CND Practice Exam 2 — 20 Questions

Question 1

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies implemented in GKE allow administrators to define granular traffic rules based on pod labels and namespaces.

Answer

Identity-Aware Proxy (IAP)

Answer

Google Cloud Armor security policies

Answer

VPC Firewall Rules using subnet tags

Question 2

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Accepted Answer

Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools. Credential dumping leaves specific traces, including abnormal handles opened to LSASS, unexpected processes reading LSASS memory, and specific Event IDs.

Answer

Regular scheduled defragmentation of the system volume by dfrgui.exe

Answer

Standard domain user successfully changing their own account password via Ctrl+Alt+Del

Question 3

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

Accepted Answer

AWS Organizations with all features enabled. AWS Organizations must be enabled and configured with all-features mode before Security Hub can aggregate findings across multiple accounts in an enterprise environment.

Answer

AWS Shield Advanced

Answer

AWS CloudTrail

Answer

AWS Transit Gateway

Question 4

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

Accepted Answer

Enforces separation of corporate apps and data from personal user applications. Containerized work profiles separate work apps/data from personal data and allow IT to wipe corporate data independently.

Answer

Requires rooting or jailbreaking the mobile device during enrollment

Answer

Prevents the use of any passcode on the device

Answer

Gives IT full administrative control over personal photos, messages, and personal app usage

Question 5

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to VMs directly over SSL (port 443) without public IP addresses on the VMs.

Answer

Azure VPN Gateway with point-to-site configuration

Answer

Azure Load Balancer with TCP reset enabled

Answer

Azure Front Door with Web Application Firewall

Question 6

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

Accepted Answer

Azure Key Vault (Managed HSM or Standard Vault). Azure Key Vault allows organizations to generate, manage, and control cryptographic keys used for customer-managed key encryption in Azure Storage.

Answer

Azure Information Protection (AIP)

Answer

Azure Active Directory (Microsoft Entra ID) Identity Protection

Answer

Azure Sentinel (Microsoft Sentinel)

Question 7

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery orchestrates and manages replication, failover, and recovery of workloads, replicating VM disks across regions.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 8

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

Accepted Answer

Remove all current security groups and attach an isolation security group with deny-all rules. Detaching existing security groups and attaching a strict isolation security group that blocks all inbound and outbound traffic allows forensic analysis while preventing network lateral movement.

Answer

Terminate the EC2 instance and restore from the latest snapshot

Answer

Modify the instance state to 'stopped' via AWS CLI

Answer

Delete the attached Elastic Network Interface (ENI)

Question 9

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

Accepted Answer

Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall. Azure Virtual Network Hub-and-Spoke architecture routes all inter-spoke traffic through a centralized Hub virtual network containing Azure Firewall or third-party NVA appliances.

Answer

Full mesh VPC peering between all individual application virtual networks

Answer

Azure ExpressRoute Local circuits with direct peering

Answer

Default Azure Virtual Network peering without route tables

Question 10

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The find command with -perm -4000 searches for files with the SUID permission bit set across the file system.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 11

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Disabling root SSH login and enforcing strict file permissions (umask) are standard Linux hardening best practices.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 12

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI with Cilium supports network policies and data plane encryption (IPsec/WireGuard) for node-to-node and pod-to-pod traffic in AKS.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 13

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

Accepted Answer

Cloud Storage Bucket Lock using Object Retention Policies (WORM). Cloud Storage Bucket Lock using Object Retention Policies (WORM storage) enforces Write Once, Read Many compliance protections that cannot be bypassed even by bucket owners.

Answer

Google Cloud IAM Bucket-Level Access Control with deny policies

Answer

Customer-managed encryption keys (CMEK) with scheduled key rotation

Answer

GCP Storage object versioning with lifecycle rules

Question 14

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications securely without exposing traffic to the public internet.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 15

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Accepted Answer

stats sum(bytes) by dest_ip. The 'stats' command in Splunk is used for statistical aggregation, such as summing total bytes per destination IP.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 16

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model, Infrastructure and Capability are core meta-features that describe how the Adversary and Victim are connected.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 17

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). AWS S3 Account-Level Block Public Access settings prevent any S3 bucket within the account from being made public, regardless of individual bucket policies.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary

Question 18

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 19

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting all serial numbers, model details, and completing a proper evidence custody form is vital for maintaining the legal chain of custody.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 20

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

Accepted Answer

Rkhunter (Rootkit Hunter). Chkrootkit and Rootkit Hunter (Rkhunter) are standard tools used on Linux to scan for rootkits, backdoors, and local exploits.

Answer

Autopsy

Answer

Cisco Firepower

Answer

Volatility