CND Exam Simulation 1 — 100 Questions

Question 1

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring a host-based packet filter firewall (such as nftables or iptables). Option B is correct because a host-based packet filter such as nftables or iptables enforces least-privilege network access on the gateway itself, restricting inbound/outbound traffic to only the ports and protocols the industrial IoT function requires. Option C is correct because reducing the attack surface by removing unnecessary packages and disabling insecure legacy services like Telnet and FTP (which transmit credentials in cleartext) eliminates well-known vectors for compromise on embedded Linux endpoints. Option D is correct because an automated, secure firmware and patch update mechanism ensures known vulnerabilities are remediated promptly and integrity-verified, which is essential for long-lived IoT devices that cannot rely on manual updates. Option A is not a hardening practice: shared static SSH keys and root auto-login destroy accountability and enable lateral movement, whereas best practice is unique per-device keys, disabled root SSH login, and key-based authentication with passphrases. Option E is not a hardening practice: disabling local logging and audit daemons removes the forensic and detection capability needed to identify intrusions and is not an acceptable trade-off for marginal CPU savings.

Answer

Configuring all system accounts with shared static SSH keys and root auto-login

Answer

Disabling local logging and audit daemons to maximize CPU performance

Question 2

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

Accepted Answer

Stateful session synchronization (State Sync / HA heartbeat link). Stateful session synchronization replicates the connection state table between the active and standby firewalls over the HA heartbeat/sync link, so that when failover occurs the standby already knows about every established TCP session. This preserves sequence numbers, session timers, and NAT translations, allowing existing sessions to continue without forcing users to re-authenticate. VRRP handles the virtual IP failover, but it does not carry session state — that is the job of state sync.

Answer

Network Address Translation (NAT) pool overloading

Answer

Asymmetric routing bypass mode

Answer

Dynamic DNS update propagation

Question 3

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

Accepted Answer

Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation. A WIPS with triangulation uses multiple sensors to measure signal strength (RSSI) from a detected rogue AP and calculates its physical location by comparing readings across sensors. This is the only listed technique that both detects the rogue AP and locates its physical source, which is required to remove it. WIPS also correlates BSSIDs, SSIDs, and behavior to distinguish true rogues from neighboring APs.

Answer

Running regular traceroute commands from endpoints

Answer

Enabling port security on enterprise access layer switches

Answer

Configuring static ARP entries on enterprise switches

Question 4

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Accepted Answer

Multi-Factor Authentication (MFA) for all authentication attempts. Option B is correct because Multi-Factor Authentication (MFA) ensures that even if a remote employee's password is compromised, an attacker cannot authenticate to internal corporate resources without the additional factor, directly mitigating credential-theft and phishing risks inherent to home environments. Option E is correct because an encrypted VPN tunnel using IPsec or TLS provides confidentiality and integrity for data in transit between the remote endpoint and the corporate network, preventing eavesdropping or tampering on untrusted home or public networks. Options A, C, and D are incorrect: disabling endpoint firewall protection weakens host defenses and exposes the device to inbound attacks, sharing credentials with family members violates least-privilege and non-repudiation principles, and connecting directly over unencrypted public Wi-Fi without tunneling exposes all traffic to interception and man-in-the-middle attacks.

Answer

Disabling endpoint firewall protection to improve home network gaming performance

Answer

Sharing corporate laptop credentials with family members for household convenience

Answer

Connecting directly via unencrypted public Wi-Fi without any protective tunneling

Question 5

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 6

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 7

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

Accepted Answer

sha256sum evidence.raw. The sha256sum command computes a SHA-256 cryptographic hash of the specified file, producing a unique fixed-length digest that serves as a digital fingerprint. Any modification to the evidence file—even a single bit flip—will produce a completely different hash value, allowing an analyst to later re-hash the file and compare digests to prove integrity. SHA-256 is collision-resistant and widely accepted in forensic and legal contexts as a standard for evidence authentication. Unlike MD5 or SHA-1, it has no known practical collision attacks, making it suitable for cryptographic proof.

Answer

dd if=/dev/sdb of=/evidence.raw --hash=md5

Answer

ftk_imager --verify --md5 evidence.raw

Answer

volatility -f evidence.raw --hash

Question 8

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Accepted Answer

Amazon VPC Security Groups acting as stateful virtual firewall instances. Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets. Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Answer

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Answer

AWS Shield Standard for intra-VPC subnet routing

Question 9

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Accepted Answer

Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results. Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft. Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Answer

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Answer

Granting db_owner permissions to all public database roles by default

Question 10

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Accepted Answer

Inline placement directly in the path of network traffic flow to allow active packet dropping.. Option A is correct because a NIPS is typically deployed inline, sitting directly in the traffic path so it can actively drop or block malicious packets in real time rather than merely alerting. Option E is correct because many NIPS platforms can terminate or disrupt an in-progress attack by injecting TCP RST packets to reset the offending connection, which is an active prevention capability. Options B and D describe passive, detection-only behavior characteristic of a NIDS (e.g., SPAN port/TAP monitoring or syslog alerting without affecting traffic), so they do not represent prevention. Option C is incorrect because a NIPS must inspect Layer 3 and Layer 4 headers (and often higher layers) to identify and block malicious traffic, so operating as a pure Layer 2 bridge without inspection is not a NIPS feature.

Answer

Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

Answer

Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

Answer

Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.

Question 11

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 12

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

Accepted Answer

Validate the file's magic bytes (header signature), enforce an extension whitelist, and store files outside the web root. Preventing arbitrary file upload RCE requires validating the file's actual content (magic bytes/header signature), enforcing a strict extension whitelist, and storing uploaded files outside the web root so they cannot be executed. This triple control defeats both extension-spoofing (e.g., 'shell.php.jpg') and direct execution of uploaded payloads. Magic-byte validation ensures the file truly is the claimed type, not a renamed script.

Answer

Pass the uploaded file directly to the operating system's eval() function

Answer

Compress the uploaded file using ZIP format before saving

Answer

Check only the filename extension provided in the client's HTTP multipart header

Question 13

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a Cisco IOS feature that allows administrators to apply a QoS policy to traffic destined for the router's control plane (the CPU). It rate-limits or drops excessive control-plane traffic, such as routing protocol updates, ICMP, and management access, preventing CPU exhaustion attacks from external floods. By protecting the control plane, CoPP ensures the router remains stable and available even under attack.

Answer

Spanning Tree Root Guard

Answer

Port Security

Answer

Dynamic ARP Inspection (DAI)

Question 14

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

Accepted Answer

Enable Amazon S3 Block Public Access settings across all AWS accounts and buckets.. Amazon S3 Block Public Access is a preventive control that overrides bucket policies and ACLs to reject any public access, regardless of how the bucket is configured. Enabling it at the account level ensures that even newly created buckets or misconfigured policies cannot expose data publicly. This directly addresses the requirement to prevent public accessibility due to misconfigurations.

Answer

Deploy an AWS WAF web access control list on Amazon CloudFront distributions.

Answer

Configure AWS Security Hub with CIS AWS Foundations Benchmark compliance standards.

Answer

Install a host-based antivirus agent on all EC2 virtual machine instances.

Question 15

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

Accepted Answer

IEEE 802.1Q. IEEE 802.1Q is the standard that defines VLAN tagging on Ethernet frames, inserting a 4-byte tag into the frame header that carries the VLAN ID (12 bits, supporting 4094 usable VLANs). On a trunk link between switches, 802.1Q tags each frame so the receiving switch knows which VLAN the frame belongs to, enabling logical segmentation of the finance and HR departments across shared physical infrastructure.

Answer

IEEE 802.1X

Answer

IEEE 802.3ad

Answer

IEEE 802.11i

Question 16

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase of incident response involves monitoring alerts, validating whether they are true or false positives, and determining scope and impact. Triaging an EDR alert about cmd.exe with encoded arguments—a common living-off-the-land technique—falls squarely in this phase. Eradication and Recovery occur after a confirmed incident, and Preparation is the pre-incident readiness stage.

Answer

Eradication

Answer

Recovery

Answer

Preparation

Question 17

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

Accepted Answer

Prohibiting the creation and download of user-managed service account keys where possible. Option B is correct because user-managed service account keys are long-lived credentials that, once downloaded, can be exfiltrated and used to impersonate the service account; prohibiting their creation and download (and instead using short-lived credentials via Workload Identity Federation, service account impersonation, or attached service accounts) directly reduces credential theft risk. Option C is correct because enforcing least privilege with predefined or custom IAM roles limits each principal to only the permissions required, which prevents privilege escalation paths that arise when identities hold excessive permissions. Option A is wrong because disabling Cloud Audit Logs removes the audit trail needed to detect and investigate unauthorized privilege escalation or credential misuse, and it does not improve IAM hygiene. Option D is wrong because assigning primitive roles like Owner or Editor grants broad, excessive permissions that violate least privilege and enable privilege escalation. Option E is wrong because publishing service account JSON keys publicly exposes credentials to anyone, directly enabling credential theft and unauthorized access.

Answer

Disabling Google Cloud Audit Logs to reduce storage overhead

Answer

Assigning broad primitive roles (Owner, Editor) to all project contributors

Answer

Sharing service account JSON keys publicly in public GitHub repositories for collaboration

Question 18

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting the make, model, serial number, and signing an evidence custody form is the immediate step required to establish and maintain chain of custody upon physical removal of the drive. This documentation creates the legal record of who had control of the evidence, when, and under what conditions, which is essential for evidentiary integrity in court.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 19

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy. Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 20

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7, analyze parameters, and block SQL injection signatures using rule sets and anomaly scoring. It sits in front of the web application and can dynamically detect and mitigate SQLi attempts, including union-based queries.

Answer

Configure a reverse proxy load balancer with IP hashing persistence algorithms.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.

Answer

Implement a stateful network firewall configured with Layer 4 packet inspection rules.