CND Network Defense Architecture Quiz

1. A Virtual Private Network (VPN) provides secure communication by:

Increasing bandwidth capacity

Encrypting traffic and hiding the user's IP address

Eliminating the need for firewalls

Blocking all external connections

2. What is the Zero Trust security model based on?

Trust all internal traffic

Never trust, always verify every access request

Trusting only encrypted connections

Blocking external users completely

3. Which standard framework provides guidelines for network security architecture?

NIST Cybersecurity Framework

ISO 27001

Both NIST and ISO 27001

None of the above

4. What is the primary purpose of network monitoring tools?

Increase network latency

Detect anomalies and unauthorized activity

Replace firewalls

Accelerate all traffic

5. Which logging mechanism is essential for forensic analysis in network defense?

Disabling all system logs

Centralized log collection and retention

Storing logs on local devices only

Rotating logs hourly

6. What does VLAN tagging accomplish in network design?

Increases data transfer speed

Logically separates network traffic while using shared infrastructure

Encrypts all VLAN traffic

Replaces physical network segmentation

7. A Web Application Firewall (WAF) protects against attacks targeting:

Network layer threats only

Application layer vulnerabilities

Physical security breaches

Wireless networks only

8. Which network defense mechanism prevents IP spoofing attacks?

Enabling access control lists (ACLs)

Using reverse DNS lookups

Implementing ingress filtering

Disabling ICMP packets

9. What is port security used for in network defense?

Blocking all network ports

Preventing unauthorized devices from connecting to switch ports

Encrypting port communications

Monitoring port traffic only

10. Which protocol is commonly used to manage network devices securely?

HTTP

SSH

FTP

SMTP

11. Which network defense principle involves layering multiple security controls to protect assets?

Defense-in-depth

Single-point protection

Perimeter security only

Zero-trust isolation

12. What is the primary goal of network access control (NAC)?

Increase network speed

Ensure only compliant devices connect to the network

Replace VPN technology

Monitor user behavior only

13. Which authentication method uses two independent verification factors?

Single Sign-On

Multi-factor authentication

Password-only authentication

Biometric scanning only

14. What does a proxy server do in network defense?

Accelerates all internet connections

Acts as intermediary to filter and monitor client requests

Replaces the need for firewalls

Encrypts data at rest only

15. Which of the following is a stateful firewall feature?

Blocks all outbound traffic

Maintains connection state information to allow established connections

Encrypts all passing packets

Scans files for malware

16. A DMZ (Demilitarized Zone) is a network segment used for what purpose?

Storing backup data

Hosting public-facing services while protecting internal networks

Isolating guest Wi-Fi traffic

Testing new software updates

17. What is the difference between an IDS and an IPS?

IDS detects threats; IPS detects and blocks threats

IDS is faster than IPS

IPS only works on wireless networks

IDS encrypts traffic; IPS does not

18. Which device analyzes network traffic to detect suspicious patterns or known attack signatures?

Router

Load balancer

Intrusion Detection System (IDS)

DHCP server

19. Network segmentation divides a network into smaller zones. What is a key benefit?

Increases bandwidth usage

Limits lateral movement of threats

Eliminates the need for firewalls

Reduces latency for all users

20. What is the primary function of a firewall in network defense?

Encrypt all data packets

Control and monitor incoming/outgoing network traffic

Detect malware in files

Patch system vulnerabilities