CND Practice Test 18 — 15 Questions

Question 1

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools. Option A is correct because Sysmon Event ID 10 (ProcessAccess) specifically logs when a process opens a handle to another process, and access to lsass.exe by unverified or unusual tools is a classic credential-dumping indicator (e.g., Mimikatz or procdump). Option D is correct because unsigned or unknown binaries running from writable user paths like C:\Users\Public and then opening handles to LSASS combine two strong red flags: masquerading/execution from atypical locations plus direct LSASS access. Option E is correct because Windows Security Event IDs 4656/4663 record handle requests to objects, and a request to lsass.exe with PROCESS_VM_READ (0x0010) is exactly the permission needed to read LSASS memory for credential extraction. Option B is not relevant because dfrgui.exe performing scheduled defragmentation is normal system maintenance and does not touch LSASS memory. Option C is not relevant because a standard user changing their own password via Ctrl+Alt+Del is a legitimate, expected activity that does not involve dumping LSASS credentials.

Answer

Regular scheduled defragmentation of the system volume by dfrgui.exe

Answer

Standard domain user successfully changing their own account password via Ctrl+Alt+Del

Question 2

A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)

Accepted Answer

It establishes a baseline of normal network traffic patterns and detects deviations from that baseline.. Option A is correct because anomaly-based IPS detection works by first profiling legitimate traffic to build a statistical baseline of normal behavior, then flagging activity that deviates from that baseline as suspicious. Option B is correct because, since anomaly detection does not depend on pre-existing signatures, it can identify novel or zero-day attacks whose patterns have never been seen before. Option C is incorrect because relying on an up-to-date database of known malware signatures and attack strings describes signature-based detection, not anomaly-based detection. Option D is incorrect because anomaly-based systems are actually prone to false positives, since legitimate but unusual traffic can deviate from the baseline, and no IPS guarantees zero false positives in high-throughput environments. Option E is incorrect because anomaly-based engines learn behavior dynamically and do not require vendor signature or threat-intelligence updates for every new vulnerability, which again describes signature-based systems.

Answer

It relies on an up-to-date database of known malware signatures and explicit attack strings.

Answer

It guarantees zero false positive alerts in high-throughput enterprise network environments.

Answer

It requires manual updates from vendor threat intelligence feeds every time a new vulnerability is discovered.

Question 3

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

Accepted Answer

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections. In Windows Defender Firewall with Advanced Security, the default outbound action (Allow or Block) is configured per profile under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties, then selecting each profile (Domain, Private, Public) and setting the Outbound connections radio button to Block. This is the only location in GPO where the firewall's default outbound behaviour is defined; individual rules then explicitly permit traffic.

Answer

Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall

Answer

Computer Configuration -> Preferences -> Control Panel Settings -> Network Options

Answer

Computer Configuration -> Policies -> Software Restriction Policies

Question 4

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

Accepted Answer

Transport Layer Security (TLS v1.3). Option C, Transport Layer Security (TLS v1.3), is correct because TLS provides authenticated, encrypted channels over untrusted networks using modern cipher suites and a handshake that negotiates ephemeral keys, ensuring confidentiality and integrity for protocols such as HTTPS. Option E, Internet Protocol Security (IPsec) VPN, is correct because IPsec operates at the network layer to encrypt and authenticate IP packets, commonly in tunnel mode for site-to-site or remote-access VPNs, protecting data in transit across public networks. The unmarked options do not belong: Telnet (A), HTTP (B), and FTP (D) are all plaintext protocols that transmit credentials and data without encryption, so they cannot provide secure communication channels.

Answer

Plaintext Telnet protocol

Answer

Unencrypted HTTP protocol

Answer

Plaintext File Transfer Protocol (FTP)

Question 5

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

Accepted Answer

AWS VPC Flow Logs. AWS VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for network interfaces in a VPC, making them the correct feature to analyze outbound communication from EC2 instances to unknown external IPs. They can be published to CloudWatch Logs or S3 and queried with Athena for anomaly detection.

Answer

Amazon GuardDuty Kubernetes audit logs

Answer

AWS Trusted Advisor network optimization checks

Answer

AWS CloudTrail Management Events

Question 6

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

Accepted Answer

Traceroute / ping utilities to test end-to-end path connectivity and TTL expiration. Option A is correct because traceroute and ping utilities test end-to-end path connectivity and reveal where TTL expiration or ICMP unreachables occur, helping localize the hop or firewall at which packets stop traversing the path. Option B is correct because packet analyzers such as tcpdump or Wireshark capturing on the firewall's ingress and egress interfaces show whether packets actually arrive, are malformed, or are dropped before/after inspection, providing ground-truth evidence of the drop point. Option C is correct because firewall packet flow tracing/debug tools like Cisco ASA packet-tracer or Palo Alto's global packet diagnostic simulate or follow a specific flow through the policy, NAT, and inspection stages, explicitly reporting the rule or stage that drops the packet. Option D does not belong because reformatting the firewall disk and reinstalling BIOS firmware is a destructive hardware/firmware recovery action, not a diagnostic method for identifying where traffic is dropped. Option E does not belong because permanently disconnecting all internal switch uplinks would cause an outage and remove the traffic needed for diagnosis rather than help identify the drop cause.

Answer

Reformatting the firewall hard drive and reinstalling the BIOS firmware

Answer

Disconnecting all internal switch uplinks permanently

Question 7

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

Accepted Answer

Cloud Storage Bucket Lock using Object Retention Policies (WORM). Cloud Storage Bucket Lock with Object Retention Policies enforces WORM (Write Once Read Many) semantics, preventing any user—including project owners and root administrators—from modifying or deleting objects until the retention period expires. Once a retention policy is locked, it cannot be shortened or removed, satisfying the 5-year compliance mandate. This is the only GCP feature that provides immutable, tamper-proof retention at the object level.

Answer

Google Cloud IAM Bucket-Level Access Control with deny policies

Answer

Customer-managed encryption keys (CMEK) with scheduled key rotation

Answer

GCP Storage object versioning with lifecycle rules

Question 8

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

Accepted Answer

Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.. A Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID can identify applications regardless of port, inspect payloads, and block unauthorized outbound traffic and unknown protocols. This is essential for detecting and stopping data exfiltration over non-standard ports like TCP 4443. Traditional stateless filtering and NAT cannot perform this level of application-aware inspection.

Answer

Configure a stateless packet filtering access control list on the core router interface.

Answer

Activate standard IP source guard on all internal user-facing switch access ports.

Answer

Enable Network Address Translation (NAT) overload (PAT) on the perimeter router.

Question 9

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

Accepted Answer

SSH (Secure Shell) version 2. SSH version 2 provides strong encryption for all traffic, including authentication and command-line sessions, using algorithms like AES and Diffie-Hellman key exchange. This satisfies the policy requirement for an encrypted tunnel during remote administration. Telnet, TFTP, and HTTP transmit data in cleartext, offering no confidentiality. Therefore, SSHv2 is the only listed protocol that meets the encryption mandate.

Answer

TFTP (Trivial File Transfer Protocol)

Answer

HTTP over port 80

Answer

Telnet over port 23

Question 10

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

Accepted Answer

Network protection and Wi-Fi security inspection. Network protection and Wi-Fi security inspection is the MTD capability that detects rogue access points, evil twins, and man-in-the-middle attacks by monitoring the device's network connections and analyzing Wi-Fi traffic for anomalies. This directly addresses the requirement to detect network-layer threats such as rogue APs and MitM attacks.

Answer

Application sideloading enforcement

Answer

Containerized workspace isolation

Answer

Remote wipe capability for lost devices

Question 11

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

Accepted Answer

Establishing the CSIRT, defining escalation paths, and drafting incident response procedures. ISO/IEC 27035's 'Planning and Preparation' phase is about building the incident management capability before incidents occur — establishing the CSIRT, defining escalation paths, and drafting incident response procedures. These governance activities ensure that when a major breach happens, roles, communication channels, and playbooks are already in place. The other options describe actions taken during detection, response, or post-incident phases.

Answer

Isolating compromised VLANs from the core routing backbone during an active attack

Answer

Restoring critical database backups from immutable offsite storage vaults

Answer

Performing root-cause analysis on active command-and-control channels

Question 12

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

Accepted Answer

AWS CloudTrail combined with Amazon EventBridge and SNS alerts. AWS CloudTrail records all API activity in the account, including IAM and EC2 security group modifications. Amazon EventBridge can match specific CloudTrail events (e.g., unauthorized ModifyPolicy or AuthorizeSecurityGroupIngress calls) and route them to Amazon SNS for alerting. This combination provides the required monitoring and notification pipeline.

Answer

AWS Direct Connect combined with VPC Flow Logs

Answer

AWS Config rules combined with Amazon Inspector

Answer

AWS WAF combined with Amazon Route 53 DNS logging

Question 13

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

Accepted Answer

Documenting the business justification, performing risk assessment, and obtaining CAB approval. Firewall rule changes in production require documented business justification, a risk assessment of the change's impact, and approval from the Change Advisory Board (CAB) before deployment. This ensures the change is authorized, auditable, and aligned with the organization's risk appetite. Skipping any of these steps violates ITIL-aligned change management and can introduce security gaps or outages.

Answer

Deleting all existing firewall rules to ensure a clean rulebase state

Answer

Immediately pushing the rule via automated script without prior peer review to minimize downtime

Answer

Disabling change logging to save disk space on the management server

Question 14

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

Accepted Answer

Strategic threat intelligence. Strategic threat intelligence is high-level, long-term intelligence focused on the adversary's intent, motivations, campaign histories, and overall risk posture. It is consumed by executives and decision-makers to shape security strategy and investment. The scenario describes detailed campaign histories and adversary motivations, which are hallmarks of strategic intelligence rather than operational, tactical, or technical feeds.

Answer

Operational threat intelligence

Answer

Tactical threat intelligence

Answer

Technical threat intelligence

Question 15

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Accepted Answer

Application awareness and identification (App-ID). Option A is correct because Enterprise NGFWs use deep packet inspection and application signatures (e.g., Palo Alto App-ID, Cisco NBAR) to identify applications regardless of port or protocol, which traditional stateful firewalls cannot do since they only track TCP/UDP sessions and ports. Option E is correct because NGFWs integrate user identification (e.g., User-ID via Active Directory, LDAP, or Captive Portal) to enforce policies based on user or group identity rather than just IP addresses, a capability absent from traditional stateful firewalls. Option B is incorrect because NGFWs operate at Layers 3 through 7, not exclusively at Layer 2. Option C is incorrect because NGFWs commonly decrypt and inspect HTTPS traffic via SSL/TLS decryption. Option D is incorrect because NGFWs use identity, application, and content-based controls, not static MAC address filtering.

Answer

Strict restriction to operating exclusively at Layer 2 (Data Link layer)

Answer

Inability to inspect encrypted HTTPS traffic under any circumstances

Answer

Exclusive reliance on static MAC address filtering for access control