CND Practice Test 12 — 15 Questions

Question 1

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Setting a strong UEFI/BIOS administrator password to prevent unauthorized configuration changes. Securing firmware requires enabling Secure Boot and setting a strong BIOS/UEFI administrator password.

Answer

Leaving the physical chassis intrusion detection switch disconnected

Answer

Configuring the boot order to prioritize booting from unverified USB flash drives first

Answer

Disabling Trusted Platform Module (TPM) activation across all systems

Question 2

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

Accepted Answer

Described Content Matching (DCM) with a Data Identifier utilizing Luhn algorithm validation. Symantec DLP uses Exact Data Matching (EDM), Described Content Matching (DCM) / Regular Expressions with Luhn validation, or Indexed Document Matching (IDM). DCM combined with validation algorithms matches standard patterns like credit cards.

Answer

Exact Data Matching (EDM)

Answer

Indexed Document Matching (IDM)

Answer

Vector Machine Learning (VML)

Question 3

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

Accepted Answer

Process Lineage and Tree Visualization. EDR tools capture process creation telemetry, allowing analysts to visualize process trees showing parent-child relationships and command-line arguments.

Answer

Network Packet Capture (PCAP)

Answer

Hardware Diagnostics

Answer

Disk Defragmentation

Question 4

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

Accepted Answer

Signature-based detection rules. Signature-based or pattern-matching rules in a WAF inspect HTTP traffic for known signatures and attack patterns (such as SQL injection or XSS strings).

Answer

TCP handshake stateful inspection

Answer

Behavioral anomaly machine learning baseline profiling

Answer

Data Loss Prevention (DLP) pattern matching

Question 5

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

Accepted Answer

arp.exe or ipconfig.exe. Built-in binaries like net.exe, ipconfig.exe, whoami.exe, and nbtstat.exe are frequently abused by attackers for local reconnaissance.

Answer

calc.exe

Answer

mspaint.exe

Answer

notepad.exe

Question 6

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

Accepted Answer

bcrypt via the pgcrypto extension using the crypt(password, gen_salt('bf', 12)) function. Argon2id or bcrypt are modern, memory-hard hashing algorithms recommended for password storage. PostgreSQL supports bcrypt natively via the pgcrypto extension using the crypt() function with a salt and cost factor.

Answer

SHA-256 without a salt

Answer

AES-256-CBC symmetric encryption with a shared database key

Answer

MD5 with a hardcoded static salt

Question 7

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

Accepted Answer

Network protection and Wi-Fi security inspection. Advanced Mobile Threat Defense agents monitor network traffic anomalies, SSL stripping, and ARP spoofing to detect rogue access points and MitM attacks.

Answer

Application sideloading enforcement

Answer

Containerized workspace isolation

Answer

Remote wipe capability for lost devices

Question 8

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them, protecting against pass-the-hash.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 9

A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?

Accepted Answer

Customer Managed Key (CMK) with automatic annual key rotation enabled and backed by AWS CloudHSM. AWS KMS Customer Managed Keys (CMKs) support automatic annual key rotation (setting rotation to true) and can be backed by AWS CloudHSM via Custom Key Store integration.

Answer

S3 Master Symmetric Key with client-side PGP encryption keys

Answer

External Key Store (XKS) with static key material managed on-premise without rotation

Answer

AWS Managed Key with manual rotation every 90 days via CLI

Question 10

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

Accepted Answer

/etc/profile. The system-wide default umask for login shells on many Linux distributions is configured in /etc/profile or /etc/login.defs.

Answer

/etc/ssh/sshd_config

Answer

/etc/security/limits.conf

Answer

/etc/environment

Question 11

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

Accepted Answer

Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class. Group Policy allows restricting removable storage access under Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions.

Answer

Stop and disable the Windows Plug and Play service

Answer

Enable BitLocker To Go on all internal drives

Answer

Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints

Question 12

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

Accepted Answer

Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions. Booting into Safe Mode or using the EDR management console to temporarily disable specific sensor modules (such as kernel process or file monitoring) allows isolation of the conflicting component.

Answer

Uninstall the third-party disk encryption driver permanently

Answer

Reinstall the Windows operating system with a clean image

Answer

Disable Secure Boot in UEFI settings

Question 13

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?

Accepted Answer

Failing to strictly validate the JWT algorithm header, allowing 'none' or asymmetric-to-symmetric key confusion (RS256 to HS256). Accepting 'none' as a valid algorithm or failing to verify the cryptographic signature (e.g., confusing RS256 with HS256 where the public key is treated as the HMAC secret) allows attackers to forge arbitrary JWT payloads.

Answer

Setting an expiration time (exp claim) of 15 minutes

Answer

Storing the JWT inside an HTTP-only Secure cookie instead of localStorage

Answer

Including the user's role claim inside the public payload section

Question 14

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

Accepted Answer

Windows PowerShell Operational Log (Event ID 4104). PowerShell Script Block Logging (Event ID 4104) logs the full content of code blocks as they are executed, capturing obfuscated or encoded scripts in their decoded form.

Answer

System Event Log (Event ID 7045)

Answer

Security Event Log (Event ID 4688)

Answer

Windows Defender Operational Log (Event ID 1116)

Question 15

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

Accepted Answer

Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool. Modern endpoint management and EDR/patch tools integrate third-party catalog feeds to automatically package and push vendor patches to endpoints.

Answer

Manually download and install MSI installers via local administrator logon scripts

Answer

Disable all third-party software on endpoints

Answer

Rely exclusively on Microsoft Windows Update for Business