Courseiva

CCNA Network Perimeter Protection Questions

47 questions · Network Perimeter Protection topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selectmedium

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Select 2 answers
A.Optical Network Tap (Test Access Point)
B.Inline active blocking mechanism that terminates malicious TCP sessions directly
C.Directly modifying the TCP/IP stack of external client operating systems
D.Switch Port Analyzer (SPAN) or Mirror Port
E.Using DHCP broadcast packets to rewrite routing tables
AnswersA, D

An optical network tap sits inline on a fibre link and splits the signal, sending a copy to the NIDS while traffic passes through uninterrupted. It captures full-duplex traffic passively, satisfying the collection requirement without introducing a forwarding device.

Why this answer

Option A (Optical Network Tap, or Test Access Point) is correct because a passive optical tap splits the light signal so a copy of the traffic is sent to the NIDS while the original traffic continues uninterrupted, which is a standard out-of-band collection method. Option D (Switch Port Analyzer, or SPAN/Mirror Port) is correct because SPAN copies frames from one or more switch ports or VLANs to a monitoring port where the NIDS sensor is connected, making it a common way to collect traffic for analysis. Option B is not a collection method but an inline active blocking mechanism, which describes IPS functionality rather than NIDS traffic capture.

Option C is incorrect because modifying external client TCP/IP stacks is not a deployment mode for collecting traffic and would be an endpoint-based approach, not a NIDS collection method. Option E is incorrect because DHCP broadcasts are used for address assignment, not for rewriting routing tables to collect traffic for a NIDS.

Exam trap

The trap is confusing NIDS (passive detection) with IPS (active prevention) — option B describes IPS functionality, and candidates who don't distinguish between the two may select it as a valid 'deployment method.'

Practice this question →
2
MCQhard

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

A.nftables create filter-table --default-drop
B.iptables -P INPUT DROP
C.nft add table inet filter; nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
D.ufw default deny incoming
AnswerC

This sequence creates an inet family filter table, then adds a base chain bound to the input hook with priority 0 and a drop policy, matching the required table, hook and default-drop configuration in one correct syntax.

Why this answer

The correct nftables command sequence creates a table named 'filter' in the inet family, adds a base chain named 'input' with type filter, hook input, priority 0, and policy drop. This sets up packet filtering with a default drop policy for incoming traffic.

Exam trap

CND often tests the confusion between nftables and iptables/ufw syntax, leading candidates to pick iptables or ufw commands when nftables is explicitly required.

How to eliminate wrong answers

Option A is wrong because 'nftables' is not a valid command; the correct command is 'nft', and the syntax 'create filter-table --default-drop' is invalid. Option B is wrong because 'iptables -P INPUT DROP' sets the default policy for the iptables INPUT chain, not nftables, and does not create a table or base chain. Option D is wrong because 'ufw default deny incoming' configures the Uncomplicated Firewall, a frontend for iptables, not nftables directly.

Practice this question →
3
MCQeasy

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A.Unmanaged Layer 2 Switch
B.Patch Panel
C.Stateful Inspection Firewall
D.Hub
AnswerC

A stateful inspection firewall tracks connection state in a session table, examining Layer 3 addresses and Layer 4 ports to permit return traffic dynamically. Stateless packet filters and Layer 2 switches cannot make forwarding decisions based on established connection states.

Why this answer

A Stateful Inspection Firewall operates at Layer 3 (network) and Layer 4 (transport) to inspect packet headers and maintain a state table of established connections. It makes dynamic forwarding decisions based on the context of the traffic — for example, allowing return traffic for an outbound session without an explicit rule. This stateful behavior distinguishes it from stateless packet filters.

Exam trap

CND often tests the confusion between stateless packet filtering and stateful inspection, causing candidates to select a packet filtering firewall or a Layer 2 switch when the question emphasizes dynamic decisions based on connection states.

How to eliminate wrong answers

Option A is wrong because an unmanaged Layer 2 switch operates at Layer 2 (data link) and forwards frames based on MAC addresses, with no Layer 3/4 inspection or state tracking. Option B is wrong because a patch panel is a passive physical cabling device that does not inspect or forward packets at any layer. Option D is wrong because a hub is a Layer 1 device that broadcasts all traffic to all ports without any inspection or stateful decision-making.

Practice this question →
4
MCQeasy

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

A.Intrusion Prevention System
B.Stateful Inspection Firewall
C.Proxy Server
D.Honeypot
AnswerD

A honeypot is a deliberately vulnerable decoy host that attracts attackers away from production systems while logging their tools, techniques and procedures. This matches the stem's requirement for a perimeter decoy loaded with vulnerabilities to gather telemetry on adversary tactics.

Why this answer

A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Exam trap

The trap here is confusing honeypots with IPS or firewalls — candidates see 'perimeter defense' and pick an active blocking device, missing that the defining characteristic is deception and attacker observation, not prevention.

How to eliminate wrong answers

Option A is wrong because an Intrusion Prevention System is an inline security control that inspects traffic and blocks malicious packets, not a decoy designed to attract attackers. Option B is wrong because a stateful inspection firewall tracks connection state to permit or deny traffic based on policy, but it does not act as a lure or collect attacker TTPs. Option C is wrong because a proxy server brokers client requests to external resources for caching, filtering, or anonymity — it is not a deliberately vulnerable decoy system.

Practice this question →
5
Multi-Selecthard

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

Select 3 answers
A.Traceroute / ping utilities to test end-to-end path connectivity and TTL expiration
B.Network packet analyzers (e.g., tcpdump or Wireshark) capturing traffic on firewall interfaces
C.Firewall packet flow tracing / debug packet tools (e.g., Cisco ASA packet-tracer or Palo Alto global packet diagnostic)
D.Reformatting the firewall hard drive and reinstalling the BIOS firmware
E.Disconnecting all internal switch uplinks permanently
AnswersA, B, C

Traceroute and ping reveal where along the path packets stop returning, exposing TTL expiry and unreachable hops. This satisfies the requirement to locate the drop point by narrowing the failing segment before deeper firewall inspection.

Why this answer

Option A is correct because traceroute and ping utilities test end-to-end path connectivity and reveal where TTL expiration or ICMP unreachables occur, helping localize the hop or firewall at which packets stop traversing the path. Option B is correct because packet analyzers such as tcpdump or Wireshark capturing on the firewall's ingress and egress interfaces show whether packets actually arrive, are malformed, or are dropped before/after inspection, providing ground-truth evidence of the drop point. Option C is correct because firewall packet flow tracing/debug tools like Cisco ASA packet-tracer or Palo Alto's global packet diagnostic simulate or follow a specific flow through the policy, NAT, and inspection stages, explicitly reporting the rule or stage that drops the packet.

Option D does not belong because reformatting the firewall disk and reinstalling BIOS firmware is a destructive hardware/firmware recovery action, not a diagnostic method for identifying where traffic is dropped. Option E does not belong because permanently disconnecting all internal switch uplinks would cause an outage and remove the traffic needed for diagnosis rather than help identify the drop cause.

Exam trap

The trap is choosing destructive or unrelated 'fixes' (reimaging, disconnecting links) instead of diagnostic tools — candidates must recognize that the question asks for identification, not remediation.

Practice this question →
6
MCQeasy

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

A.DNS Sinkholing
B.Active Response / Process Termination
C.Passive Log Alerting
D.Vulnerability Patch Management
AnswerB

Active response is the HIPS capability that acts on a detected intrusion rather than merely alerting. Terminating the offending process is process termination, an active response that stops the injection attack immediately, matching the proactive preventive action described.

Why this answer

When a HIPS detects an injection attack and immediately terminates the offending process, it is performing an active response — a proactive preventive action that stops the attack in real time rather than merely logging it. Process termination is a classic active-response capability of host-based IPS tools such as OSSEC, Wazuh, or commercial HIPS platforms.

Exam trap

CND often tests the distinction between passive detection (logging/alerting) and active response (blocking/terminating), tricking candidates into selecting a logging option when the scenario explicitly describes a preventive action.

How to eliminate wrong answers

Option A is wrong because DNS sinkholing redirects DNS queries to a controlled server to block malicious domains — it does not terminate processes and is not what the HIPS did here. Option C is wrong because passive log alerting only records and notifies; it takes no preventive action, whereas the scenario explicitly states the process was terminated. Option D is wrong because vulnerability patch management is a separate remediation workflow that fixes the underlying flaw, not an in-line response to a detected attack.

Practice this question →
7
MCQmedium

A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?

A.Reverse proxy caching that stores static HTTP responses and serves them to repeat visitors
B.SSL/TLS offload with full application-layer inspection and Web Application Firewall policy enforcement
C.Network Address Translation that hides the internal web server IP addresses from external clients
D.Stateful packet filtering that tracks TCP session state and enforces port 443 access control lists
AnswerB

SSL/TLS offload lets the ADC decrypt inbound HTTPS so it can inspect the plaintext request, validate the client certificate during the handshake, apply WAF signatures for SQL injection, then re-encrypt to the backend servers. Because inspection occurs after decryption, the SQL injection payload is visible in the HTTP layer and can be blocked before it reaches the web farm.

Why this answer

Terminating TLS at the ADC is what makes deep inspection possible, because encrypted traffic must be decrypted before HTTP-layer signatures and certificate validation can be applied. Re-encrypting to the backend preserves confidentiality on the internal segment. Stateful filtering, caching, and NAT all operate below or outside the application layer and cannot detect SQL injection or verify client identity.

Exam trap

The trap here is assuming that any perimeter device terminating TLS automatically inspects the decrypted content, when many load balancers only offload encryption without applying WAF or certificate-validation policy.

Practice this question →
8
Multi-Selectmedium

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Select 2 answers
A.Application awareness and identification (App-ID)
B.Strict restriction to operating exclusively at Layer 2 (Data Link layer)
C.Inability to inspect encrypted HTTPS traffic under any circumstances
D.Exclusive reliance on static MAC address filtering for access control
E.Integrated user identification and policy enforcement (User-ID)
AnswersA, E

App-ID identifies applications regardless of port, protocol or encryption, then enforces policy on that classification. This satisfies the scenario's requirement for a distinguishing NGFW feature, because traditional stateful inspection firewalls match only static five-tuple header data and cannot recognise the actual application generating the traffic.

Why this answer

Option A is correct because Enterprise NGFWs use deep packet inspection and application signatures (e.g., Palo Alto App-ID, Cisco NBAR) to identify applications regardless of port or protocol, which traditional stateful firewalls cannot do since they only track TCP/UDP sessions and ports. Option E is correct because NGFWs integrate user identification (e.g., User-ID via Active Directory, LDAP, or Captive Portal) to enforce policies based on user or group identity rather than just IP addresses, a capability absent from traditional stateful firewalls. Option B is incorrect because NGFWs operate at Layers 3 through 7, not exclusively at Layer 2.

Option C is incorrect because NGFWs commonly decrypt and inspect HTTPS traffic via SSL/TLS decryption. Option D is incorrect because NGFWs use identity, application, and content-based controls, not static MAC address filtering.

Exam trap

The trap here is confusing NGFW features with generic firewall or switch capabilities — candidates may select Layer 2 restrictions or MAC filtering because they sound like security controls, but NGFWs are defined by Layer 7 application and user awareness.

Practice this question →
9
MCQeasy

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A.To passively monitor and analyze network traffic copies for malicious signatures and anomalies.
B.To actively block and drop malicious packets inline.
C.To act as the default gateway for the DMZ network.
D.To perform Network Address Translation for internal hosts.
AnswerA

Promiscuous mode lets the interface accept frames not addressed to it, so the span/mirror port delivers copies of perimeter traffic. The NIDS then passively inspects those copies for malicious signatures and anomalies without inline blocking or altering traffic flow.

Why this answer

A NIDS deployed in promiscuous mode on a SPAN/mirror port receives copies of all traffic traversing the monitored segment, allowing it to passively inspect packets for malicious signatures and anomalies without affecting traffic flow. Promiscuous mode lets the NIC accept frames not addressed to it, which is essential for seeing all mirrored traffic.

Exam trap

The trap is conflating NIDS (passive detection on a mirror port) with IPS (inline active blocking) — candidates often pick the 'block' answer because it sounds more protective.

How to eliminate wrong answers

Option B is wrong because active blocking/dropping requires an inline IPS deployment, not a passive SPAN-port NIDS — a mirrored port receives copies and cannot drop original packets. Option C is wrong because a NIDS is a monitoring device, not a router; it does not forward traffic or act as a default gateway. Option D is wrong because NAT is a routing function performed by firewalls/routers, not by a passive monitoring sensor.

Practice this question →
10
MCQhard

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

A.External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.
B.External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.
C.External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.
D.External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.
AnswerD

The external firewall filters internet traffic into the DMZ, while the internal firewall permits only required service ports from the DMZ to the internal network. This back-to-back arrangement ensures a compromised DMZ host cannot freely reach internal systems.

Why this answer

In a dual-firewall DMZ architecture, the external firewall should inspect and restrict traffic from the internet to the DMZ, while the internal firewall should restrict traffic from the DMZ to the internal network to only required service ports. This implements defense-in-depth: the external firewall protects the DMZ from internet threats, and the internal firewall prevents a compromised DMZ host from pivoting into the internal network. This segmentation is a security best practice.

Exam trap

The trap is assuming that any traffic from DMZ to internal network should be completely blocked, which is option C; however, best practice allows only required service ports, not a blanket block, to maintain functionality while minimizing risk.

How to eliminate wrong answers

Option A is wrong because a transparent bridge on the external firewall does not provide inspection or restriction of traffic; also, NAT on the internal firewall for internet-bound traffic is inefficient and does not align with best practices. Option B is wrong because the external firewall should not route internal traffic; its role is to protect the DMZ, and a honeypot gateway on the internal firewall is not a standard security control. Option C is wrong because permitting all traffic to the DMZ from the external firewall is insecure; the external firewall should restrict and inspect traffic, not allow all.

Additionally, blocking all traffic from DMZ to internal network is overly restrictive and may break necessary services; best practice is to allow only required ports.

Practice this question →
11
MCQhard

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

A.Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection)
B.Zone Protection Profile attached to the external zone
C.NAT Policy translation destination field
D.Network Interfaces configuration tab
AnswerA

Security profiles are attached per-rule under the Actions tab's Profile Setting, where Antivirus and Vulnerability Protection are selected. This binds signature-based scanning and exploit prevention to the rule matching web-browsing traffic, satisfying the requirement to inspect and block known threats.

Why this answer

In Palo Alto Networks PAN-OS, threat profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis) are attached to a Security Policy rule under the Actions tab in the Profile Setting section. This is where the firewall applies content inspection to traffic matching the rule, enabling signature-based malware detection and vulnerability exploit prevention.

Exam trap

CND often tests whether candidates know where threat profiles live in PAN-OS — the trap is confusing zone-based protections (Zone Protection Profile) with rule-based content inspection (Security Policy Actions tab).

How to eliminate wrong answers

Option B is wrong because Zone Protection Profiles are attached to zones (Network > Zones) and protect against flood, reconnaissance, and packet-based attacks — they do not perform content inspection for malware or exploits. Option C is wrong because NAT Policy handles address and port translation, not security inspection; the destination translation field has nothing to do with threat profiles. Option D is wrong because Network Interfaces configuration handles Layer 1-3 settings (IP, zones, virtual routers), not security rule actions or threat inspection.

Practice this question →
12
Multi-Selecteasy

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

Select 2 answers
A.It is deployed on the core internal network without any logging or monitoring.
B.It is used exclusively as a high-performance database cluster for enterprise clients.
C.It replaces the need for any firewalls or perimeter security defenses.
D.It consists of multiple interconnected decoy systems simulating an entire network environment.
E.It provides a broader view of attacker techniques and lateral movement across multiple systems.
AnswersD, E

Multiple interconnected decoy systems let defenders observe lateral movement, credential reuse and multi-stage attack chains across hosts, which a single honeypot cannot capture. This satisfies the stem's requirement for a network-scale deception environment, distinguishing the honeynet's breadth of telemetry from one isolated decoy.

Why this answer

Option D is correct because a honeynet is by definition a collection of two or more honeypots deployed together and interconnected to emulate a realistic network segment, complete with servers, services, and topology, rather than a single isolated decoy host. Option E is correct because this multi-system design lets defenders observe attacker behavior across hosts, including reconnaissance, pivoting, and lateral movement, yielding richer threat intelligence than a lone honeypot can provide. The unmarked options do not belong: A is wrong because honeynets are heavily instrumented with logging, monitoring, and often IDS/IPS sensors, and are typically placed in a controlled DMZ or isolated segment rather than the unprotected core internal network; B is wrong because a honeynet is a deception and threat-intelligence tool, not a production database cluster; and C is wrong because a honeynet is a complementary detection layer and never replaces firewalls or perimeter defenses.

Exam trap

CND often tests the distinction between a honeypot (single decoy) and a honeynet (network of decoys), and candidates may incorrectly assume that a honeynet replaces other security controls or is deployed on the core network without monitoring.

Practice this question →
13
MCQhard

A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?

A.The attacker is conducting an ARP poisoning attack, and the firewall should enable dynamic ARP inspection on the internal interface
B.The attacker is attempting a TCP session hijack, and the firewall should allow the segments so the internal host can reset the connection
C.The attacker is performing a UDP amplification attack, and the firewall should rate-limit the source address rather than drop the segments
D.The attacker is performing a TCP FIN scan to map open ports, and the stateful firewall correctly drops the invalid segments before they reach internal hosts
AnswerD

A FIN scan sends a bare FIN segment to a port without completing a handshake; an open port ignores it while a closed port replies with RST, revealing port state. SYN-FIN combinations are likewise malformed. A stateful firewall tracks that no session exists for these segments and drops them, which is the correct defensive behavior and prevents the scan from reaching internal hosts.

Why this answer

TCP FIN and SYN-FIN segments without an established session are classic stealth scan techniques used to infer port state from RST responses. A stateful firewall that tracks connection state recognizes these segments as not belonging to any session and drops them, preventing the scan from reaching internal hosts. Session hijacking, UDP amplification, and ARP poisoning involve entirely different mechanisms and are not indicated by these flags.

Exam trap

The trap here is treating every anomalous TCP flag combination as a session hijack, when bare FIN and SYN-FIN segments are actually port-scanning techniques that a stateful firewall should drop.

Practice this question →
14
Multi-Selectmedium

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

Select 2 answers
A.Traditional firewalls inspect layer 7 payloads while NGFWs are strictly restricted to layer 3 and layer 4 filtering.
B.NGFWs can identify applications regardless of port numbers using Deep Packet Inspection and heuristic analysis.
C.NGFWs rely exclusively on static access control lists based strictly on source IP, destination IP, and TCP/UDP ports.
D.Traditional firewalls require external proxy servers to perform SSL/TLS decryption, whereas NGFWs cannot inspect encrypted traffic.
E.NGFWs integrate user identity awareness (e.g., Active Directory integration) into firewall access control policies.
AnswersB, E

Deep Packet Inspection with heuristic analysis identifies the application itself, so NGFWs enforce policy on the actual protocol even when it tunnels over non-standard ports. This satisfies the differentiation criterion, unlike traditional firewalls that only inspect port and state.

Why this answer

Option B is correct because NGFWs use Deep Packet Inspection (DPI) and heuristic/behavioral analysis to identify applications by their traffic signatures and behavior, allowing them to recognize applications even when they run on non-standard ports or tunnel over HTTP/HTTPS, which traditional port-based firewalls cannot do. Option E is correct because NGFWs integrate user identity awareness, typically via Active Directory or LDAP integration, so access control policies can be written against users and groups rather than only IP addresses, adding an identity dimension to enforcement. Option A is wrong because it reverses the roles: traditional firewalls operate at layers 3 and 4, while NGFWs add layer 7 application inspection.

Option C is wrong because static ACLs based only on source/destination IP and TCP/UDP ports describe traditional firewalls, not NGFWs. Option D is wrong because NGFWs commonly perform SSL/TLS decryption and inspection themselves, and traditional firewalls do not require external proxy servers for that purpose.

Exam trap

CND often tests whether candidates can distinguish NGFW capabilities (App-ID, User-ID, TLS inspection) from traditional firewall capabilities (5-tuple ACLs), and distractors frequently invert the two.

Practice this question →
15
MCQmedium

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

A.SSL/TLS Decryption (Inspection)
B.Layer 2 Bridging
C.Port Forwarding
D.Static NAT
AnswerA

SSL/TLS decryption terminates the encrypted session at the NGFW, decrypts the payload, applies DPI signatures, then re-encrypts before forwarding. Without it, HTTPS traffic remains opaque to signature matching, satisfying the stem's requirement to inspect encrypted session payloads rather than merely metadata.

Why this answer

SSL/TLS Decryption (Inspection) is the feature that allows an NGFW to decrypt encrypted traffic, inspect the plaintext payload against DPI signatures, and then re-encrypt it before forwarding. Without this, HTTPS traffic remains encrypted and DPI cannot see inside, so malicious payloads bypass detection. This is essential for enforcing security policies on encrypted sessions.

Exam trap

CND often tests the misconception that DPI can inspect encrypted traffic without decryption, or that other features like NAT or bridging can somehow enable payload inspection.

How to eliminate wrong answers

Option B is wrong because Layer 2 Bridging operates at the data link layer and simply forwards frames based on MAC addresses; it does not decrypt or inspect encrypted payloads. Option C is wrong because Port Forwarding is a NAT function that redirects traffic to a different port or host, but it does not decrypt SSL/TLS. Option D is wrong because Static NAT translates IP addresses one-to-one and has no capability to decrypt or inspect encrypted traffic.

Practice this question →
16
MCQmedium

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

A.Management VLAN
B.Internal Trusted Zone
C.Demilitarized Zone (DMZ)
D.Guest Wireless Zone
AnswerC

The DMZ hosts public-facing services so that if compromised, attackers cannot directly access the internal LAN.

Why this answer

The Demilitarized Zone (DMZ) is the segmented network zone designed to host public-facing services such as web servers, mail relays, and reverse proxies. It sits between the untrusted internet and the trusted internal LAN, with distinct firewall contexts controlling traffic in each direction, so a compromise of a public server does not grant direct access to internal systems.

Exam trap

CND often tests zone placement, and the trap is confusing the DMZ with the internal trusted zone or management VLAN — public-facing services belong in the DMZ, never directly in the trusted LAN.

How to eliminate wrong answers

Option A (Management VLAN) is wrong because it is reserved for out-of-band management of network devices and hypervisors, not public-facing services. Option B (Internal Trusted Zone) is wrong because placing internet-facing servers there exposes the internal LAN directly to compromise. Option D (Guest Wireless Zone) is wrong because it is for untrusted guest user devices, not for hosting production public services.

Practice this question →
17
MCQhard

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

A.Implement an explicit HTTP Proxy service with SSL/TLS decryption enabled.
B.Configure a static Destination NAT (DNAT) rule mapping port 21 to an internal range of ephemeral ports.
C.Disable stateful tracking for FTP traffic and rely strictly on stateless packet filtering access control lists.
D.Enable Deep Packet Inspection (DPI) with protocol decoding for FTP to dynamically open pinholes for data channels.
AnswerD

FTP negotiates data-channel ports inside the control channel, so the ALG must decode FTP commands via DPI to learn each PORT/PASV pair and open matching pinholes dynamically, satisfying the requirement for ephemeral inbound data connections.

Why this answer

To support active FTP, the firewall must inspect the FTP control channel (port 21) and dynamically open ephemeral data ports based on the PORT/PASV commands. This requires Deep Packet Inspection (DPI) with an FTP protocol decoder, which allows the firewall to understand FTP signaling and create temporary pinholes. Enabling DPI for FTP is the correct mechanism to handle the dynamic nature of FTP data connections.

Exam trap

The trap is confusing stateful inspection with application-layer inspection; candidates might think that stateful tracking alone can handle FTP data channels, but it cannot because the data connection is separate and dynamically negotiated.

How to eliminate wrong answers

Option A is wrong because an HTTP proxy with SSL/TLS decryption is irrelevant to FTP; it does not inspect FTP control channels. Option B is wrong because a static DNAT rule mapping port 21 to a range of ephemeral ports is not feasible and does not dynamically open ports based on control channel negotiations; it would be static and insecure. Option C is wrong because disabling stateful tracking and relying on stateless ACLs would not allow dynamic opening of data channels; it would require pre-opening a wide range of ports, which is insecure and impractical.

Practice this question →
18
MCQeasy

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

A.Network Segmentation
B.Packet Fragmentation
C.Network Bridging
D.Network Flooding
AnswerA

Network segmentation divides a network into zones, using VLANs and subnets, firewalls, ACLs or microsegmentation, and allows only the traffic each zone needs between them. If one device is compromised, the attacker cannot freely reach everything else, so the damage is contained and lateral movement is slowed and visible at the boundaries. It also reduces compliance scope, for example for PCI DSS.

Why this answer

Network segmentation is the practice of dividing a large network into smaller, isolated subnetworks (segments) using VLANs, subnets, firewalls, or SDN policies to limit the blast radius of a breach and restrict lateral movement. It is a foundational zero-trust and defense-in-depth control.

Exam trap

The trap is confusing segmentation (isolation for security) with bridging (connecting segments) or fragmentation (packet-level splitting) — candidates who focus on the word 'breaking' may incorrectly pick fragmentation.

How to eliminate wrong answers

Option B is wrong because packet fragmentation is an IP-layer mechanism for splitting packets that exceed the MTU, unrelated to network isolation. Option C is wrong because network bridging connects network segments at Layer 2 (e.g., a bridge or switch), which actually extends a broadcast domain rather than isolating it. Option D is wrong because network flooding is an attack or traffic condition (e.g., MAC flooding, SYN flood) that overwhelms a network, not a segmentation technique.

Practice this question →
19
MCQmedium

An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?

A.The two firewalls must share the same rule base and firmware version to function, otherwise traffic will be dropped
B.Log correlation across two different vendors is straightforward because both use the same syslog format by default
C.Placing two firewalls in series doubles throughput because each firewall processes only half of the traffic
D.Dual-vendor firewalls increase complexity in rule management and log correlation, but reduce the risk of a single vendor vulnerability compromising the perimeter
AnswerD

Two different firewall platforms avoid a single point of failure from one vendor's software flaw, since an exploit that works against one is unlikely to work against the other. The tradeoff is that administrators must manage two rule sets and normalize logs from two formats, increasing operational overhead. This accurately describes the realistic consideration of the architecture.

Why this answer

A dual-vendor firewall design provides defense in depth by ensuring that a vulnerability in one vendor's product does not automatically expose the network, since the second platform enforces its own policy. The realistic cost is operational: two rule sets to maintain, two management interfaces, and log formats that must be normalized for correlation. Throughput is limited by the slowest inline device, and rules do not need to match.

Exam trap

The trap here is assuming that stacking firewalls in series automatically multiplies performance, when inline devices actually cap throughput at the slowest link and add latency.

Practice this question →
20
MCQeasy

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

A.iptables -A INPUT -p tcp --syn --fin -j DROP
B.iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
C.iptables -A INPUT -p tcp --flags ALL SYN,FIN -j DROP
D.iptables -A INPUT -p tcp --match flags --syn-fin -j DROP
AnswerB

The --tcp-flags SYN,FIN SYN,FIN match requires both SYN and FIN set in the same packet, the malformed combination described. Appending it to INPUT with -j DROP discards those packets, precisely targeting the attack vector without affecting legitimate TCP traffic.

Why this answer

The --tcp-flags option takes two arguments: a mask of flags to examine and a comparison list of flags that must be set. 'SYN,FIN SYN,FIN' means 'examine the SYN and FIN bits, and match only if both are set,' which precisely targets the malformed SYN+FIN combination. The -j DROP then discards matching packets.

Exam trap

The trap is confusing the two-argument --tcp-flags syntax with a single-flag match — candidates pick options that look plausible but use non-existent flags like --syn-fin or --flags.

How to eliminate wrong answers

Option A is wrong because --syn and --fin are not valid combined flags in iptables; --syn matches SYN packets with ACK and FIN cleared, and there is no --fin match extension. Option C is wrong because --flags is not a valid iptables option — the correct option is --tcp-flags. Option D is wrong because --match flags and --syn-fin are not valid iptables syntax; there is no such match module or flag alias.

Practice this question →
21
Multi-Selecthard

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

Select 3 answers
A.Deploying zone protection or flood protection profiles against SYN and UDP floods
B.Disabling remote management (SSH/HTTPS) on the external untrusted interface
C.Enabling Reverse Path Forwarding (uRPF) to prevent IP spoofing
D.Leaving default administrator credentials unchanged for rapid access
E.Permitting all inbound ICMP echo requests without rate limiting
AnswersA, B, C

Zone protection profiles apply SYN cookies and random early drop to absorb volumetric floods before they saturate state tables, directly satisfying the stem's requirement to harden against volumetric attacks. Flood protection thresholds rate-limit UDP and ICMP per zone, blocking reconnaissance sweeps while preserving legitimate sessions.

Why this answer

Option A is correct because zone protection and flood protection profiles (e.g., on Palo Alto or equivalent firewalls) apply SYN flood, UDP flood, and ICMP flood thresholds to drop volumetric attack traffic before it exhausts session tables. Option B is correct because exposing SSH/HTTPS management on the untrusted external interface invites brute-force and exploitation attempts; management should be restricted to a trusted internal interface or out-of-band path. Option C is correct because unicast Reverse Path Forwarding (uRPF) validates the source address against the routing table, dropping packets with spoofed source IPs commonly used in reconnaissance and reflection attacks.

Option D is wrong because default administrator credentials are publicly known and must always be changed during hardening. Option E is wrong because permitting all inbound ICMP echo requests without rate limiting enables ping sweeps, ICMP floods, and tunneling, so ICMP should be rate-limited or selectively filtered.

Exam trap

The trap is selecting 'permit all ICMP' as a troubleshooting convenience — candidates forget that unrestricted ICMP is itself a DoS vector and a reconnaissance aid.

Practice this question →
22
Multi-Selectmedium

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

Select 2 answers
A.Assigning Layer 3 IP addresses to every data interface participating in packet routing
B.Configuring dynamic BGP peering on all client-facing ports
C.Removing all security rules since Layer 2 devices cannot filter traffic
D.Configuring a management IP address on a management interface or BVI (Bridge Virtual Interface) for device access
E.Placing the bridged interfaces into a common bridge group or zone
AnswersD, E

Transparent mode forwards traffic at Layer 2 without routing, so no data-plane interface holds a routable address. Administrators therefore assign a management IP on a dedicated management interface or BVI to reach the device for configuration and monitoring.

Why this answer

In Transparent (Layer 2) mode, the firewall forwards frames between interfaces in the same bridge domain without acting as a Layer 3 hop, so option D is correct: a management IP must be assigned to a dedicated management interface or a BVI so administrators can reach the device for configuration, monitoring, and updates, since the data interfaces themselves carry no routable addresses. Option E is also correct because the participating interfaces must be bound into a common bridge group (or equivalent Layer 2 zone) so the firewall can bridge traffic between them and apply policy to the bridged flows. Option A is wrong because assigning Layer 3 IPs to every data interface is characteristic of Routed mode, not Transparent mode, where data interfaces remain unnumbered.

Option B is wrong because BGP peering requires Layer 3 adjacency and is irrelevant to a Layer 2 bridge deployment. Option C is wrong because transparent firewalls still enforce security rules on bridged traffic; Layer 2 operation does not disable filtering.

Exam trap

CND often tests the confusion between Transparent and Routed modes, leading candidates to select options that involve IP addresses on data interfaces or routing protocols, which are not applicable in Transparent mode.

Practice this question →
23
MCQmedium

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

A.RADIUS
B.VRRP (Virtual Router Redundancy Protocol)
C.BGP (Border Gateway Protocol)
D.DHCP (Dynamic Host Configuration Protocol)
AnswerB

VRRP elects a master router that owns a shared virtual IP and MAC, so the standby assumes both within seconds of failure, giving seamless failover with no client reconfiguration. It is the vendor-neutral first-hop redundancy protocol commonly paired with firewall HA.

Why this answer

VRRP (Virtual Router Redundancy Protocol) is designed to provide first-hop redundancy by allowing multiple routers or firewalls to share a virtual IP address and MAC address. The active device owns the virtual IP and forwards traffic, while the standby takes over seamlessly if the active fails, ensuring continuous availability for hosts that use the virtual IP as their default gateway.

Exam trap

The trap here is confusing routing protocols (BGP) or AAA protocols (RADIUS) with first-hop redundancy protocols; candidates often pick BGP because it sounds like it handles failover, but BGP is for route exchange, not virtual IP sharing.

How to eliminate wrong answers

Option A is wrong because RADIUS is an authentication, authorization, and accounting (AAA) protocol used for network access control, not for providing IP failover or virtual IP sharing. Option C is wrong because BGP is a dynamic routing protocol used for exchanging routes between autonomous systems, not for first-hop redundancy or virtual IP failover. Option D is wrong because DHCP is used to dynamically assign IP addresses and configuration parameters to hosts, not to provide gateway redundancy or failover between firewalls.

Practice this question →
24
MCQmedium

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

A.log icmp any any -> any any (msg:"ICMP Ping Detected"; itype:8; sid:1000003;)
B.drop udp external any -> $HOME_NET 53 (content:"passwd"; sid:1000002;)
C.alert tcp any any -> any 80 (msg:"Directory Traversal Attempt"; content:"../../etc/passwd"; sid:1000001; rev:1;)
D.pass ip any any -> any any (content:"GET /index.html"; sid:1000004;)
AnswerC

The header alerts on TCP traffic destined to port 80, matching HTTP, while the content option inspects the payload for the literal traversal string. Correct syntax with msg, sid and rev makes it a valid Snort signature for detecting the attack.

Why this answer

The correct Snort rule must match TCP traffic destined to port 80 (HTTP) and inspect the payload for the directory traversal string. Option C uses the proper header 'alert tcp any any -> any 80' with a content match on '../../etc/passwd', which is exactly the signature required to detect this attack. The 'sid' and 'rev' fields provide unique identification and revision tracking, completing a valid Snort rule.

Exam trap

The trap here is confusing protocol/port matching with payload inspection; candidates may pick a rule that matches the string but uses the wrong protocol or action, or they may overlook that 'pass' rules do not generate alerts.

How to eliminate wrong answers

Option A is wrong because it defines an ICMP rule with 'itype:8' (echo request), which has nothing to do with HTTP or directory traversal. Option B is wrong because it targets UDP port 53 (DNS) and only matches the string 'passwd', which is far too generic and would not detect the full traversal pattern. Option D is wrong because it uses the 'pass' action, which tells Snort to ignore the traffic, and it matches a benign GET request for index.html rather than the malicious traversal string.

Practice this question →
25
MCQeasy

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

A.Kali Linux Metasploitable
B.Honeyd
C.Snort IDS
D.Wireshark
AnswerB

Honeyd emulates virtual hosts with simulated operating systems and services, so attackers interact with fabricated stacks rather than a real OS. This satisfies the low-interaction requirement: no genuine system is exposed, yet scanning and service probes are logged, revealing reconnaissance without compromise risk.

Why this answer

Honeyd is a low-interaction honeypot framework that emulates virtual hosts and services at the network level, letting defenders detect scanning and probing without exposing a real OS. It responds to connection attempts with simulated service banners, so there is no actual system to compromise.

Exam trap

CND often tests the distinction between low-interaction honeypots and vulnerable-by-design systems — the trap is choosing Metasploitable or an IDS like Snort when the requirement is a safe, emulated decoy.

How to eliminate wrong answers

Option A is wrong because Metasploitable is a deliberately vulnerable full OS used as a high-interaction target for practicing exploitation, not a low-interaction honeypot — compromising it is the point. Option C is wrong because Snort is a signature-based IDS/IPS that detects traffic patterns but does not emulate hosts or services to attract reconnaissance. Option D is wrong because Wireshark is a packet capture and analysis tool, not a honeypot; it passively observes traffic rather than luring attackers.

Practice this question →
26
Multi-Selecthard

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

Select 3 answers
A.Throughput capacity and latency impact under peak load
B.Fail-open versus fail-closed hardware bypass behavior during power failure
C.Configuring the IPS to act as an authoritative DNS root server
D.The physical cable color used for connection to the core switch
E.Signature tuning to minimize false positives that could drop legitimate traffic
AnswersA, B, E

Inline IPS inspects every packet in the forwarding path, so its inspection engine must sustain peak throughput without adding latency that breaches application SLAs. Insufficient capacity causes queuing, dropped sessions and outages rather than mere detection gaps.

Why this answer

Option A is correct because an inline IPS sits directly in the traffic path, so its throughput capacity and added latency under peak load determine whether it can inspect every packet without becoming a bottleneck or causing timeouts. Option B is correct because inline IPS devices must define fail-open versus fail-closed behavior (often via hardware bypass NICs or external bypass switches) so that a power or software failure either preserves connectivity or intentionally blocks traffic according to policy. Option E is correct because poorly tuned signatures generate false positives that drop legitimate production traffic, so signature tuning and threshold adjustment are essential to avoid self-inflicted outages.

Option C is incorrect because an IPS is not a DNS root server and has no role in authoritative DNS resolution. Option D is incorrect because cable color is a physical labeling convention with no bearing on IPS operation or network disruption.

Exam trap

CND often tests whether candidates can distinguish operational IPS concerns (throughput, fail mode, tuning) from absurd distractors (cable color, DNS root role) — the trap is overthinking and selecting a plausible-sounding but technically irrelevant option.

Practice this question →
27
MCQeasy

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

A.Unmanaged Switch
B.Application Gateway (Proxy Firewall)
C.Packet Filtering Firewall
D.Hub
AnswerB

An application gateway proxy terminates and inspects Layer 7 traffic, parsing HTTP, FTP, or SIP commands to enforce granular filtering. Unlike packet-filter or stateful firewalls that examine headers and ports, it understands application protocol semantics, satisfying the requirement for application-layer decisions.

Why this answer

An Application Gateway (Proxy Firewall) operates at Layer 7 (application) and understands specific application protocols like HTTP, FTP, and SIP. It acts as an intermediary, terminating client connections and initiating new ones to the server, allowing deep inspection of application-layer payloads for granular filtering. This is also known as a proxy firewall or application-level gateway.

Exam trap

CND often tests the confusion between packet filtering firewalls (Layer 3/4) and application gateways (Layer 7), causing candidates to select packet filtering when the question emphasizes understanding application protocols like HTTP or SIP.

How to eliminate wrong answers

Option A is wrong because an unmanaged switch operates at Layer 2 and forwards frames based on MAC addresses, with no application-layer awareness. Option C is wrong because a packet filtering firewall operates at Layer 3/4, inspecting headers (IP addresses, ports, protocols) but not application-layer payloads or protocol semantics. Option D is wrong because a hub is a Layer 1 device that broadcasts all traffic without any inspection or filtering.

Practice this question →
28
MCQhard

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

A.Change the firewall default gateway to the backup ISP.
B.Disable the entire IPS inspection engine globally.
C.Change the specific offending signature action from block/drop to alert (log-only) mode.
D.Bypass the IPS by moving it from inline mode to out-of-band monitoring mode.
AnswerC

Switching the offending signature to alert mode stops the IPS dropping legitimate custom-protocol traffic, immediately restoring business-critical transactions. Because the sensor remains inline, traffic still traverses it and matching events are logged, preserving perimeter visibility. This surgically removes only the false-positive action rather than disabling inspection wholesale, satisfying both the availability and visibility constraints.

Why this answer

The immediate, surgical fix is to change the specific offending signature's action from block/drop to alert (log-only) so the false-positive traffic flows while the IPS still inspects and logs it. This preserves perimeter visibility and detection coverage for all other signatures, and gives the team time to tune the signature or write an exception for the custom protocol. It is the standard 'tune, don't disable' response to IPS false positives.

Exam trap

CND often tests whether candidates overreact to false positives by disabling the whole IPS or moving it out-of-band, when the correct answer is always to tune the specific offending signature.

How to eliminate wrong answers

Option A is wrong because changing the firewall's default gateway to a backup ISP has no bearing on IPS signature behavior and would not stop the false positives. Option B is wrong because disabling the entire IPS inspection engine globally removes all protection and visibility, which is a drastic overreaction to a single signature's false positives. Option D is wrong because moving the IPS out-of-band eliminates its ability to block malicious traffic inline — it sacrifices prevention rather than tuning the offending rule, and it is a larger architectural change than the situation warrants.

Practice this question →
29
MCQeasy

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

A.Internal LAN
B.Demilitarized Zone (DMZ)
C.Management VLAN
D.Virtual Private Network (VPN) pool
AnswerB

A DMZ provides a buffered zone between the untrusted internet and the trusted internal network.

Why this answer

A Demilitarized Zone (DMZ) is a network segment that sits between the internal trusted network and the untrusted internet. It is designed to host publicly accessible services like web servers while isolating them from the internal corporate network. This isolation limits the impact if the server is compromised, as attackers cannot directly access internal resources.

Exam trap

CND often tests the misconception that a DMZ is just another VLAN or that a VPN pool can serve as a DMZ, confusing network segmentation concepts.

How to eliminate wrong answers

Option A is wrong because the internal LAN is the trusted corporate network; placing a publicly accessible web server there would expose internal systems to direct attack. Option C is wrong because a management VLAN is used for out-of-band management of network devices, not for hosting public-facing servers. Option D is wrong because a VPN pool is for remote access connections, not for hosting public servers.

Practice this question →
30
MCQmedium

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

A.IEEE 802.1X
B.IEEE 802.3ad
C.IEEE 802.11i
D.IEEE 802.1Q
AnswerD

IEEE 802.1Q inserts a four-byte tag into the Ethernet frame header carrying the VLAN identifier, so trunk ports can distinguish and segregate traffic for finance and HR across the shared link. Without tagging, the switch cannot separate VLAN membership on a trunk.

Why this answer

IEEE 802.1Q is the standard that defines VLAN tagging on Ethernet frames, inserting a 4-byte tag into the frame header that carries the VLAN ID (12 bits, supporting 4094 usable VLANs). On a trunk link between switches, 802.1Q tags each frame so the receiving switch knows which VLAN the frame belongs to, enabling logical segmentation of the finance and HR departments across shared physical infrastructure.

Exam trap

The trap here is confusing 802.1X (port-based access control/NAC) with 802.1Q (VLAN tagging) because both start with '802.1' and are frequently mentioned together in network security discussions.

How to eliminate wrong answers

Option A is wrong because IEEE 802.1X is a port-based network access control standard for authenticating devices/users before granting LAN access (used with EAP and RADIUS), not for VLAN frame tagging. Option B is wrong because IEEE 802.3ad defines Link Aggregation (LACP) for bundling multiple physical links into one logical link, which is unrelated to VLAN tagging. Option C is wrong because IEEE 802.11i is a wireless security standard (WPA2) governing encryption and authentication on WLANs, not Ethernet VLAN tagging.

Practice this question →
31
MCQmedium

A security engineer is deploying an inline NIPS appliance between the perimeter firewall and the internal core switch. During testing, legitimate TCP sessions from branch offices are being reset mid-transfer, and packet captures show the sensor injecting RST packets to both endpoints. Which configuration change will most directly stop the NIPS from breaking these legitimate flows?

A.Increase the NIPS inspection queue depth and memory allocation to handle the branch-office session volume.
B.Reconfigure the NIPS to operate in passive IDS mode and mirror traffic from the core switch instead of sitting inline.
C.Tune the signature set by disabling signatures with a high false-positive rate on the branch-office traffic profile.
D.Enable fail-open mode so the sensor stops forwarding traffic when the inspection engine is overloaded.
AnswerC

The RST injection indicates the NIPS matched a signature against legitimate branch-office sessions and acted on the false positive. Disabling or thresholding the offending signatures removes the trigger, so the sensor stops resetting those flows while still inspecting the rest of the traffic. This directly targets the root cause—misclassification—rather than altering sensor availability or placement.

Why this answer

The sensor is injecting RST packets because a signature matched legitimate branch-office traffic—a false positive. Inline NIPS devices act on matches by dropping or resetting the session, so the fix is to tune the signature set rather than change failure modes, placement, or resources. Correcting the misclassification preserves inline prevention while restoring the legitimate TCP flows.

Exam trap

The trap here is assuming any NIPS-caused disruption must be a performance or fail-open issue, when an inline sensor resetting both endpoints is actually evidence of a signature false positive acting on legitimate traffic.

Practice this question →
32
MCQhard

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

A.Proxy ARP
B.Spanning Tree Protocol (STP)
C.Network Address Translation (NAT)
D.Reverse Path Forwarding (RPF) / uRPF
AnswerD

Unicast Reverse Path Forwarding checks each incoming packet's source address against the routing table, confirming the packet arrived on the interface the router would use to reach that source. Packets failing this check are dropped, blocking spoofed addresses from the untrusted interface.

Why this answer

Reverse Path Forwarding (RPF) or unicast RPF (uRPF) is a feature that checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface that the router would use to send traffic back to that source. If the packet arrives on a different interface, it is dropped, which prevents IP spoofing. This is exactly what the question describes.

Exam trap

The trap is confusing uRPF with other security features like NAT or Proxy ARP; candidates may think NAT prevents spoofing, but NAT is for address translation, not source validation.

How to eliminate wrong answers

Option A is wrong because Proxy ARP is a technique where a router responds to ARP requests on behalf of hosts on another network, which has nothing to do with source IP verification. Option B is wrong because Spanning Tree Protocol is a Layer 2 loop prevention mechanism, not a security feature for source IP validation. Option C is wrong because NAT translates IP addresses, but it does not check source IP against the routing table to prevent spoofing.

Practice this question →
33
Multi-Selectmedium

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Select 2 answers
A.Automatically purchasing new zero-day exploits from underground forums
B.Converting all network packets into analog audio signals for manual listening
C.Signature-based detection (matching known attack patterns and byte sequences)
D.Manually shutting down all enterprise internet circuits during off-peak hours
E.Anomaly-based detection (establishing a baseline of normal traffic and flagging deviations)
AnswersC, E

Signature-based detection compares traffic against a database of known attack patterns, such as byte sequences and exploit fingerprints, flagging exact matches. It satisfies the stem's requirement for a commonly used IDPS identification method, delivering high accuracy for documented threats though unable to detect novel or polymorphic attacks lacking existing signatures.

Why this answer

Option C is correct because signature-based detection is a core IDPS methodology: the sensor compares packet payloads and headers against a database of known attack patterns, byte sequences, and Snort/Suricata-style rules, generating an alert when a match occurs. Option E is also correct because anomaly-based detection builds a statistical or behavioral baseline of normal traffic (protocols, ports, bandwidth, connection rates) and flags deviations from that baseline as potential intrusions, which allows it to catch novel or previously unseen attacks. The remaining options are not IDPS detection methods: A describes illicit exploit acquisition, not traffic inspection; B is a nonsensical signal-conversion idea unrelated to packet analysis; and D is a manual network-availability action, not a detection technique.

Exam trap

CND often tests the distinction between signature-based and anomaly-based detection, and candidates sometimes pick operational or nonsensical options because they sound 'security-related' — the key is recognizing that only signature and anomaly matching are actual IDPS detection methodologies.

Practice this question →
34
Multi-Selecteasy

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

Select 2 answers
A.Elimination of the need for any firewalls or security monitoring
B.Enhanced enforcement of granular access control policies between zones
C.Guaranteed prevention of all zero-day malware infections on endpoints
D.Automatic encryption of all data at rest without performance overhead
E.Containment of security breaches and limitation of lateral movement
AnswersB, E

Placing firewalls and policy enforcement points between zones lets administrators permit or deny traffic by source, destination, port and protocol, rather than trusting everything inside a flat network. This delivers granular, zone-specific access control that a single perimeter boundary cannot achieve.

Why this answer

Option B is correct because network segmentation divides the enterprise into distinct zones (e.g., DMZ, internal, PCI, guest) separated by firewalls or ACLs, which allows granular, zone-to-zone access control policies to be enforced rather than relying on a flat network with broad trust. Option E is correct because segmentation limits an attacker's ability to move laterally after compromising a host; by restricting east-west traffic between segments, a breach is contained within its zone, reducing blast radius and dwell time. The unmarked options do not belong: A is false because segmentation complements, not replaces, firewalls and monitoring; C is false because no architecture guarantees prevention of all zero-day malware on endpoints; and D is false because segmentation does not automatically encrypt data at rest, nor does encryption come without performance overhead.

Exam trap

CND often tests the misconception that segmentation eliminates the need for other controls or provides absolute protection; candidates must recognise that segmentation is a containment and access-control mechanism, not a silver bullet.

Practice this question →
35
MCQmedium

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

A.iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
B.iptables -A INPUT -m limit --limit 5/min -j LOG
C.iptables -A FORWARD -p tcp --dport 80 -j REJECT
D.iptables -A INPUT -m state --state NEW -j DROP
AnswerA

The conntrack match with --ctstate ESTABLISHED,RELATED identifies packets belonging to already-tracked connections, and the ACCEPT target passes them immediately. Placed before later rules, it satisfies the stem's requirement that established or related TCP traffic bypasses subsequent checks.

Why this answer

The conntrack match extension with --ctstate ESTABLISHED,RELATED tells iptables to accept packets that belong to connections already tracked by the kernel's connection-tracking subsystem, or that are related to such connections (e.g., FTP data channels, ICMP errors). Placing this rule early in the INPUT chain ensures return traffic for outbound-initiated sessions is permitted without re-evaluating later rules, which is the canonical stateful-firewall pattern.

Exam trap

CND often tests whether candidates confuse the legacy -m state --state syntax with the modern -m conntrack --ctstate syntax, and whether they understand that ESTABLISHED,RELATED must be ACCEPTed early to allow return traffic.

How to eliminate wrong answers

Option B is wrong because -m limit --limit 5/min -j LOG only rate-limits logging of matching packets; it does not accept established traffic and would leave return packets to be evaluated by subsequent (likely DROP) rules. Option C is wrong because it targets the FORWARD chain (traffic transiting the host, not destined for it) and REJECTs port 80, which is the opposite of allowing established connections. Option D is wrong because it DROPs NEW connections on INPUT, which would block legitimate inbound sessions rather than permit established/related return traffic.

Practice this question →
36
MCQeasy

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

A.HTTP
B.SNMPv1
C.SSH (Secure Shell)
D.TFTP
AnswerC

SSH provides cryptographic security for remote logins and command execution.

Why this answer

SSH (Secure Shell) is the standard protocol for encrypted remote command-line management of network devices, replacing plaintext Telnet on port 23. SSH operates on TCP port 22 and provides confidentiality, integrity, and authentication via cryptographic key exchange, making it the correct choice for secure CLI management of perimeter devices.

Exam trap

The trap is confusing management protocols (SSH, Telnet, SNMP) with file transfer or web protocols (TFTP, HTTP), leading candidates to pick a protocol that is not an encrypted CLI.

How to eliminate wrong answers

Option A is wrong because HTTP is an unencrypted web protocol used for browser-based management, not an encrypted CLI, and it transmits data in plaintext. Option B is wrong because SNMPv1 is a plaintext monitoring/management protocol using community strings, not an encrypted CLI, and is considered insecure. Option D is wrong because TFTP is a trivial file transfer protocol with no authentication or encryption, used for transferring files such as configurations or IOS images, not for interactive CLI management.

Practice this question →
37
MCQhard

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

A.The firewall drops all incoming SYN packets immediately.
B.The firewall encodes connection parameters into the sequence number (SYN cookie) without allocating memory state until the client responds with an ACK.
C.The firewall resets the TCP window size to zero for all external connections.
D.The firewall proxies the TCP handshake by establishing a full connection before forwarding traffic to the server.
AnswerB

SYN cookies defer state allocation: the firewall encodes connection parameters into the sequence number and sends that cookie, allocating no memory until the client returns a valid ACK. Half-open requests therefore consume no table entries, defeating the flood.

Why this answer

SYN cookies mitigate TCP SYN flood attacks by encoding connection parameters (such as source/destination IP and port, and a secret) into the initial sequence number (ISN) of the SYN-ACK. The server does not allocate any state for the half-open connection until it receives the final ACK from the client, which contains the cookie. This prevents the server's connection table from being exhausted by a flood of SYN packets.

The firewall/router can implement SYN cookies to protect downstream servers.

Exam trap

The trap is confusing SYN cookies with SYN proxy or other techniques; candidates might think SYN cookies involve proxying the handshake (option D), but they actually defer state allocation without proxying.

How to eliminate wrong answers

Option A is wrong because dropping all incoming SYN packets would prevent legitimate connections as well; SYN cookies allow legitimate connections to proceed. Option C is wrong because resetting the TCP window size to zero is a flow control mechanism, not a mitigation for SYN floods; it would not prevent resource exhaustion. Option D is wrong because proxying the TCP handshake (like a SYN proxy) is a different technique; SYN cookies do not establish a full connection before forwarding; they defer state allocation until the ACK.

Practice this question →
38
Multi-Selecthard

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Select 3 answers
A.Allow internal users unrestricted, unmonitored access to all DMZ administrative portals by default.
B.Never allow direct, uninspected traffic from the external zone to pass straight through the DMZ into the internal network.
C.Place public-facing web and DNS servers inside the DMZ zone.
D.Enforce the principle of least privilege using granular firewall rules between the DMZ and internal network.
E.Disable all logging on perimeter firewalls to conserve CPU cycles.
AnswersB, C, D

Traffic from the external zone must terminate in the DMZ rather than transit it into the internal network. Blocking uninspected pass-through traffic enforces zone separation, so a compromised DMZ host cannot relay external connections inward, satisfying the stem's secure DMZ design principle.

Why this answer

Option B is correct because a core DMZ design rule is that traffic from the external/untrusted zone must never be permitted to traverse the DMZ and reach the internal network without being terminated, inspected, or proxied by a security control; this prevents attackers from using the DMZ as a pivot point. Option C is correct because public-facing services such as web and DNS servers are the classic DMZ residents — they must be reachable from the internet, so placing them in the DMZ isolates them from the protected internal network. Option D is correct because least privilege applied through granular firewall rules between the DMZ and the internal network limits lateral movement; only specific, required flows (for example, a web server initiating a single TCP port to a specific backend database) should be allowed.

Option A is incorrect because granting internal users unrestricted, unmonitored access to DMZ administrative portals violates least privilege and monitoring requirements, turning the DMZ into an unmanaged attack path. Option E is incorrect because disabling perimeter firewall logging destroys the audit trail needed for detection, incident response, and compliance; logging should be retained and tuned, not turned off.

Exam trap

The trap here is that candidates see 'DMZ' and assume any traffic touching it is automatically safe, forgetting that the DMZ is itself semi-trusted and must be treated as a potential pivot point requiring inspection and least privilege.

Practice this question →
39
Multi-Selecteasy

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Select 2 answers
A.Inline placement directly in the path of network traffic flow to allow active packet dropping.
B.Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).
C.Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.
D.Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.
E.The ability to reset active TCP connections using TCP reset (RST) injections when malicious payloads are detected.
AnswersA, E

Inline placement lets the NIPS inspect every packet in real time and drop malicious traffic before it reaches the target, satisfying the requirement for active prevention rather than passive detection. Out-of-band, SPAN-based tools can only alert or reset after the fact, so they cannot block packets directly.

Why this answer

Option A is correct because a NIPS is typically deployed inline, sitting directly in the traffic path so it can actively drop or block malicious packets in real time rather than merely alerting. Option E is correct because many NIPS platforms can terminate or disrupt an in-progress attack by injecting TCP RST packets to reset the offending connection, which is an active prevention capability. Options B and D describe passive, detection-only behavior characteristic of a NIDS (e.g., SPAN port/TAP monitoring or syslog alerting without affecting traffic), so they do not represent prevention.

Option C is incorrect because a NIPS must inspect Layer 3 and Layer 4 headers (and often higher layers) to identify and block malicious traffic, so operating as a pure Layer 2 bridge without inspection is not a NIPS feature.

Exam trap

The trap is conflating NIDS and NIPS capabilities — candidates pick passive monitoring or alert-only options because they sound like standard IDS features, forgetting that prevention requires inline placement and active response actions like packet drops or RST injection.

Practice this question →
40
MCQmedium

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

A.Control Plane Policing (CoPP)
B.Spanning Tree Root Guard
C.Port Security
D.Dynamic ARP Inspection (DAI)
AnswerA

CoPP applies a policer to control-plane traffic, rate-limiting packets destined for the route processor before they reach the CPU. This directly prevents external floods from exhausting router CPU, satisfying the stated requirement to protect the control plane against CPU exhaustion attacks.

Why this answer

Control Plane Policing (CoPP) is a Cisco IOS feature that allows administrators to apply a QoS policy to traffic destined for the router's control plane (the CPU). It rate-limits or drops excessive control-plane traffic, such as routing protocol updates, ICMP, and management access, preventing CPU exhaustion attacks from external floods. By protecting the control plane, CoPP ensures the router remains stable and available even under attack.

Exam trap

CND often tests the distinction between control plane protection and Layer 2 security features; candidates may confuse CoPP with features like Port Security or DAI because they all involve 'protection', but only CoPP directly safeguards the router's CPU from excessive control-plane traffic.

How to eliminate wrong answers

Option B is wrong because Spanning Tree Root Guard is a Layer 2 feature that prevents a switch port from becoming the root port, mitigating rogue root bridge attacks, not CPU exhaustion on a router. Option C is wrong because Port Security restricts MAC addresses on a switch port to prevent MAC flooding and unauthorized access, which is a Layer 2 access control mechanism, not control plane protection. Option D is wrong because Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing, a Layer 2 security feature, and does not address control plane CPU exhaustion.

Practice this question →
41
MCQeasy

A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?

A.A DNS sinkhole that returns a non-routable address for domains on a blocklist
B.A web proxy configured in explicit mode with manual browser settings on each workstation
C.A host-based firewall installed on every employee workstation with outbound port 80 and 443 rules
D.A transparent web proxy that intercepts HTTP and HTTPS traffic inline and applies URL categorization and logging
AnswerD

A transparent proxy sits inline as a bridge, so clients keep their existing IP configuration and traffic is redirected without browser changes. It can categorize URLs, block known malicious destinations, and log every request. This matches the no-budget, no-client-change constraints while still providing the required filtering and audit trail.

Why this answer

A transparent proxy is deployed inline and redirects traffic without reconfiguring clients, satisfying the bridge requirement. It inspects the HTTP request line and Host header, enabling URL categorization, malicious-site blocking, and centralized logging. Explicit proxies, host firewalls, and DNS sinkholes each miss at least one requirement, such as client changes, per-endpoint management, or lack of request-level logging.

Exam trap

The trap here is equating DNS sinkholing with web filtering, when a sinkhole only affects name resolution and cannot see the full URL or log the actual HTTP request.

Practice this question →
42
Multi-Selecthard

A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)

Select 2 answers
A.Increase the maximum transmission unit on the external interface to eliminate fragmentation entirely
B.Configure the firewall to drop all fragmented packets regardless of source or protocol
C.Disable TCP window scaling and selective acknowledgment to simplify packet inspection
D.Set a maximum fragment reassembly timeout and memory limit to bound resource consumption
E.Enable IP fragment reassembly and normalization on the firewall before policy evaluation
AnswersD, E

Fragment reassembly consumes memory and CPU, so enforcing a timeout and a maximum buffer size prevents an attacker from exhausting resources with incomplete fragment sets, a technique known as a fragment exhaustion attack. These limits allow legitimate fragmented traffic within bounds while protecting the firewall's own stability.

Why this answer

Fragment reassembly with normalization ensures the firewall inspects the complete datagram and resolves overlapping fragments consistently, defeating evasion. Bounding reassembly with a timeout and memory limit protects the device from resource exhaustion caused by incomplete or malicious fragment sets. Dropping all fragments harms legitimate traffic, while TCP option changes and MTU adjustments do not address fragment-based evasion.

Exam trap

The trap here is believing that dropping every fragmented packet is a safe hardening step, when it actually breaks legitimate protocols and leaves the firewall unable to inspect fragmented traffic correctly.

Practice this question →
43
MCQhard

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

A.Strict TCP handshake validation
B.Unicast RPF (Reverse Path Forwarding)
C.Stateful Session Synchronization (Cluster State Sync)
D.NAT hairpinning
AnswerC

Stateful Session Synchronization replicates connection state tables between cluster members, so Firewall B recognises the SYN-ACK as belonging to an existing session established via Firewall A. This prevents the return packet being dropped as out-of-state under asymmetric routing.

Why this answer

Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Exam trap

CND often tests the misconception that enabling a routing or anti-spoofing feature (like uRPF) fixes asymmetric routing, when the actual requirement is replicating the stateful session table across the HA pair.

How to eliminate wrong answers

Option A is wrong because strict TCP handshake validation actually makes the problem worse — it enforces that every packet matches an existing state entry, so an unsynchronized firewall will drop the SYN-ACK even harder. Option B is wrong because Unicast RPF is an anti-spoofing mechanism that checks the source address against the routing table; it does not share connection state and can itself drop packets in asymmetric routing scenarios. Option D is wrong because NAT hairpinning (NAT loopback) only allows internal hosts to reach an internal server via its public NAT address — it has nothing to do with synchronizing state tables between two firewalls.

Practice this question →
44
MCQeasy

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

A.ufw enable 192.168.100.0/24
B.ufw allow from 192.168.100.0/24 to any port 22 proto tcp
C.ufw deny ssh
D.ufw route allow 22
AnswerB

UFW's allow rule with a from source and to any port 22 proto tcp matches the subnet constraint exactly, permitting inbound SSH only from 192.168.100.0/24 while denying other sources. Specifying proto tcp restricts the rule to SSH's transport, and the /24 CIDR covers the whole subnet.

Why this answer

The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Exam trap

CND often tests UFW syntax precision — candidates pick options that look like valid commands but either use wrong keywords (`enable` with a subnet) or confuse routing (`route allow`) with input filtering.

How to eliminate wrong answers

Option A is wrong because `ufw enable 192.168.100.0/24` is invalid syntax — `enable` activates the firewall and does not take a subnet argument. Option C is wrong because `ufw deny ssh` would block SSH entirely, the opposite of the requirement, and it does not scope to the subnet. Option D is wrong because `ufw route allow 22` is for routed traffic (forwarding between interfaces) and does not specify a source subnet or the correct port syntax.

Practice this question →
45
MCQeasy

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

A.To serve as the primary domain controller for the internal enterprise network.
B.To store encrypted backups of internal databases.
C.To bridge wireless clients directly to the wired core.
D.To act as a hardened, single-purpose server exposed to the internet in a DMZ.
AnswerD

A DMZ bastion host is deliberately hardened and limited to a single purpose, sitting in the perimeter network to broker administrative access to internal systems. Exposing it to the internet while stripping unnecessary services reduces the attack surface, satisfying the DMZ containment requirement.

Why this answer

A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Exam trap

CND often tests whether candidates understand that a bastion is a hardened jump host, not a general-purpose server — the trap is picking an option that places a domain controller or sensitive data in the DMZ.

How to eliminate wrong answers

Option A is wrong because a domain controller should never sit in a DMZ — exposing AD to the internet-facing segment would be a catastrophic security failure. Option B is wrong because storing encrypted backups of internal databases in a DMZ exposes sensitive data to the least-trusted network segment. Option C is wrong because bridging wireless clients directly to the wired core bypasses segmentation and defeats the purpose of the DMZ.

Practice this question →
46
Multi-Selecteasy

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Select 2 answers
A.Perimeter firewalls controlling traffic entering and leaving the zone
B.Unprotected hubs connecting all corporate workstations
C.Internal active directory domain controllers serving workstation logins
D.Public-facing web or mail servers
E.Unrestricted direct fiber connections to employee home routers
AnswersA, D

Perimeter firewalls enforce the boundary between the internet, the DMZ and the internal network, filtering traffic entering and leaving the zone. This satisfies the stem's requirement for a standard DMZ element by providing the access control that segments the public-facing subnet from trusted internal resources.

Why this answer

Option A is correct because a DMZ is by definition a segmented perimeter network, and perimeter firewalls (often deployed as an external firewall facing the Internet and an internal firewall facing the trusted LAN) enforce the access-control policy that governs traffic entering and leaving the zone. Option D is correct because the classic purpose of a DMZ is to host public-facing services such as web, mail, DNS, or reverse-proxy servers that must be reachable from untrusted networks while being isolated from the internal corporate network. Option B is incorrect because hubs are legacy, unswitched devices that broadcast all traffic to every port and provide no segmentation or access control, making them unsuitable for any security zone, let alone a DMZ.

Option C is incorrect because internal Active Directory domain controllers authenticate users and hold sensitive directory data, so placing them in a DMZ would expose the core identity infrastructure to Internet-facing threats; DMZ hosts should use separate, isolated identity services if needed. Option E is incorrect because unrestricted direct fiber links to employee home routers would bypass perimeter firewalls and create an unmonitored, unauthenticated path into the enterprise network, violating DMZ segmentation principles.

Exam trap

The trap is assuming that any server can go in a DMZ or that internal identity services (like AD) can be extended into the DMZ; candidates often overlook that DMZ isolation is about preventing lateral movement into the internal network.

Practice this question →
47
Multi-Selecthard

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Select 3 answers
A.Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.
B.Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.
C.Deploy strict firewall access control lists (ACLs) blocking all unnecessary inbound and outbound ports on the DMZ perimeter.
D.Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.
E.Disable all non-essential services, accounts, and management daemons on servers deployed within the DMZ.
AnswersA, C, E

A three-legged firewall uses separate interfaces for internet, DMZ, and internal segments, while a dual-firewall design places the DMZ between two devices. Both satisfy the stem's isolation requirement by forcing traffic between zones through distinct policy enforcement points rather than a single flat path.

Why this answer

Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks.

Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Exam trap

CND often tests the misconception that placing domain controllers in the DMZ is acceptable for authentication, or that DMZ servers should have unrestricted access to internal resources, leading candidates to select insecure options.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Network Perimeter Protection questions.

Start 20-question session