CND · topic practice

Network Security Controls Protocols And Devices practice questions

Q: How should I use these Network Security Controls Protocols And Devices practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Network Security Controls Protocols And Devices questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Security Controls Protocols And Devices domain.

Practise EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) Network Security Controls Protocols And Devices practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Security Controls Protocols And Devices

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Security Controls Protocols And Devices

Network Security Controls Protocols And Devices questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Security Controls Protocols And Devices exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Security Controls Protocols And Devices questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Open the full VLAN trunking answer →

A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?

Trap 1: Enable dynamic trunking protocol (DTP) on all ports and set the…

Enabling DTP allows switches to negotiate trunking automatically, which is precisely how attackers exploit switch spoofing VLAN hopping.

Trap 2: Enable spanning-tree portfast and BPDU guard on all trunk ports

Portfast and BPDU guard are used on access ports to speed up convergence and prevent unauthorized switches, not for VLAN hopping.

Trap 3: Configure port security with sticky MAC addresses and maximum limit…

Port security limits MAC address counts, but it does not prevent 802.1Q double-tagging or DTP trunk negotiation attacks.

Study all Network Security Controls Protocols And Devices common traps →

A
Enable dynamic trunking protocol (DTP) on all ports and set the native VLAN to VLAN 1
Why wrong: Enabling DTP allows switches to negotiate trunking automatically, which is precisely how attackers exploit switch spoofing VLAN hopping.
B
Enable spanning-tree portfast and BPDU guard on all trunk ports
Why wrong: Portfast and BPDU guard are used on access ports to speed up convergence and prevent unauthorized switches, not for VLAN hopping.
C
Disable Dynamic Trunking Protocol (DTP) and explicitly set access ports to non-trunking mode
Disabling DTP and forcing ports into static access mode prevents an attacker from negotiating a trunk link to access other VLANs.
D
Configure port security with sticky MAC addresses and maximum limit of one
Why wrong: Port security limits MAC address counts, but it does not prevent 802.1Q double-tagging or DTP trunk negotiation attacks.

Network Security Controls Protocols And Devices practice questions

What to know about Network Security Controls Protocols And Devices

Common Network Security Controls Protocols And Devices exam traps

Network Security Controls Protocols And Devices questions

A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Track your progress over time

Start a Network Security Controls Protocols And Devices only practice session

Related CND topic practice pages

Endpoint Protection practice questions

Enterprise Cloud Virtual And Wireless Network Protection practice questions

Network Security Controls Protocols And Devices practice questions

Incident Detection Response And Threat Prediction practice questions

Network Attacks And Defense Strategies practice questions

Network Defense Management practice questions

Application And Data Protection practice questions

Network Perimeter Protection practice questions

CND fundamentals practice questions

CND scenario practice questions

CND troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid