CND Practice Test 12 — 15 Questions

Question 1

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Maintain a comprehensive Software Bill of Materials (SBOM) and perform automated Software Composition Analysis (SCA) for third-party libraries.. Option B is correct because maintaining a comprehensive Software Bill of Materials (SBOM) gives the organization visibility into every third-party component and transitive dependency in its software, while automated Software Composition Analysis (SCA) continuously detects known vulnerabilities (CVEs) and license risks in those libraries, directly countering supply chain attacks that hide in dependencies. Option E is correct because strict vendor access controls combined with multi-factor authentication (MFA) and just-in-time (JIT) privileged access management ensure that third-party support accounts receive only time-bound, least-privilege access that is monitored and revoked after use, preventing attackers from abusing persistent vendor credentials to pivot into the environment. Option A is wrong because disabling code signing removes integrity verification of builds and enables tampered or malicious artifacts to run undetected. Option C is wrong because granting permanent, unmonitored Domain Administrator rights to vendors creates an uncontrolled privileged backdoor and violates least privilege. Option D is wrong because relying solely on vendor self-assessments provides no independent verification and leaves supply chain risks unaudited.

Answer

Disable all code signing requirements for internal and external software builds.

Answer

Grant third-party vendor support accounts permanent, unmonitored Domain Administrator privileges.

Answer

Rely entirely on vendor self-assessments without conducting independent code audits or penetration testing.

Question 2

An enterprise security engineer is investigating potential AWS IAM privilege escalation paths and misconfigurations. Which TWO AWS IAM actions or conditions represent known high-risk misconfigurations that can lead to privilege escalation? (Choose TWO)

Accepted Answer

Allowing unrestricted iam:PassRole combined with permission to launch EC2 instances with administrative IAM roles. Option B is correct because iam:PassRole by itself only lets a principal hand a role to an AWS service, but when combined with permissions such as ec2:RunInstances, the user can launch an EC2 instance that assumes an administrative role and then use that instance's credentials to escalate privileges. Option E is correct because granting *:* on iam:CreatePolicyVersion allows a user to create a new version of an existing policy with arbitrary permissions and set it as the default, effectively escalating to any privilege the policy can grant. Option A is not a privilege escalation risk; enforcing MFA on IAM user sign-ins is a security best practice that strengthens authentication. Option C is not a risk because read-only AWS managed policies for auditing users grant only visibility, not the ability to modify permissions or resources. Option D is not a risk because IAM password complexity policies improve credential strength and do not grant additional privileges.

Answer

Enforcing Multi-Factor Authentication (MFA) on all IAM user sign-ins

Answer

Attaching AWS managed policies for read-only access to auditing users

Answer

Requiring IAM password complexity policies

Question 3

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

Accepted Answer

Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key exchanges. Perfect Forward Secrecy (PFS) ensures that session keys are derived from ephemeral Diffie-Hellman exchanges and are not recoverable from long-term keys. Even if an attacker later compromises the preshared key or private key, past session keys cannot be reconstructed, so captured traffic remains undecryptable. This is exactly the property the security team requires.

Answer

Authenticated Encryption with Associated Data (AEAD) using GCM mode

Answer

Anti-replay protection using sequence number windows

Answer

RSA signature-based peer authentication

Question 4

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

Accepted Answer

Perform a comprehensive risk assessment and align the identified risks against Annex A control objectives.. ISO/IEC 27001 requires that the Statement of Applicability (SoA) be derived from the results of a formal risk assessment. The risk assessment identifies which threats and vulnerabilities apply to the organization, and Annex A controls are then selected (or excluded with justification) based on those findings. Without completing the risk assessment first, the SoA has no defensible basis for inclusion or exclusion of controls.

Answer

Configure firewall rulebases to block all inbound traffic by default.

Answer

Draft the incident response playbook according to NIST SP 800-61.

Answer

Deploy a Security Information and Event Management (SIEM) solution for continuous monitoring.

Question 5

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

Accepted Answer

Resource Public Key Infrastructure (RPKI) with Route Origin Validation (ROV). RPKI with Route Origin Validation (ROV) is the cryptographic mechanism that binds IP prefixes to their authorized origin AS numbers via signed Route Origin Authorizations (ROAs). Edge routers performing ROV query RPKI validators (e.g., Routinator, OctoRPKI) and mark BGP announcements as Valid, Invalid, or NotFound, allowing operators to drop Invalid routes and prevent prefix hijacking. This directly addresses origin authentication of BGP announcements.

Answer

DNSSEC zone signing across all authoritative name servers

Answer

OSPFv3 authentication trailers using HMAC-SHA-256

Answer

IPsec Transport Mode with pre-shared keys

Question 6

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

Accepted Answer

Identifying and cataloging all network assets, data flows, and current vulnerabilities. The Assessment and Analysis phase of the Network Defense Lifecycle is the discovery and baseline phase: you must inventory assets, map data flows, and identify current vulnerabilities before you can design or deploy defenses. Without this baseline, subsequent phases (design, implementation, monitoring) lack the context to prioritize controls. This aligns with frameworks like NIST CSF's Identify function and the CND methodology's emphasis on situational awareness first.

Answer

Conducting incident containment following a zero-day breach

Answer

Deploying next-generation firewalls across core network segments

Answer

Decommissioning obsolete routers and end-of-life switches

Question 7

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

Accepted Answer

Reverse Path Forwarding (RPF) / uRPF. Reverse Path Forwarding (RPF) or unicast RPF (uRPF) is a feature that checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface that the router would use to send traffic back to that source. If the packet arrives on a different interface, it is dropped, which prevents IP spoofing. This is exactly what the question describes.

Answer

Proxy ARP

Answer

Spanning Tree Protocol (STP)

Answer

Network Address Translation (NAT)

Question 8

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Accepted Answer

DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.. Option A (DKIM) is correct because it adds a cryptographic signature to outbound messages using a private key, with the public key published in a DNS TXT record, allowing receivers to verify message integrity and detect tampering or spoofing. Option C (DMARC) is correct because it builds on SPF and DKIM by publishing a DNS TXT record at _dmarc that tells receivers how to handle messages failing alignment checks (none, quarantine, or reject) and provides aggregate/forensic reporting, directly countering spoofing and credential-harvesting phishing. Option E (SPF) is correct because it publishes a DNS TXT record listing authorized sending hosts (e.g., ip4, ip6, include, -all) so receivers can reject mail from unauthorized servers forging the domain. Option B (DHCP snooping) is incorrect because it is a Layer 2 switch feature that filters rogue DHCP servers and builds IP-to-MAC bindings, unrelated to email authentication. Option D (uRPF) is incorrect because it is a router anti-spoofing technique for validating source IP addresses against the routing table, not an email or DNS control.

Answer

Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

Answer

Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.

Question 9

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for encrypted remote command-line management of network devices, replacing plaintext Telnet on port 23. SSH operates on TCP port 22 and provides confidentiality, integrity, and authentication via cryptographic key exchange, making it the correct choice for secure CLI management of perimeter devices.

Answer

HTTP

Answer

SNMPv1

Answer

TFTP

Question 10

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

Accepted Answer

Recovery. After eradication, the next immediate phase in the NIST SP 800-61 lifecycle is Recovery. Recovery involves restoring systems to normal operation, validating that they are clean, and monitoring for any residual issues. This follows containment and eradication.

Answer

Detection and Analysis

Answer

Preparation

Answer

Post-Incident Activity

Question 11

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

Accepted Answer

Audit and Accountability Retention Policy Violation. The scenario describes security audit logs being purged after 7 days when compliance requires 365-day retention. This is a direct failure of the audit and accountability retention policy — the organization's logging retention controls do not meet the mandated retention period. The control family (Audit and Accountability) and the specific failure (retention policy violation) match exactly.

Answer

Configuration Management Baseline Drift

Answer

Network Redundancy Fault Tolerance Failure

Answer

Access Control Discretionary Discrepancy

Question 12

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Accepted Answer

Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection). In Palo Alto Networks PAN-OS, threat profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis) are attached to a Security Policy rule under the Actions tab in the Profile Setting section. This is where the firewall applies content inspection to traffic matching the rule, enabling signature-based malware detection and vulnerability exploit prevention.

Answer

Zone Protection Profile attached to the external zone

Answer

NAT Policy translation destination field

Answer

Network Interfaces configuration tab

Question 13

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

Accepted Answer

Full-tunnel VPN. A full-tunnel VPN routes all client traffic — including internet-bound traffic — through the VPN tunnel to the corporate data center, where it is inspected by the security stack before reaching the internet. This ensures consistent policy enforcement and prevents split-tunnel bypass. Split-tunnel VPN, by contrast, sends only corporate traffic through the tunnel while internet traffic goes directly.

Answer

Clientless SSL VPN

Answer

Split-tunnel VPN

Answer

Transport mode IPsec VPN

Question 14

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

Accepted Answer

Employee completion rate for mandatory annual cybersecurity awareness training.. Option B is correct because the employee completion rate for mandatory annual cybersecurity awareness training directly measures how effectively the governance program is reducing human-factor risk, which is a recognized indicator of security culture and policy enforcement. Option C is correct because the percentage of critical systems covered by active, tested disaster recovery backup policies demonstrates governance oversight of resilience and business continuity controls, verifying that recovery capabilities are validated rather than merely documented. Option E is correct because the percentage of high-risk vulnerabilities remediated within the defined SLA reflects the organization's ability to enforce risk-based remediation priorities and hold operational teams accountable to governance commitments. Option A is not a governance metric because raw packet volume at the internet gateway is a capacity or traffic statistic that says nothing about policy effectiveness, risk reduction, or control performance. Option D is also not a governance metric because total gigabytes of archived SIEM log data measures storage consumption, not the quality, coverage, or timeliness of detection and response activities.

Answer

Total number of physical packets traversing the core external internet gateway daily.

Answer

Total gigabytes of log data stored in the centralized SIEM archival repository.

Question 15

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

Accepted Answer

It is hypothesis-driven, focusing on assumptions that adversaries are already inside the network. Option A is correct because proactive threat hunting is fundamentally hypothesis-driven: hunters assume adversaries may already be present and form testable hypotheses (e.g., 'attackers are using living-off-the-land binaries for lateral movement') to guide their searches, rather than waiting for an alert. Option C is correct because threat hunting is a human-led, iterative process in which analysts manually and repeatedly query endpoint telemetry (EDR process trees, command lines) and network telemetry (NetFlow, DNS, proxy logs) to validate or refute hypotheses, refining the hunt as findings emerge. These two traits distinguish hunting from reactive SOC monitoring, which is alert-driven and typically triggered by SIEM correlation rules or IDS signatures after suspicious activity is detected. Option B is wrong because hunting is proactive and occurs before or independent of a completed ransomware event, not only afterward. Option D is wrong because hunting complements, but does not replace, preventive controls such as firewalls and endpoint protection agents. Option E is wrong because exclusive reliance on automated SIEM alerts describes reactive monitoring, the very approach hunting is meant to augment.

Answer

It is performed only after a major ransomware encryption event completes

Answer

It replaces network firewalls and endpoint protection agents completely

Answer

It relies exclusively on automated SIEM alerts to trigger response actions