Certified Network Defense Architect (CNDA) — Questions and Answers

Question 1: A CNDA is performing a Business Impact Analysis (BIA). What are the two primary metrics gathered for each critical system?

RTO (Recovery Time Objective) and RPO (Recovery Point Objective) (Correct answer)
Number of users and storage capacity
Uptime percentage and bandwidth usage
CVSS score and patch count

Correct answer: RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

RTO defines how quickly a system must be restored after failure, while RPO defines the maximum acceptable data loss measured in time.

Question 2: An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

An audit finding
A vulnerability scan report
A penetration test report
An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official (Correct answer)

Correct answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Question 3: In a zero-trust architecture, what is the guiding principle for granting network access?

Never trust, always verify regardless of location (Correct answer)
Perimeter security is sufficient
Grant access based on IP address
Trust all internal users by default

Correct answer: Never trust, always verify regardless of location

Zero trust requires continuous verification of identity and device posture before granting access to any resource, internal or external.

Question 4: Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Advanced Persistent Threat (APT) (Correct answer)
Drive-by download
Script kiddie attack
Opportunistic breach

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

Question 5: In a CNDA context, what is 'threat normalization' as it applies to IDS?

Reducing alert severity ratings
Converting logs to a standard format
Reassembling fragmented or evasion-altered traffic to its true form before inspection (Correct answer)
Normalizing network bandwidth

Correct answer: Reassembling fragmented or evasion-altered traffic to its true form before inspection

Threat normalization reconstructs traffic that has been obfuscated through fragmentation or encoding so signatures can match it accurately.

Question 6: During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Reinstall the OS immediately
Delete all logs to prevent attacker access
Isolate the system on a quarantine network while capturing memory and disk images (Correct answer)
Immediately power off the affected system

Correct answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

Question 7: What is the primary difference between a vulnerability assessment and a penetration test?

Vulnerability assessments are only run on web apps; pen tests cover networks
They are identical in scope and methodology
Pen tests are automated; vulnerability assessments are manual
A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact (Correct answer)

Correct answer: A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 8: Which firewall policy approach explicitly denies all traffic that is not permitted by a specific rule?

Default deny (deny-all) policy (Correct answer)
Default allow policy
Stateless filtering
Implicit permit

Correct answer: Default deny (deny-all) policy

A default deny policy blocks all traffic unless explicitly allowed, implementing the principle of least privilege at the network level.

Question 9: Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Full mesh topology
Defense-in-depth segmentation (Correct answer)
Flat network
Hub-and-spoke topology

Correct answer: Defense-in-depth segmentation

Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.

Question 10: Which attack type is specifically designed to evade signature-based IDS by breaking payloads across multiple packets?

Man-in-the-middle attack
Fragmentation attack (Correct answer)
SQL injection
Replay attack

Correct answer: Fragmentation attack

Fragmentation attacks split malicious payloads across multiple IP fragments so no single fragment matches a complete signature.

Question 11: Which firewall type inspects the full context of a TCP session rather than individual packets?

Stateful inspection firewall (Correct answer)
Next-generation firewall
Packet filter firewall
Proxy firewall

Correct answer: Stateful inspection firewall

A stateful firewall tracks the state of active connections and uses this context to determine whether packets belong to a legitimate session.

Question 12: During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Notifying all users of the incident
Filing an insurance claim
Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)
Updating the asset inventory

Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

Question 13: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Triage, Escalation, Resolution, Review
Identify, Protect, Detect, Respond
Alert, Investigate, Patch, Close
Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 14: A CNDA is designing a DMZ. Which traffic flow is considered best practice?

DMZ servers have unrestricted access to internal LAN
Internet → DMZ → Internal without inspection
Internet → Firewall → DMZ → Firewall → Internal (Correct answer)
Internal → DMZ → Internet without firewall

Correct answer: Internet → Firewall → DMZ → Firewall → Internal

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

Question 15: A WIDS alert indicates 'beacon flooding' on the wireless network. What is the primary impact of this attack?

Capture of WPA2 4-way handshakes from all clients
Exhaustion of DHCP address pool
Denial of service by overwhelming client scanning queues with thousands of fake SSIDs (Correct answer)
Forced downgrade from WPA3 to WPA2

Correct answer: Denial of service by overwhelming client scanning queues with thousands of fake SSIDs

Beacon flooding generates thousands of fake SSID beacons, overwhelming the scanning and display capabilities of wireless clients and potentially causing DoS conditions.

Question 16: Which of the following BEST describes quantitative risk analysis?

Assigning numerical monetary values to risk using metrics like ALE and SLE (Correct answer)
Categorizing risks as High, Medium, or Low
Using a heat map to visualize risk
Conducting stakeholder interviews

Correct answer: Assigning numerical monetary values to risk using metrics like ALE and SLE

Quantitative risk analysis uses formulas like ALE (Annual Loss Expectancy) = SLE × ARO to express risk in financial terms.

Question 17: Which OSINT technique involves gathering information about an organization's internet-facing assets without active scanning?

Active directory enumeration
Port scanning
Phishing simulation
Passive reconnaissance using tools like Shodan, DNS records, and certificate transparency logs (Correct answer)

Correct answer: Passive reconnaissance using tools like Shodan, DNS records, and certificate transparency logs

Passive OSINT collects publicly available information without touching target systems, leaving no footprint and providing an attacker's-eye view of the attack surface.

Question 18: What is the purpose of a Certificate Revocation List (CRL) in a VPN PKI deployment?

To identify certificates that have been revoked before their expiration date (Correct answer)
To list all trusted root CAs
To assign IP addresses to VPN clients
To store private keys securely

Correct answer: To identify certificates that have been revoked before their expiration date

A CRL allows VPN gateways to check whether a client or server certificate has been revoked due to compromise or policy change.

Question 19: An attacker sends thousands of half-open TCP connections to overwhelm a server. Which firewall feature mitigates this?

URL filtering
Application inspection
Content filtering
SYN proxy or SYN cookies (Correct answer)

Correct answer: SYN proxy or SYN cookies

A SYN proxy intercepts TCP handshakes and only forwards complete connections to the server, protecting against SYN flood attacks.

Question 20: Which of the following BEST describes a software-defined perimeter (SDP)?

A cloud load balancer
A physical firewall at the network edge
A dynamic, identity-based access control that hides resources until authenticated (Correct answer)
A VLAN-based segmentation strategy

Correct answer: A dynamic, identity-based access control that hides resources until authenticated

SDP creates an encrypted overlay that makes resources invisible to unauthenticated users, reducing the attack surface.

Question 21: What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

To negotiate and establish the Security Associations (SAs) and exchange keys (Correct answer)
To authenticate web certificates
To compress VPN traffic
To encrypt the data payload

Correct answer: To negotiate and establish the Security Associations (SAs) and exchange keys

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Question 22: Which EAP method provides mutual authentication using digital certificates on both the client and the server?

EAP-MD5
PEAP-MSCHAPv2
EAP-TLS (Correct answer)
EAP-FAST

Correct answer: EAP-TLS

EAP-TLS requires both the authentication server and the client to present valid X.509 certificates, providing strong mutual authentication.

Question 23: A wireless IDS (WIDS) has flagged a large number of deauthentication frames targeting all clients on an AP. What is the most likely intent of this activity?

Forcing clients to reassociate to capture the 4-way WPA2 handshake (Correct answer)
Triggering 802.11r fast BSS transition
Testing AP load balancing
RF spectrum analysis

Correct answer: Forcing clients to reassociate to capture the 4-way WPA2 handshake

Attackers send spoofed deauthentication frames to disconnect clients, forcing them to reauthenticate so the WPA2 4-way handshake can be captured for offline cracking.

Question 24: Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

PPTP
SSL/TLS VPN
IPsec (Correct answer)
L2TP without IPsec

Correct answer: IPsec

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

Question 25: When conducting a wireless security assessment, what does a 'karma attack' exploit?

WPS PIN brute force using split-PIN validation
ARP poisoning over wireless to redirect traffic
Auto-connect behavior where clients accept connections from APs responding to their probe requests (Correct answer)
RC4 keystream reuse in WEP networks

Correct answer: Auto-connect behavior where clients accept connections from APs responding to their probe requests

The karma attack involves an attacker's AP responding to any client probe request with a matching SSID, exploiting the client's auto-connect behavior to force an association.

Question 26: What does 'mean time to detect' (MTTD) measure in a security operations context?

The average time between an attacker gaining access and the defender detecting the intrusion (Correct answer)
Time to respond to a detected alert
Time to patch a vulnerability after discovery
Time to restore systems after an incident

Correct answer: The average time between an attacker gaining access and the defender detecting the intrusion

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

Question 27: What does the Diffie-Hellman algorithm accomplish in a VPN key exchange?

It encrypts the VPN payload
It compresses tunnel traffic
It signs the VPN certificate
It allows two parties to establish a shared secret over an untrusted channel without prior shared information (Correct answer)

Correct answer: It allows two parties to establish a shared secret over an untrusted channel without prior shared information

Diffie-Hellman enables two parties to derive the same shared secret using public values exchanged over an insecure channel.

Question 28: What is the primary purpose of a SIEM (Security Information and Event Management) system?

To automatically patch vulnerabilities
To manage user accounts and passwords
To replace firewalls and IDS
To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)

Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection

SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.

Question 29: A CNDA is evaluating whether to prioritize patching based on CVSS base score alone. What is the limitation of this approach?

CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls (Correct answer)
CVSS base scores are not publicly available
CVSS scores change daily
CVSS scores only apply to web vulnerabilities

Correct answer: CVSS base scores do not account for exploitability in the wild, asset criticality, or compensating controls

CVSS base scores measure severity in isolation — they do not reflect whether a vulnerability is actively exploited or whether mitigating controls reduce actual risk.

Question 30: What is the primary risk of placing an IDS sensor outside the perimeter firewall?

It cannot detect internal threats
It requires more storage
It generates excessive false positives from internet noise but misses post-filter attacks (Correct answer)
It will only see encrypted traffic

Correct answer: It generates excessive false positives from internet noise but misses post-filter attacks

An external IDS sees all raw internet traffic, producing high false-positive rates, but traffic blocked by the firewall never reaches internal systems.

Question 31: What is the MITRE ATT&CK framework used for in incident response?

Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs) (Correct answer)
Auditing firewall rules
Scoring vulnerability severity
Defining patch management schedules

Correct answer: Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

Question 32: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

DNS resolution activity
A misconfigured DHCP client
Normal NTP synchronization
A command-and-control (C2) connection from malware (Correct answer)

Correct answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Question 33: What distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

NGFW only filters at Layer 3
NGFW cannot perform NAT
NGFW adds application-layer inspection, user identity awareness, and integrated IPS (Correct answer)
NGFW uses only signature-based detection

Correct answer: NGFW adds application-layer inspection, user identity awareness, and integrated IPS

An NGFW combines stateful inspection with deep packet inspection, application identification, user-based policies, and IPS capabilities.

Question 34: Which type of firewall architecture uses a separate proxy process for each application protocol?

Packet filter
Stateful firewall
Deep packet inspection engine
Application proxy (circuit-level gateway) (Correct answer)

Correct answer: Application proxy (circuit-level gateway)

An application proxy firewall terminates connections and creates new ones, fully understanding each protocol to enforce granular policies.

Question 35: What is the primary purpose of vulnerability scanning in a CNDA security program?

To exploit vulnerabilities in a controlled manner
To identify and prioritize known weaknesses in systems before attackers can exploit them (Correct answer)
To monitor network traffic for intrusions
To inventory software licenses

Correct answer: To identify and prioritize known weaknesses in systems before attackers can exploit them

Vulnerability scanning discovers known weaknesses, misconfigurations, and missing patches so organizations can remediate the highest risks first.

Question 36: What does 'threat modeling' help a CNDA accomplish during the design phase of a new system?

Document user requirements
Calculate the total cost of ownership
Define SLA metrics
Identify potential threats, attack vectors, and necessary security controls before the system is built (Correct answer)

Correct answer: Identify potential threats, attack vectors, and necessary security controls before the system is built

Threat modeling during design is far cheaper than retrofitting security — it identifies what could go wrong and informs security requirements before code is written.

Question 37: Under HIPAA, what category of information must healthcare organizations protect?

All employee email
Financial transaction records
Marketing contact lists
Protected Health Information (PHI) that identifies individuals (Correct answer)

Correct answer: Protected Health Information (PHI) that identifies individuals

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Question 38: Which fundamental cryptographic weakness made WEP completely broken and unsuitable for use?

Absence of certificate-based mutual authentication
Lack of a 4-way handshake
Use of SHA-1 for integrity checking
Short 24-bit Initialization Vector reuse with RC4 (Correct answer)

Correct answer: Short 24-bit Initialization Vector reuse with RC4

WEP's 24-bit IV space is small enough to force IV reuse within minutes on a busy network, allowing attackers to recover the key using statistical attacks on RC4 keystreams.

Question 39: An organization is deploying wireless in a high-security environment. Which 802.11 amendment introduced the robust security network (RSN) framework that WPA2 is based on?

802.11i (Correct answer)
802.11a
802.11n
802.11w

Correct answer: 802.11i

IEEE 802.11i introduced the Robust Security Network (RSN) framework, defining CCMP/AES encryption and the 4-way handshake that became the foundation of WPA2.

Question 40: What US federal law requires federal agencies to implement a risk management framework for information security?

PCI-DSS
HIPAA
FISMA (Federal Information Security Modernization Act) (Correct answer)
SOX

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies and contractors to develop, document, and implement information security programs based on NIST frameworks.

Question 41: Which framework categorizes threat actors and their motivations into APT groups with numbered designations?

MITRE ATT&CK with Group designations (e.g., APT28) (Correct answer)
NIST CSF
OWASP Top 10
CVE numbering system

Correct answer: MITRE ATT&CK with Group designations (e.g., APT28)

MITRE ATT&CK catalogs threat actor groups (e.g., APT28, Lazarus Group) with their known TTPs, enabling defenders to tailor controls.

Question 42: What is the difference between a CVE and a CWE?

They are identical naming conventions
CVE is for networks; CWE is for applications
CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
CVE scores severity; CWE tracks patches

Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses

CVE (Common Vulnerabilities and Exposures) identifies specific real-world vulnerabilities, while CWE (Common Weakness Enumeration) classifies root-cause software weakness types.

Question 43: Which IDS/IPS detection method identifies attacks by comparing traffic to known bad patterns?

Signature-based detection (Correct answer)
Anomaly-based detection
Heuristic detection
Behavioral analysis

Correct answer: Signature-based detection

Signature-based detection matches traffic against a database of known attack patterns, making it effective against known threats.

Question 44: Which technique allows a host-based IDS (HIDS) to detect file system tampering?

File integrity monitoring (FIM) using cryptographic hashes (Correct answer)
Network packet capture
Protocol analysis
Signature scanning of running processes

Correct answer: File integrity monitoring (FIM) using cryptographic hashes

HIDS uses FIM to hash critical files at baseline and alerts when hashes change, indicating unauthorized modification.

Question 45: What is the purpose of a honeypot in a network defense architecture?

To load balance web servers
To lure and study attacker behavior in a controlled environment (Correct answer)
To encrypt sensitive data in transit
To speed up legitimate network traffic

Correct answer: To lure and study attacker behavior in a controlled environment

A honeypot is a decoy system that attracts attackers, allowing defenders to observe techniques without risk to production assets.

Question 46: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

To complete regulatory reporting
To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
To calculate the financial cost of the breach
To assign blame for the incident

Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.

Question 47: What is the primary security benefit of network time protocol (NTP) synchronization across all devices?

Reduces CPU load on routers
Prevents ARP spoofing
Encrypts network traffic
Ensures consistent timestamps for log correlation and forensic analysis (Correct answer)

Correct answer: Ensures consistent timestamps for log correlation and forensic analysis

Synchronized time across devices ensures log entries can be accurately correlated during incident investigation.

Question 48: What is a 'security control baseline' as used in NIST SP 800-53?

The minimum acceptable patch level for servers
The default firewall rule set
A predefined set of security controls tailored to a system's impact level (Low, Moderate, High) (Correct answer)
A list of denied network addresses

Correct answer: A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 49: What firewall feature prevents internal hosts from using unauthorized DNS servers?

Split DNS
DNS sinkholing
DNSSEC validation
DNS proxy or DNS inspection policy (Correct answer)

Correct answer: DNS proxy or DNS inspection policy

A DNS inspection policy on the firewall can intercept and redirect DNS queries to approved resolvers, preventing DNS tunneling and C2 communication.

Question 50: A penetration tester uses a wireless adapter in monitor mode to capture 802.11 frames without associating to any AP. This technique is called what?

Passive sniffing (Correct answer)
Active scanning
Promiscuous mode capture
SSID enumeration

Correct answer: Passive sniffing

Passive sniffing (monitor mode) captures all 802.11 frames in range without transmitting, making it undetectable to standard WIDS that look for association attempts.

Question 51: What is a zero-day vulnerability?

A vulnerability in zero-trust architecture
A vulnerability with a CVSS score of zero
A vulnerability that has been public for zero days before patching
A vulnerability unknown to the vendor for which no patch exists (Correct answer)

Correct answer: A vulnerability unknown to the vendor for which no patch exists

A zero-day is a previously unknown vulnerability that the vendor has had zero days to patch, making it especially dangerous since no fix exists.

Question 52: What does 'false positive' mean in the context of an IDS?

A rule that always matches
An attack that was not detected
A legitimate activity that is incorrectly flagged as malicious (Correct answer)
An alert with no log entry

Correct answer: A legitimate activity that is incorrectly flagged as malicious

A false positive occurs when benign traffic triggers an alert, wasting analyst time and potentially leading to alert fatigue.

Question 53: A CNDA uses the STRIDE model. What does the 'T' stand for and what type of attack does it represent?

Tampering — unauthorized modification of data or systems (Correct answer)
Transmission — intercepting data in transit
Targeting — selecting victims for attacks
Tracking — monitoring user activity

Correct answer: Tampering — unauthorized modification of data or systems

In STRIDE, Tampering represents integrity threats — unauthorized modification of data, configuration, or code.

Question 54: What is the purpose of a Plan of Action and Milestones (POA&M)?

To document known security weaknesses, remediation plans, and timelines for correction (Correct answer)
To outline the incident response team structure
To schedule employee performance reviews
To define the network topology

Correct answer: To document known security weaknesses, remediation plans, and timelines for correction

A POA&M is a management tool that tracks security deficiencies, assigns responsibility, and establishes milestones for remediation.

Question 55: Which tool is used to passively monitor for new CVEs and vendor advisories relevant to an organization's software inventory?

Splunk SIEM
Metasploit
Nmap
A vulnerability intelligence feed or Software Composition Analysis (SCA) tool (Correct answer)

Correct answer: A vulnerability intelligence feed or Software Composition Analysis (SCA) tool

SCA tools and CVE intelligence feeds continuously monitor software components against vulnerability databases and notify when a new CVE affects installed software.

Question 56: MAC address filtering as a wireless security control is ineffective primarily because of what reason?

MAC filtering disables WPA2 CCMP encryption
Modern operating systems randomize MACs every connection
MAC addresses are transmitted in cleartext and can be spoofed by an attacker (Correct answer)
Access points cannot store more than 255 MAC addresses

Correct answer: MAC addresses are transmitted in cleartext and can be spoofed by an attacker

MAC addresses are visible in plaintext 802.11 frame headers even on encrypted networks, allowing attackers to clone an authorized MAC using freely available tools.

Question 57: During a wireless site survey, a security architect discovers overlapping channels 1, 6, and 11 in the 2.4 GHz band being used correctly. Why are these specific channels chosen?

They are the only channels that support WPA3
They are reserved for enterprise 802.1X use
They provide maximum range due to lower frequency
They are the only three non-overlapping channels in 2.4 GHz (Correct answer)

Correct answer: They are the only three non-overlapping channels in 2.4 GHz

In the 2.4 GHz band, only channels 1, 6, and 11 are non-overlapping (in the US), preventing co-channel interference between adjacent access points.

Question 58: A CNDA must choose between a routed and a bridged firewall deployment. Which scenario favors a transparent (bridged) firewall?

When dynamic routing protocols are needed
When IP re-addressing of existing segments is impractical (Correct answer)
When NAT is required for all internal hosts
When VPN termination is required on the firewall

Correct answer: When IP re-addressing of existing segments is impractical

A transparent firewall operates at Layer 2 and can be inserted into an existing network without changing IP addressing.

Question 59: A firewall rule set should follow which ordering principle for efficiency and security?

Most permissive rules first
Most specific rules first, with a deny-all at the bottom (Correct answer)
Rules in alphabetical order
Deny-all at the top, allow rules at the bottom

Correct answer: Most specific rules first, with a deny-all at the bottom

Specific rules should precede general ones, and an implicit or explicit deny-all at the end ensures no unauthorized traffic passes.

Question 60: What is a 'threat hunting' program in the context of network defense?

Running automated vulnerability scans
Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems (Correct answer)
Patching known CVEs before exploitation
Monitoring social media for threat actor chatter

Correct answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Question 61: A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Ignore it as a false positive
Block all traffic from Tokyo
Delete the user account immediately
Disable the account temporarily and contact the user to verify legitimacy (Correct answer)

Correct answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

Question 62: Which IR containment strategy involves blocking a malicious domain at the DNS level to prevent malware from communicating with C2?

Firewall null routing
DNS sinkholing (Correct answer)
ARP poisoning
BGP blackholing

Correct answer: DNS sinkholing

DNS sinkholing redirects queries for malicious domains to a controlled server, severing C2 communication while identifying infected hosts.

Question 63: Which compliance framework applies specifically to organizations that process, store, or transmit payment card data?

HIPAA
ISO 27001
NIST CSF
PCI-DSS (Correct answer)

Correct answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is mandated by card brands for any entity handling cardholder data.

Question 64: Which security governance concept requires that multiple people must collaborate to perform sensitive actions, preventing unilateral misuse?

Least privilege
Need to know
Two-person integrity (dual control) (Correct answer)
Separation of duties

Correct answer: Two-person integrity (dual control)

Two-person integrity (dual control) requires two authorized individuals to be present or act together for sensitive operations, such as accessing cryptographic keys.

Question 65: What is the purpose of a System Security Plan (SSP) in a federal compliance context?

To define employee compensation
To outline the organization's marketing strategy
To list all known vulnerabilities
To document the security controls implemented for a specific information system (Correct answer)

Correct answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Question 66: In an enterprise WLAN, which protocol allows a client to roam between access points without re-performing full 802.1X authentication, reducing latency?

802.11u (Interworking with External Networks)
802.11v (BSS Transition Management)
802.11k (Radio Resource Management)
802.11r (Fast BSS Transition) (Correct answer)

Correct answer: 802.11r (Fast BSS Transition)

802.11r enables fast BSS transition (FT) by pre-establishing PMK-R1 key hierarchies, allowing clients to roam with minimal re-authentication delay.

Question 67: A captured wireless packet shows the GCMP-256 cipher suite being negotiated. This indicates the wireless network is using which security standard?

WPA2-Enterprise with EAP-TLS
WPA3-Personal with SAE
WPA3-Enterprise 192-bit mode (Correct answer)
WPA2 with optional AES-256

Correct answer: WPA3-Enterprise 192-bit mode

GCMP-256 is mandated by the WPA3-Enterprise 192-bit security mode (CNSA suite), designed for high-security environments requiring NSA Suite B cryptography.

Question 68: Which IPsec mode encapsulates the entire original IP packet, including the header, and is used for gateway-to-gateway VPNs?

Transport mode
Tunnel mode (Correct answer)
Aggressive mode
Quick mode

Correct answer: Tunnel mode

Tunnel mode wraps the entire original IP packet inside a new IP packet with a new header, hiding the original source and destination.

Question 69: What is a bug bounty program in the context of vulnerability management?

An internal reward for security team members who find bugs
A government grant for cybersecurity research
A tool that automatically discovers and reports bugs
A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment (Correct answer)

Correct answer: A program that invites external researchers to responsibly disclose vulnerabilities in exchange for recognition or payment

Bug bounty programs create a structured channel for external security researchers to report vulnerabilities responsibly before malicious actors find them.

Question 70: What cryptographic property ensures that a sender cannot deny having sent a message?

Confidentiality
Integrity
Availability
Non-repudiation (Correct answer)

Correct answer: Non-repudiation

Non-repudiation, achieved through digital signatures, provides proof of origin that the sender cannot later deny.

Question 71: Which log source is MOST valuable for detecting privilege escalation on a Windows system?

DNS query logs
Web server access logs
Network flow data
Windows Security Event Log (Event ID 4672 - Special Privileges Assigned) (Correct answer)

Correct answer: Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

Question 72: An IDS detects a known attack signature. What is the IMMEDIATE response it takes by default?

Blocks the connection automatically
Sends an alert to the administrator (Correct answer)
Resets the attacker's TCP session
Quarantines the source IP

Correct answer: Sends an alert to the administrator

An IDS (Intrusion Detection System) is a passive device that generates alerts; it does not block traffic by default.

Question 73: Which IPS deployment mode allows it to actively block malicious traffic inline?

Port mirroring mode
Inline mode between network segments (Correct answer)
Passive (promiscuous) mode
Out-of-band mode

Correct answer: Inline mode between network segments

Inline IPS sits in the traffic path and can drop or modify packets before they reach the destination.

Question 74: What is an attack surface reduction strategy that a CNDA would implement to minimize vulnerability exposure?

Using only cloud-hosted services
Maximizing the number of administrative accounts
Disabling unnecessary services, ports, and protocols across all systems (Correct answer)
Enabling all available services and ports for maximum functionality

Correct answer: Disabling unnecessary services, ports, and protocols across all systems

Reducing the attack surface by disabling unneeded services, ports, and protocols means fewer potential entry points for attackers.

Question 75: Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

NIST SP 800-53
ISO 27001
NIST Cybersecurity Framework (CSF) (Correct answer)
CIS Controls

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 76: Which vulnerability management practice involves grouping systems by criticality and applying different patching SLAs to each group?

Risk-based patch prioritization (Correct answer)
Compensating controls only
Patch deferral
Universal patching

Correct answer: Risk-based patch prioritization

Risk-based patch prioritization assigns shorter remediation windows to critical systems and high-CVSS vulnerabilities while allowing more time for lower-risk assets.

Question 77: Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Metasploit
Wireshark or tcpdump (Correct answer)
Nmap
Nessus

Correct answer: Wireshark or tcpdump

Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.

Question 78: What does 'perfect forward secrecy' (PFS) protect against in a VPN?

Compromise of the long-term private key exposing past session keys (Correct answer)
Eavesdropping on the initial handshake
Replay attacks
DNS leaks in VPN tunnels

Correct answer: Compromise of the long-term private key exposing past session keys

PFS generates ephemeral session keys so that compromising the long-term key does not allow decryption of previously recorded sessions.

Question 79: In a third-party risk management program, what document formally defines the security obligations of a vendor?

NDA (Non-disclosure agreement)
BAA (Business Associate Agreement) or security addendum (Correct answer)
SOW (Statement of Work)
SLA (Service Level Agreement)

Correct answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

Question 80: A network architect wants to isolate guest Wi-Fi users from the corporate LAN. Which design approach is most effective?

Enable client isolation only on the corporate SSID
Use SSID hiding on the corporate network
Deploy a captive portal without VLAN segmentation
Assign guest users to a separate VLAN with ACLs blocking internal subnets (Correct answer)

Correct answer: Assign guest users to a separate VLAN with ACLs blocking internal subnets

Placing guest users in a dedicated VLAN with ACLs preventing access to corporate subnets provides network-layer isolation independent of AP configuration.

Question 81: In network architecture, what does 'East-West traffic' refer to?

Traffic between two different ISPs
Traffic from branch offices to headquarters
Traffic between servers within the same data center or cloud environment (Correct answer)
Traffic between the internet and internal servers

Correct answer: Traffic between servers within the same data center or cloud environment

East-West traffic is server-to-server communication within a data center, which is the primary path for lateral movement after a breach.

Question 82: Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

SHA-256
SHA-3
SHA-512
MD5 (Correct answer)

Correct answer: MD5

MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.

Question 83: Which addressing scheme is recommended to prevent direct internet enumeration of internal hosts?

Using public IPs on all internal servers
IPv6 link-local addresses
Using APIPA addresses
RFC 1918 private addressing with NAT (Correct answer)

Correct answer: RFC 1918 private addressing with NAT

RFC 1918 private addresses are non-routable on the internet, and NAT hides internal topology from external attackers.

Question 84: A CNDA needs to inspect encrypted HTTPS traffic for malware. Which firewall capability is required?

SSL/TLS inspection (deep packet inspection) (Correct answer)
NAT overload
Geo-blocking
URL filtering

Correct answer: SSL/TLS inspection (deep packet inspection)

SSL/TLS inspection decrypts, inspects, and re-encrypts traffic so the firewall can examine encrypted payloads for threats.

Question 85: In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

IKEv2
GRE
AH (Authentication Header) (Correct answer)
ESP (Encapsulating Security Payload)

Correct answer: AH (Authentication Header)

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

Question 86: What is the primary purpose of a network baseline in security architecture?

To configure default gateway settings
To define maximum allowed bandwidth
To establish normal behavior for anomaly detection (Correct answer)
To document all IP addresses

Correct answer: To establish normal behavior for anomaly detection

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Question 87: What does 'due diligence' mean in the context of cybersecurity governance?

Documenting all software licenses
Requiring all staff to take phishing training
Running daily vulnerability scans
Researching and understanding risks before implementing security controls and business decisions (Correct answer)

Correct answer: Researching and understanding risks before implementing security controls and business decisions

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

Question 88: In risk management, what does the formula Risk = Threat × Vulnerability × Impact represent?

A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact (Correct answer)
A patch priority formula
A firewall rule priority formula
A compliance scoring model

Correct answer: A qualitative method for calculating risk exposure based on threat likelihood, exploitability, and business impact

This formula helps prioritize risks by combining the likelihood of a threat exploiting a vulnerability with the potential business impact.

Question 89: What is a 'playbook' in the context of incident response?

A documented, step-by-step procedure for responding to a specific type of incident (Correct answer)
A list of authorized users
A network diagram
A vendor-supplied patch guide

Correct answer: A documented, step-by-step procedure for responding to a specific type of incident

A playbook provides predefined, repeatable procedures so responders take consistent, effective action when a specific incident type occurs.

Question 90: Which protocol is used to provide out-of-band management access to network devices?

Console via dedicated OOB network (Correct answer)
SNMP
Telnet
HTTP

Correct answer: Console via dedicated OOB network

Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.

Question 91: In the NIST Risk Management Framework (RMF), what is the correct order of the first three steps?

Select, Implement, Assess
Assess, Select, Implement
Prepare, Categorize, Select (Correct answer)
Categorize, Select, Implement

Correct answer: Prepare, Categorize, Select

NIST RMF steps are: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — Prepare was added in RMF Rev 2.

Question 92: What is 'lateral movement' in the context of a network intrusion?

Changing user permissions horizontally
Moving files between servers
An attacker traversing from the initial foothold to other systems within the network (Correct answer)
Routing traffic through multiple firewalls

Correct answer: An attacker traversing from the initial foothold to other systems within the network

Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.

Question 93: Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?

CIS benchmark control
CVE identifier
Indicator of Compromise (IoC) such as a malicious IP or domain (Correct answer)
CVSS score

Correct answer: Indicator of Compromise (IoC) such as a malicious IP or domain

IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.

Question 94: Which risk treatment option involves purchasing cyber insurance to offset potential financial losses?

Risk acceptance
Risk transference (Correct answer)
Risk avoidance
Risk mitigation

Correct answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider, without eliminating the risk itself.

Question 95: What is the key advantage of anomaly-based IDS over signature-based IDS?

Simpler rule management
Faster processing speed
Ability to detect zero-day and previously unknown attacks (Correct answer)
Lower false positive rate

Correct answer: Ability to detect zero-day and previously unknown attacks

Anomaly-based IDS detects deviations from established baselines, enabling detection of novel attacks that have no known signatures.

Question 96: Which regulation requires US public companies to maintain adequate internal controls over financial reporting and cybersecurity disclosures?

FERPA
SOX (Sarbanes-Oxley Act) (Correct answer)
CCPA
GLBA

Correct answer: SOX (Sarbanes-Oxley Act)

SOX Section 404 requires management and auditors to assess internal controls, and the SEC now requires timely cybersecurity incident disclosure.

Question 97: What is the purpose of a 'stateful failover' configuration in a firewall cluster?

To load balance new connections
To synchronize firewall rules only
To replicate connection state tables so sessions survive a failover without dropping (Correct answer)
To back up firewall logs

Correct answer: To replicate connection state tables so sessions survive a failover without dropping

Stateful failover synchronizes active session tables between firewall peers so existing connections continue seamlessly if the active unit fails.

Question 98: Which type of threat intelligence is MOST actionable for a SOC analyst responding to an active incident?

Technical intelligence (vulnerability details)
Tactical intelligence (TTPs of threat actors targeting your sector)
Strategic intelligence (geopolitical threat landscape)
Operational intelligence (specific indicators like malicious IPs and hashes) (Correct answer)

Correct answer: Operational intelligence (specific indicators like malicious IPs and hashes)

Operational intelligence provides specific, immediately actionable IoCs such as malicious IPs, domains, and file hashes that can be directly used in detection tools.

Question 99: During a forensic investigation, which principle ensures the integrity of digital evidence?

Storing evidence on a shared network drive
Deleting unnecessary files before imaging
Using the original media for all analysis
Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)

Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

Question 100: Which threat intelligence sharing format is a community standard for expressing cyber threat indicators in a structured, machine-readable way?

CEF (Common Event Format)
NetFlow
LEEF (Log Event Extended Format)
STIX (Structured Threat Information eXpression) (Correct answer)

Correct answer: STIX (Structured Threat Information eXpression)

STIX is an open standard for representing CTI, including threat actors, malware, attack patterns, and IoCs in a structured format.

Certified Network Defense Architect (CNDA)

The CNDA is an EC-Council certification exclusively for U.S. government and military personnel that validates advanced network defense architecture skills including firewall deployment, intrusion detection, risk management, and threat intelligence. It is built on the CEH and CND frameworks and requires prior CEH certification.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds