CND Practice Test 20 — 15 Questions

Question 1

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions. Booting into Safe Mode loads only essential drivers, preventing the EDR kernel-mode driver from starting and allowing administrative access to the system. Once in Safe Mode, the administrator can change the EDR driver's start type (e.g., from boot-start to demand-start) or apply sensor configuration exclusions to prevent the conflict with the third-party disk encryption filter driver. This isolates the conflicting driver without removing critical security controls or data protection.

Answer

Uninstall the third-party disk encryption driver permanently

Answer

Reinstall the Windows operating system with a clean image

Answer

Disable Secure Boot in UEFI settings

Question 2

An enterprise security architect is designing a Zero Trust network segmentation model. Which THREE core principles are foundational to Zero Trust architecture regarding network access and device verification? (Choose three)

Accepted Answer

Assuming breach and inspecting all traffic regardless of whether it originates internally or externally. Option A is correct because Zero Trust assumes breach and inspects all traffic regardless of whether it originates internally or externally, eliminating the notion of a trusted internal network. Option C is correct because least privilege access is a core Zero Trust principle that limits users to only the specific applications and resources they require, reducing lateral movement. Option D is correct because Zero Trust requires continuous verification of user identity and device security posture for every access request, rather than trusting a session after initial authentication. Option B is incorrect because implicit trust of internal network segments after LAN or VPN connection directly contradicts Zero Trust. Option E is incorrect because static perimeter firewalls as the sole control reflect a traditional perimeter model, not Zero Trust.

Answer

Implicit trust of internal network segments once a user connects to the corporate LAN or VPN

Answer

Static perimeter firewalls as the sole security control required to protect enterprise assets

Question 3

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

Accepted Answer

NGFWs can identify applications regardless of port numbers using Deep Packet Inspection and heuristic analysis.. Option B is correct because NGFWs use Deep Packet Inspection (DPI) and heuristic/behavioral analysis to identify applications by their traffic signatures and behavior, allowing them to recognize applications even when they run on non-standard ports or tunnel over HTTP/HTTPS, which traditional port-based firewalls cannot do. Option E is correct because NGFWs integrate user identity awareness, typically via Active Directory or LDAP integration, so access control policies can be written against users and groups rather than only IP addresses, adding an identity dimension to enforcement. Option A is wrong because it reverses the roles: traditional firewalls operate at layers 3 and 4, while NGFWs add layer 7 application inspection. Option C is wrong because static ACLs based only on source/destination IP and TCP/UDP ports describe traditional firewalls, not NGFWs. Option D is wrong because NGFWs commonly perform SSL/TLS decryption and inspection themselves, and traditional firewalls do not require external proxy servers for that purpose.

Answer

Traditional firewalls inspect layer 7 payloads while NGFWs are strictly restricted to layer 3 and layer 4 filtering.

Answer

NGFWs rely exclusively on static access control lists based strictly on source IP, destination IP, and TCP/UDP ports.

Answer

Traditional firewalls require external proxy servers to perform SSL/TLS decryption, whereas NGFWs cannot inspect encrypted traffic.

Question 4

A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?

Accepted Answer

TUN mode operates at Layer 3 (Network Layer) routing IP packets without layer 2 broadcast traffic.. TUN mode is a Layer 3 (Network Layer) virtual interface that routes IP packets between the client and the VPN server, carrying only unicast IP traffic and no Layer 2 broadcast or multicast frames. This makes it ideal for remote-access VPNs where clients need routed access to corporate subnets, not bridged LAN access. TAP mode, by contrast, operates at Layer 2 and carries Ethernet frames including broadcasts.

Answer

TUN mode only supports TCP transport and cannot function over UDP connections.

Answer

TUN mode operates at Layer 2 (Data Link Layer) handling Ethernet frames and broadcasts.

Answer

TUN mode requires the use of MAC-level bridging across all connected client interfaces.

Question 5

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

Accepted Answer

Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs. The correct mitigation is to force all internal clients to use designated internal DNS resolvers and block direct outbound UDP/TCP 53 to external IPs at the perimeter. This prevents internal hosts from establishing arbitrary DNS tunnels to attacker-controlled authoritative servers while still allowing legitimate recursive resolution through controlled resolvers that can be monitored and filtered.

Answer

Block all outbound TCP and UDP port 53 traffic globally across the entire perimeter firewall

Answer

Implement an HTTP web proxy to inspect all DNS packets at Layer 7

Answer

Enable spanning-tree root guard on all switch access ports

Question 6

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

Accepted Answer

At least every 6 months and after any significant infrastructure modification. PCI-DSS v4.0 Requirement 11.3.1 mandates that external penetration testing be performed at least once every 6 months and after any significant change to the CDE infrastructure or applications. This cadence ensures that newly exposed services or configuration changes are validated against real-world attack techniques. The other options misstate the frequency or scope.

Answer

Every 30 days continuously across all internal subnets

Answer

Annually following the completion of the fiscal budget review

Answer

Only upon the initial deployment of the cardholder data environment

Question 7

An enterprise is reviewing its Disaster Recovery (DR) and Business Continuity (BC) policies. During a risk assessment, the team calculates the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical database systems. Which THREE factors directly influence these metrics? (Choose three)

Accepted Answer

Criticality of the business application and financial impact of downtime. Option B is correct because the criticality of the business application and the financial impact of downtime directly drive how aggressively RTO and RPO targets are set — a revenue-critical database demands tighter objectives than a low-impact system. Option D is correct because backup frequency and type determine the maximum data loss window (RPO): continuous replication yields near-zero RPO, while nightly batch backups allow up to 24 hours of loss. Option E is correct because hardware restoration speed and data recovery throughput determine how quickly systems can be brought back online, directly bounding the achievable RTO. Option A is incorrect because coffee machine branding has no bearing on recovery metrics, and option C is incorrect because exterior paint color is irrelevant to RTO/RPO calculations.

Answer

The brand name of office breakroom coffee machines

Answer

The geographic color of the exterior data center facility paint

Question 8

A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?

Accepted Answer

Event Source: sts.amazonaws.com, Event Name: AssumeRole. AWS STS AssumeRole events are logged in CloudTrail with eventSource sts.amazonaws.com and eventName AssumeRole, capturing when an IAM user or role assumes another role, including cross-account role assumption. Searching for this event identifies principals that have obtained administrative privileges via role assumption.

Answer

Event Source: s3.amazonaws.com, Event Name: PutBucketPolicy

Answer

Event Source: organizations.amazonaws.com, Event Name: AcceptHandshake

Answer

Event Source: iam.amazonaws.com, Event Name: CreateUser

Question 9

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

Accepted Answer

Enable Deep Packet Inspection (DPI) with protocol decoding for FTP to dynamically open pinholes for data channels.. To support active FTP, the firewall must inspect the FTP control channel (port 21) and dynamically open ephemeral data ports based on the PORT/PASV commands. This requires Deep Packet Inspection (DPI) with an FTP protocol decoder, which allows the firewall to understand FTP signaling and create temporary pinholes. Enabling DPI for FTP is the correct mechanism to handle the dynamic nature of FTP data connections.

Answer

Implement an explicit HTTP Proxy service with SSL/TLS decryption enabled.

Answer

Configure a static Destination NAT (DNAT) rule mapping port 21 to an internal range of ephemeral ports.

Answer

Disable stateful tracking for FTP traffic and rely strictly on stateless packet filtering access control lists.

Question 10

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

Accepted Answer

sudo cryptsetup luksFormat /dev/sdb1. The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Answer

sudo fdisk /dev/sdb1 --encrypt

Answer

sudo mkfs.ext4 -e encrypted /dev/sdb1

Answer

sudo mount -o encrypt /dev/sdb1 /mnt/secure

Question 11

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

Accepted Answer

Network Segmentation. Network segmentation is the practice of dividing a large network into smaller, isolated subnetworks (segments) using VLANs, subnets, firewalls, or SDN policies to limit the blast radius of a breach and restrict lateral movement. It is a foundational zero-trust and defense-in-depth control.

Answer

Packet Fragmentation

Answer

Network Bridging

Answer

Network Flooding

Question 12

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Accepted Answer

Enforcing SELinux in targeted or multi-category security (MLS) mode. Option A is correct because SELinux is a Linux MAC implementation, and running it in enforcing mode (targeted or MLS) applies mandatory type/level policy that confines processes beyond standard discretionary permissions. Option D is correct because AppArmor enforces per-program MAC profiles, so confining critical network-facing daemons limits what files, capabilities, and network operations they can access even if compromised. Option E is correct because sysctl hardening such as fs.suid_dumpable=0 and kernel.kptr_restrict=2 restricts privilege-relevant information leaks and core dumps that could expose kernel addresses or sensitive process memory. Option B is incorrect because chmod 777 makes home directories world-writable, weakening access control rather than enforcing MAC or least privilege. Option C is incorrect because disabling audit logging and accounting removes accountability and monitoring, which does not restrict process privileges and undermines hardening.

Answer

Setting all user home directory permissions to world-writable (chmod 777)

Answer

Disabling all audit logging and accounting daemons

Question 13

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

Accepted Answer

Enforce LDAP signing and channel binding while disabling anonymous LDAP enumeration via Group Policy.. Anonymous LDAP enumeration allows unauthenticated attackers to query the directory for user, group, and attribute information, which is exactly the reconnaissance described. Enforcing LDAP signing and channel binding via Group Policy hardens the LDAP channel against relay and tampering attacks, while disabling anonymous LDAP enumeration blocks the unauthenticated queries. Together these controls directly mitigate the observed technique.

Answer

Enable Kerberos pre-authentication enforcement on all Domain Controller service principal accounts.

Answer

Configure SMB packet signing globally and disable SMBv1 across all domain member servers.

Answer

Implement NT LAN Manager (NTLM) v2 exclusive authentication and disable NTLM fallback.

Question 14

An enterprise administrator is setting up an AWS Site-to-Site VPN connection between an on-premises data center and an AWS VPC. To ensure maximum data confidentiality and integrity across the public internet, which IPsec cryptographic parameters should be enforced in the VPN tunnel configuration?

Accepted Answer

AES-256 encryption, SHA-2 (SHA-384) integrity, and DH Group 14 or higher. For maximum confidentiality and integrity over an IPsec tunnel, AES-256 provides strong symmetric encryption, SHA-2 (e.g., SHA-384) provides robust integrity/authentication, and DH Group 14 (2048-bit MODP) or higher ensures strong Perfect Forward Secrecy. These parameters align with modern cryptographic best practices and AWS VPN recommendations. Weaker ciphers like DES, RC4, MD5, and low DH groups are deprecated and vulnerable.

Answer

RC4 encryption, SHA-1 integrity, and no PFS

Answer

AES-128 encryption, MD5 integrity, and DH Group 2

Answer

DES encryption, MD5 integrity, and DH Group 1

Question 15

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

Accepted Answer

VPC Firewall rules blocking port 22 inbound from 0.0.0.0/0, combined with Identity-Aware Proxy (IAP). To block direct SSH from the internet while still allowing authorized access, you create a VPC firewall rule that denies ingress on TCP/22 from 0.0.0.0/0, and then use Identity-Aware Proxy (IAP) TCP forwarding to grant access based on IAM identity and context. IAP tunnels SSH through Google's infrastructure, so the instance never needs to accept public SSH connections. This is Google's recommended 'zero trust' pattern for administrative access.

Answer

Google Cloud Armor perimeter security

Answer

Google Cloud DNS DNSSEC configuration

Answer

Shared VPC host project firewall restriction