CND Practice Test 19 — 15 Questions

Question 1

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

Accepted Answer

Enforcing a passcode policy with complexity and auto-lock requirements. Data-at-rest protection on iOS/iPadOS is anchored in the Secure Enclave and the Data Protection API, which derives encryption keys from the device passcode. Without a strong passcode policy enforced via MDM (complexity, minimum length, auto-lock timeout), the encryption keys are trivially derivable and data at rest is effectively unprotected. MDM payloads such as com.apple.security.FDERecoveryKeyEscrow and Passcode Policy enforce these controls across supervised devices.

Answer

Disabling Apple Push Notification service (APNs)

Answer

Enabling AirDrop for all contacts

Answer

Enabling iCloud Backup for all application data

Question 2

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

Accepted Answer

AWS Organizations with all features enabled. AWS Organizations with all features enabled is required to create the organizational structure and enable centralized management of Security Hub across all accounts. Security Hub integrates with Organizations to automatically add new accounts and aggregate findings. All features must be enabled to use service control policies and delegated administration, which are necessary for Security Hub's multi-account setup.

Answer

AWS Shield Advanced

Answer

AWS CloudTrail

Answer

AWS Transit Gateway

Question 3

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

Accepted Answer

Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).. Enabling Rogue AP Detection and Automated Containment on the WLC is correct because the WLC can continuously scan for unauthorized APs, classify them as rogue, and automatically send deauthentication frames to contain the threat. This directly addresses the evil twin attack by detecting the unauthorized AP using the corporate SSID and neutralizing it without manual intervention. It is the purpose-built enterprise wireless feature for this scenario.

Answer

Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).

Answer

Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.

Answer

Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.

Question 4

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

Accepted Answer

Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall. Hub-and-Spoke with User Defined Routes (UDR) pointing to Azure Firewall is correct because it centralizes East-West traffic inspection. In this topology, spoke VNets peer with a hub VNet that hosts Azure Firewall, and UDRs on the spoke subnets force all inter-spoke traffic through the firewall's private IP as the next hop. This satisfies the requirement to inspect all inter-subnet traffic between different virtual networks using a centralized NGFW.

Answer

Full mesh VPC peering between all individual application virtual networks

Answer

Azure ExpressRoute Local circuits with direct peering

Answer

Default Azure Virtual Network peering without route tables

Question 5

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 6

A GCP cloud security team is auditing a Kubernetes cluster running in Google Kubernetes Engine (GKE). Which THREE security hardening steps should be verified to ensure robust cluster security? (Choose THREE)

Accepted Answer

Enable Workload Identity for secure pod-to-GCP-service authentication. Option A is correct because Workload Identity binds a Kubernetes service account to a Google Cloud IAM service account, letting pods authenticate to GCP APIs via short-lived OAuth 2.0 tokens instead of static, long-lived service account keys. Option C is correct because a GKE Private Cluster gives nodes internal-only IPs and keeps the control plane reachable only through authorized networks, drastically shrinking the external attack surface. Option D is correct because Binary Authorization enforces a deploy-time policy that admits only container images signed by trusted attestors, preventing unsigned or tampered images from running. Option B is wrong because exposing the master endpoint to 0.0.0.0/0 removes network isolation and invites brute-force and exploitation attempts against the API server. Option E is wrong because disabling RBAC eliminates least-privilege authorization and lets any authenticated principal perform unrestricted actions, weakening rather than hardening the cluster.

Answer

Expose the Kubernetes master control plane endpoint with public IP accessible from 0.0.0.0/0

Answer

Disable Kubernetes Role-Based Access Control (RBAC) to simplify pod management

Question 7

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at Layer 7 and inspects HTTP/HTTPS requests for application-layer attacks like SQL injection, XSS, and command injection, dropping malicious requests before they reach the web server. It understands HTTP semantics (headers, parameters, cookies, bodies) and can apply signature-based and anomaly-based rules specifically tuned for web applications.

Answer

Network Intrusion Prevention System (NIPS)

Answer

Packet filtering router

Answer

Traditional Stateful Packet Inspection Firewall

Question 8

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

Accepted Answer

Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class. Group Policy's 'Prevent installation of devices using drivers that match these device setup classes' setting lets administrators block entire device setup classes (like USB mass storage, GUID {53f56307-b6bf-11d0-94f2-00a0c91efb8b}) while allowing other USB classes such as smart cards and HID input devices. This is the precise, class-based approach required by the policy.

Answer

Stop and disable the Windows Plug and Play service

Answer

Enable BitLocker To Go on all internal drives

Answer

Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints

Question 9

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

Accepted Answer

/etc/modprobe.d/blacklist.conf. Kernel module blacklisting on Linux is configured in files under /etc/modprobe.d/, conventionally /etc/modprobe.d/blacklist.conf, using the 'blacklist <module>' directive. This prevents the module from being auto-loaded by udev or other mechanisms during boot or hotplug events. For a minimal IoT kernel, this is the standard way to disable USB storage (usb-storage) and Bluetooth (bluetooth, btusb) modules.

Answer

/etc/fstab

Answer

/boot/grub/grub.cfg

Answer

/etc/sysctl.conf

Question 10

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

Accepted Answer

Ability to detect previously unknown (zero-day) attacks based on baseline deviations. Option B is correct because anomaly-based detection compares live traffic against a learned baseline of normal behavior, so deviations can reveal zero-day or previously unknown attacks for which no signature exists yet. Option E is correct because anomaly-based systems build profiles from the organization's own traffic, allowing detection thresholds and models to reflect that environment's unique protocols, hosts, and usage patterns. Options A, C, and D are not correct: anomaly-based detection does not name exact malware families instantaneously (that is signature matching), it typically consumes significant CPU/memory for baselining and statistical analysis, and it is well known for generating false positives when legitimate behavior deviates from the baseline.

Answer

Instantaneous identification of exact malware families by name without analysis

Answer

Zero computational resource overhead

Answer

Complete absence of false positive alerts in any network environment

Question 11

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

Accepted Answer

Windows PowerShell Operational Log (Event ID 4104). The Windows PowerShell Operational Log records script block logging events, specifically Event ID 4104, which captures the decoded contents of script blocks executed by PowerShell. When an encoded command is run, PowerShell decodes it internally, and if script block logging is enabled, the decoded script is written to this log. This makes Event ID 4104 the correct source for retrieving the actual script contents, not just the encoded command line.

Answer

System Event Log (Event ID 7045)

Answer

Security Event Log (Event ID 4688)

Answer

Windows Defender Operational Log (Event ID 1116)

Question 12

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

Accepted Answer

Azure Firewall with Application Rules. Azure Firewall Application Rules operate at Layer 7 and support fully qualified domain names (FQDNs) as target criteria, allowing outbound HTTP/HTTPS/SQL traffic to be filtered by domain name rather than IP. This is the only native Azure resource that natively supports FQDN-based outbound filtering at the network level. Azure Firewall resolves FQDNs via its own DNS proxy and applies allow/deny rules per domain, which is essential when destinations use dynamic IPs (e.g., Microsoft 365, SaaS endpoints).

Answer

Azure Application Gateway with Web Application Firewall

Answer

Network Security Group (NSG) with custom service tags

Answer

User Defined Routes (UDR) pointing to a load balancer

Question 13

An organization is establishing forensic readiness to ensure that digital evidence can be legally and technically sound during an investigation. Which THREE practices directly contribute to organizational forensic readiness? (Choose three)

Accepted Answer

Enforcing strict chain of custody documentation procedures for all acquired evidence. Option C is correct because strict chain of custody documentation is a foundational forensic readiness practice: it records who handled each piece of evidence, when, where, and how, preserving its integrity and admissibility so the evidence can withstand legal scrutiny. Option D is correct because synchronized NTP across all network devices and hosts ensures consistent, correlatable timestamps, which is essential for reconstructing event timelines and for log evidence to be technically and legally credible. Option E is correct because centralized, tamper-evident log archiving preserves log integrity, prevents alteration or deletion, and supports the availability and authenticity of evidence needed during an investigation. Option A is not correct because disabling audit logging destroys the very records needed for an investigation and undermines forensic readiness. Option B is not correct because relying exclusively on volatile RAM analysis discards persistent disk images and backups, losing evidence that survives reboots and weakening the overall forensic capability.

Answer

Disabling audit logging on workstations to preserve local system storage space

Answer

Relying exclusively on volatile RAM analysis without retaining disk images or backups

Question 14

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

Accepted Answer

It consists of multiple interconnected decoy systems simulating an entire network environment.. Option D is correct because a honeynet is by definition a collection of two or more honeypots deployed together and interconnected to emulate a realistic network segment, complete with servers, services, and topology, rather than a single isolated decoy host. Option E is correct because this multi-system design lets defenders observe attacker behavior across hosts, including reconnaissance, pivoting, and lateral movement, yielding richer threat intelligence than a lone honeypot can provide. The unmarked options do not belong: A is wrong because honeynets are heavily instrumented with logging, monitoring, and often IDS/IPS sensors, and are typically placed in a controlled DMZ or isolated segment rather than the unprotected core internal network; B is wrong because a honeynet is a deception and threat-intelligence tool, not a production database cluster; and C is wrong because a honeynet is a complementary detection layer and never replaces firewalls or perimeter defenses.

Answer

It is deployed on the core internal network without any logging or monitoring.

Answer

It is used exclusively as a high-performance database cluster for enterprise clients.

Answer

It replaces the need for any firewalls or perimeter security defenses.

Question 15

A GCP cloud administrator is setting up Cloud VPN to connect an on-premises datacenter to a GCP VPC. Which TWO components must be configured to establish a functional High Availability (HA) VPN gateway? (Choose TWO)

Accepted Answer

A GCP HA VPN gateway providing two public IP addresses automatically. Option A is correct because a GCP HA VPN gateway is the required GCP-side resource for an HA VPN, and it automatically provisions two public IP addresses (one per interface) to provide 99.99% availability when both tunnels are configured. Option C is correct because HA VPN requires dynamic routing via a Cloud Router running BGP to exchange routes between the VPC and the on-premises network, and BGP sessions must be established on each tunnel interface. Option B is incorrect because a dedicated physical fiber interconnect cable is associated with Cloud Interconnect (Dedicated Interconnect), not Cloud VPN, which runs IPsec over the public internet. Option D is incorrect because Cloud Armor is an edge security service for HTTP(S) load balancers and does not attach to VPN gateways. Option E is incorrect because a legacy target VPN gateway with static routes is the older, non-HA VPN construct and does not satisfy the HA VPN requirement.

Answer

A dedicated physical fiber interconnect cable

Answer

A Google Cloud Armor security policy attached to the VPN gateway

Answer

A standalone legacy target VPN gateway with static routes