CND Practice Test 13 — 15 Questions

Question 1

An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) (A) is a foundational sub-policy because it defines how employees may use organizational IT assets, covering email, internet, and device usage, which directly supports the governance umbrella of an Information Security Policy framework. The Access Control Policy (B) is also foundational because it specifies rules for granting, reviewing, and revoking access to systems and data, establishing least privilege and need-to-know principles that underpin security governance. Options C, D, and E are not policy documents but technical network configuration artifacts: Spanning Tree Protocol priority values, BGP route advertisement rules, and OSPF area design are operational networking details, not governance-level security policies.

Answer

Spanning Tree Protocol Priority Table

Answer

BGP Routing Advertisement Standard

Answer

OSPF Area Design Specification

Question 2

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

Accepted Answer

Server Name Indication (SNI) fields in the TLS Client Hello message. Option C is correct because the SNI field in the TLS Client Hello is sent in cleartext even when the rest of the session is encrypted, so the analyst can see which hostnames a client is contacting and flag anomalous or DGA-like domains. Option D is correct because JA3 (client) and JA3S (server) fingerprints are derived from the TLS Client Hello and Server Hello parameters (version, cipher suites, extensions, elliptic curves), letting the analyst detect malware families or non-browser TLS stacks even without decrypting traffic. Option E is correct because X.509 certificate metadata such as issuer, validity dates, and self-signed status is observable during the handshake and can reveal suspicious or internally generated certificates used by C2 or exfiltration channels. Option A does not belong because HTTPS payload bodies are encrypted by TLS, so plaintext passwords are not directly extractable from captured traffic without decryption keys or a TLS-terminating proxy. Option B does not belong because raw ICMP echo payload strings are unrelated to TLS handshake anomalies and would not identify encrypted-channel exfiltration.

Answer

Plaintext passwords extracted from HTTPS payload bodies

Answer

Raw ICMP echo payload strings

Question 3

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

Accepted Answer

Enhanced enforcement of granular access control policies between zones. Option B is correct because network segmentation divides the enterprise into distinct zones (e.g., DMZ, internal, PCI, guest) separated by firewalls or ACLs, which allows granular, zone-to-zone access control policies to be enforced rather than relying on a flat network with broad trust. Option E is correct because segmentation limits an attacker's ability to move laterally after compromising a host; by restricting east-west traffic between segments, a breach is contained within its zone, reducing blast radius and dwell time. The unmarked options do not belong: A is false because segmentation complements, not replaces, firewalls and monitoring; C is false because no architecture guarantees prevention of all zero-day malware on endpoints; and D is false because segmentation does not automatically encrypt data at rest, nor does encryption come without performance overhead.

Answer

Elimination of the need for any firewalls or security monitoring

Answer

Guaranteed prevention of all zero-day malware infections on endpoints

Answer

Automatic encryption of all data at rest without performance overhead

Question 4

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

Accepted Answer

Process Lineage and Tree Visualization. Process lineage and tree visualization reconstructs the parent-child relationships between processes (e.g., winword.exe → powershell.exe → cmd.exe), letting analysts see the full execution chain that led to a suspicious child process. This is a core EDR capability because it exposes attack patterns like Office macros spawning scripting engines — a hallmark of phishing and fileless malware. Without lineage, an isolated alert on the child process lacks the context needed to determine whether it is malicious.

Answer

Network Packet Capture (PCAP)

Answer

Hardware Diagnostics

Answer

Disk Defragmentation

Question 5

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Accepted Answer

Never allow direct, uninspected traffic from the external zone to pass straight through the DMZ into the internal network.. Option B is correct because a core DMZ design rule is that traffic from the external/untrusted zone must never be permitted to traverse the DMZ and reach the internal network without being terminated, inspected, or proxied by a security control; this prevents attackers from using the DMZ as a pivot point. Option C is correct because public-facing services such as web and DNS servers are the classic DMZ residents — they must be reachable from the internet, so placing them in the DMZ isolates them from the protected internal network. Option D is correct because least privilege applied through granular firewall rules between the DMZ and the internal network limits lateral movement; only specific, required flows (for example, a web server initiating a single TCP port to a specific backend database) should be allowed. Option A is incorrect because granting internal users unrestricted, unmonitored access to DMZ administrative portals violates least privilege and monitoring requirements, turning the DMZ into an unmanaged attack path. Option E is incorrect because disabling perimeter firewall logging destroys the audit trail needed for detection, incident response, and compliance; logging should be retained and tuned, not turned off.

Answer

Allow internal users unrestricted, unmonitored access to all DMZ administrative portals by default.

Answer

Disable all logging on perimeter firewalls to conserve CPU cycles.

Question 6

A network security engineer is designing a secure enterprise wireless network architecture to mitigate modern wireless attacks. Which THREE security configurations and protocols should be mandated? (Choose THREE)

Accepted Answer

WPA3-Enterprise with 192-bit cryptographic strength. Option B is correct because WPA3-Enterprise with 192-bit cryptographic strength (Suite-B, using GCMP-256, HMAC-SHA-384, and ECDHE) provides the strongest standardized wireless encryption and is mandated for high-security environments to defeat offline dictionary and downgrade attacks. Option C is correct because Protected Management Frames (PMF, defined in 802.11w) cryptographically protects deauthentication, disassociation, and action frames, preventing spoofing and deauth/disassoc denial-of-service attacks that plague WPA2 networks. Option E is correct because a Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, detects and automatically contains rogue APs, evil twins, and misconfigured clients, which is essential for mitigating modern wireless threats. Option A is not appropriate because open authentication with MAC address filtering offers no real confidentiality or integrity, and MAC addresses are trivially spoofed. Option D is not appropriate because WEP shared key authentication is cryptographically broken (RC4 with weak IVs) and enables trivial key recovery, so it must never be mandated even for legacy compatibility.

Answer

Open authentication with MAC address filtering

Answer

WEP shared key authentication for legacy device compatibility

Question 7

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (Inspection) is the feature that allows an NGFW to decrypt encrypted traffic, inspect the plaintext payload against DPI signatures, and then re-encrypt it before forwarding. Without this, HTTPS traffic remains encrypted and DPI cannot see inside, so malicious payloads bypass detection. This is essential for enforcing security policies on encrypted sessions.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 8

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

Accepted Answer

Local Security Policy (secpol.msc). Local Security Policy (secpol.msc) is the Microsoft Management Console snap-in that exposes Account Policies — including Password Policy (complexity, minimum length, history) and Account Lockout Policy — for standalone Windows systems not governed by domain Group Policy. It writes to the local security database and is the correct tool for non-domain-joined endpoints.

Answer

Local Users and Groups (lusrmgr.msc)

Answer

Group Policy Management Console (gpmc.msc)

Answer

System Configuration (msconfig.exe)

Question 9

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Accepted Answer

Perimeter firewalls controlling traffic entering and leaving the zone. Option A is correct because a DMZ is by definition a segmented perimeter network, and perimeter firewalls (often deployed as an external firewall facing the Internet and an internal firewall facing the trusted LAN) enforce the access-control policy that governs traffic entering and leaving the zone. Option D is correct because the classic purpose of a DMZ is to host public-facing services such as web, mail, DNS, or reverse-proxy servers that must be reachable from untrusted networks while being isolated from the internal corporate network. Option B is incorrect because hubs are legacy, unswitched devices that broadcast all traffic to every port and provide no segmentation or access control, making them unsuitable for any security zone, let alone a DMZ. Option C is incorrect because internal Active Directory domain controllers authenticate users and hold sensitive directory data, so placing them in a DMZ would expose the core identity infrastructure to Internet-facing threats; DMZ hosts should use separate, isolated identity services if needed. Option E is incorrect because unrestricted direct fiber links to employee home routers would bypass perimeter firewalls and create an unmonitored, unauthenticated path into the enterprise network, violating DMZ segmentation principles.

Answer

Unprotected hubs connecting all corporate workstations

Answer

Internal active directory domain controllers serving workstation logins

Answer

Unrestricted direct fiber connections to employee home routers

Question 10

A security engineer is performing a security audit of an enterprise firewall and discovers several misconfigurations. Which THREE of the following practices represent severe security vulnerabilities in firewall deployment? (Choose three)

Accepted Answer

Configuring a default 'any-any-allow' rule at the bottom of the security policy rulebase without logging. Option A is correct because a default 'any-any-allow' rule at the bottom of the rulebase silently permits all traffic that fails to match earlier rules, effectively negating the firewall's deny-by-default posture, and the absence of logging removes any audit trail or detection capability. Option B is correct because exposing the management GUI/SSH directly to the internet without a VPN or source IP restriction gives attackers a reachable authentication surface for brute-force, credential-stuffing, and exploitation of management-plane vulnerabilities, violating the principle of out-of-band, restricted administrative access. Option E is correct because leaving factory default administrator usernames and passwords active allows trivial unauthorized access using publicly documented credentials, leading to full device compromise and policy manipulation. Option C does not belong because enabling stateful inspection on internal DMZ interfaces is a recommended, security-enhancing practice, not a vulnerability. Option D does not belong because strict reverse path forwarding on external interfaces is a legitimate anti-spoofing control that mitigates IP spoofing and asymmetric routing attacks.

Answer

Enabling stateful inspection on all internal DMZ interfaces

Answer

Implementing strict reverse path forwarding (RPF) checks on external interfaces

Question 11

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

Accepted Answer

Windows Defender Firewall with Advanced Security. Windows Defender Firewall with Advanced Security supports application-based (program-based) rules in addition to port/protocol rules. Each rule can specify the executable path (e.g., C:\Program Files\App\app.exe), and the firewall evaluates inbound/outbound traffic against that program identity. This satisfies the requirement of filtering by application executable name rather than only IP/port.

Answer

Windows User Account Control (UAC)

Answer

Windows BitLocker Drive Encryption

Answer

Windows Subsystem for Linux (WSL)

Question 12

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

Accepted Answer

Network engineers implement emergency rule modifications directly in production without pre-testing or CAB approval.. Implementing emergency firewall rule changes directly in production without pre-testing or CAB approval represents the highest risk because it bypasses change control, potentially introducing misconfigurations that can cause outages or security breaches. This deficiency directly threatens network availability and security posture by allowing untested changes.

Answer

Change request ticket numbers are generated automatically by software rather than handwritten logs.

Answer

Change request forms require the signature of the lead network architect rather than the CISO.

Answer

Firewall change tickets are archived in a digital repository for only 12 months instead of 3 years.

Question 13

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Accepted Answer

stats sum(bytes) by dest_ip. The stats command in Splunk is used for aggregating and summarizing data. Using 'stats sum(bytes) by dest_ip' calculates the total outbound bytes for each destination IP address, directly fulfilling the requirement. This is the standard SPL syntax for grouped aggregation.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 14

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Accepted Answer

Executing remote lock and remote wipe commands for lost or stolen devices. Option A is correct because MDM platforms universally support remote lock and remote wipe as core security actions, allowing administrators to secure or erase a lost or stolen tablet via push commands over the management channel. Option C is correct because MDM can enforce device-wide encryption requirements, such as mandating BitLocker, FileVault, or Android storage encryption, and can report or block devices that fail to meet this compliance policy. Option B is not a standard MDM security policy, since MDM is designed to restrict untrusted software and firmware rather than permit unrestricted custom firmware installation. Option D is not standard, as MDM relies on over-the-air communication to manage devices and would not permanently disable all such channels. Option E is not a security policy, because removing screen lock passcode requirements weakens device security rather than enforcing it.

Answer

Allowing unrestricted installation of custom untrusted firmware packages

Answer

Disabling all over-the-air communication channels permanently

Answer

Removing all screen lock passcode requirements

Question 15

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

Accepted Answer

Network-level containment. Isolating an infected subnet from the rest of the corporate network is a network-level containment strategy because it restricts the blast radius at the network layer rather than on individual hosts or applications. This approach segments the network so the worm cannot spread laterally to other subnets while the team remediates the infected systems. It is a common early step in worm outbreak response.

Answer

Host-level containment

Answer

Full enterprise quarantine

Answer

Application-level containment