EC-Council · Free Practice Questions · Last reviewed May 2026
48 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?
Azure Backup Vault with geo-redundant storage (GRS)
Azure ExpressRoute Global Reach
Azure Site Recovery (ASR)
Azure Site Recovery continuously replicates VM disks asynchronously to a secondary region, storing replicas in a low-cost state without running secondary compute. This directly satisfies the stem's constraint of cross-region disaster recovery without permanently provisioned standby VMs, enabling failover only when required.
Azure Traffic Manager with priority routing
A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?
Running regular traceroute commands from endpoints
Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation
A WIPS with triangulation continuously monitors the RF spectrum, flags unauthorised BSSIDs spoofing the corporate SSID, and uses signal-strength readings from multiple sensors to calculate the rogue AP's physical location. This directly satisfies the stem's requirement to both detect the rogue device and locate its physical source.
Enabling port security on enterprise access layer switches
Configuring static ARP entries on enterprise switches
A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?
Azure Firewall with Application Rules
Azure Firewall with Application Rules filters outbound traffic using FQDNs, satisfying the requirement for domain-based filtering rather than IP addresses. Application Rules operate at layer 7, inspecting HTTP/HTTPS and TLS SNI, which Network Rules (layer 3–4, IP-based) cannot do. This makes it the only listed resource that enforces FQDN egress control from the subnet.
Azure Application Gateway with Web Application Firewall
Network Security Group (NSG) with custom service tags
User Defined Routes (UDR) pointing to a load balancer
An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?
Identity-Aware Proxy (IAP)
Kubernetes Network Policies
Kubernetes Network Policies select pods by label and define ingress and egress rules between them, so traffic filtering works on identity rather than IP addresses. GKE enforces these policies through its network plugin, satisfying the label-based pod restriction requirement.
Google Cloud Armor security policies
VPC Firewall Rules using subnet tags
A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?
Event Source: s3.amazonaws.com, Event Name: PutBucketPolicy
Event Source: organizations.amazonaws.com, Event Name: AcceptHandshake
Event Source: iam.amazonaws.com, Event Name: CreateUser
Event Source: sts.amazonaws.com, Event Name: AssumeRole
Temporary credential acquisition via AWS Security Token Service is recorded as AssumeRole with event source sts.amazonaws.com. Searching CloudTrail for this pair reveals exactly which IAM users or roles obtained administrative sessions across accounts, satisfying the cross-account privilege audit requirement.
An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?
AWS Shield Advanced
AWS Organizations with all features enabled
AWS Organizations with all features enabled creates the organizational management structure Security Hub requires for centralised findings aggregation. All-features mode, rather than consolidated billing only, permits service-managed policies and delegated administrator designation, enabling automatic ingestion across every member account. Without this prerequisite, cross-account centralisation cannot be configured.
AWS CloudTrail
AWS Transit Gateway
Want more Enterprise Cloud Virtual And Wireless Network Protection practice?
Practice this domainAn enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?
Upgrade the IDS hardware to process higher bandwidth capacity
Convert the IDS into an inline IPS
Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses
Suppressing alerts by source IP removes the scanner's noise while leaving every detection signature active for genuine threats, directly cutting false positive fatigue. This satisfies the stem's constraint of reducing alert volume without disabling signatures, since the exclusion targets a known benign origin rather than the detection logic itself.
Move the IDS from a switch SPAN port to an inline routing position
An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?
Clientless SSL VPN
Full-tunnel VPN
Full-tunnel VPN captures every packet from the client, including internet-bound traffic, and forwards it through the VPN gateway to the corporate data centre, where the security stack inspects it. This directly satisfies the policy's requirement that all remote-worker internet traffic traverse the corporate security controls rather than egressing locally.
Split-tunnel VPN
Transport mode IPsec VPN
A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?
On the internal network boundary between the Finance and Guest VLANs
Placing the device on the internal boundary between the Finance and Guest VLANs forces all inter-zone traffic through it, where ACLs can deny or permit flows. This satisfies the isolation requirement without relying on perimeter firewalls that never see internal east-west traffic.
At the perimeter boundary directly connected to the ISP modem
On the local loopback interface of each end-user workstation
Inside the ISP core routing infrastructure
A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?
Three-legged firewall architecture creating separate internal, external, and DMZ zones
A three-legged firewall uses three distinct physical or logical interfaces to isolate the internal network, external network, and DMZ into separate security zones.
Placing all web and database servers on the same internal VLAN protected by host firewalls
Single-firewall dual-homed architecture with a software loopback filter
Direct flat bridging between the external router and the internal core switch
A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?
TLS 1.3 separates key exchange parameters from cipher suites, simplifying options to AEAD algorithms
TLS 1.3 removes the cipher-suite negotiation of key exchange, authentication and bulk encryption combined. Key exchange is negotiated separately via supported groups, leaving only AEAD algorithms such as AES-GCM, which is why legacy ECDHE_RSA suites disappear from the menu.
TLS 1.3 eliminates symmetric encryption in favor of asynchronous cryptographic operations for all data payloads
TLS 1.3 requires all connections to use legacy RSA key transport mechanisms
TLS 1.3 mandates the use of pre-shared keys (PSKs) exclusively for all sessions
A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?
Network Intrusion Prevention System (NIPS)
Packet filtering router
Traditional Stateful Packet Inspection Firewall
Web Application Firewall (WAF)
A Web Application Firewall parses HTTP and HTTPS requests at Layer 7, matching payloads against SQL injection signatures and blocking them before they reach the web server. Unlike a network firewall, which filters only by IP address and port, a WAF satisfies the stem's requirement for application-layer inspection and signature-based dropping.
Want more Network Security Controls Protocols And Devices practice?
Practice this domainAn enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?
Identifying and cataloging all network assets, data flows, and current vulnerabilities
Assessment and Analysis establishes the baseline the rest of the lifecycle depends on. Cataloguing network assets, mapping data flows and recording current vulnerabilities gives defenders the visibility needed to prioritise later protection, detection and response activities.
Conducting incident containment following a zero-day breach
Deploying next-generation firewalls across core network segments
Decommissioning obsolete routers and end-of-life switches
A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?
Every 30 days continuously across all internal subnets
Annually following the completion of the fiscal budget review
At least every 6 months and after any significant infrastructure modification
PCI-DSS v4.0 Requirement 11.3 mandates external penetration testing at least every six months, plus after any significant infrastructure or application change. This recurring cadence and change-triggered retest satisfy the CDE's continuous assurance obligation, rather than the annual testing some frameworks accept.
Only upon the initial deployment of the cardholder data environment
A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?
Physical Security Controls
User Responsibilities and Data Sharing
The User Responsibilities and Data Sharing section governs how employees handle and disclose data, so revising it lets the policy explicitly regulate sharing on external cloud collaboration platforms. Other sections cover asset use or enforcement, not the specific data-sharing behaviour the manager must address.
Disaster Recovery Protocols
Network Infrastructure Redundancy
An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?
PL (Planning)
SR (Supply Chain Risk Management)
The SR family directly covers supply chain risk management controls, including policies, plans, and processes governing suppliers and third parties. It is the NIST SP 800-53 Rev. 5 family that operationalises the Govern function's cybersecurity supply chain risk management outcomes.
CA (Assessment, Authorization, and Monitoring)
SC (System and Communications Protection)
During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?
BGP Routing Table Summaries
Active Directory Account Access Logs and Group Memberships
Account access logs record individual logon events tied to distinct usernames, revealing whether one account is used concurrently from separate locations or sessions. Group memberships show privilege assignment, not usage, so logs are the artifact proving whether credentials are shared.
Network Switch Port VLAN Assignments
DNS Zone File Configurations
A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?
Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs
Default-deny with explicit allow rules for only required destination ports and IPs enforces least privilege between DMZ and application tier, minimising exposed attack surface. This satisfies the stem's requirement to structure firewall rules per least privilege in the network defence lifecycle.
Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic
Disable firewall packet filtering on internal interfaces to maximize application throughput
Permit all internal traffic by default, blocking only known malicious signatures
Want more Network Defense Management practice?
Practice this domainA network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?
stats sum(bytes) by dest_ip
The stats command aggregates events and, with sum(bytes) by dest_ip, totals outbound byte counts per destination address, producing the per-IP volumes the alert needs. This satisfies the stem's requirement to group abnormal outbound traffic by destination IP.
rex field=bytes max_match=1
table dest_ip, bytes
eval bytes_sum = sum(bytes)
An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?
Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged
Pre-staging LiME and enabling kernel crash dumps guarantees volatile RAM can be captured before reboot destroys it, satisfying the live kernel attack constraint. LiME loads as a kernel module, dumping memory directly to disk or network, while crash dumps preserve state on panic — both essential for forensic readiness.
Configuring automatic disk encryption using BitLocker with a TPM chip
Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring
Enabling centralized syslog forwarding over encrypted TLS channels
An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?
Heuristic detection
Behavioral analytics detection
Signature-based detection
Snort compares packet payloads against a database of known attack patterns. The alert fired because the traffic matched a stored signature for the 'SELECT * FROM users WHERE' SQL injection string, so detection relies on predefined signatures rather than anomaly or behaviour baselines.
Anomaly-based detection
A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?
Microsoft-Windows-PowerShell/Operational, Event ID 4104
Microsoft-Windows-PowerShell/Operational with Event ID 4104 records script block text when logging captures executed code, including de-obfuscated content, satisfying the requirement to inspect full LotLBin script blocks. Event ID 4103 only logs pipeline execution details, not the complete block text, so 4104 is the precise channel and ID.
Security log, Event ID 4688
System log, Event ID 7045
Microsoft-Windows-PowerShell/Operational, Event ID 4103
During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?
Host-level containment
Network-level containment
Isolating an infected subnet severs network connectivity between that segment and the rest of the corporate network, which is precisely network-level containment. It blocks worm propagation across subnets without halting endpoint processes, distinguishing it from host-level or application-level containment.
Full enterprise quarantine
Application-level containment
During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?
extend
project
summarize
where
The where operator filters a table by a boolean predicate, returning only rows matching the condition. Applied to DeviceProcessEvents with FileName == "cmd.exe", it satisfies the stem's requirement to include only process creation events whose file name matches cmd.exe.
Want more Incident Detection Response And Threat Prediction practice?
Practice this domainDuring an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?
Upgrade the web server operating system and apply all vendor-supplied kernel patches.
Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.
Install a host-based intrusion detection system (HIDS) to monitor web application log directories.
Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.
IMDSv2 mitigates SSRF by requiring a PUT request to obtain a session token before any metadata query, which attacker-controlled URL parameters cannot supply. Combined with strict URL parsing libraries that reject malformed or redirecting inputs, this directly satisfies the stem's constraint: preventing SSRF exploitation against the instance metadata service.
A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?
Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).
Rogue AP Detection with Automated Containment lets the WLC classify access points by comparing their wired MAC addresses against the known authorised list, then issue 802.11 deauthentication frames to clients associated with the offending BSSID. This directly satisfies the stem's requirement to automatically detect and contain the evil twin without manual intervention.
Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).
Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.
Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.
A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?
Filter for 'http.request.method == POST' and look for binary attachments.
Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.
Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.
DNS tunnelling encodes stolen data or C2 instructions inside DNS query names, so filtering 'dns' and examining query strings for abnormal length, high entropy, or encoded patterns exposes the exfiltration channel that normal DNS traffic would not exhibit.
Filter for 'icmp' and examine the payload size of Echo Request packets.
An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?
Enable Kerberos pre-authentication enforcement on all Domain Controller service principal accounts.
Configure SMB packet signing globally and disable SMBv1 across all domain member servers.
Enforce LDAP signing and channel binding while disabling anonymous LDAP enumeration via Group Policy.
Anonymous LDAP binds let the workstation enumerate users and groups without credentials. Enforcing LDAP signing and channel binding via Group Policy authenticates and integrity-protects the session, while disabling anonymous enumeration removes the unauthenticated query path the SIEM detected.
Implement NT LAN Manager (NTLM) v2 exclusive authentication and disable NTLM fallback.
A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?
Enable Dynamic ARP Inspection (DAI) bound to the DHCP snooping database.
Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping replies with spoofed IP-to-MAC mappings. This directly neutralises ARP cache poisoning on the subnet, satisfying the requirement to stop the MitM attack at the switch rather than relying on host-based detection.
Activate Unicast Reverse Path Forwarding (uRPF) on the default gateway router.
Deploy IEEE 802.1Q VLAN trunking with native VLAN mismatch remediation.
Configure Port Fast and BPDU Guard on all access-layer switch interfaces.
An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?
Configure a DomainKeys Identified Mail (DKIM) CNAME record.
Implement a Domain-based Message Authentication, Reporting, and Conformance (DMARC) TXT record.
Create a Sender Policy Framework (SPF) TXT record specifying authorized sending IP addresses.
An SPF TXT record lists the IP addresses and hosts authorised to send mail for the domain. Receiving servers check the envelope sender against this record, so unauthorised senders fail the check and spoofed messages are rejected.
Deploy a Mail Exchange (MX) record pointing to the internal relay gateway.
Want more Network Attacks And Defense Strategies practice?
Practice this domainAn enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?
McAfee DLP Endpoint Client
The McAfee DLP Endpoint Client runs on each workstation and enforces device-control policies locally, inspecting file operations to USB mass storage and blocking them without server round-trips. This satisfies the stem's requirement for on-endpoint inspection and blocking, unlike network-based or ePO-managed components that cannot intercept local bus traffic.
McAfee DLP Prevent
McAfee ePolicy Orchestrator (ePO) Relay Server
McAfee DLP Discover
An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?
Invoke the java.net.URLEncoder.encode() method on all parameters
Wrap all input strings inside single quotes and strip out semicolon characters
Use parameterized queries and PreparedStatement objects with placeholder parameters
Parameterised queries with PreparedStatement placeholders separate SQL code from user-supplied data, so input is bound as a literal value rather than parsed as SQL syntax. This neutralises injection in the flagged JDBC template query, satisfying the requirement to secure the database interaction.
Sanitize all input characters using HTML entity encoding before passing them to the database driver
A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?
Exact Data Matching (EDM)
Described Content Matching (DCM) with a Data Identifier utilizing Luhn algorithm validation
DCM inspects payload content against predefined Data Identifiers, and the credit card identifier applies Luhn checksum validation to candidate digit strings. This validates the check digit, so random 16-digit numbers are rejected, matching the stem's requirement for standard card formats.
Indexed Document Matching (IDM)
Vector Machine Learning (VML)
A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?
nocase
The `nocase` modifier performs case-insensitive pattern matching on the preceding content match, so `admin_login.php` triggers regardless of capitalisation. This satisfies the stem's requirement to detect the exact string in the HTTP URI whatever its case, whereas default Snort matching is case-sensitive and would miss variants such as `Admin_Login.php`.
uricontent
depth
offset
An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?
pg_encrypt_cluster utility
PostgreSQL Enterprise TDE Daemon
Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions
PostgreSQL lacks native TDE, so dm-crypt/LUKS encrypts the entire data directory at the block device layer, satisfying data-at-rest protection without schema changes. pgcrypto adds column-level cryptographic functions for granular protection of sensitive fields. Together they deliver encryption at rest using native PostgreSQL tooling rather than unavailable built-in TDE.
pg_tde core extension module
An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?
Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings
Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services
User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker
Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives
Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives contains the "Require additional authentication at startup" setting, where the TPM startup PIN is enforced. This path satisfies the stem's requirement to mandate a startup PIN on TPM-equipped systems through Group Policy.
Want more Application And Data Protection practice?
Practice this domainAn organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?
Windows PowerShell Operational Log (Event ID 4104)
Event ID 4104 in the PowerShell Operational log records script block logging, capturing the decoded content of obfuscated or encoded commands. This directly satisfies the analyst's need to read the plaintext script, which the command-line process auditing (4688) and transcription logs would not reliably reconstruct.
System Event Log (Event ID 7045)
Security Event Log (Event ID 4688)
Windows Defender Operational Log (Event ID 1116)
A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?
Windows Defender Application Control (WDAC)
User Account Control (UAC)
BitLocker Drive Encryption
Windows Defender Credential Guard
Credential Guard uses Virtualisation-Based Security to run LSASS in an isolated Hyper-V-protected container, so NTLM and Kerberos secrets cannot be read by a compromised process. This satisfies the stem's requirement to isolate LSASS memory using virtualisation against pass-the-hash.
An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?
Software Update Groups
Maintenance Windows
Maintenance Windows define precise schedules during which MECM may deploy patches, restarting devices only within that period. Configuring a window outside active hours directly satisfies the minimal-disruption constraint, since installations and reboots are suppressed during business use and enforced only within the defined boundary.
Automatic Deployment Rules (ADR)
Client Settings - Computer Restart
An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?
Local Users and Groups (lusrmgr.msc)
Local Security Policy (secpol.msc)
secpol.msc edits the local security database, covering password complexity, minimum length and account lockout thresholds on standalone machines. Domain Group Policy cannot apply without Active Directory, so the local policy console is the only mechanism meeting the standalone constraint.
Group Policy Management Console (gpmc.msc)
System Configuration (msconfig.exe)
A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?
Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall
Computer Configuration -> Preferences -> Control Panel Settings -> Network Options
Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections
Configuring the outbound default action to Block in the domain profile's Properties satisfies the requirement to deny all outbound traffic except explicitly permitted rules. This firewall-level default, applied via GPO to all targeted computers, enforces the deny-by-default posture before any allow rules are evaluated.
Computer Configuration -> Policies -> Software Restriction Policies
An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?
/etc/fstab
/boot/grub/grub.cfg
/etc/modprobe.d/blacklist.conf
Blacklisting modules in `/etc/modprobe.d/blacklist.conf` prevents the kernel from loading USB storage and Bluetooth drivers at boot, directly reducing the minimal Linux kernel's attack surface. This file is read by modprobe during module initialisation, satisfying the industrial IoT constraint of disabling unnecessary kernel modules.
/etc/sysctl.conf
Want more Endpoint Protection practice?
Practice this domainAn administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?
ufw enable 192.168.100.0/24
ufw allow from 192.168.100.0/24 to any port 22 proto tcp
UFW's allow rule with a from source and to any port 22 proto tcp matches the subnet constraint exactly, permitting inbound SSH only from 192.168.100.0/24 while denying other sources. Specifying proto tcp restricts the rule to SSH's transport, and the /24 CIDR covers the whole subnet.
ufw deny ssh
ufw route allow 22
A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
The conntrack match with --ctstate ESTABLISHED,RELATED identifies packets belonging to already-tracked connections, and the ACCEPT target passes them immediately. Placed before later rules, it satisfies the stem's requirement that established or related TCP traffic bypasses subsequent checks.
iptables -A INPUT -m limit --limit 5/min -j LOG
iptables -A FORWARD -p tcp --dport 80 -j REJECT
iptables -A INPUT -m state --state NEW -j DROP
A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?
External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.
External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.
External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.
External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.
The external firewall filters internet traffic into the DMZ, while the internal firewall permits only required service ports from the DMZ to the internal network. This back-to-back arrangement ensures a compromised DMZ host cannot freely reach internal systems.
An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?
log icmp any any -> any any (msg:"ICMP Ping Detected"; itype:8; sid:1000003;)
drop udp external any -> $HOME_NET 53 (content:"passwd"; sid:1000002;)
alert tcp any any -> any 80 (msg:"Directory Traversal Attempt"; content:"../../etc/passwd"; sid:1000001; rev:1;)
The header alerts on TCP traffic destined to port 80, matching HTTP, while the content option inspects the payload for the literal traversal string. Correct syntax with msg, sid and rev makes it a valid Snort signature for detecting the attack.
pass ip any any -> any any (content:"GET /index.html"; sid:1000004;)
A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?
SSL/TLS Decryption (Inspection)
SSL/TLS decryption terminates the encrypted session at the NGFW, decrypts the payload, applies DPI signatures, then re-encrypts before forwarding. Without it, HTTPS traffic remains opaque to signature matching, satisfying the stem's requirement to inspect encrypted session payloads rather than merely metadata.
Layer 2 Bridging
Port Forwarding
Static NAT
A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?
Intrusion Prevention System
Stateful Inspection Firewall
Proxy Server
Honeypot
A honeypot is a deliberately vulnerable decoy host that attracts attackers away from production systems while logging their tools, techniques and procedures. This matches the stem's requirement for a perimeter decoy loaded with vulnerabilities to gather telemetry on adversary tactics.
Want more Network Perimeter Protection practice?
Practice this domainThe CND exam has 100 questions and must be completed in 240 minutes. The passing score is 60–85% (cut score varies by exam form). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 8 domains: Enterprise Cloud Virtual And Wireless Network Protection, Network Security Controls Protocols And Devices, Network Defense Management, Incident Detection Response And Threat Prediction, Network Attacks And Defense Strategies, Application And Data Protection, Endpoint Protection, Network Perimeter Protection. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official EC-Council CND exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.