CNDA common mistakes
CNDA · Understand the traps and how to avoid them.
Treating the OSI and TCP/IP models as a memorization list, then failing scenario items that ask which layer a control or attack belongs to (for example, whether a VLAN ACL or a SYN flood is a Layer 3 or Layer 4 concern).
Candidates study layer names in isolation instead of mapping concrete devices, protocols, and attacks onto layers, so the mapping breaks when a question describes a real scenario rather than asking for a definition.
What to do instead
Build a one-page mapping table with four columns: layer, example protocol, example device or control, and example attack. Fill it from memory, then check it. Practice by taking ten defenses you know (port security, ACL, WAF, TLS, ARP inspection) and stating the layer each operates at and why.
Confusing the roles of stateful inspection, stateless ACLs, and application-layer proxies, and choosing a stateful firewall as the fix for an attack that actually requires application inspection.
All three are described as 'filtering traffic', so candidates pick whichever term sounds strongest instead of reasoning about what information each device can see.
What to do instead
For each device type, write what it can and cannot see: stateless ACL sees 5-tuple per packet; stateful firewall sees connection state; proxy or WAF sees application payload. Then for a given attack (SQL injection, fragmented packet evasion, session hijack) ask which of those data points is required to detect it.
Answering DMZ design questions by placing database servers or internal directory services directly in the DMZ, or by allowing DMZ-to-internal traffic broadly.
Candidates focus on protecting the internal network from the internet and forget that a compromised DMZ host becomes the pivot point, so they design a DMZ that is reachable from outside and freely reaches inside.
What to do instead
Apply the rule that the DMZ is a semi-trusted zone: inbound from internet only to published services, outbound from DMZ to internal only for specific required flows, and no direct internet-initiated path to internal assets. Redraw a three-zone diagram (internet, DMZ, internal) and mark every allowed flow with its justification.
Choosing host hardening controls without matching them to the threat, such as recommending application whitelisting to stop credential theft or recommending antivirus signature updates to stop a living-off-the-land attack using built-in tools.
Candidates memorize a list of endpoint controls and pick the most familiar one rather than reasoning about the attack technique and which control actually interrupts it.
What to do instead
Pair each common endpoint technique with the control that defeats it: credential dumping vs. credential guard and least privilege; script-based attacks vs. constrained language mode and logging; ransomware vs. offline backups plus execution control. State the technique first, then the control.
Treating patching as a single action and ignoring the difference between vulnerability remediation, configuration hardening, and compensating controls when a patch is not available.
Exam items often describe a legacy system that cannot be patched, and candidates default to 'apply the patch' instead of proposing segmentation, virtual patching, or restrictive ACLs.
What to do instead
For any unpatched asset, practice writing three layers: network restriction (who can reach it), host restriction (what it can run), and monitoring (what would indicate exploitation). Recognize that 'compensating control' questions expect one control from each layer.
Reading IDS and IPS alerts as equivalent and recommending an IPS signature as the detection method for an attack that only manifests in logs or in aggregate behavior over time.
Candidates conflate detection with prevention and assume signature engines catch everything, so they miss questions where the correct answer is log correlation, anomaly baselines, or netflow analysis.
What to do instead
Classify detection methods by what they consume: signatures consume packet payload, anomaly detection consumes baselines, log analysis consumes host and application events, flow analysis consumes metadata. For each scenario, ask what data source would actually contain the evidence, then pick the method that reads that source.
Failing to distinguish a true positive from a false positive when the question describes an alert that fired on legitimate administrative activity, and recommending containment when tuning is the correct response.
Candidates equate 'alert fired' with 'incident confirmed' and jump to response actions, which is exactly the trap in triage questions.
What to do instead
Use a fixed triage sequence: validate the alert against raw data, determine whether the activity is authorized, classify as true or false positive, then select the response. Practice by writing, for five sample alerts, the single piece of evidence that would settle the classification.
Describing incident response phases out of order or skipping containment, moving straight from identification to eradication and recovery.
Candidates remember the phase names but not the purpose of containment, so they treat it as optional or merge it with eradication.
What to do instead
Memorize the sequence with a one-line purpose each: preparation, identification, containment, eradication, recovery, lessons learned. Emphasize that containment protects unaffected systems first, and that short-term containment (isolate) can precede long-term containment (rebuild) before eradication.
Recommending full reimaging as the first response to every endpoint compromise, ignoring scope determination and evidence preservation.
Reimaging feels decisive and safe, so candidates choose it without considering that the scope of compromise must be established first and that wiping a host destroys forensic evidence.
What to do instead
Order response actions by dependency: preserve volatile evidence, determine scope and lateral movement, contain affected hosts, eradicate, then recover. Choose reimaging only after scope is understood and evidence is captured, or when the host cannot be trusted and evidence is not required.
Treating defense in depth as a list of products rather than independent, overlapping controls, and answering 'add another firewall' when the gap is a missing detective or recovery control.
Candidates associate defense in depth with stacking preventive devices, so they miss questions where the correct answer adds monitoring, segmentation, or backup and recovery rather than another blocking device.
What to do instead
Categorize controls as preventive, detective, and corrective, and for any scenario name one control of each type. If a scenario already has strong prevention, the missing layer is almost always detection or recovery. Practice by mapping an existing layered design and marking which of the three categories is absent.