ATT&CK mapping does not patch vulnerabilities — it identifies adversary techniques, and patching is a separate vulnerability management workflow.

Practice this question →
32
MCQmedium

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

A.Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs
B.Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic
C.Disable firewall packet filtering on internal interfaces to maximize application throughput
D.Permit all internal traffic by default, blocking only known malicious signatures
AnswerA

Default-deny with explicit allow rules for only required destination ports and IPs enforces least privilege between DMZ and application tier, minimising exposed attack surface. This satisfies the stem's requirement to structure firewall rules per least privilege in the network defence lifecycle.

Why this answer

The principle of least privilege requires that firewall rules between the DMZ and the internal application tier follow an implicit deny posture, permitting only the specific destination ports and IP addresses required for legitimate application traffic. This limits lateral movement if the DMZ is compromised, since an attacker cannot reach arbitrary internal hosts or services. Explicitly enumerating allowed flows also produces an auditable rule set that supports network defense lifecycle management (design, implement, monitor, maintain).

Exam trap

CND often tests the misconception that internal network traffic is inherently trusted, so candidates pick options that permit all internal traffic or only inspect the perimeter instead of applying default-deny least privilege between internal tiers.

How to eliminate wrong answers

Option B is wrong because trusting all outbound traffic while only inspecting inbound perimeter traffic ignores east-west threats and exfiltration from compromised internal hosts; stateful inspection must apply to both directions and to internal segments. Option C is wrong because disabling packet filtering on internal interfaces removes a core defense-in-depth layer and exposes the application tier directly to any DMZ compromise, trading security for throughput that can be achieved through hardware scaling instead. Option D is wrong because a default-permit posture with signature-only blocking is a blacklist model that fails against unknown or encrypted threats and violates least privilege; firewalls should default-deny, not default-allow.

Practice this question →
33
Multi-Selecteasy

An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)

Select 2 answers
A.Acceptable Use Policy (AUP)
B.Access Control Policy
C.Spanning Tree Protocol Priority Table
D.BGP Routing Advertisement Standard
E.OSPF Area Design Specification
AnswersA, B

The Acceptable Use Policy is a foundational sub-policy because it defines how employees may use organisational assets, directly satisfying the governance umbrella's need for enforceable user-conduct rules. It translates high-level policy intent into specific, auditable behavioural constraints, covering email, internet, and device usage, which the framework requires.

Why this answer

The Acceptable Use Policy (AUP) (A) is a foundational sub-policy because it defines how employees may use organizational IT assets, covering email, internet, and device usage, which directly supports the governance umbrella of an Information Security Policy framework. The Access Control Policy (B) is also foundational because it specifies rules for granting, reviewing, and revoking access to systems and data, establishing least privilege and need-to-know principles that underpin security governance. Options C, D, and E are not policy documents but technical network configuration artifacts: Spanning Tree Protocol priority values, BGP route advertisement rules, and OSPF area design are operational networking details, not governance-level security policies.

Exam trap

CND often tests whether candidates can distinguish governance documents (AUP, Access Control Policy) from technical network configuration artifacts (STP, BGP, OSPF), so avoid picking options that sound technical but are not policies.

Practice this question →
34
Multi-Selecteasy

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Select 2 answers
A.Disabling endpoint firewall protection to improve home network gaming performance
B.Multi-Factor Authentication (MFA) for all authentication attempts
C.Sharing corporate laptop credentials with family members for household convenience
D.Connecting directly via unencrypted public Wi-Fi without any protective tunneling
E.Encrypted Virtual Private Network (VPN) tunnel with IPsec or TLS
AnswersB, E

MFA directly satisfies the policy's requirement for strong authentication on every access attempt to internal resources. By demanding a second factor beyond a password, it neutralises credential theft and replay attacks, which are the primary risks when remote sessions traverse untrusted home networks. This enforces identity assurance regardless of location.

Why this answer

Option B is correct because Multi-Factor Authentication (MFA) ensures that even if a remote employee's password is compromised, an attacker cannot authenticate to internal corporate resources without the additional factor, directly mitigating credential-theft and phishing risks inherent to home environments. Option E is correct because an encrypted VPN tunnel using IPsec or TLS provides confidentiality and integrity for data in transit between the remote endpoint and the corporate network, preventing eavesdropping or tampering on untrusted home or public networks. Options A, C, and D are incorrect: disabling endpoint firewall protection weakens host defenses and exposes the device to inbound attacks, sharing credentials with family members violates least-privilege and non-repudiation principles, and connecting directly over unencrypted public Wi-Fi without tunneling exposes all traffic to interception and man-in-the-middle attacks.

Exam trap

CND often tests the misconception that a VPN alone is sufficient without MFA, or that home network security is adequate, leading candidates to overlook the need for both encryption and strong authentication.

Practice this question →
35
MCQeasy

A CND analyst at a healthcare provider is asked to classify a new data set containing patient appointment notes, physician referrals, and insurance billing codes. The organization follows a four-tier internal classification scheme (Public, Internal, Confidential, Restricted). Which classification level BEST fits this data set?

A.Confidential
B.Restricted
C.Public
D.Internal
AnswerA

Confidential is the appropriate tier because the data contains protected health information that must be restricted to authorized clinical and billing staff, encrypted in transit and at rest, and handled under HIPAA safeguards. It is sensitive but not classified at the highest Restricted tier, which is typically reserved for data whose disclosure would cause catastrophic organizational harm.

Why this answer

The data set contains protected health information, which requires controlled access, encryption, and regulatory safeguards, so it belongs in the Confidential tier. Restricted is too high for routine clinical and billing records, while Public and Internal tiers fail to capture the legal and privacy impact of a leak. Correct classification drives the right handling and control baseline.

Exam trap

The trap here is assuming any regulated data must automatically be classified at the highest tier rather than matching the tier to the actual impact of disclosure.

Practice this question →
36
MCQhard

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

A.Disabling log verbosity to prevent storage overhead on the central syslog collector
B.Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter
C.Relying entirely on end users to manually report anomalous log entries via email
D.Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows
AnswerD

A SIEM ingests logs centrally, correlates events automatically and drives scheduled analyst triage, directly fulfilling A.12.4.1's requirement that logs be produced, kept and regularly reviewed. Manual periodic reading cannot evidence consistent review at scale, so this satisfies the governance constraint.

Why this answer

Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows provides continuous, automated log review that satisfies ISO/IEC 27001 A.12.4.1. The SIEM aggregates logs, correlates events, and generates alerts for analyst review, ensuring regular monitoring and governance. This is the most effective automated practice for meeting the control's requirement for regular review.

Exam trap

CND often tests whether candidates confuse log collection with log review, so picking options that only store or export logs without regular automated review leads to the wrong answer.

How to eliminate wrong answers

Option A is wrong because disabling log verbosity reduces the data available for review, directly undermining the control's requirement to record user activities, exceptions, and security events. Option B is wrong because exporting raw logs to an unindexed USB drive once per quarter is neither regular nor automated, and it lacks integrity controls, making review impractical and non-compliant. Option C is wrong because relying on end users to manually report anomalies is not a systematic, automated review process and does not satisfy the governance requirement for regular log review.

Practice this question →
37
MCQeasy

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

A.Annualized Loss Expectancy (ALE)
B.Packet drop rate on enterprise core firewalls
C.Common Vulnerability Scoring System (CVSS) base score
D.Active directory domain controller CPU utilization
AnswerA

Annualized Loss Expectancy multiplies single loss expectancy by annualised rate of occurrence, expressing expected yearly financial loss in monetary terms. This gives the board a quantified exposure figure, unlike qualitative ratings or technical metrics that lack direct financial meaning.

Why this answer

Annualized Loss Expectancy (ALE) is the correct answer because it quantifies financial exposure in monetary terms by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). This allows a CISO to translate technical risk into a dollar figure that a board of directors can directly understand and use for budget and risk-acceptance decisions. It is the standard quantitative risk metric used in executive risk reporting.

Exam trap

CND often tests the confusion between technical severity metrics (CVSS) and business/financial risk metrics (ALE), so candidates must remember that only ALE expresses monetary exposure.

How to eliminate wrong answers

Option B is wrong because packet drop rate is a low-level operational performance metric that indicates network congestion or hardware issues, not financial exposure from breaches. Option C is wrong because CVSS base scores measure the technical severity of a vulnerability (0.0–10.0) but do not express monetary loss or business impact. Option D is wrong because domain controller CPU utilization is a host performance indicator with no direct relationship to breach-related financial risk.

Practice this question →
38
MCQmedium

An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?

A.Antivirus signature update logs from all workstation endpoints.
B.Software asset inventory spreadsheets listing operating system versions.
C.Architecture diagrams and firewall rulebases demonstrating that out-of-scope networks cannot reach the CDE without strict filtering.
D.HR onboarding records showing background checks for all employees with physical access to the building.
AnswerC

Architecture diagrams plus firewall rulebases prove that out-of-scope networks cannot reach the cardholder data environment without strict filtering. This documented evidence demonstrates segmentation controls to the PCI-DSS auditor, satisfying the requirement for proof rather than assertion.

Why this answer

PCI-DSS segmentation evidence requires demonstrating that out-of-scope networks cannot reach the cardholder data environment (CDE) without passing through a controlled, filtered boundary. Architecture diagrams show the intended segmentation, and firewall rulebases prove the actual enforcement — together they are the standard artifacts auditors request to validate that the CDE is isolated and that all access is explicitly authorized and restricted.

Exam trap

CND often tests the confusion between segmentation evidence (diagrams + firewall rules) and unrelated compliance artifacts (AV logs, asset inventories, HR records) — candidates pick any document that sounds audit-related rather than the one that proves network isolation.

How to eliminate wrong answers

Option A is wrong because antivirus signature logs are endpoint malware protection evidence, unrelated to network segmentation. Option B is wrong because a software asset inventory lists OS versions for patch management, not network isolation. Option D is wrong because HR background check records address personnel screening (PCI-DSS 12.7), not network segmentation controls.

Practice this question →
39
MCQeasy

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

A.The vendor part numbers and firmware release schedules for core network switches.
B.The exact physical coordinates and lock combinations of the server room cages.
C.Explicit notification that network activity is monitored and clear disciplinary actions for violations.
D.Detailed command-line instructions for configuring IPsec VPN tunnels on remote laptops.
AnswerC

Enforceability depends on employees having prior notice that monitoring occurs and on defined, consistent penalties. Without explicit monitoring notification and stated disciplinary consequences, the AUP cannot be applied fairly or defended when violations are actioned.

Why this answer

The essential element for enforceability in an AUP is explicit notification that network activity is monitored and clear disciplinary actions for violations. Without informing employees that their activity is monitored, the policy may be legally unenforceable due to privacy expectations. Clear disciplinary actions provide the necessary consequences to deter violations and ensure consistent enforcement.

This combination establishes both transparency and accountability, which are fundamental to a valid AUP.

Exam trap

CND often tests the misconception that technical details (like part numbers or configurations) are essential in policy documents, when in fact policies must focus on user behavior, monitoring, and consequences to be enforceable.

How to eliminate wrong answers

Option A is wrong because vendor part numbers and firmware schedules are technical inventory details, not policy elements that affect employee behavior or enforceability. Option B is wrong because physical coordinates and lock combinations are security-sensitive operational details that belong in a physical security plan, not an AUP, and their inclusion could compromise security. Option D is wrong because command-line instructions for VPN configuration are technical procedures, not policy statements, and they do not address user responsibilities or consequences.

Practice this question →
40
MCQmedium

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

A.Physical Security Controls
B.User Responsibilities and Data Sharing
C.Disaster Recovery Protocols
D.Network Infrastructure Redundancy
AnswerB

The User Responsibilities and Data Sharing section governs how employees handle and disclose data, so revising it lets the policy explicitly regulate sharing on external cloud collaboration platforms. Other sections cover asset use or enforcement, not the specific data-sharing behaviour the manager must address.

Why this answer

The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Exam trap

The trap is being drawn to technical-sounding options (physical security, DR, network redundancy) when the question is about policy scope — candidates must recognize that AUPs address user behavior, not infrastructure.

How to eliminate wrong answers

Option A is wrong because Physical Security Controls address facility access, locks, and environmental protections — not employee data-sharing behavior on cloud platforms. Option C is wrong because Disaster Recovery Protocols define recovery time/point objectives and restoration procedures, which are unrelated to acceptable use of collaboration tools. Option D is wrong because Network Infrastructure Redundancy concerns resilient network design (redundant links, failover), not policy governing employee data sharing.

Practice this question →
41
MCQmedium

A CND engineer is reviewing the organization's incident response plan. The plan states that after containment and eradication, the team must validate that the affected systems are clean before restoring normal operations. Which activity BEST fulfills this validation requirement?

A.Asking the affected user to confirm that the system appears to be working normally
B.Rebuilding affected hosts from a known-good image and confirming endpoint protection reports no detections
C.Reviewing the original alert that triggered the investigation to confirm it is no longer firing
D.Documenting the root cause in the incident report and closing the ticket
AnswerB

Rebuilding from a trusted baseline and confirming no detections validates that the systems are free of the identified compromise before they rejoin production. This directly supports the recovery phase of the incident response lifecycle and prevents reintroducing the threat. It is the most reliable validation because it removes any residual artifacts rather than merely observing that symptoms have stopped.

Why this answer

Validation requires positive technical evidence that the threat has been removed. Rebuilding from a known-good image and confirming clean endpoint protection reports provides that evidence and eliminates residual artifacts. Alert silence, user reassurance, and paperwork closure are all weak proxies that can mask a still-compromised system being returned to production.

Exam trap

The trap here is treating the disappearance of the original alert as proof of remediation rather than requiring positive evidence from a trusted baseline.

Practice this question →
42
MCQeasy

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

A.BGP Routing Table Summaries
B.Active Directory Account Access Logs and Group Memberships
C.Network Switch Port VLAN Assignments
D.DNS Zone File Configurations
AnswerB

Account access logs record individual logon events tied to distinct usernames, revealing whether one account is used concurrently from separate locations or sessions. Group memberships show privilege assignment, not usage, so logs are the artifact proving whether credentials are shared.

Why this answer

To verify that administrative accounts are not sharing credentials and to validate individual accountability, the auditor must inspect Active Directory account access logs and group memberships. These artifacts show which accounts exist, who is a member of privileged groups, and when each account was used to log on. If multiple administrators are using the same account, the logon events will show the same account name from different workstations or at overlapping times, which is the evidence of shared credentials.

Exam trap

CND often tests the difference between network-layer artifacts (routing tables, VLANs, DNS) and identity-layer artifacts (AD logs, group memberships) — candidates who focus on network security may overlook that accountability is an identity and access management concern.

How to eliminate wrong answers

Option A is wrong because BGP routing table summaries are network-layer routing data and have nothing to do with user authentication or accountability. Option C is wrong because switch port VLAN assignments are Layer 2 network segmentation data and do not record user identity or account usage. Option D is wrong because DNS zone file configurations are name-resolution records and contain no authentication or account-usage information.

Practice this question →
43
Multi-Selectmedium

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

Select 3 answers
A.Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways
B.Environmental monitoring sensors tracking temperature and humidity thresholds
C.Visitor management logs requiring identification verification and escort protocols
D.Biometric or electronic card-key access control systems logging all entry and exit events
E.Leaving data center exterior emergency exit doors propped open for convenient cooling
AnswersB, C, D

Environmental monitoring sensors satisfy Annex A.11.2.1's requirement for environmental threat protection by detecting temperature and humidity excursions before equipment damage occurs. Unlike reactive fire suppression or access logging, continuous threshold monitoring provides the preventive detection capability the standard expects in a primary data centre housing critical infrastructure.

Why this answer

Option B is correct because ISO/IEC 27001 Annex A (A.11.2.1/A.7.5 in the 2022 revision) requires protection against environmental threats, and temperature/humidity sensors with defined thresholds detect conditions that could damage servers and storage. Option C is correct because Annex A physical entry controls (A.11.1.2/A.7.2) require visitor records, identity verification, and escorting of unauthorized persons to prevent unauthorized physical access. Option D is correct because Annex A requires secure areas to be protected by appropriate entry controls such as biometric or card-key systems, and logging all entry/exit events provides the audit trail needed for accountability and incident investigation.

Option A is not acceptable because storing unencrypted backup tapes with sensitive PII in unlocked hallways violates both physical protection of media (A.11.2.3/A.7.10) and confidentiality requirements. Option E is not acceptable because propping open emergency exits defeats physical perimeter security and violates secure-area access control requirements, even if done for cooling convenience.

Exam trap

CND often tests whether candidates can distinguish actual implemented controls from obvious control violations — the trap is picking a plausible-sounding but non-compliant practice (open doors, unsecured tapes) as if it were a security measure.

Practice this question →
44
MCQhard

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

A.SQL injection vulnerabilities in web application forms
B.LLMNR/NBT-NS poisoning and credential relay attacks
C.BGP prefix hijacking and route table poisoning
D.DNS zone transfer enumeration via nslookup
AnswerB

Disabling LLMNR removes the multicast name-resolution fallback that attackers spoof to harvest NetNTLM hashes and relay credentials. This directly mitigates LLMNR/NBT-NS poisoning and credential relay attacks on domain member servers, as the CIS benchmark intends.

Why this answer

Disabling LLMNR mitigates LLMNR/NBT-NS poisoning and credential relay attacks, where an attacker responds to broadcast name resolution requests to impersonate a legitimate host and capture NTLMv2 hashes for offline cracking or relay. LLMNR is a multicast protocol (224.0.0.252, ff02::1:3) that Windows uses as a fallback when DNS fails, and tools like Responder exploit it. Disabling it forces resolution through DNS, reducing the attack surface.

Exam trap

CND often tests whether candidates associate LLMNR with the correct attack class (credential relay/poisoning) rather than unrelated vulnerabilities like SQL injection or BGP hijacking, causing them to pick a distractor based on superficial keyword matching.

How to eliminate wrong answers

Option A is wrong because SQL injection is a web application vulnerability mitigated by input validation and parameterized queries, not by disabling a name resolution protocol. Option C is wrong because BGP prefix hijacking is a routing-layer attack mitigated by RPKI, BGPsec, and prefix filtering, not by LLMNR configuration. Option D is wrong because DNS zone transfer enumeration is mitigated by restricting AXFR/IXFR to authorized secondary servers, not by disabling LLMNR.

Practice this question →
45
MCQeasy

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

A.Exposing the legacy host directly to the public internet for easier monitoring
B.Disabling the system logging service to prevent disk space exhaustion
C.Implementing strict network segmentation and firewall micro-perimeter isolation around the legacy host
D.Granting full local administrator privileges to all domain users
AnswerC

Micro-segmentation and firewall isolation restrict lateral movement from the unpatched host, containing any compromise. This satisfies the stem's constraint that immediate replacement is impossible, since compensating controls reduce exposure while the end-of-life system remains in service.

Why this answer

When immediate replacement of an end-of-life OS is impossible, best practice is to isolate the legacy host using strict network segmentation and firewall micro-perimeter controls. This limits the attack surface and prevents lateral movement, even if the host is compromised. Segmentation buys time until a replacement can be deployed.

Exam trap

The trap is selecting an option that seems to improve monitoring or access but actually increases exposure, such as exposing the host to the internet or disabling logging.

How to eliminate wrong answers

Option A is wrong because exposing a legacy host to the public internet drastically increases risk and is never a mitigation. Option B is wrong because disabling logging reduces visibility and hinders incident detection, worsening security. Option D is wrong because granting full admin privileges to all users violates least privilege and increases the risk of compromise.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Network Defense Management questions.

Start 20-question session