CND Practice Test 10 — 10 Questions

Question 1

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WPA3-Enterprise 192-bit mode (Suite B compliance). WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Answer

WPA2-Enterprise with AES-CCMP and TKIP fallback

Answer

Enhanced Open (OWE) with opportunistic encryption

Answer

WPA3-Personal with SAE and transition mode enabled

Question 2

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

Accepted Answer

Remove all current security groups and attach an isolation security group with deny-all rules. To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Answer

Terminate the EC2 instance and restore from the latest snapshot

Answer

Modify the instance state to 'stopped' via AWS CLI

Answer

Delete the attached Elastic Network Interface (ENI)

Question 3

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

Accepted Answer

Endpoint local service status confirming antivirus daemon/service execution and recent scan logs. Option B is correct because checking the endpoint's local service status verifies that the antivirus daemon/service is actually running, and reviewing recent scan logs confirms the agent is performing its scanning function rather than merely being installed. Option D is correct because a centralized EDR management console dashboard aggregates agent health telemetry and signature update status across all workstations, which is the most efficient way to confirm fleet-wide functionality and compliance. Option A is incorrect because spanning-tree root bridge priority is a Layer 2 switching parameter unrelated to endpoint security agents. Option C is incorrect because DNS root hint tables only affect name resolution and reveal nothing about antivirus or EDR operation. Option E is incorrect because BGP ASN peering configurations concern internet routing between autonomous systems, not endpoint protection status.

Answer

Network switch spanning-tree root bridge priority metrics

Answer

DNS root hint server IP address tables

Answer

BGP router autonomous system number (ASN) peering configurations

Question 4

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Accepted Answer

Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert). Option C is correct because SOAR platforms are built to run orchestrated playbooks that trigger automated containment actions, such as isolating an endpoint via EDR API or disabling an account when a high-fidelity alert fires, reducing mean time to respond. Option D is correct because SOAR natively performs automated IOC enrichment by querying external threat intelligence APIs (e.g., VirusTotal, MISP, Recorded Future) to add context like reputation, geolocation, and related campaigns to alerts. Option E is correct because SOAR integrates with ITSM and case management tools such as Jira and ServiceNow to auto-create, update, and track incident tickets, streamlining workflow and documentation. Option A is incorrect because designing marketing websites is a web development function unrelated to security orchestration or incident response. Option B is incorrect because SOAR is software orchestration, not physical robotics, and it does not replace data center firewalls with robotic hardware arms.

Answer

Designing corporate marketing websites

Answer

Replacing physical data center firewalls with robotic hardware arms

Question 5

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

Accepted Answer

Azure Key Vault (Managed HSM or Standard Vault). Azure Key Vault (either a Standard vault or a Managed HSM pool) is the Azure service that stores and manages customer-managed keys (CMK) used for Storage Account encryption at rest. Storage Accounts integrate natively with Key Vault via a system-assigned or user-assigned managed identity, allowing the storage service to unwrap the CMK for encryption/decryption without exposing the key. Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules when the auditor requires keys stored in dedicated HSM hardware.

Answer

Azure Information Protection (AIP)

Answer

Azure Active Directory (Microsoft Entra ID) Identity Protection

Answer

Azure Sentinel (Microsoft Sentinel)

Question 6

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

Accepted Answer

Configuring Azure Storage Firewall rules to restrict access to specific Virtual Networks and IP ranges. Option C is correct because configuring Azure Storage Firewall rules (network rules on the storage account) restricts access to specified virtual networks, subnets, and public IP ranges, blocking unauthorized clients and reducing data exfiltration paths. Option D is correct because Microsoft Defender for Storage provides threat detection for anomalous access, suspicious exfiltration attempts, and malicious activity against blobs, files, and other storage services. Option A is wrong because allowing anonymous public read access by default exposes blob data to anyone and directly increases exfiltration risk. Option B is wrong because removing Azure Key Vault cryptographic keys would break encryption and key management rather than improve protection. Option E is wrong because disabling HTTPS forces unencrypted HTTP traffic, weakening security and violating secure transport requirements.

Answer

Allowing anonymous public read access on all blob containers by default

Answer

Removing all Azure Key Vault cryptographic keys

Answer

Disabling HTTPS traffic so clients communicate exclusively over unencrypted HTTP

Question 7

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

Accepted Answer

Demilitarized Zone (DMZ). A Demilitarized Zone (DMZ) is a network segment that sits between the internal trusted network and the untrusted internet. It is designed to host publicly accessible services like web servers while isolating them from the internal corporate network. This isolation limits the impact if the server is compromised, as attackers cannot directly access internal resources.

Answer

Internal LAN

Answer

Management VLAN

Answer

Virtual Private Network (VPN) pool

Question 8

An enterprise security team is hardening an Azure environment. Which THREE actions should be implemented to secure Azure Virtual Machines and management planes? (Choose THREE)

Accepted Answer

Enabling Microsoft Defender for Cloud for continuous posture management and threat detection. Option B is correct because Microsoft Defender for Cloud provides continuous security posture management (secure score, regulatory compliance) and threat detection across Azure VMs and management planes, which is a core hardening control. Option D is correct because Just-In-Time (JIT) VM access in Defender for Cloud removes standing open management ports (22/3389) and grants time-bound, IP-restricted, request-approved access, directly reducing the attack surface. Option E is correct because Azure Bastion delivers browser-based RDP/SSH over TLS through the Azure portal, so VMs need no public IP addresses and management ports need not be exposed to the internet. Option A is incorrect because disabling Azure Disk Encryption removes OS and data disk encryption at rest, weakening rather than hardening the VM. Option C is incorrect because publicly opening TCP 22 and 3389 on NSGs exposes SSH and RDP to internet scanning and brute-force attacks, the opposite of a hardening action.

Answer

Disabling Azure Disk Encryption across all operating system disks

Answer

Opening TCP ports 22 and 3389 publicly on all NSGs for easy administrative troubleshooting

Question 9

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

Accepted Answer

LLMNR/NBT-NS poisoning and credential relay attacks. Disabling LLMNR mitigates LLMNR/NBT-NS poisoning and credential relay attacks, where an attacker responds to broadcast name resolution requests to impersonate a legitimate host and capture NTLMv2 hashes for offline cracking or relay. LLMNR is a multicast protocol (224.0.0.252, ff02::1:3) that Windows uses as a fallback when DNS fails, and tools like Responder exploit it. Disabling it forces resolution through DNS, reducing the attack surface.

Answer

SQL injection vulnerabilities in web application forms

Answer

BGP prefix hijacking and route table poisoning

Answer

DNS zone transfer enumeration via nslookup

Question 10

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

Accepted Answer

Configure MAC Authentication Bypass (MAB) with a specific device profiling and authorization profile on the RADIUS server.. MAC Authentication Bypass (MAB) is the correct solution because it allows the switch to authenticate devices that lack an 802.1X supplicant by using the device's MAC address as the credential against the RADIUS server. Combined with device profiling and an authorization profile, the camera can be placed into a restricted VLAN or given limited ACLs, achieving both authentication and isolation. This is the standard Cisco ISE/switch design pattern for headless devices like cameras, printers, and IoT sensors.

Answer

Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

Answer

Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

Answer

Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.