I85PREP
⌘ K
CNDA study materials
CNDA study resources

CNDA practice questions

One question at a time. Build your CNDA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Defense Fundamentals

In network defense, what does the principle of least privilege primarily accomplish?

  1. It guarantees availability by reserving bandwidth for critical flows
  2. It limits each user and process to only the access needed for its task Correct answer.
  3. It duplicates every packet to a monitoring sensor for later review
  4. It encrypts all traffic between internal hosts and the perimeter

Explanation

Least privilege restricts accounts, services, and processes to the minimum rights required to perform their function, which shrinks the attack surface and limits blast radius after compromise. It is an authorization concept, not an encryption or availability control, though it supports defense in depth.

Question 2Network Defense Fundamentals

A security team wants to segment a data center so that compromised web servers cannot reach database servers directly. Which control best achieves this?

  1. A longer password policy applied to all administrator accounts
  2. A host-based antivirus agent on each database server
  3. Full packet capture stored for ninety days
  4. Internal firewalls enforcing deny-by-default between zones Correct answer.

Explanation

Zone-based segmentation with deny-by-default firewall rules blocks lateral movement between tiers, so a compromised web host cannot open sessions to the database tier. The other options improve endpoint hygiene, credential strength, or visibility but do not enforce network path restrictions.

Question 3Network Defense Fundamentals

Which statement correctly describes the role of a DMZ in a traditional perimeter architecture?

  1. It is the management VLAN used exclusively for switch administration
  2. It hosts only internal employee workstations behind a proxy
  3. It stores offline backups that are never connected to the network
  4. It is a buffer zone for internet-facing services separated from the internal network Correct answer.

Explanation

A DMZ is a screened subnet holding externally reachable services such as web and mail gateways, placed between the untrusted internet and the trusted internal network. If a DMZ host is compromised, the internal segmentation rules still restrict onward access.

Question 4Network Defense Fundamentals

An analyst observes a flood of SYN packets from many spoofed source addresses against a public web server, and half-open connections exhaust the backlog. Which defense most directly mitigates this?

  1. Increasing the DNS TTL for the web server's records
  2. Deploying full-disk encryption on the web server
  3. Enabling SYN cookies on the server and rate limiting at the edge Correct answer.
  4. Shortening the password rotation interval for web administrators

Explanation

SYN cookies let the server avoid allocating state for each half-open handshake until the client completes it, and edge rate limiting reduces the flood volume. Together they address the resource exhaustion caused by spoofed SYN traffic.

Question 5Network Defense Fundamentals

What is the primary purpose of a network-based intrusion detection system deployed on a SPAN port?

  1. To terminate VPN sessions for remote users
  2. To translate private addresses to public addresses
  3. To assign IP addresses to endpoints dynamically
  4. To monitor mirrored traffic and alert on suspicious patterns Correct answer.

Explanation

A NIDS on a SPAN port receives a copy of traffic and inspects it for signatures or anomalies, generating alerts without sitting inline. It is a detection control, so it observes rather than blocks by default.

Question 6Network Defense Fundamentals

A company must ensure that traffic leaving its network to the internet is inspected and that malicious outbound connections are blocked inline. Which deployment meets this requirement?

  1. A honeypot placed in the DMZ
  2. An inline intrusion prevention system at the egress point Correct answer.
  3. A passive IDS attached to a mirror port
  4. A syslog collector receiving firewall logs

Explanation

An IPS sits in the traffic path and can drop malicious sessions, which is required to block outbound command-and-control traffic. Passive sensors and log collectors only observe, and a honeypot is a decoy.

Question 7Network Defense Fundamentals

Which characteristic distinguishes a stateful firewall from a stateless packet filter?

  1. It tracks connection state to permit return traffic automatically Correct answer.
  2. It inspects application payloads for protocol violations
  3. It resolves domain names before applying rules
  4. It encrypts packets before forwarding them

Explanation

A stateful firewall maintains a connection table so that replies to an allowed outbound session are permitted without a separate inbound rule. Stateless filters evaluate each packet in isolation against static criteria.

Question 8Network Defense Fundamentals

A next-generation firewall is configured with a rule that allows only HTTP methods GET and POST to a specific web application. What type of control is this?

  1. Link-layer MAC filtering
  2. Quality of service shaping
  3. Application-layer filtering based on protocol semantics Correct answer.
  4. Network address translation

Explanation

Restricting allowed HTTP methods requires parsing the application protocol, which is application-layer filtering. It enforces what operations a client may perform rather than where packets are routed or how fast they move.

Question 9Network Defense Fundamentals

What does a VLAN primarily provide in a switched network?

  1. Centralized authentication of wireless clients
  2. Logical separation of broadcast domains Correct answer.
  3. Automatic failover of routing paths
  4. Encryption of frames between switches

Explanation

VLANs partition a physical switch fabric into separate logical broadcast domains, which supports segmentation and reduces unnecessary broadcast traffic. They do not by themselves encrypt, route around failures, or authenticate users.

Question 10Network Defense Fundamentals

An attacker on a compromised host sends forged ARP replies to map the default gateway's IP to the attacker's MAC address. Which defense most directly counters this?

  1. Deploying dynamic ARP inspection with trusted bindings Correct answer.
  2. Rotating SNMP community strings
  3. Disabling unused switch ports
  4. Enabling DHCP snooping only

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding table, typically built from DHCP snooping, and drops forged mappings. This directly prevents the attacker from poisoning the gateway entry on other hosts.

Question 11Network Defense Fundamentals

A host has been assigned a static IP address that duplicates another host on the same subnet. Which symptom is most consistent with this condition?

  1. Failure of DNS zone transfers between servers
  2. Complete loss of power to the network switch
  3. Intermittent connectivity and ARP conflicts reported in logs Correct answer.
  4. Rejection of all email by the spam filter

Explanation

Duplicate addresses cause ARP conflict warnings and intermittent reachability because replies may be delivered to the wrong host. Address conflict detection tools and DHCP reservation help prevent recurrence.

Question 12Network Defense Fundamentals

A rogue device is plugged into an access switch port and begins advertising itself as a default gateway using router advertisement messages. Which control best prevents this?

  1. IPv6 RA guard on access ports Correct answer.
  2. BPDU guard on edge ports
  3. Storm control for broadcast traffic
  4. Port security limiting MAC addresses per port

Explanation

RA guard blocks router advertisement messages arriving on ports where a router is not expected, preventing the rogue device from becoming a default gateway. MAC limits and BPDU guard address different layer-two threats.

Question 13Network Defense Fundamentals

What is the main security benefit of implementing 802.1X port-based network access control on switch ports?

  1. It automatically assigns public IP addresses to clients
  2. It requires devices to authenticate before gaining network access Correct answer.
  3. It encrypts all frames on the access link
  4. It increases the maximum frame size on the link

Explanation

802.1X authenticates supplicants through an authenticator and authentication server before the port is authorized, blocking unauthorized devices. Encryption on the link would require additional mechanisms such as MACsec.

Question 14Network Defense Fundamentals

Which practice most reduces the risk of credential theft through lateral movement after an initial workstation compromise?

  1. Tiering administrative accounts so domain admins never log on to workstations Correct answer.
  2. Allowing all users local administrator rights for convenience
  3. Using the same local administrator password on all workstations
  4. Storing service account passwords in a shared spreadsheet

Explanation

Administrative tiering keeps high-privilege credentials off lower-trust systems, so compromise of a workstation does not expose domain admin secrets. Unique local passwords and restricted rights further limit credential reuse.

Question 15Network Defense Fundamentals

A security analyst needs to determine whether a suspicious domain was contacted by internal hosts. Which data source is most directly suited to this question?

  1. Firewall rule change history
  2. Server disk utilization metrics
  3. DNS query logs from internal resolvers Correct answer.
  4. Switch interface error counters

Explanation

DNS resolver logs record the names internal hosts requested, which directly answers whether a domain was looked up. The other sources describe link health, configuration history, or capacity rather than name resolution activity.

Question 16Network Defense Fundamentals

An organization wants to detect DNS tunneling used for data exfiltration. Which indicator is most relevant?

  1. Repeated TCP retransmissions on the WAN link
  2. Large numbers of unique subdomains under one parent domain with high-entropy labels Correct answer.
  3. Frequent DHCP renewals from wireless clients
  4. High CPU usage on the mail relay

Explanation

DNS tunneling encodes data in query names, producing many unique, high-entropy subdomains under a single parent and unusually large query volumes. Monitoring resolver logs for these patterns reveals covert channels.

Question 17Network Defense Fundamentals

What is the purpose of a network access control list applied to a router interface?

  1. To balance load across multiple gateways
  2. To encrypt routing protocol updates
  3. To record every packet for forensic review
  4. To permit or deny traffic based on defined criteria Correct answer.

Explanation

An ACL is an ordered set of permit and deny statements matched against packet attributes such as source, destination, and port. It enforces a filtering policy rather than capturing, encrypting, or load balancing traffic.

Question 18Network Defense Fundamentals

A firewall administrator places a deny-all rule at the bottom of an ACL and specific permit rules above it. Why does rule order matter?

  1. Rules are evaluated in random order to prevent predictability
  2. Routers evaluate all rules and apply the most specific one regardless of position
  3. ACLs are evaluated top-down and the first match is applied Correct answer.
  4. Only the last rule in the list is ever enforced

Explanation

ACL processing is sequential: the first matching statement determines the action, and later rules are skipped. Placing broad denies above specific permits would therefore block traffic the policy intended to allow.

Question 19Network Defense Fundamentals

Which control best protects data in transit between two branch offices over an untrusted provider network?

  1. Port security on branch access switches
  2. VLAN trunking across the provider links
  3. A site-to-site IPsec VPN between the branch gateways Correct answer.
  4. A captive portal for guest wireless users

Explanation

IPsec provides encryption, integrity, and authentication for traffic crossing an untrusted medium, protecting confidentiality and detecting tampering. VLANs and port security are local segmentation controls and do not secure provider transit.

Question 20Network Defense Fundamentals

What is the primary function of a proxy server in a defense-in-depth architecture?

  1. It mediates client requests to external resources and can enforce policy Correct answer.
  2. It stores cryptographic keys for disk encryption
  3. It provides redundant power to core switches
  4. It assigns layer-two addresses to endpoints

Explanation

A proxy terminates client requests and forwards them on the client's behalf, allowing URL filtering, content inspection, and logging. It is a mediation point rather than an addressing, power, or key management service.

Question 21Network Defense Fundamentals

An organization separates its out-of-band management network from production traffic. What risk does this primarily reduce?

  1. Loss of DNS zone redundancy
  2. Exposure of device administration interfaces to compromised production hosts Correct answer.
  3. Failure of uninterruptible power supplies
  4. Mismatch of duplex settings on access ports

Explanation

An out-of-band management network isolates administrative interfaces from production hosts, so a compromised server cannot reach switch or router management planes. This limits lateral movement into infrastructure devices.

Question 22Network Defense Fundamentals

A sensor reports a signature match on traffic that is actually benign business activity. How should this event be classified?

  1. A false positive requiring tuning Correct answer.
  2. A false negative revealing a detection gap
  3. A true negative confirming normal operation
  4. A true positive requiring immediate containment

Explanation

A false positive occurs when a detection mechanism alerts on legitimate activity, so the correct response is to tune or suppress the rule while preserving coverage. True positives are real incidents, and false negatives are missed detections.

Question 23Network Defense Fundamentals

During triage, an analyst sees repeated failed logins from a single external address followed by a successful login to a VPN account. Which conclusion is best supported?

  1. The firewall ACL order is misconfigured
  2. The VPN concentrator has a hardware fault
  3. The account may be compromised through password guessing and should be investigated Correct answer.
  4. The user's device has a duplicate IP address

Explanation

A burst of failures followed by success matches a brute-force or credential-stuffing pattern that ended in access, so the account should be treated as potentially compromised. The analyst should review session activity and reset credentials.

Question 24Network Defense Fundamentals

What does a TCP three-way handshake accomplish that a single SYN packet does not?

  1. It encrypts the payload of the session
  2. It confirms bidirectional reachability and synchronizes sequence numbers Correct answer.
  3. It assigns a routable address to the client
  4. It authenticates the user's credentials

Explanation

The SYN, SYN-ACK, ACK exchange verifies that both endpoints can send and receive and establishes initial sequence numbers for reliable delivery. Encryption, addressing, and user authentication are handled by other mechanisms.

Question 25Network Defense Fundamentals

An attacker sends packets with the source address of a trusted internal host to bypass address-based filtering. Which defense most effectively addresses this spoofing technique?

  1. Enabling verbose logging on the web server
  2. Increasing the size of the connection tracking table
  3. Shortening the DHCP lease duration
  4. Ingress and egress filtering that drops packets with invalid source addresses Correct answer.

Explanation

Anti-spoofing filters at network boundaries drop packets whose source addresses could not legitimately originate from that direction, defeating address-based trust bypass. This is the basis of BCP 38 style filtering.

Question 26Network Defense Fundamentals

Which security function does a demilitarized zone (DMZ) provide when it is placed between the internet and an internal corporate network?

  1. It guarantees that internal hosts cannot reach the internet through any protocol
  2. It replaces the need for a firewall because the DMZ performs all filtering
  3. It isolates internet-facing services so that a compromise of those hosts does not directly expose the internal network Correct answer.
  4. It encrypts all traffic between the internet and internal hosts using a site-to-site tunnel

Explanation

A DMZ is a segmented network that hosts public-facing services such as web and mail servers while enforcing a firewall boundary between the untrusted internet and the trusted internal LAN. If a DMZ host is compromised, the attacker still has to cross an additional control point to reach internal systems, which supports defense in depth.

Question 27Network Defense Fundamentals

An analyst is reviewing a packet capture and needs to identify the transport protocol used by a session that provides reliable, ordered delivery with acknowledgments. Which protocol matches?

  1. TCP Correct answer.
  2. ICMP
  3. UDP
  4. ARP

Explanation

TCP establishes a connection with a three-way handshake and uses sequence numbers, acknowledgments, and retransmission to deliver a reliable, ordered byte stream. UDP is connectionless and does not guarantee delivery, while ICMP and ARP are used for diagnostics and address resolution rather than reliable transport.

Question 28Network Defense Fundamentals

Which statement describes how NAT affects inbound connections to an internal web server?

  1. NAT automatically forwards all inbound ports to the first internal host that sends outbound traffic
  2. Inbound connections require an explicit port-forward or destination NAT rule mapping a public address and port to the internal server Correct answer.
  3. Inbound connections are handled by ARP and do not involve NAT translation
  4. NAT prevents any inbound connection from ever reaching an internal server

Explanation

NAT rewrites addresses and ports, and by default it only creates mappings for outbound-initiated flows. To let external clients reach an internal server, an administrator must configure a static mapping such as destination NAT or a port forward that ties a public IP and port to the internal address.

Question 29Network Defense Fundamentals

Which element of network defense is primarily concerned with collecting and correlating logs from firewalls, routers, and servers to detect suspicious patterns?

  1. Patch management
  2. Network baselining
  3. Vulnerability scanning
  4. Security information and event management Correct answer.

Explanation

SIEM platforms aggregate and normalize logs from many sources, apply correlation rules, and alert analysts to patterns that individual devices would not reveal. Vulnerability scanning, patching, and baselining are important controls but do not provide centralized log correlation and alerting.

Question 30Network Defense Fundamentals

A network team wants to detect a host that is scanning many destinations on the same subnet for open TCP ports. Which detection approach is most direct?

  1. Reviewing DHCP lease durations for unusually short assignments
  2. Checking the ARP cache size on the core switch
  3. Auditing DNS zone transfer settings on the internal resolver
  4. Monitoring for a single host generating many connection attempts to distinct destination ports or addresses in a short interval Correct answer.

Explanation

Port scanning produces a distinctive pattern of many connection attempts spread across destination ports or hosts within a brief window, which threshold and flow-based detection can surface. DHCP leases, ARP cache size, and zone transfer settings do not reflect the breadth of outbound connection attempts that characterize scanning.

Question 31Network Defense Fundamentals

An organization deploys an intrusion prevention system inline at the internet edge. What is the key operational difference from an intrusion detection system deployed on a SPAN port?

  1. The IPS only records alerts and cannot influence traffic flow
  2. The IPS decrypts all TLS sessions without any configuration
  3. The IPS can block malicious traffic in real time because packets must pass through it Correct answer.
  4. The IPS eliminates the need for firewall rules at the perimeter

Explanation

An inline IPS sits in the traffic path, so it can drop or reset sessions that match a malicious signature before they reach the protected network. A passive IDS on a SPAN port only observes copies of traffic and raises alerts, leaving blocking to other devices.

Question 32Network Defense Fundamentals

A security engineer wants to prevent users on the guest wireless network from reaching internal server subnets while still allowing internet access. Which control placement is most appropriate?

  1. A DNS forwarder change on the internal resolver
  2. An ACL applied to the router or firewall interface that serves the guest VLAN, permitting internet-bound traffic and denying internal subnets Correct answer.
  3. A longer DHCP lease time for guest clients
  4. A host-based firewall rule pushed only to the internal servers

Explanation

Enforcement belongs at the boundary where guest traffic is routed, so an ACL or firewall policy on that interface can permit egress to the internet while denying destinations in internal server ranges. Controls on internal servers or DNS settings do not stop guest traffic from reaching those subnets in the first place.

Question 33Network Defense Fundamentals

Which practice best limits the blast radius of a compromised server within a flat data center network?

  1. Increasing the size of the broadcast domain so all servers share one subnet
  2. Disabling logging on servers to reduce noise
  3. Segmenting server tiers into separate VLANs or subnets with firewall policy between them Correct answer.
  4. Relying on MAC address filtering alone for access control

Explanation

Microsegmentation and tiered zoning place enforcement points between server groups so an attacker who compromises one host cannot freely reach others. Larger flat subnets expand reachable targets, while reduced logging and MAC filtering do not contain lateral movement.

Question 34Network Defense Fundamentals

An analyst observes a workstation sending periodic DNS queries for long, high-entropy subdomains of a single domain. What is the most likely explanation?

  1. Normal web browsing to a content delivery network
  2. A time synchronization request to an NTP server
  3. A DHCP server renewing an address lease
  4. DNS tunneling used to exfiltrate data through the resolver Correct answer.

Explanation

Encoded payloads carried in DNS query names produce long labels with high entropy directed at one domain, which is characteristic of DNS tunneling and exfiltration. Legitimate CDN lookups, DHCP renewals, and NTP traffic do not generate that pattern of encoded subdomain queries.

Question 35Network Defense Fundamentals

A firewall rule set contains a permit rule for a management subnet followed later by a deny rule for the same subnet. How will most stateful firewalls evaluate this traffic?

  1. They reject the configuration because overlapping rules are invalid
  2. They apply the last matching rule in the list
  3. They apply the most specific rule regardless of order
  4. They apply the first matching rule, so the permit takes effect and the later deny is never reached Correct answer.

Explanation

Firewalls evaluate rules in order and act on the first match, so a permit placed above a deny for the same traffic wins and the deny is shadowed. Administrators order rules from most specific to most general and place a default deny at the end to avoid unintended permits.

Question 36Network Defense Fundamentals

Which measure most directly reduces the risk of an attacker capturing credentials from unencrypted management protocols such as Telnet on a network segment?

  1. Shortening the DHCP lease time for management hosts
  2. Replacing Telnet with SSH and restricting management access to a dedicated administrative VLAN Correct answer.
  3. Adding more switch ports to the management segment
  4. Enabling broadcast storm control on access switches

Explanation

Telnet sends credentials in cleartext, so any host able to observe the segment can capture them; SSH encrypts the session and an administrative VLAN limits who can reach the device. Adding ports, storm control, and lease tuning do not protect credentials in transit.

Question 37Network Defense Fundamentals

A web server in a DMZ is compromised and the attacker begins connecting to internal database hosts on port 3306. Which layered control would most likely have stopped this lateral movement?

  1. A backup schedule that runs nightly for the database
  2. A longer password for the database administrator account
  3. A firewall policy between the DMZ and internal zones that permits only required application flows Correct answer.
  4. A signature that alerts on the initial web exploit

Explanation

Zone-to-zone firewall policy enforces which flows may cross from the DMZ to internal networks, so a rule permitting only the application's required ports and destinations would block arbitrary database connections. Alerting on the exploit and strong passwords do not restrict the network path once the host is compromised.

Question 38Network Defense Fundamentals

An analyst must choose a control that detects unauthorized changes to critical router configurations. Which combination is most effective?

  1. Centralized configuration logging with integrity checks and alerts on unexpected changes Correct answer.
  2. Enabling CDP on all external-facing interfaces
  3. Increasing the SNMP community string length on each router
  4. Permitting ICMP redirects to improve routing efficiency

Explanation

Capturing configuration changes to a central log and comparing them against a known-good baseline with integrity checks reveals unauthorized modifications and supports rapid response. Longer community strings, CDP exposure, and ICMP redirects do not provide change detection and can introduce additional risk.

Question 39Network Defense Fundamentals

During an incident, an analyst needs to determine whether a suspicious external IP address communicated with internal hosts over the past week. Which data source is most appropriate as a starting point?

  1. The ARP table on a single access switch
  2. The DHCP scope options configured on the server
  3. NetFlow or IPFIX records exported from perimeter routers and firewalls Correct answer.
  4. The local host firewall log on one workstation

Explanation

Flow records capture source and destination addresses, ports, and volumes for connections crossing the monitored devices, making them well suited to historical searches for contact with a specific external address. A single ARP table, one host's firewall log, and DHCP options each cover only a narrow slice of activity.

Question 40Network Defense Fundamentals

Which control most directly mitigates the risk of a rogue DHCP server handing out malicious gateway and DNS settings to clients?

  1. Increasing the size of the DHCP address pool
  2. Port mirroring of all client traffic to an analysis host
  3. DHCP snooping configured on access switches with trusted uplink ports Correct answer.
  4. Static ARP entries on every client

Explanation

DHCP snooping classifies ports as trusted or untrusted and drops server-originated DHCP offers arriving on untrusted access ports, which prevents rogue servers from assigning attacker-controlled gateways or resolvers. Port mirroring, static ARP, and pool sizing do not stop unauthorized DHCP responses.

Question 41Perimeter and Boundary Defense

In a defense-in-depth architecture, what is the primary role of the perimeter layer relative to the internal network?

  1. It provides the first line of filtering and monitoring for traffic crossing the trust boundary Correct answer.
  2. It stores audit logs for all internal endpoints
  3. It replaces the need for host-based controls inside the network
  4. It guarantees that no malicious traffic can ever enter

Explanation

The perimeter sits at the trust boundary and provides the outermost filtering and inspection point in a layered design. It complements rather than replaces internal host and application controls, and no single layer is assumed to be impenetrable.

Question 42Perimeter and Boundary Defense

A firewall rule set processes packets in order and stops at the first match. A packet matches a permit rule placed above a deny rule. What is the result?

  1. The packet is permitted because the first matching rule wins Correct answer.
  2. The packet is held for administrator approval
  3. The packet is denied because deny rules take precedence
  4. The packet is dropped and logged as a default deny

Explanation

In first-match firewall semantics, evaluation stops at the first rule that matches the packet. Because the permit rule appears before the deny rule, the packet is allowed. Rule order is therefore a critical design and review concern.

Question 43Perimeter and Boundary Defense

Which firewall deployment model places the device inline so that all traffic between two segments must pass through it?

  1. Transparent (bridged) inline mode Correct answer.
  2. Promiscuous tap mode
  3. SPAN port monitoring mode
  4. Out-of-band log collector mode

Explanation

An inline (bridged or transparent) firewall forwards traffic between segments and can block it in real time. Monitoring-only modes observe copies of traffic and cannot enforce blocking on the live path.

Question 44Perimeter and Boundary Defense

What does a DMZ segment typically contain in a perimeter design?

  1. The core routing fabric connecting internal VLANs
  2. Internet-facing services that are separated from the internal trusted network Correct answer.
  3. Backup tapes stored offline for disaster recovery
  4. Domain controllers that authenticate all internal users

Explanation

A DMZ hosts externally reachable services in a segment isolated from the internal network, so a compromise of a public service does not directly expose internal systems. Internal identity and core routing assets are normally kept out of the DMZ.

Question 45Perimeter and Boundary Defense

Which control best mitigates spoofed source addresses reaching an internet-facing perimeter?

  1. Enabling promiscuous mode on border switches
  2. Increasing the size of the connection tracking table
  3. Disabling all ICMP responses at the border
  4. Ingress and egress filtering that drops packets with invalid source addresses Correct answer.

Explanation

Source-address validation at the border, often implemented as ingress and egress filtering, drops packets claiming addresses that could not legitimately originate from that direction. This blunts spoofing-based reflection and amplification attacks.

Question 46Perimeter and Boundary Defense

A border device must allow return traffic for outbound connections while blocking unsolicited inbound sessions. Which mechanism accomplishes this?

  1. Static permit rules for every internal host
  2. A default permit rule at the bottom of the policy
  3. Port address translation alone
  4. Stateful inspection that tracks connection state Correct answer.

Explanation

Stateful inspection records the state of outbound flows and permits only returning packets that belong to an established session. Unsolicited inbound packets that match no state are blocked by the default policy.

Question 47Perimeter and Boundary Defense

What is the primary security purpose of network segmentation at the perimeter boundary?

  1. Increasing available bandwidth between zones
  2. Reducing the number of physical cables required
  3. Limiting lateral movement by restricting which zones can communicate Correct answer.
  4. Simplifying DNS record management

Explanation

Segmentation divides the network into zones with controlled inter-zone paths, which constrains how far an intruder can move after initial access. Bandwidth, cabling, and DNS are operational concerns rather than the security rationale.

Question 48Perimeter and Boundary Defense

An organization wants to inspect encrypted inbound web traffic at the perimeter. What is required to perform content inspection?

  1. Disabling TLS on all backend servers
  2. Relying solely on IP header inspection
  3. TLS termination or interception at a controlled inspection point Correct answer.
  4. Blocking all HTTPS traffic at the border

Explanation

Content inside TLS is opaque unless the perimeter terminates or intercepts the session at a controlled point with appropriate certificates and policy. Header-only inspection cannot see application payload.

Question 49Perimeter and Boundary Defense

Which statement correctly describes the default-deny principle at a boundary firewall?

  1. Traffic is dropped only when it matches a signature
  2. Traffic is allowed if it originates from a known subnet
  3. Only explicitly permitted traffic is allowed; everything else is dropped Correct answer.
  4. All traffic is allowed unless a specific deny rule exists

Explanation

Default deny establishes that the baseline action is to drop traffic, and access is granted only through explicit permits. This avoids exposing services through omission and keeps the policy auditable.

Question 50Perimeter and Boundary Defense

Which boundary control is designed to detect and block known malicious patterns in network traffic in real time?

  1. Configuration management database
  2. NetFlow collector
  3. Syslog aggregation server
  4. Intrusion prevention system deployed inline Correct answer.

Explanation

An inline intrusion prevention system inspects traffic against signatures or behavioral rules and can drop matching packets before delivery. Log collectors and flow tools provide visibility but do not block traffic.