CND Practice Test 15 — 15 Questions

Question 1

A security operations center (SOC) analyst is investigating a compromised Linux web server. Which TWO log files and forensic artifacts should the analyst examine to determine the initial access vector and persistence mechanisms used by the attacker? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cron job tables and spool directories (/etc/crontab and /var/spool/cron) to check for unauthorized scheduled tasks.. Option A is correct because on Linux, persistence is frequently achieved through scheduled tasks, and examining /etc/crontab along with the per-user spool directories under /var/spool/cron (and /etc/cron.d, /etc/cron.*) reveals unauthorized cron entries that re-execute attacker payloads. Option E is correct because /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) records authentication events, including SSH logins, failed password attempts, accepted publickey sessions, and sudo/su command usage, which are essential for identifying the initial access vector such as brute force or stolen credentials. Option B is not applicable because SYSVOL replication and Group Policy are Active Directory components on Windows domain controllers, not artifacts found on a Linux web server. Option C is irrelevant since MBR partition geometry and cylinder/sector metrics are disk-layout metadata and do not reveal attacker access or persistence. Option D is incorrect because SAM, SYSTEM, and SOFTWARE registry hives are Windows artifacts and do not exist on a Linux host.

Answer

Active Directory SYSVOL replication logs for Group Policy object modifications.

Answer

Master Boot Record (MBR) partition table geometry and cylinder sector metrics.

Answer

Windows Registry hives (SAM, SYSTEM, SOFTWARE) for user credential artifacts.

Question 2

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

Accepted Answer

Distributed across the physical office space as dedicated RF monitoring sensors or dual-band access points. A WIPS sensor must monitor the RF (radio frequency) spectrum to detect rogue APs, evil twins, and unauthorized devices broadcasting corporate SSIDs. Deploying dedicated RF sensors or dual-band APs throughout the physical office space ensures full wireless coverage and accurate detection. Wired or virtual placements cannot see over-the-air threats.

Answer

Installed directly on the core router's uplink interface facing the ISP

Answer

Configured as a virtual machine inside the cloud data center hypervisor cluster

Answer

Attached as a tap on the primary corporate database server's storage area network (SAN)

Question 3

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

Accepted Answer

Information Security Policy. An Information Security Policy is the top-level, umbrella document that establishes the organization's overall security objectives, scope, roles, and principles — including how data is classified, handled, and disposed of. All other policies (patch management, remote access, firewall configuration) derive from and must align with it. Drafting it first creates the baseline expectations that subordinate policies implement.

Answer

Patch Management Policy

Answer

Remote Access Policy

Answer

Firewall Configuration Policy

Question 4

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

Accepted Answer

XCCDF (Extensible Configuration Checklist Description Format). XCCDF is the SCAP standard for expressing security configuration checklists and vulnerability assessments in a machine-readable XML format. OpenSCAP consumes XCCDF documents (often paired with OVAL definitions) to perform automated compliance scans. It is the correct data format for authoring SCAP-compliant checklists.

Answer

Syslog RFC 5424

Answer

CSV (Comma-Separated Values)

Answer

SNMP MIB (Management Information Base)

Question 5

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

Accepted Answer

Throughput capacity and latency impact under peak load. Option A is correct because an inline IPS sits directly in the traffic path, so its throughput capacity and added latency under peak load determine whether it can inspect every packet without becoming a bottleneck or causing timeouts. Option B is correct because inline IPS devices must define fail-open versus fail-closed behavior (often via hardware bypass NICs or external bypass switches) so that a power or software failure either preserves connectivity or intentionally blocks traffic according to policy. Option E is correct because poorly tuned signatures generate false positives that drop legitimate production traffic, so signature tuning and threshold adjustment are essential to avoid self-inflicted outages. Option C is incorrect because an IPS is not a DNS root server and has no role in authoritative DNS resolution. Option D is incorrect because cable color is a physical labeling convention with no bearing on IPS operation or network disruption.

Answer

Configuring the IPS to act as an authoritative DNS root server

Answer

The physical cable color used for connection to the core switch

Question 6

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

Accepted Answer

External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.. In a dual-firewall DMZ architecture, the external firewall should inspect and restrict traffic from the internet to the DMZ, while the internal firewall should restrict traffic from the DMZ to the internal network to only required service ports. This implements defense-in-depth: the external firewall protects the DMZ from internet threats, and the internal firewall prevents a compromised DMZ host from pivoting into the internal network. This segmentation is a security best practice.

Answer

External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.

Answer

External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.

Answer

External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.

Question 7

A security analyst is investigating a compromised network segment and discovers that an attacker bypassed network perimeter access controls by tunneling malicious command-and-control traffic through allowed protocols. Which THREE protocols are most commonly abused for covert data exfiltration and tunneling through corporate firewalls? (Choose three)

Accepted Answer

ICMP (Internet Control Message Protocol). ICMP (A) is correct because attackers commonly tunnel data inside ICMP echo request/reply payloads (e.g., icmptunnel, ptunnel), and many firewalls permit ping for troubleshooting, making it a classic covert channel. HTTPS/TLS on port 443 (B) is correct because encrypted web traffic is almost universally allowed outbound, so C2 traffic blends into normal TLS sessions and cannot be inspected without TLS interception, making it the most prevalent exfiltration channel. DNS on port 53 (D) is correct because DNS queries and responses are typically permitted for name resolution, and attackers abuse it via DNS tunneling tools (e.g., iodine, dnscat2) using TXT, NULL, or CNAME records to carry data. BGP (C) is not a typical covert channel for a compromised host segment; it is a routing protocol between autonomous systems on port 179, and RIP (E) is a legacy interior routing protocol on UDP 520, neither of which is commonly abused for host-level C2 tunneling through perimeter firewalls.

Answer

BGP (Border Gateway Protocol, Port 179)

Answer

RIP (Routing Information Protocol, UDP Port 520)

Question 8

A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)

Accepted Answer

SSL/TLS-based VPN (e.g., OpenVPN or AnyConnect) integrated with an identity provider for MFA. Option C is correct because an SSL/TLS-based VPN such as OpenVPN or Cisco AnyConnect encrypts all client traffic through a TLS tunnel and can be integrated with an identity provider (e.g., RADIUS, SAML, or LDAP) to enforce multi-factor authentication before granting access. Option E is correct because an IPsec VPN client using IKEv2 provides strong encryption of all traffic and supports certificate-based authentication combined with MFA (for example, EAP-MSCHAPv2 plus a one-time token), satisfying both the encryption and MFA mandates. Option A is wrong because Telnet on port 23 transmits credentials and session data in cleartext and offers no MFA. Option B is wrong because PPTP is cryptographically broken and unauthenticated dial-up does not provide MFA or reliable encryption. Option D is wrong because standard HTTP to internal portals is unencrypted and does not itself enforce MFA or encrypt all client traffic.

Answer

Unencrypted Telnet management session over port 23

Answer

Unauthenticated PPTP remote dial-up connection

Answer

Standard HTTP web browsing to internal unencrypted portals

Question 9

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

Accepted Answer

Design Phase. Threat modeling is most effective when integrated during the Design Phase because that is when architectural decisions, data flows, and trust boundaries are defined. Identifying threats at this stage allows flaws to be remediated before code is written, which is far cheaper than fixing them later. This aligns with SSDLC best practices (e.g., Microsoft SDL, OWASP SAMM).

Answer

Retirement Phase

Answer

Maintenance Phase

Answer

Deployment Phase

Question 10

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). It uses the proper Snort rule syntax for detecting large ICMP echo requests. The header 'alert icmp any any -> any any' correctly specifies the ICMP protocol and action, while the option 'dsize:>1000' accurately matches packets with payloads greater than 1000 bytes. This combination directly addresses the requirement to detect ICMP echo requests with payloads exceeding 1000 bytes, which could indicate covert channel data exfiltration.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 11

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

Accepted Answer

Enforces separation of corporate apps and data from personal user applications. Option B is correct because a containerized work profile (e.g., Android Enterprise work profile) creates a cryptographically and logically isolated container where corporate apps, accounts, and data are kept separate from the user's personal apps and data, enforced by the OS. Option D is correct because this separation enables a selective (enterprise) wipe that removes only the work profile and its corporate data while leaving personal photos, messages, and apps intact. Option A is incorrect because work profiles are a native OS feature that does not require rooting or jailbreaking; in fact, rooting/jailbreaking typically breaks the security model and is prohibited. Option C is incorrect because work profiles actually support and often require a secure passcode or biometric for the work container, not the removal of passcodes. Option E is incorrect because the whole point of the container is to limit IT visibility and control to the corporate container, not to grant access to personal photos, messages, or personal app usage.

Answer

Requires rooting or jailbreaking the mobile device during enrollment

Answer

Prevents the use of any passcode on the device

Answer

Gives IT full administrative control over personal photos, messages, and personal app usage

Question 12

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

Accepted Answer

where. The `where` operator in KQL is the filtering operator — it returns only rows from a table that satisfy a given predicate, such as `DeviceProcessEvents | where FileName == 'cmd.exe'`. This is exactly the behavior required to include only rows where the file name matches 'cmd.exe'. It is the KQL equivalent of a SQL WHERE clause and is the standard operator used in Microsoft Defender for Endpoint advanced hunting queries.

Answer

extend

Answer

project

Answer

summarize

Question 13

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Accepted Answer

Potential operational downtime and business impact. Option A is correct because selecting a containment strategy requires weighing the operational downtime and business impact of taking the compromised web server offline, since containment actions such as isolating the host, blocking ports, or shutting it down can disrupt critical services and must be balanced against the severity of the threat. Option D is correct because evidence preservation is a key containment consideration; volatile data such as RAM contents, running processes, and network connections can be lost if the server is powered off or rebooted, so defenders may choose network isolation over shutdown to preserve forensic artifacts. The remaining options are not relevant: Ethernet cable color (B), the IT director's desk location (C), and the server manufacturer's brand name (E) have no bearing on containment strategy selection.

Answer

The color of the Ethernet cables connected to the rack

Answer

The office desk location of the IT director

Answer

The brand name of the server manufacturer

Question 14

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

Accepted Answer

NetFlow and IPFIX traffic flow records. Network-based telemetry is data collected from the network fabric rather than from an endpoint's operating system. Option A (NetFlow and IPFIX traffic flow records) is correct because these are flow-export protocols generated by routers, switches, and firewalls that summarize IP conversations (5-tuple, byte/packet counts, timestamps) without touching host internals. Option C (Full Packet Capture (PCAP) files from network taps) is correct because PCAPs are captured at taps, SPAN ports, or inline sensors and contain raw packet payloads and headers traversing the wire. Option D (DNS query and response logs collected at the recursive resolver) is correct because resolver logs record network name-resolution transactions (query name, type, client IP, response) observed on the network infrastructure, not on the endpoint. Option B (Master File Table ($MFT) filesystem journals) is host-based, as the $MFT is an NTFS metadata structure on a Windows volume, and Option E (Windows Security Event Logs, Event ID 4624) is host-based, since 4624 is a logon event written to the endpoint's Security log.

Answer

Master File Table ($MFT) filesystem journals

Answer

Windows Security Event Logs (Event ID 4624)

Question 15

An organization is aligning its defenses with the NIST SP 800-53 Rev. 5 'Access Control (AC)' control family. Which THREE controls are core requirements within this family? (Choose three)

Accepted Answer

AC-3: Access Enforcement. AC-3 (Access Enforcement) is a core AC family control because it requires the system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, making it fundamental to the Access Control family. AC-2 (Account Management) is also core to AC because it governs the lifecycle of system accounts—creation, enabling, modification, disabling, and removal—which is prerequisite to enforcing access decisions. AC-5 (Separation of Duties) belongs to the AC family and is a core requirement that divides duties of individuals to prevent malevolent activity without collusion, directly addressing access control governance. PE-3 (Physical Access Control) is not in the AC family; it belongs to the Physical and Environmental Protection (PE) family, so it does not satisfy the question. IR-4 (Incident Handling) is not in the AC family; it belongs to the Incident Response (IR) family and addresses incident handling capability rather than access control.

Answer

PE-3: Physical Access Control

Answer

IR-4: Incident Handling