CND Practice Test 15 — 15 Questions

Question 1

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/etc/modprobe.d/blacklist.conf. Kernel module blacklisting on modern Linux distributions is configured by creating configuration files inside the /etc/modprobe.d/ directory.

Answer

/etc/fstab

Answer

/boot/grub/grub.cfg

Answer

/etc/sysctl.conf

Question 2

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

Accepted Answer

VPC Firewall rules blocking port 22 inbound from 0.0.0.0/0, combined with Identity-Aware Proxy (IAP). Disabling IP forwarding and removing SSH ingress firewall rules while using Identity-Aware Proxy (IAP) TCP forwarding secures SSH access.

Answer

Google Cloud Armor perimeter security

Answer

Google Cloud DNS DNSSEC configuration

Answer

Shared VPC host project firewall restriction

Question 3

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Accepted Answer

Analyze the log files to verify if an unauthorized breach has occurred. According to NIST SP 800-61, Preparation is the first phase, but when actively handling an event, the first operational phase of the incident response lifecycle is Detection and Analysis.

Answer

Contain the compromised host to prevent lateral movement

Answer

Perform post-incident lessons learned activities

Answer

Eradicate the malware from the impacted SSH server

Question 4

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

Accepted Answer

Memory regions containing executable code that do not back to any file on disk (unbacked memory). Process injection leaves artifacts such as memory permission changes (PAGE_EXECUTE_READWRITE), unbacked memory regions, and mismatched thread start addresses.

Answer

Standard file creation timestamps in the $MFT

Answer

Default Windows system wallpaper configuration settings

Question 5

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

Accepted Answer

It is hypothesis-driven, focusing on assumptions that adversaries are already inside the network. Threat hunting is a proactive, hypothesis-driven pursuit of adversaries rather than waiting for automated alerts to trigger.

Answer

It is performed only after a major ransomware encryption event completes

Answer

It replaces network firewalls and endpoint protection agents completely

Answer

It relies exclusively on automated SIEM alerts to trigger response actions

Question 6

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

Accepted Answer

clevis and systemd-cryptsetup. clevis is a client-side automated decryption framework that integrates with systemd-cryptsetup to unlock LUKS volumes using network policies or TPM2 bindings.

Answer

fdisk partition manager

Answer

gnupg keychain agent

Answer

cryptsetup-reencrypt

Question 7

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

Accepted Answer

Disabling installation from unknown sources and enforcing Managed Google Play accounts. Disabling 'Unknown Sources' (installations from outside Google Play) combined with forcing Google Play managed accounts ensures secure app management.

Answer

Configuring devices in personal use profile mode

Answer

Disabling factory reset protection (FRP)

Answer

Enabling USB debugging mode for all users

Question 8

An enterprise cloud architect is configuring Google Cloud VPC Network Service Tiers to optimize cost and security for sensitive internal database traffic. Which service tier should be selected to ensure traffic stays entirely within Google's private global backbone network without touching the public internet?

Accepted Answer

Premium Tier Network Routing. Google Cloud Premium Tier routes traffic over Google's private global network backbone, whereas Standard Tier uses public transit peering.

Answer

Hybrid Tier Routing via Cloud Interconnect

Answer

Public IP Tier with SSL offloading

Answer

Standard Tier Network Routing

Question 9

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Accepted Answer

Amazon VPC Security Groups acting as stateful virtual firewall instances. Security Groups, Network ACLs (NACLs), and AWS Network Firewall provide multi-layered network isolation and traffic filtering in AWS.

Answer

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Answer

AWS Shield Standard for intra-VPC subnet routing

Question 10

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. Establishing command and control channels after successful exploitation is classified under the Command and Control phase of the Cyber Kill Chain.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 11

An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)

Accepted Answer

Cross-Site Scripting (XSS) by inspecting parameters for malicious injected client-side script tags.. WAFs are specifically designed to inspect HTTP traffic and mitigate web vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injection (SQLi).

Answer

ARP cache poisoning by validating ARP reply frames against DHCP snooping bindings.

Answer

BGP route hijacking by verifying autonomous system path announcements.

Answer

DHCP starvation attacks by monitoring DHCP Discover message rates on edge switches.

Question 12

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

Accepted Answer

unhide. rkhunter or chkrootkit can check for hidden processes, but specialized tools like unhide directly compare ps/top outputs with direct procfs/syscall examination to detect hidden PIDs.

Answer

lsof -i

Answer

netstat -anp

Answer

ps aux --forest

Question 13

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

Accepted Answer

Enforcing a passcode policy with complexity and auto-lock requirements. Enforcing device encryption (which is built into iOS devices when a passcode is set) ensures data at rest is encrypted with hardware keys.

Answer

Disabling Apple Push Notification service (APNs)

Answer

Enabling AirDrop for all contacts

Answer

Enabling iCloud Backup for all application data

Question 14

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

Accepted Answer

Azure Firewall with Application Rules. Azure Firewall supports application rules based on FQDNs for outbound network traffic, allowing filtering without relying on static IP addresses.

Answer

Azure Application Gateway with Web Application Firewall

Answer

Network Security Group (NSG) with custom service tags

Answer

User Defined Routes (UDR) pointing to a load balancer

Question 15

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

Accepted Answer

Private Google Access enabled on the subnet. Private Google Access allows VM instances without external IP addresses to reach Google APIs and services using internal IP addresses.

Answer

GCP Cloud NAT gateway attached to the subnet

Answer

External HTTP(S) Load Balancer

Answer

Dedicated Interconnect with partner peering