CND Practice Test 11 — 15 Questions

Question 1

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

nft add table inet filter; nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }. The correct nftables command sequence creates a table named 'filter' in the inet family, adds a base chain named 'input' with type filter, hook input, priority 0, and policy drop. This sets up packet filtering with a default drop policy for incoming traffic.

Answer

nftables create filter-table --default-drop

Answer

iptables -P INPUT DROP

Answer

ufw default deny incoming

Question 2

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

Accepted Answer

Full Disk Encryption (such as BitLocker or FileVault). Full Disk Encryption (FDE) technologies like BitLocker (Windows) and FileVault (macOS) encrypt the entire storage volume at rest, ensuring that if a laptop is lost or stolen, the data cannot be read without the decryption key. This directly satisfies the policy requirement that sensitive data at rest on laptops be cryptographically protected. FDE operates below the file system, protecting OS files, swap space, and user data uniformly.

Answer

Transport Layer Security (TLS) version 1.3

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Intrusion Detection System (IDS) signature files

Question 3

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI powered by Cilium supports transparent data plane encryption using WireGuard, which encrypts node-to-node and pod-to-pod traffic within the AKS cluster. Enabling data plane encryption during cluster creation (or via configuration) satisfies the requirement for encrypted in-transit communication between nodes. This is the native AKS feature designed for intra-cluster transport encryption.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 4

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

Accepted Answer

Active Response / Process Termination. When a HIPS detects an injection attack and immediately terminates the offending process, it is performing an active response — a proactive preventive action that stops the attack in real time rather than merely logging it. Process termination is a classic active-response capability of host-based IPS tools such as OSSEC, Wazuh, or commercial HIPS platforms.

Answer

DNS Sinkholing

Answer

Passive Log Alerting

Answer

Vulnerability Patch Management

Question 5

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

Accepted Answer

Formulating a threat hypothesis based on recent adversary tactics, techniques, and procedures (TTPs). Option A is correct because mature threat hunting begins with a hypothesis derived from current adversary TTPs (e.g., MITRE ATT&CK techniques), which directs hunters toward plausible, high-value threats rather than waiting for alerts. Option D is correct because hunting is an iterative, hypothesis-driven process of querying telemetry (SIEM, EDR, network data) and analyzing artifacts to surface threats that automated detection missed. These two activities are proactive and analyst-led, distinguishing them from reactive alert handling. Option B is not correct because out-of-the-box SIEM correlation alerts are automated, reactive detection rather than proactive hunting. Option C is not correct because automated firewall drops based on malicious IP feeds are preventive, signature-based controls, not hunting. Option E is not correct because scheduled vulnerability scans are routine, automated assessment activities, not hypothesis-driven threat hunting.

Answer

Relying entirely on out-of-the-box SIEM correlation alerts for immediate notification

Answer

Configuring automated firewall rule drops for known malicious IP feeds

Answer

Executing routine scheduled vulnerability scans against external perimeter assets

Question 6

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

Accepted Answer

SR (Supply Chain Risk Management). NIST SP 800-53 Revision 5 introduced the SR (Supply Chain Risk Management) control family specifically to address supply chain risk governance, including processes for identifying, assessing, and mitigating risks from suppliers and third parties. The NIST CSF v2.0 Govern function's supply chain risk management outcomes map directly to the SR family controls.

Answer

PL (Planning)

Answer

CA (Assessment, Authorization, and Monitoring)

Answer

SC (System and Communications Protection)

Question 7

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

Accepted Answer

Conducting automated authenticated vulnerability scans of all internal and external assets on a regular schedule. CIS Control 4 (Continuous Vulnerability Management) requires automated, authenticated vulnerability scanning of all internal and external assets on a regular schedule, with remediation tracked. Authenticated scans provide deeper visibility into installed software and missing patches than unauthenticated scans. This is the core activity auditors look for to demonstrate compliance with Control 4.

Answer

Performing manual penetration testing once every five years

Answer

Deploying hardware token multi-factor authentication for VPN users

Answer

Restricting administrative access to local console connections only

Question 8

An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)

Accepted Answer

Hot Standby Router Protocol (HSRP). HSRP (A) is Cisco's first-hop redundancy protocol in which an active and standby router share a virtual IP and MAC address, allowing the standby to take over the default gateway role if the active fails, directly preventing a gateway single point of failure. GLBP (B) is Cisco's advanced FHRP that provides gateway redundancy while also load-balancing traffic across multiple gateways via a virtual IP and multiple virtual MAC addresses, so it both eliminates the single gateway failure and improves availability. VRRP (E) is the standards-based (RFC 5798) first-hop redundancy protocol where a master and backup routers share a virtual router IP/MAC, providing vendor-neutral gateway failover. STP root guard (C) is a Layer 2 loop-prevention/root-bridge protection feature and does not provide default-gateway redundancy, and DHCP snooping (D) is a Layer 2 security feature that filters rogue DHCP servers and builds a binding table, unrelated to gateway failover.

Answer

Spanning Tree Protocol (STP) root guard

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Question 9

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

Accepted Answer

CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage. The order of volatility, from most volatile to least volatile, is: CPU registers and cache, routing tables and network connections, system memory (RAM), and then hard disk storage. This sequence ensures that the most perishable evidence is captured first before it is lost due to power-down or ongoing system activity. Option B correctly lists this order.

Answer

Running processes, hard disk storage, system memory (RAM), CPU registers

Answer

Hard disk image, system memory (RAM), network connections, running processes

Answer

System memory (RAM), hard disk storage, running processes, CPU registers

Question 10

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies are the native GKE feature that allows pod-level traffic control based on labels, namespaces, and ports. They operate at Layer 3/4 and are enforced by the CNI plugin (e.g., Calico on GKE), enabling fine-grained segmentation without relying on IP addresses. This directly meets the requirement to restrict traffic between pods using labels.

Answer

Identity-Aware Proxy (IAP)

Answer

Google Cloud Armor security policies

Answer

VPC Firewall Rules using subnet tags

Question 11

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Accepted Answer

Data in transit across network gateways (Network DLP). Option C is correct because Network DLP monitors data in transit as it crosses network gateways, inspecting protocols such as HTTP/S, SMTP, and FTP to detect and block sensitive intellectual property leaving the perimeter. Option E is correct because Storage/Discovery DLP scans data at rest on endpoint hard drives and file shares, using content fingerprinting and regex rules to locate and remediate stored sensitive files. Together, these cover the two fundamental data states—in motion and at rest—that a comprehensive DLP architecture must address. Option A is not a standard DLP monitoring location, as Bluetooth beacon devices are proximity/telemetry hardware, not data transport channels for DLP inspection. Option B is incorrect because CPU cache registers are transient internal processor state and are not a monitored DLP data state. Option D is incorrect because analog modem lines are legacy dial-up channels, not a recognized DLP monitoring location in modern architectures.

Answer

Data routed through internal Bluetooth beacon devices

Answer

Data processed inside physical server CPU cache registers only

Answer

Data transmitted over analog telephone modem lines

Question 12

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Ensuring kernel crash dumps are enabled and pre-staging a trusted memory acquisition utility like LiME directly supports forensic readiness by allowing volatile RAM contents to be captured during a live kernel attack. This preserves critical evidence that would otherwise be lost on reboot or shutdown. The other options do not address volatile memory acquisition.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 13

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

Accepted Answer

Demilitarized Zone (DMZ). The Demilitarized Zone (DMZ) is the segmented network zone designed to host public-facing services such as web servers, mail relays, and reverse proxies. It sits between the untrusted internet and the trusted internal LAN, with distinct firewall contexts controlling traffic in each direction, so a compromise of a public server does not grant direct access to internal systems.

Answer

Management VLAN

Answer

Internal Trusted Zone

Answer

Guest Wireless Zone

Question 14

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

Accepted Answer

To passively monitor and analyze network traffic copies for malicious signatures and anomalies.. A NIDS deployed in promiscuous mode on a SPAN/mirror port receives copies of all traffic traversing the monitored segment, allowing it to passively inspect packets for malicious signatures and anomalies without affecting traffic flow. Promiscuous mode lets the NIC accept frames not addressed to it, which is essential for seeing all mirrored traffic.

Answer

To actively block and drop malicious packets inline.

Answer

To act as the default gateway for the DMZ network.

Answer

To perform Network Address Translation for internal hosts.

Question 15

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

Accepted Answer

Remediation VLAN / Quarantine Network. Non-compliant endpoints in a NAC governance policy should be placed in a remediation VLAN or quarantine network, which is an isolated segment designed to restrict access while allowing remediation resources (e.g., antivirus updates, patch servers). This prevents compromised or non-compliant devices from accessing sensitive internal resources.

Answer

Unrestricted guest wireless broadcast zone

Answer

Core router management loopback subnet

Answer

DMZ (Demilitarized Zone) web server farm