CND Practice Test 2 — 10 Questions

Question 1

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 2

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

Accepted Answer

Validate the file's magic bytes (header signature), enforce an extension whitelist, and store files outside the web root. Preventing arbitrary file upload RCE requires validating the file's actual content (magic bytes/header signature), enforcing a strict extension whitelist, and storing uploaded files outside the web root so they cannot be executed. This triple control defeats both extension-spoofing (e.g., 'shell.php.jpg') and direct execution of uploaded payloads. Magic-byte validation ensures the file truly is the claimed type, not a renamed script.

Answer

Pass the uploaded file directly to the operating system's eval() function

Answer

Compress the uploaded file using ZIP format before saving

Answer

Check only the filename extension provided in the client's HTTP multipart header

Question 3

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a Cisco IOS feature that allows administrators to apply a QoS policy to traffic destined for the router's control plane (the CPU). It rate-limits or drops excessive control-plane traffic, such as routing protocol updates, ICMP, and management access, preventing CPU exhaustion attacks from external floods. By protecting the control plane, CoPP ensures the router remains stable and available even under attack.

Answer

Spanning Tree Root Guard

Answer

Port Security

Answer

Dynamic ARP Inspection (DAI)

Question 4

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

Accepted Answer

Enable Amazon S3 Block Public Access settings across all AWS accounts and buckets.. Amazon S3 Block Public Access is a preventive control that overrides bucket policies and ACLs to reject any public access, regardless of how the bucket is configured. Enabling it at the account level ensures that even newly created buckets or misconfigured policies cannot expose data publicly. This directly addresses the requirement to prevent public accessibility due to misconfigurations.

Answer

Deploy an AWS WAF web access control list on Amazon CloudFront distributions.

Answer

Configure AWS Security Hub with CIS AWS Foundations Benchmark compliance standards.

Answer

Install a host-based antivirus agent on all EC2 virtual machine instances.

Question 5

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

Accepted Answer

IEEE 802.1Q. IEEE 802.1Q is the standard that defines VLAN tagging on Ethernet frames, inserting a 4-byte tag into the frame header that carries the VLAN ID (12 bits, supporting 4094 usable VLANs). On a trunk link between switches, 802.1Q tags each frame so the receiving switch knows which VLAN the frame belongs to, enabling logical segmentation of the finance and HR departments across shared physical infrastructure.

Answer

IEEE 802.1X

Answer

IEEE 802.3ad

Answer

IEEE 802.11i

Question 6

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase of incident response involves monitoring alerts, validating whether they are true or false positives, and determining scope and impact. Triaging an EDR alert about cmd.exe with encoded arguments—a common living-off-the-land technique—falls squarely in this phase. Eradication and Recovery occur after a confirmed incident, and Preparation is the pre-incident readiness stage.

Answer

Eradication

Answer

Recovery

Answer

Preparation

Question 7

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

Accepted Answer

Prohibiting the creation and download of user-managed service account keys where possible. Option B is correct because user-managed service account keys are long-lived credentials that, once downloaded, can be exfiltrated and used to impersonate the service account; prohibiting their creation and download (and instead using short-lived credentials via Workload Identity Federation, service account impersonation, or attached service accounts) directly reduces credential theft risk. Option C is correct because enforcing least privilege with predefined or custom IAM roles limits each principal to only the permissions required, which prevents privilege escalation paths that arise when identities hold excessive permissions. Option A is wrong because disabling Cloud Audit Logs removes the audit trail needed to detect and investigate unauthorized privilege escalation or credential misuse, and it does not improve IAM hygiene. Option D is wrong because assigning primitive roles like Owner or Editor grants broad, excessive permissions that violate least privilege and enable privilege escalation. Option E is wrong because publishing service account JSON keys publicly exposes credentials to anyone, directly enabling credential theft and unauthorized access.

Answer

Disabling Google Cloud Audit Logs to reduce storage overhead

Answer

Assigning broad primitive roles (Owner, Editor) to all project contributors

Answer

Sharing service account JSON keys publicly in public GitHub repositories for collaboration

Question 8

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting the make, model, serial number, and signing an evidence custody form is the immediate step required to establish and maintain chain of custody upon physical removal of the drive. This documentation creates the legal record of who had control of the evidence, when, and under what conditions, which is essential for evidentiary integrity in court.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 9

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy. Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 10

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7, analyze parameters, and block SQL injection signatures using rule sets and anomaly scoring. It sits in front of the web application and can dynamically detect and mitigate SQLi attempts, including union-based queries.

Answer

Configure a reverse proxy load balancer with IP hashing persistence algorithms.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.

Answer

Implement a stateful network firewall configured with Layer 4 packet inspection rules.