CND Practice Test 17 — 15 Questions

Question 1

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Accepted Answer

AlienVault Open Threat Exchange (OTX). AlienVault Open Threat Exchange (OTX) is correct because it is a free, publicly accessible community platform where researchers share indicators of compromise (IOCs) such as IP addresses, domains, and file hashes, making it a classic OSINT source for network defenders. The National Vulnerability Database (NVD), maintained by NIST, is also correct because it publicly publishes CVE records, CVSS severity scores, and CPE applicability data that defenders use for vulnerability management without any restricted access. Internal employee performance reviews are not OSINT since they are private organizational records, not publicly available intelligence. Proprietary zero-day broker feeds requiring an NDA and subscription fees are closed-source (commercial) intelligence, not open-source. Classified military signals intelligence intercepts are classified government intelligence, which by definition falls outside OSINT.

Answer

Internal employee performance reviews

Answer

Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

Answer

Classified military signals intelligence intercepts

Question 2

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Option C, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, is correct because this machine-wide Run key causes listed programs to execute automatically at system startup for all users, a classic autostart location abused for persistence. Option D, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key launches listed programs at logon of that user, and it is frequently used since it often requires no administrative privileges. Option E, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, is correct because values such as Shell, Userinit, and Notify in this key are hijacked to execute malicious code during the logon process. Option A, HKEY_CLASSES_ROOT\.txt\DefaultIcon, is not a standard autostart persistence location; it only defines the default icon for .txt files and does not trigger execution at boot or logon. Option B, HKEY_PERFORMANCE_DATA\CurrentPerformance, is a volatile performance-counter hive used for system metrics, not a persistence mechanism, so it does not belong.

Answer

HKEY_CLASSES_ROOT\.txt\DefaultIcon

Answer

HKEY_PERFORMANCE_DATA\CurrentPerformance

Question 3

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

Accepted Answer

Configuring a management IP address on a management interface or BVI (Bridge Virtual Interface) for device access. In Transparent (Layer 2) mode, the firewall forwards frames between interfaces in the same bridge domain without acting as a Layer 3 hop, so option D is correct: a management IP must be assigned to a dedicated management interface or a BVI so administrators can reach the device for configuration, monitoring, and updates, since the data interfaces themselves carry no routable addresses. Option E is also correct because the participating interfaces must be bound into a common bridge group (or equivalent Layer 2 zone) so the firewall can bridge traffic between them and apply policy to the bridged flows. Option A is wrong because assigning Layer 3 IPs to every data interface is characteristic of Routed mode, not Transparent mode, where data interfaces remain unnumbered. Option B is wrong because BGP peering requires Layer 3 adjacency and is irrelevant to a Layer 2 bridge deployment. Option C is wrong because transparent firewalls still enforce security rules on bridged traffic; Layer 2 operation does not disable filtering.

Answer

Assigning Layer 3 IP addresses to every data interface participating in packet routing

Answer

Configuring dynamic BGP peering on all client-facing ports

Answer

Removing all security rules since Layer 2 devices cannot filter traffic

Question 4

A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)

Accepted Answer

Disabling ICMP redirect processing on host operating systems and core routers. Option A is correct because disabling ICMP redirect processing on hosts and routers prevents an attacker from using forged ICMP redirect messages to alter a victim's routing table and insert themselves as a man-in-the-middle. Option B is correct because IPv6 RA Guard on switch access ports filters and drops rogue Router Advertisement messages, blocking the RA spoofing vector used to hijack the default gateway. Option E is correct because source address validation and uRPF (Unicast Reverse Path Forwarding) drop packets whose source addresses do not match the expected inbound path, making it harder for an attacker to spoof addresses needed for these redirection attacks. Option C is not appropriate because Spanning Tree PortFast is a Layer 2 convergence feature and does not mitigate ICMP redirect or IPv6 RA spoofing, and enabling it on trunk ports can even cause loops. Option D is incorrect because SNMPv1 community strings are weak management credentials and do not provide any protection against local network redirection attacks.

Answer

Enabling Spanning Tree PortFast across all trunk ports

Answer

Enabling SNMPv1 community strings on all perimeter routing devices

Question 5

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

Accepted Answer

Dynamic ARP Inspection (DAI) leveraging the DHCP snooping database to drop spoofed ARP packets.. Option A is correct because Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets on untrusted ports, dropping ARP spoofing attempts that would otherwise enable man-in-the-middle attacks at Layer 2. Option C is correct because Port Security restricts the number of source MAC addresses learned on an access port and can take violation actions such as shutdown, restrict, or protect, mitigating MAC flooding and unauthorized device attachment. Option E is correct because DHCP Snooping builds the trusted IP-to-MAC binding database that DAI and IP Source Guard rely on, while also rate-limiting and blocking rogue DHCP server offers on untrusted ports. Option B does not belong because BGP Route Flap Damping is an inter-domain routing stability mechanism applied at the WAN/ISP edge, not a Layer 2 switch hardening feature. Option D does not belong because a Web Application Firewall inspects HTTP application-layer traffic and is irrelevant to protecting a switch's Layer 2 control plane.

Answer

Border Gateway Protocol (BGP) Route Flap Damping to stabilize wide-area inter-domain routing.

Answer

Web Application Firewall (WAF) rule sets for HTTP parameter parsing and inspection.

Question 6

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

Accepted Answer

Freeze global object prototypes using Object.freeze() and validate incoming JSON keys to disallow __proto__ assignments. Prototype pollution occurs when attacker-controlled JSON keys like __proto__ or constructor.prototype are merged into objects, altering Object.prototype and affecting all objects in the Node.js process. The correct remediation is to freeze the global prototypes with Object.freeze(Object.prototype) and to validate/reject incoming JSON keys that contain __proto__, constructor, or prototype before any merge or assignment. This directly blocks the pollution vector at the source rather than trying to sanitize output.

Answer

Sanitize all input parameters using DOMPurify before rendering them

Answer

Configure CORS headers with Access-Control-Allow-Origin set to specific domains

Answer

Implement parameterized SQL queries for all database interactions

Question 7

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

Accepted Answer

clevis and systemd-cryptsetup. Clevis and systemd-cryptsetup are used together to enable automatic decryption of LUKS-encrypted volumes using a TPM 2.0 chip. Clevis provides a framework for automated decryption, and systemd-cryptsetup integrates with systemd to unlock the volume during boot without manual passphrase entry.

Answer

fdisk partition manager

Answer

gnupg keychain agent

Answer

cryptsetup-reencrypt

Question 8

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Accepted Answer

Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges. Option A is correct because pg_hba.conf is the host-based access control file that determines which clients may connect and how they authenticate; enforcing scram-sha-256 (the strongest built-in password method, replacing md5) and narrowing remote CIDR ranges blocks unauthorized hosts and prevents password-hash replay attacks. Option B is correct because loading the pgcrypto extension enables column-level encryption functions (e.g., pgp_sym_encrypt) so sensitive data is encrypted at rest within the database, protecting it even if table files or backups are exposed. Option D is correct because setting ssl = on in postgresql.conf together with ssl_cert_file and ssl_key_file (valid server certificate paths) encrypts client-server traffic in transit, preventing credential and data interception. Option C is wrong because null superuser passwords with trust authentication allow anyone to connect as superuser without credentials, a critical vulnerability. Option E is wrong because disabling logging removes the audit trail needed to detect and investigate unauthorized access, and it does nothing to secure access or data at rest.

Answer

Set superuser password to null and allow trust authentication for all interfaces

Answer

Disable all logging in postgresql.conf to maximize query execution performance

Question 9

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Accepted Answer

Optical Network Tap (Test Access Point). Option A (Optical Network Tap, or Test Access Point) is correct because a passive optical tap splits the light signal so a copy of the traffic is sent to the NIDS while the original traffic continues uninterrupted, which is a standard out-of-band collection method. Option D (Switch Port Analyzer, or SPAN/Mirror Port) is correct because SPAN copies frames from one or more switch ports or VLANs to a monitoring port where the NIDS sensor is connected, making it a common way to collect traffic for analysis. Option B is not a collection method but an inline active blocking mechanism, which describes IPS functionality rather than NIDS traffic capture. Option C is incorrect because modifying external client TCP/IP stacks is not a deployment mode for collecting traffic and would be an endpoint-based approach, not a NIDS collection method. Option E is incorrect because DHCP broadcasts are used for address assignment, not for rewriting routing tables to collect traffic for a NIDS.

Answer

Inline active blocking mechanism that terminates malicious TCP sessions directly

Answer

Directly modifying the TCP/IP stack of external client operating systems

Answer

Using DHCP broadcast packets to rewrite routing tables

Question 10

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

Accepted Answer

Querying authentication logs for service accounts logging in interactively via remote desktop. MITRE ATT&CK T1078 (Valid Accounts) describes adversaries using legitimate credentials to authenticate, so the best hunting methodology is to look for anomalous authentication behavior — such as service accounts logging in interactively via RDP, which violates normal service-account usage patterns. Querying authentication logs for that behavior directly aligns with detecting misuse of valid accounts, making B correct.

Answer

Scanning internal subnets for unpatched EternalBlue vulnerabilities

Answer

Searching endpoint logs for known ransomware string signatures

Answer

Checking firewall rules for outbound traffic on port 443

Question 11

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

Accepted Answer

The proxy's custom Root CA certificate installed into the workstations' Trusted Root Certification Authorities store. For SSL interception, the Squid proxy generates a forged certificate for each HTTPS site on the fly, signed by its own internal Root CA. For clients to trust these forged certificates without warnings, the proxy's Root CA certificate must be installed in each workstation's Trusted Root Certification Authorities store. This establishes a chain of trust so browsers accept the intercepted TLS sessions transparently.

Answer

The public keys of every external website visited by users

Answer

An expired SSLv2 certificate bundle

Answer

Self-signed SSH host keys generated on the Squid proxy

Question 12

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

Accepted Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4104. PowerShell script block logging writes events to the Microsoft-Windows-PowerShell/Operational log with Event ID 4104, containing the full text of executed script blocks. This is the primary source for inspecting PowerShell code executed on a Windows system, including obfuscated or malicious scripts.

Answer

Security log, Event ID 4688

Answer

System log, Event ID 7045

Answer

Microsoft-Windows-PowerShell/Operational, Event ID 4103

Question 13

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

Accepted Answer

Stateful Inspection Firewall. A Stateful Inspection Firewall operates at Layer 3 (network) and Layer 4 (transport) to inspect packet headers and maintain a state table of established connections. It makes dynamic forwarding decisions based on the context of the traffic — for example, allowing return traffic for an outbound session without an explicit rule. This stateful behavior distinguishes it from stateless packet filters.

Answer

Unmanaged Layer 2 Switch

Answer

Patch Panel

Answer

Hub

Question 14

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

Accepted Answer

IIS Request Filtering with rules to deny double-encoding and path traversal sequences ('..'). IIS Request Filtering is the built-in module that inspects incoming requests and can deny URL sequences, double-encoded characters, and path traversal patterns like '..'. Configuring it to reject double-encoded sequences ('%2e%2e%2f') and traversal strings blocks the attack at the web server layer before it reaches the application. This is the native IIS defense for path traversal and encoded URL attacks.

Answer

HTTP Compression Schema module

Answer

IP Address and Domain Restrictions module

Answer

Windows Authentication Provider with Kerberos constraints

Question 15

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.. IMDSv2 requires a session token obtained via a PUT request before metadata can be retrieved, which defeats most SSRF attacks that can only issue simple GET requests. Combining IMDSv2 with strict URL parsing and allow-listing on the web application prevents attackers from crafting requests to 169.254.169.254, addressing both the architectural and application-layer causes.

Answer

Upgrade the web server operating system and apply all vendor-supplied kernel patches.

Answer

Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.

Answer

Install a host-based intrusion detection system (HIDS) to monitor web application log directories.