CND Practice Test 19 — 15 Questions

Question 1

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.. In Snort, the suppress rule configuration allows administrators to suppress specific alerts for specific IP addresses or subnets without completely disabling the signature rule globally. Alternatively, modifying rules using threshold or classification is used, but suppress is the direct action for silencing false positives.

Answer

Delete the rule definition entirely from the Snort local rules file.

Answer

Disable all preprocessor inspection engines within the snort.conf configuration file.

Answer

Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

Question 2

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

Accepted Answer

Documenting the business justification, performing risk assessment, and obtaining CAB approval. Change management requires formal peer review, security impact analysis, and change advisory board (CAB) approval prior to production deployment.

Answer

Deleting all existing firewall rules to ensure a clean rulebase state

Answer

Immediately pushing the rule via automated script without prior peer review to minimize downtime

Answer

Disabling change logging to save disk space on the management server

Question 3

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed for sharing IOCs and threat data.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 4

An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?

Accepted Answer

Deploy Group Managed Service Accounts (gMSAs) and enforce strong, complex passwords (minimum 25 characters) for all service accounts.. Kerberoasting targets service accounts with weak passwords. Mitigation involves enforcing strong, complex passwords (12+ characters) or utilizing Group Managed Service Accounts (gMSAs), which automatically manage complex passwords and rotate them frequently.

Answer

Implement SMB signing enforcement and disable NTLMv1 authentication protocol.

Answer

Configure Account Lockout Policies to lock accounts after three failed login attempts.

Answer

Enable Kerberos pre-authentication requirement on all domain user and computer accounts.

Question 5

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

Accepted Answer

Implementing centralized and write-once-read-many (WORM) log storage repositories. Forensic readiness requires continuous log collection, synchronization of time sources (NTP), and establishing secure, tamper-evident storage repositories.

Answer

Disabling all system auditing to maximize storage capacity for business applications

Answer

Allowing users local administrative privileges to troubleshoot their own workstations

Question 6

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

Accepted Answer

Ability to detect previously unknown (zero-day) attacks based on baseline deviations. Anomaly detection can identify zero-day attacks and novel techniques without requiring prior known signatures.

Answer

Instantaneous identification of exact malware families by name without analysis

Answer

Zero computational resource overhead

Answer

Complete absence of false positive alerts in any network environment

Question 7

An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)

Accepted Answer

Kerberoasting by requesting Service Tickets (TGS) for SPN-associated service accounts and cracking them offline.. Kerberoasting targets service accounts with SPNs to crack TGS tickets offline, while AS-REP Roasting targets user accounts that do not require Kerberos pre-authentication to obtain AS-REP tickets for offline cracking.

Answer

Cross-Site Scripting (XSS) via injected JavaScript payloads executed in victim browsers.

Answer

SQL Injection (SQLi) by appending malicious query parameters to authentication web forms.

Answer

ARP Cache Poisoning to intercept local subnet Layer 2 Ethernet frames.

Question 8

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

Accepted Answer

sha256sum evidence.raw. To verify evidence integrity, cryptographic hashing algorithms such as SHA-256 or MD5 are used. On Linux systems, the 'sha256sum' utility is standard for generating hashes to verify file integrity.

Answer

dd if=/dev/sdb of=/evidence.raw --hash=md5

Answer

ftk_imager --verify --md5 evidence.raw

Answer

volatility -f evidence.raw --hash

Question 9

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Accepted Answer

Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.. DNS tunneling embeds arbitrary data within DNS queries (typically in the subdomain labels). Filtering for DNS traffic and analyzing exceptionally long query names containing high entropy or Base64-encoded strings is the standard methodology to detect DNS tunneling.

Answer

Filter for 'http.request.method == POST' and look for binary attachments.

Answer

Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.

Answer

Filter for 'icmp' and examine the payload size of Echo Request packets.

Question 10

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

Accepted Answer

Board of Directors and Executive Management. The Board of Directors and Executive Management hold ultimate accountability for enterprise risk management and governance.

Answer

Junior Firewall Configuration Engineer

Answer

Third-Party External Penetration Testing Consultant

Answer

Lead Network Helpdesk Support Technician

Question 11

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

Accepted Answer

Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.. Allowing the 'none' algorithm or omitting explicit algorithm verification in JWT libraries leads to signature bypass. The application code must explicitly enforce trusted cryptographic algorithms (e.g., HS256 or RS256) and reject tokens specifying 'none'.

Answer

Upgrade the JWT token expiration time (exp claim) to expire within five minutes of creation.

Answer

Implement JSON Web Encryption (JWE) to payload data without verifying headers.

Answer

Store JWT tokens in HTTP-only, Secure cookies instead of local browser storage.

Question 12

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

Accepted Answer

Full Disk Encryption (such as BitLocker or FileVault). Full Disk Encryption (FDE) protects data at rest on laptops against physical theft or unauthorized access.

Answer

Transport Layer Security (TLS) version 1.3

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Intrusion Detection System (IDS) signature files

Question 13

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

Accepted Answer

Create a Sender Policy Framework (SPF) TXT record specifying authorized sending IP addresses.. Sender Policy Framework (SPF) is implemented as a DNS TXT record that lists all authorized IP addresses and mail servers permitted to send emails on behalf of a domain.

Answer

Configure a DomainKeys Identified Mail (DKIM) CNAME record.

Answer

Implement a Domain-based Message Authentication, Reporting, and Conformance (DMARC) TXT record.

Answer

Deploy a Mail Exchange (MX) record pointing to the internal relay gateway.

Question 14

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Accepted Answer

Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert). SOAR platforms automate threat enrichment, orchestrate multi-tool containment playbooks, and streamline alert triage.

Answer

Designing corporate marketing websites

Answer

Replacing physical data center firewalls with robotic hardware arms

Question 15

An enterprise threat intelligence team is consuming a new threat feed formatted in STIX 2.1 to ingest indicators of compromise (IoCs) into their TIP (Threat Intelligence Platform). Which core STIX 2.1 domain object is specifically designed to encapsulate observable data such as file hashes, IP addresses, and domain names?

Accepted Answer

Cyber Observable Object (SCO). In STIX 2.1, the Indicator object defines a pattern that evaluates observables, but the actual atomic observable data (like IPs, file hashes, and URIs) is encapsulated within the STIX Observable object (formerly Indicators in STIX 1.x, but represented via Cyber Observable Objects or SCOs in STIX 2.x). Indicators point to observables to provide context.

Answer

Attack Pattern Object

Answer

Campaign Object

Answer

Threat Actor Object