CND Practice Test 14 — 15 Questions

Question 1

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Conditional Access policies combined with Azure VPN Gateway. Microsoft Entra Conditional Access evaluates user identity, device compliance (via Intune), and sign-in risk (location, behavior) before granting access, which is the core of Zero Trust. Combined with Azure VPN Gateway, it enforces these policies for remote workers connecting to Azure-hosted virtual desktops. This integration provides the identity- and context-aware gate that ZTNA requires.

Answer

Classic RADIUS authentication server on an Azure VM

Answer

Azure Network Security Groups with IP source restrictions

Answer

Azure Application Gateway with cookie-based affinity

Question 2

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

Accepted Answer

Three-legged firewall architecture creating separate internal, external, and DMZ zones. A three-legged firewall architecture (also called a tri-homed firewall) uses three separate network interfaces to create distinct security zones: external (internet), internal (trusted LAN), and DMZ (public-facing services). This enforces segmentation so that compromised public web servers in the DMZ cannot directly reach internal database servers, and all traffic between zones must pass through the firewall's inspection policy. It directly satisfies the requirement for an intermediary inspection zone between public web servers and internal databases.

Answer

Placing all web and database servers on the same internal VLAN protected by host firewalls

Answer

Single-firewall dual-homed architecture with a software loopback filter

Answer

Direct flat bridging between the external router and the internal core switch

Question 3

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

Accepted Answer

Board of Directors and Executive Management. The Board of Directors and Executive Management hold ultimate legal and fiduciary responsibility for an organization's information security posture and risk management decisions. This is because they are accountable to shareholders, regulators, and other stakeholders for the overall governance of the organization, including cybersecurity risk. They set the tone at the top, approve security strategies, and ensure adequate resources are allocated to mitigate risks. While other roles may implement or assess security controls, the ultimate accountability cannot be delegated.

Answer

Junior Firewall Configuration Engineer

Answer

Third-Party External Penetration Testing Consultant

Answer

Lead Network Helpdesk Support Technician

Question 4

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

Accepted Answer

Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs. The principle of least privilege requires that firewall rules between the DMZ and the internal application tier follow an implicit deny posture, permitting only the specific destination ports and IP addresses required for legitimate application traffic. This limits lateral movement if the DMZ is compromised, since an attacker cannot reach arbitrary internal hosts or services. Explicitly enumerating allowed flows also produces an auditable rule set that supports network defense lifecycle management (design, implement, monitor, maintain).

Answer

Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic

Answer

Disable firewall packet filtering on internal interfaces to maximize application throughput

Answer

Permit all internal traffic by default, blocking only known malicious signatures

Question 5

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

Accepted Answer

Enabling Windows Defender Exploit Protection system settings (e.g., CFG, DEP, ASLR). Option A is correct because Windows Defender Exploit Protection enforces memory-corruption mitigations such as Control Flow Guard (CFG), Data Execution Prevention (DEP), and Address Space Layout Randomization (ASLR), which directly harden processes against memory-based exploits. Option C is correct because Credential Guard uses virtualization-based security (VBS) to isolate LSA secrets in a protected environment, preventing tools like Mimikatz from harvesting NTLM hashes and Kerberos tickets. Option D is correct because Attack Surface Reduction (ASR) rules block behaviors commonly used in exploit chains and credential theft, such as Office child-process creation, script-based execution, and credential dumping via lsass. Option B does not belong because disabling UPnP removes a network discovery/port-mapping convenience feature and does not mitigate memory exploits or credential theft. Option E does not belong because disabling SMBv1 addresses lateral movement and legacy protocol vulnerabilities (e.g., WannaCry) rather than memory-based exploitation or credential dumping on the endpoint itself.

Answer

Disabling Universal Plug and Play (UPnP) service on endpoints

Answer

Disabling the Server Message Block v1 (SMBv1) protocol

Question 6

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

Accepted Answer

Disabling installation from unknown sources and enforcing Managed Google Play accounts. To prevent users from installing apps from unknown sources and ensure corporate apps update automatically, the EMM/MDM policy should disable installation from unknown sources and enforce Managed Google Play accounts. This configuration restricts app installation to approved sources and allows automatic updates through Managed Google Play.

Answer

Configuring devices in personal use profile mode

Answer

Disabling factory reset protection (FRP)

Answer

Enabling USB debugging mode for all users

Question 7

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

Accepted Answer

Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool. Third-party applications (browsers, PDF readers, Java, etc.) are not covered by Microsoft's native update channels, so the scalable solution is to integrate third-party patch catalogs (e.g., Patch My PC, Ivanti, or vendor catalogs) into MECM or a dedicated patch management platform. This automates detection, download, and deployment of third-party updates alongside Microsoft patches.

Answer

Manually download and install MSI installers via local administrator logon scripts

Answer

Disable all third-party software on endpoints

Answer

Rely exclusively on Microsoft Windows Update for Business

Question 8

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

Accepted Answer

Identify. The NIST CSF Identify function encompasses asset management, governance, risk assessment, and risk management strategy — exactly the activities described (categorizing assets, establishing governance policies, conducting risk assessments). Identify is the foundational function that establishes organizational understanding of cybersecurity risk.

Answer

Detect

Answer

Respond

Answer

Recover

Question 9

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

Accepted Answer

Digital Guardian Endpoint Agent with Web Inspection / Browser Control module. Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Answer

Digital Guardian Discovery Server

Answer

Digital Guardian Network Sensor

Answer

Digital Guardian Cloud Analytics Engine (CAE)

Question 10

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

Accepted Answer

VRRP (Virtual Router Redundancy Protocol). VRRP (Virtual Router Redundancy Protocol) is designed to provide first-hop redundancy by allowing multiple routers or firewalls to share a virtual IP address and MAC address. The active device owns the virtual IP and forwards traffic, while the standby takes over seamlessly if the active fails, ensuring continuous availability for hosts that use the virtual IP as their default gateway.

Answer

RADIUS

Answer

BGP (Border Gateway Protocol)

Answer

DHCP (Dynamic Host Configuration Protocol)

Question 11

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

Accepted Answer

Implementing strict network segmentation and firewall micro-perimeter isolation around the legacy host. When immediate replacement of an end-of-life OS is impossible, best practice is to isolate the legacy host using strict network segmentation and firewall micro-perimeter controls. This limits the attack surface and prevents lateral movement, even if the host is compromised. Segmentation buys time until a replacement can be deployed.

Answer

Exposing the legacy host directly to the public internet for easier monitoring

Answer

Disabling the system logging service to prevent disk space exhaustion

Answer

Granting full local administrator privileges to all domain users

Question 12

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

Accepted Answer

To locally compress, encrypt, and forward normalized log telemetry to the central SIEM collector. Forwarders or agents on endpoints are designed to collect, normalize, compress, and encrypt log telemetry locally, then forward it to the central SIEM collector. This enables the SIEM to ingest data from distributed segments without requiring direct network access to each endpoint, supporting proactive threat hunting and rapid detection. The agent handles buffering during network outages and ensures data integrity in transit.

Answer

To act as a stateful firewall blocking unauthorized inbound and outbound network packets on the host

Answer

To perform full disk encryption key escrow and manage endpoint certificate lifecycles

Answer

To automatically execute remediation scripts and isolate compromised endpoints without human intervention

Question 13

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

Accepted Answer

Annualized Loss Expectancy (ALE). Annualized Loss Expectancy (ALE) is the correct answer because it quantifies financial exposure in monetary terms by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). This allows a CISO to translate technical risk into a dollar figure that a board of directors can directly understand and use for budget and risk-acceptance decisions. It is the standard quantitative risk metric used in executive risk reporting.

Answer

Packet drop rate on enterprise core firewalls

Answer

Common Vulnerability Scoring System (CVSS) base score

Answer

Active directory domain controller CPU utilization

Question 14

During a network security audit, the auditor requests evidence that the principle of least privilege is enforced for administrative access to core network infrastructure routers. Which artifact should the network administrator provide to demonstrate compliance?

Accepted Answer

TACACS+ or RADIUS accounting records coupled with RBAC role definitions mapped to administrative job functions.. Least privilege for administrative access is demonstrated by AAA accounting records that show exactly who logged in, when, and what commands they executed, paired with RBAC role definitions that map job functions to specific privilege levels. TACACS+ (or RADIUS) accounting logs provide the audit trail, while the RBAC documentation proves that each admin was granted only the permissions their role requires. Together they are the direct evidence an auditor needs to verify least-privilege enforcement.

Answer

The enterprise backup policy outlining retention periods for offsite media.

Answer

The vulnerability scanning report listing missing security patches on network devices.

Answer

NetFlow export configurations showing traffic volume across core interfaces.

Question 15

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

Accepted Answer

Encrypted log forwarding via HTTPS REST APIs to the SIEM collector. Option B is correct because forwarding logs via HTTPS REST APIs encrypts the data in transit with TLS and allows the SIEM collector to authenticate the sender and validate integrity through the TLS channel and HTTP-level authentication. Option C is correct because Syslog over TLS, standardized on TCP port 6514, wraps syslog messages in a TLS session that provides confidentiality, server authentication, and message integrity, which is exactly what secure centralized log transmission requires. The unmarked options do not belong: unencrypted UDP Syslog on port 514 (A) sends cleartext datagrams with no integrity or authentication, TFTP (D) is an unauthenticated, unencrypted file transfer protocol, and SNMPv1 traps (E) are sent in cleartext with weak community-string authentication and no integrity protection.

Answer

Unencrypted UDP Syslog (Port 514)

Answer

Unauthenticated TFTP log backup transfers

Answer

SNMPv1 trap forwarding