I85PREP
⌘ K
CND study materials
CND study resources

CND practice questions

One question at a time. Build your CND understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Attacks and Defense Strategies

Which denial-of-service attack exhausts a server's connection table by sending many TCP connection requests with spoofed source addresses, leaving half-open connections?

  1. Teardrop
  2. Ping of death
  3. SYN flood Correct answer.
  4. Smurf

Explanation

A SYN flood abuses the TCP three-way handshake: the server allocates state for each SYN and waits for a final ACK that never arrives. Because source addresses are spoofed, the half-open entries cannot be completed and the backlog fills, denying service to legitimate clients.

Question 2Network Attacks and Defense Strategies

A workstation's ARP cache is repeatedly updated so that the default gateway's IP address maps to an attacker's MAC address. What is the primary effect?

  1. The attacker immediately gains administrative rights on the gateway device.
  2. Encrypted sessions are decrypted automatically.
  3. Traffic to the gateway is rerouted through the attacker. Correct answer.
  4. The gateway reboots and drops all connections.

Explanation

ARP has no built-in authentication, so any host can answer for another IP address. Poisoning the gateway mapping makes victims send their frames to the attacker, who can forward or alter them, producing a man-in-the-middle position.

Question 3Network Attacks and Defense Strategies

Flooding a switch with thousands of bogus source MAC addresses causes the switch to take which action?

  1. Reboot and reload its configuration
  2. Drop all frames until the table is cleared
  3. Assign every port to a single default VLAN
  4. Flood frames out every port so traffic can be captured Correct answer.

Explanation

A switch learns source MAC addresses in its CAM table, which has finite space. When the table overflows, unknown unicast destinations force the switch to flood frames out all ports in the VLAN, letting an attacker capture traffic that would normally be unicast.

Question 4Network Attacks and Defense Strategies

VLAN hopping allows an attacker to accomplish what?

  1. Merge two VLANs into one permanent broadcast domain
  2. Expand the VLAN ID range available on the switch
  3. Disable spanning tree on the uplink trunk
  4. Reach hosts on another VLAN Correct answer.

Explanation

VLAN hopping abuses trunk negotiation or double-tagged frames so traffic crosses a VLAN boundary that should isolate it. The result is that the attacker can communicate with hosts in a segment they were never placed in.

Question 5Network Attacks and Defense Strategies

A DHCP starvation attack primarily achieves which outcome?

  1. The address pool is exhausted, denying leases to valid clients. Correct answer.
  2. The switch port is placed in an error-disabled state.
  3. DHCP messages between client and server are encrypted end to end.
  4. A rogue client is automatically granted a permanent static reservation.

Explanation

The attacker requests leases using many fabricated MAC addresses until the server's pool is depleted. Legitimate clients then fail to obtain an address, and the attacker can position a rogue DHCP server to hand out malicious settings.

Question 6Network Attacks and Defense Strategies

What is the main purpose of a DMZ in a network architecture?

  1. To store offline backups of the internal database servers
  2. To host Internet-facing services apart from the internal network Correct answer.
  3. To provide a second default gateway for redundancy
  4. To terminate all internal VLAN traffic at one point

Explanation

A DMZ is a screened segment where publicly reachable services are placed so that compromising them does not directly expose the internal LAN. Traffic between the DMZ and the internal network is restricted by policy.

Question 7Network Attacks and Defense Strategies

How does an intrusion prevention system (IPS) differ from an intrusion detection system (IDS)?

  1. An IPS sits inline and can drop malicious traffic Correct answer.
  2. An IPS stores logs while an IDS does not
  3. An IPS only analyzes encrypted traffic
  4. An IPS relies on signatures while an IDS does not

Explanation

An IDS receives a copy of traffic and raises alerts, but it is not in the forwarding path. An IPS is deployed inline, so it can block or reset the offending session in addition to alerting.

Question 8Network Attacks and Defense Strategies

A honeypot is deployed mainly to do what?

  1. Replace the firewall at the network edge
  2. Block all inbound traffic to the production subnet
  3. Lure attackers and record their activity Correct answer.
  4. Accelerate patching of internal servers

Explanation

A honeypot is a decoy system with no legitimate production role, so any interaction with it is suspicious by definition. Activity against it provides early warning and intelligence about attacker tools and techniques.

Question 9Network Attacks and Defense Strategies

An attacker injects forged records into a recursive resolver's cache so that a bank's hostname resolves to an attacker-controlled address. Which attack is this?

  1. ARP spoofing
  2. DNS zone transfer abuse
  3. DNS tunneling
  4. DNS cache poisoning Correct answer.

Explanation

Cache poisoning plants false records in a resolver so that subsequent queries from many users receive the attacker's answer. Users reach the wrong server even though they typed the correct name, enabling credential theft or malware delivery.

Question 10Network Attacks and Defense Strategies

Which attack uses overlapping IP fragments with manipulated offset values to crash or evade a target's reassembly process?

  1. Land
  2. Smurf
  3. Teardrop Correct answer.
  4. SYN flood

Explanation

Fragment reassembly relies on offset fields to rebuild the original datagram. Overlapping fragments with contradictory offsets can corrupt reassembly buffers on vulnerable stacks or slip data past filters that inspect fragments individually.

Question 11Network Attacks and Defense Strategies

In a smurf attack, what does the attacker do?

  1. Spoofs the victim's IP in broadcast ICMP requests Correct answer.
  2. Sends a single oversized ICMP packet directly to the victim host
  3. Floods the victim with malformed UDP datagrams
  4. Opens many half-open TCP sessions from a botnet

Explanation

The attacker sends ICMP echo requests to a network's broadcast address with the victim's address as the source. Every reachable host answers the victim, multiplying the traffic volume by the size of the amplifying network.

Question 12Network Attacks and Defense Strategies

To hijack an established TCP session without observing the traffic, an attacker must be able to do what?

  1. Guess the victim's login password
  2. Predict the next TCP sequence numbers Correct answer.
  3. Force the client to reboot
  4. Obtain the server's private key

Explanation

A receiver accepts a segment only if its sequence number falls within the expected window. A blind attacker must therefore infer the current sequence and acknowledgment values, for example by manipulating the peer or by exploiting weak initial sequence number generation.

Question 13Network Attacks and Defense Strategies

Which activity is a form of passive reconnaissance?

  1. Banner grabbing from exposed services
  2. Reviewing publicly available WHOIS and DNS records Correct answer.
  3. Running a SYN scan against the target
  4. Sending crafted packets to probe UDP ports

Explanation

Passive reconnaissance gathers information from third-party and public sources without sending packets to the target, which keeps the activity hidden from the target's monitoring. Querying registries and resolvers is a typical example.

Question 14Network Attacks and Defense Strategies

A firewall's rule set begins with "permit any to any" followed by "deny tcp any host 10.0.0.5 port 22". Why does the deny never take effect?

  1. SSH is encrypted, so the firewall cannot match the port
  2. Stateless firewalls ignore transport-layer port numbers
  3. Deny rules must be defined in a separate policy
  4. The permit rule matches first, so the deny is never evaluated Correct answer.

Explanation

Packet-filtering rules are evaluated in order and the first match decides the fate of the packet. A broad permit placed above a specific deny hides that deny, so specific exceptions must precede general permits.

Question 15Network Attacks and Defense Strategies

Which standard provides port-based network access control so a device is authenticated before it receives VLAN or network access?

  1. 802.3ad
  2. 802.1X Correct answer.
  3. 802.1Q
  4. 802.11i

Explanation

802.1X defines port-based access control using a supplicant, an authenticator such as a switch, and an authentication server such as RADIUS. Until authentication succeeds, the port stays in a restricted state, which is the basis of many NAC deployments.

Question 16Network Attacks and Defense Strategies

An attacker configures an access point that broadcasts the same SSID as the corporate wireless network in order to capture credentials. What is this attack called?

  1. Evil twin Correct answer.
  2. Bluejacking
  3. Deauthentication attack
  4. WPS brute force

Explanation

An evil twin imitates a legitimate SSID so clients associate with the attacker's access point instead. Once joined, victims may be prompted for credentials or have their traffic relayed and captured.

Question 17Network Attacks and Defense Strategies

What does defense in depth mean in network security?

  1. Deploying two identical firewalls from the same vendor
  2. Storing backups on a second disk array
  3. Encrypting every packet twice at the perimeter
  4. Layering controls so one failure does not expose everything Correct answer.

Explanation

Defense in depth combines preventive, detective, and corrective controls at multiple layers so that no single bypass leads to full compromise. The controls should be diverse, because identical products share identical weaknesses.

Question 18Network Attacks and Defense Strategies

A zero-day vulnerability is being exploited and no vendor patch exists yet. Which action is the most appropriate compensating control?

  1. Increase the password length for all administrator accounts
  2. Reboot the affected servers every hour
  3. Postpone any change until the vendor releases the final patch
  4. Disable the affected feature or apply the vendor's documented workaround Correct answer.

Explanation

When no patch is available, the goal is to remove or restrict the exposure while preserving service, such as disabling the vulnerable component or applying a vendor mitigation. This is a compensating control rather than a permanent fix.

Question 19Network Attacks and Defense Strategies

Why is network segmentation considered a defense against lateral movement?

  1. It removes the need for endpoint antivirus
  2. It limits how far an attacker can move after initial compromise Correct answer.
  3. It encrypts all traffic between hosts
  4. It assigns public IP addresses to every host

Explanation

Segmentation uses VLANs, ACLs, and internal firewalls to restrict which systems can talk to each other. An attacker who compromises one host can reach only the peers permitted by policy, which slows or blocks propagation.

Question 20Network Attacks and Defense Strategies

What is the main value of a SIEM platform in network defense?

  1. It provides DHCP addresses to endpoints
  2. It replaces the need for log retention
  3. It correlates events from many sources to detect patterns Correct answer.
  4. It blocks malicious packets at line rate

Explanation

A SIEM centralizes logs and alerts from firewalls, IDS, endpoints, and identity systems, then applies correlation rules to surface multi-source incidents. The correlation, not the raw collection, is what turns isolated events into actionable detections.

Question 21Network Attacks and Defense Strategies

An attacker announces a more-specific BGP prefix covering a bank's address space so that Internet traffic is diverted. Which mitigation most directly protects the bank's own routes?

  1. Longer TCP initial sequence numbers
  2. RPKI origin validation and prefix filters on peers Correct answer.
  3. Disabling ICMP redirects on routers
  4. DHCP snooping on access switches

Explanation

BGP has no inherent proof of prefix ownership, so peers can be tricked into accepting false announcements. Resource Public Key Infrastructure origin validation plus explicit prefix filters let neighbors reject announcements that do not match the authorized origin AS.

Question 22Network Attacks and Defense Strategies

Which indicator most strongly suggests DNS tunneling rather than ordinary DNS traffic?

  1. Queries evenly spread across hundreds of domains
  2. Many queries with long random-looking labels to one domain Correct answer.
  3. Periodic A queries for the same internal hostname
  4. NXDOMAIN responses from the internal resolver

Explanation

DNS tunneling encodes stolen data or command traffic inside query names, which produces unusually long, high-entropy labels directed at a single attacker-controlled domain. Normal resolution uses short, dictionary-like names spread across many domains.

Question 23Network Attacks and Defense Strategies

Which statement about IPsec AH and ESP is correct?

  1. AH encrypts the payload; ESP only authenticates it
  2. ESP provides confidentiality and integrity; AH provides integrity only Correct answer.
  3. Neither AH nor ESP offers integrity protection
  4. Both AH and ESP encrypt the entire IP packet, including the outer header

Explanation

ESP has a confidentiality component because it encrypts the payload, and it also authenticates the data it carries. AH authenticates the packet including much of the IP header but performs no encryption, so it is used where integrity without confidentiality is required.

Question 24Network Attacks and Defense Strategies

Why can a TCP FIN scan sometimes succeed against a stateless firewall that blocks inbound SYN packets?

  1. FIN packets carry no port information
  2. FIN scans only work on UDP services
  3. The firewall only filters connection-initiating SYN packets Correct answer.
  4. FIN packets are always encrypted

Explanation

A simple packet filter that denies inbound SYN assumes every connection begins with a handshake. A FIN-flagged probe starts no session, so the filter passes it, and the target's response or silence reveals whether the port is open.

Question 25Network Attacks and Defense Strategies

Which observation best indicates ICMP tunneling on a network?

  1. A high count of broadcast ARP requests
  2. A sudden drop in DNS query volume
  3. Repeated TCP resets from the gateway
  4. ICMP payloads with unusually large or structured data Correct answer.

Explanation

Normal ICMP echo traffic carries small, predictable payloads used for reachability testing. A covert channel hides data in the echo payload, producing oversized or consistently patterned content that is anomalous for the environment.

Question 26Administrative and Technical Network Security

In a security policy hierarchy, which document type provides step-by-step instructions for performing a specific operational task?

  1. Policy
  2. Guideline
  3. Standard
  4. Procedure Correct answer.

Explanation

Procedures are the most granular tier of the documentation hierarchy and describe exactly how a task is carried out, including sequence and responsible parties. They implement the intent of higher-level policies and standards.

Question 27Administrative and Technical Network Security

What is the primary purpose of a DMZ in a network design?

  1. To serve as a disaster recovery datacenter
  2. To encrypt all traffic between VLANs
  3. To separate public-facing services from internal hosts Correct answer.
  4. To host internal file shares for employees

Explanation

A DMZ (screened subnet) places systems that must be reachable from untrusted networks into a segment that is isolated from the internal LAN by filtering devices. If a public service is compromised, the attacker still lacks direct access to internal hosts.

Question 28Administrative and Technical Network Security

An administrator disables Telnet, FTP, and unused RPC services on a production server. Which goal does this primarily serve?

  1. Improving log fidelity
  2. Reducing the attack surface Correct answer.
  3. Simplifying DNS resolution
  4. Increasing available bandwidth

Explanation

Every listening service is a potential entry point; removing unneeded ones eliminates whole classes of exploits and misconfigurations. This is a core host-hardening step that shrinks the attack surface.

Question 29Administrative and Technical Network Security

Which improvement does WPA3-Personal provide over WPA2-Personal?

  1. It replaces AES with 3DES for encryption
  2. It removes the need for a pre-shared key entirely
  3. It uses SAE to resist offline dictionary attacks Correct answer.
  4. It relies on WEP for backward compatibility

Explanation

WPA3-Personal replaces the WPA2 four-way handshake's offline-crackable exchange with Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange. This makes captured handshakes far less useful for offline guessing.

Question 30Administrative and Technical Network Security

An access control vestibule (mantrap) at a data center entrance is deployed primarily to:

  1. Detect smoke and suppress fire in the server room
  2. Provide backup power to door controllers
  3. Prevent tailgating by admitting one person at a time Correct answer.
  4. Log network access attempts from vendors

Explanation

A mantrap uses two interlocking doors so that only one person can pass at a time, defeating piggybacking and tailgating. It is a physical access control compensating measure for high-sensitivity areas.

Question 31Administrative and Technical Network Security

The principle of least privilege requires that a user account:

  1. Be granted only the access needed for assigned duties Correct answer.
  2. Be shared among the team to reduce licensing costs
  3. Have domain administrator rights for troubleshooting
  4. Expire automatically after 24 hours in all cases

Explanation

Least privilege limits each account to the minimum rights required to perform its function, which constrains the damage from misuse or compromise. Additional rights should be granted temporarily and removed when the need ends.

Question 32Administrative and Technical Network Security

An inline security device that inspects traffic and drops malicious packets in real time is best described as:

  1. A passive network tap
  2. A syslog collector
  3. An intrusion prevention system Correct answer.
  4. A host-based antivirus scanner

Explanation

An intrusion prevention system sits in the traffic path and can block or reset malicious activity as it occurs. An IDS, by contrast, is typically passive and only alerts.

Question 33Administrative and Technical Network Security

Rotating staff through different administrative roles mainly helps by:

  1. Allowing one person to hold all root credentials
  2. Eliminating the requirement for background checks
  3. Deterring fraud through independent oversight Correct answer.
  4. Reducing the need for documented procedures

Explanation

Job rotation ensures more than one person understands a function and that someone else reviews the work, which discourages and exposes concealed abuse. It complements mandatory vacation and separation of duties as an administrative control.

Question 34Administrative and Technical Network Security

How does a stateful firewall differ from a stateless packet filter?

  1. It filters only UDP and not TCP
  2. It tracks connection state to permit return traffic Correct answer.
  3. It examines only source and destination IP addresses
  4. It must operate as an application-layer proxy

Explanation

A stateful firewall maintains a connection table so that return packets belonging to an approved session are allowed without a separate inbound rule. Stateless filters evaluate each packet in isolation against static rules.

Question 35Administrative and Technical Network Security

An asset is valued at $20,000 and is expected to be lost once every four years. What is the annualized loss expectancy (ALE)?

  1. $80,000
  2. $20,000
  3. $1,250
  4. $5,000 Correct answer.

Explanation

ALE is the single loss expectancy multiplied by the annualized rate of occurrence. Here the SLE is $20,000 and the ARO is 0.25, so the ALE is $5,000.

Question 36Administrative and Technical Network Security

In an 802.1X deployment, the switch port that enforces authentication is called the:

  1. Registrar
  2. Authenticator Correct answer.
  3. Authentication server
  4. Supplicant

Explanation

The authenticator is the network access device, such as a switch or wireless controller, that blocks or permits traffic based on the result of the authentication exchange. The supplicant is the client and the authentication server is typically RADIUS.

Question 37Administrative and Technical Network Security

Which sequence correctly orders incident response phases after preparation?

  1. Containment, identification, eradication, recovery
  2. Identification, recovery, containment, eradication
  3. Eradication, containment, identification, recovery
  4. Identification, containment, eradication, recovery Correct answer.

Explanation

After preparation, the incident must be detected and identified, then contained to limit spread, then eradicated so the root cause and artifacts are removed, and finally recovered to normal operations before lessons learned.

Question 38Administrative and Technical Network Security

A full backup runs on Sunday, then differential backups run Monday through Thursday. How many backup sets are needed to restore Thursday's state?

  1. Two: the full backup and Thursday's differential Correct answer.
  2. Four: Monday through Thursday differentials
  3. Five: the full backup and every daily backup
  4. One: Thursday's differential alone

Explanation

A differential backup captures all changes since the last full backup, so each successive differential is cumulative. Restoring Thursday therefore requires the Sunday full set plus Thursday's differential only.

Question 39Administrative and Technical Network Security

A scan reports a critical remotely exploitable flaw on an internet-facing web server. What is the most appropriate first action?

  1. Patch or apply a compensating control after testing Correct answer.
  2. Disable logging to reduce noise while patching
  3. Wait for the next quarterly patch cycle
  4. Rebuild the server from an unpatched golden image

Explanation

Remediation priority should follow risk: a critical, remotely exploitable flaw on an exposed host warrants expedited patching or a compensating control if the patch cannot be applied immediately. Testing and change control still apply so the fix does not cause an outage.

Question 40Administrative and Technical Network Security

Why is accurate time synchronization important for log management?

  1. It prevents users from deleting log files
  2. It enables reliable event correlation Correct answer.
  3. It encrypts log entries during transmission
  4. It reduces the disk space consumed by log files

Explanation

Investigations depend on reconstructing the order of events across many devices. Without a common time source such as NTP, timestamps drift and correlation, timeline analysis, and evidentiary value all degrade.

Question 41Administrative and Technical Network Security

A production honeypot provides value mainly by:

  1. Detecting attacks with few false positives Correct answer.
  2. Replacing the need for a firewall at the perimeter
  3. Accelerating traffic between VLANs
  4. Storing backups of critical servers

Explanation

Honeypots have no legitimate production purpose, so almost any interaction with them is suspicious. This makes them high-signal detectors and useful sources of attacker intelligence and early warning.

Question 42Administrative and Technical Network Security

A switch port configured to allow a maximum of one learned MAC address primarily protects against:

  1. MAC flooding of the CAM table Correct answer.
  2. DHCP starvation across the subnet
  3. VLAN hopping through double tagging
  4. ARP poisoning from a rogue gateway

Explanation

Port security limits how many source MAC addresses can be learned on a port and defines a violation action. This prevents an attacker from flooding frames with random source addresses to overflow the CAM table and force the switch to behave like a hub.

Question 43Administrative and Technical Network Security

A data loss prevention system monitoring email and web uploads is most effective when it is:

  1. Run once per quarter as a scheduled scan
  2. Placed at egress points on the network perimeter Correct answer.
  3. Installed only on the database server
  4. Configured to block all encrypted traffic

Explanation

DLP must observe data at the point where it would leave the organization, so egress and gateway inspection of email, web, and removable media channels is essential. Host-only or scan-only deployments miss most exfiltration paths.

Question 44Administrative and Technical Network Security

How does a vulnerability scan differ from a penetration test?

  1. A scan needs no authorization; a test requires a warrant
  2. A scan is always performed manually by a red team
  3. A scan exploits flaws to prove impact; a test only enumerates them
  4. A scan identifies potential weaknesses; a test attempts to exploit them Correct answer.

Explanation

Scanning is largely automated discovery that enumerates potential weaknesses and missing patches. A penetration test is a scoped, authorized engagement in which a human attempts to chain and exploit weaknesses to demonstrate real business impact.

Question 45Administrative and Technical Network Security

WPA2-Enterprise improves on WPA2-Personal primarily because it:

  1. Authenticates users individually via 802.1X Correct answer.
  2. Uses a longer pre-shared key by default
  3. Encrypts only management frames
  4. Removes the need for a RADIUS server

Explanation

WPA2-Enterprise delegates authentication to an 802.1X exchange with a RADIUS server, so each user or device has unique credentials and keys. This enables per-user revocation and accounting, unlike a shared passphrase.

Question 46Administrative and Technical Network Security

Dynamic ARP Inspection mitigates ARP spoofing by:

  1. Disabling ARP and relying on static routes
  2. Encrypting ARP replies with IPsec
  3. Rate-limiting all broadcast traffic on the VLAN
  4. Checking ARP packets against the DHCP snooping table Correct answer.

Explanation

DAI validates the sender MAC and IP binding in intercepted ARP packets against the trusted DHCP snooping binding database, dropping packets that do not match. Ports facing legitimate DHCP servers are configured as trusted so their bindings are accepted.

Question 47Administrative and Technical Network Security

An application has a recovery point objective of 15 minutes and a recovery time objective of 2 hours. Which statement is correct?

  1. Backups must be taken every 2 hours and recovery must finish within 15 minutes
  2. Backups must be retained 15 minutes and restored within 2 hours
  3. Data loss must not exceed 15 minutes; recovery must finish within 2 hours Correct answer.
  4. The application may be down 15 minutes out of every 2 hours of operation

Explanation

The RPO defines the maximum tolerable data loss, which drives backup or replication frequency, while the RTO defines the maximum tolerable downtime, which drives recovery capability. Here the RPO is 15 minutes and the RTO is 2 hours.

Question 48Administrative and Technical Network Security

RA Guard configured on access switch ports protects against which attack?

  1. IPv6 header manipulation in transit
  2. A rogue host sending spoofed ICMPv6 Router Advertisements Correct answer.
  3. Fragmentation-based denial of service against the router
  4. Neighbor cache exhaustion from a /64 scan

Explanation

An attacker can send ICMPv6 Router Advertisements to become the default gateway or to renumber the subnet, enabling man-in-the-middle attacks. RA Guard blocks RA messages arriving on ports where a router is not expected, while uplinks to real routers are trusted.

Question 49Administrative and Technical Network Security

A gateway-to-gateway VPN that wraps entire original IP packets inside a new IP header is operating in:

  1. Tunnel mode Correct answer.
  2. Transport mode with ESP
  3. Transport mode with AH only
  4. Transport mode using ESP with no encapsulation

Explanation

Tunnel mode encapsulates the complete original packet, including its IP header, inside a new outer IP header, which is what site-to-site gateways require. Transport mode protects the payload while retaining the original IP header end to end.

Question 50Administrative and Technical Network Security

Which measure best reduces the risk of a BGP prefix hijack affecting your address space?

  1. Disabling MD5 authentication on BGP sessions
  2. Publishing RPKI ROAs and applying prefix filters to peers Correct answer.
  3. Replacing specific prefixes with default routes
  4. Enabling BPDU Guard on all access ports

Explanation

Route Origin Authorizations cryptographically state which autonomous system may originate a prefix, and prefix filters enforce the same policy at the session level. Together they let neighbors reject unauthorized announcements of your space.