CND Practice Exam 3 — 20 Questions

Question 1

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Signature-based detection. Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Answer

Heuristic detection

Answer

Behavioral analytics detection

Answer

Anomaly-based detection

Question 2

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

Accepted Answer

Support for Document Type Definitions (DTDs) and external entity references. XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Answer

Support for HTTP chunked transfer encoding

Answer

Support for UTF-8 character encoding

Answer

Support for JSON serialization and deserialization

Question 3

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 4

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL. Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 5

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

Accepted Answer

Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses. Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.

Answer

Upgrade the IDS hardware to process higher bandwidth capacity

Answer

Convert the IDS into an inline IPS

Answer

Move the IDS from a switch SPAN port to an inline routing position

Question 6

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

Accepted Answer

McAfee DLP Endpoint Client. The McAfee DLP Endpoint Client is the agent installed on each workstation that performs local inspection and enforcement, including blocking writes to USB mass storage devices. It enforces policy at the endpoint without requiring a round trip to a network appliance. This is the component that actually intercepts the file-copy operation on the host.

Answer

McAfee DLP Prevent

Answer

McAfee ePolicy Orchestrator (ePO) Relay Server

Answer

McAfee DLP Discover

Question 7

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Accepted Answer

Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events). Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence. Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Answer

The Master Boot Record (MBR) partition table sectors

Answer

The system HOSTS file in \Windows\System32\drivers\etc\

Question 8

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 9

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

Accepted Answer

Environmental monitoring sensors tracking temperature and humidity thresholds. Option B is correct because ISO/IEC 27001 Annex A (A.11.2.1/A.7.5 in the 2022 revision) requires protection against environmental threats, and temperature/humidity sensors with defined thresholds detect conditions that could damage servers and storage. Option C is correct because Annex A physical entry controls (A.11.1.2/A.7.2) require visitor records, identity verification, and escorting of unauthorized persons to prevent unauthorized physical access. Option D is correct because Annex A requires secure areas to be protected by appropriate entry controls such as biometric or card-key systems, and logging all entry/exit events provides the audit trail needed for accountability and incident investigation. Option A is not acceptable because storing unencrypted backup tapes with sensitive PII in unlocked hallways violates both physical protection of media (A.11.2.3/A.7.10) and confidentiality requirements. Option E is not acceptable because propping open emergency exits defeats physical perimeter security and violates secure-area access control requirements, even if done for cooling convenience.

Answer

Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways

Answer

Leaving data center exterior emergency exit doors propped open for convenient cooling

Question 10

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

Accepted Answer

nocase. The nocase modifier in Snort tells the detection engine to perform a case-insensitive match on the preceding content or uricontent pattern. Since the requirement is to match 'admin_login.php' regardless of case (e.g., 'Admin_Login.PHP'), appending nocase to the content/uricontent rule option is the correct approach. Without it, Snort performs a byte-exact case-sensitive comparison and would miss mixed-case variants attackers commonly use to evade signature matching.

Answer

uricontent

Answer

depth

Answer

offset

Question 11

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed to structure, store, and share IoCs in machine-readable formats like STIX and MISP JSON. It supports taxonomies, galaxies, and feeds that let ISACs and SOCs exchange indicators at scale. This makes it the correct answer for structuring and sharing threat intelligence.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 12

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

Accepted Answer

Private Google Access enabled on the subnet. Private Google Access is a subnet-level setting that allows VM instances with only internal (RFC 1918) IP addresses to reach Google APIs and services (Cloud Storage, BigQuery, Pub/Sub, etc.) using their internal IPs, without requiring a Cloud NAT or external IP. Traffic is routed over Google's internal network to the private.googleapis.com or restricted.googleapis.com VIPs (199.36.153.8/30 or 199.36.153.4/30). This is the canonical GCP control for secure, private API access from internal-only instances.

Answer

GCP Cloud NAT gateway attached to the subnet

Answer

External HTTP(S) Load Balancer

Answer

Dedicated Interconnect with partner peering

Question 13

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

Accepted Answer

Implementing IEEE 802.11w (Protected Management Frames). Option C is correct because IEEE 802.11w Protected Management Frames cryptographically protects management frames such as deauthentication and disassociation, preventing wireless sniffing-based denial-of-service and spoofing attacks against the WLAN. Option D is correct because a WIPS sensor network continuously monitors the RF spectrum to detect and automatically contain rogue APs, evil twins, and unauthorized client devices, directly addressing the unauthorized-device requirement. Option E is correct because 802.1X with a secure RADIUS server and Enterprise PKI enforces certificate-based mutual authentication, ensuring only authorized devices and users can associate and preventing credential theft or rogue supplicant access. Option A is not appropriate because WEP is cryptographically broken and provides no meaningful isolation or protection, and Option B is not appropriate because hidden SSIDs are trivially discovered by sniffers and offer no real security, so neither belongs in a hardened enterprise design.

Answer

Relying on legacy WEP shared keys for guest network isolation

Answer

Configuring hidden SSIDs as the primary security defense

Question 14

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

Accepted Answer

Enable DHCP Snooping globally and configure untrusted user access ports as untrusted.. DHCP Snooping is the switch security feature designed to prevent rogue DHCP servers and DHCP starvation attacks. By enabling it globally and configuring user access ports as untrusted, the switch only allows DHCP server responses (OFFER, ACK) from trusted ports (e.g., uplinks to legitimate DHCP servers), blocking unauthorized DHCP servers.

Answer

Activate IP Source Guard with static binding entries on all edge switch ports.

Answer

Configure Dynamic ARP Inspection (DAI) on all trunk ports connecting to core switches.

Answer

Enable Port Security with maximum MAC address limits and restrict violation actions.

Question 15

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

Accepted Answer

Insecure Management APIs lacking proper authentication, rate limiting, and input validation.. Option C is correct because cloud management APIs are the primary control plane for provisioning and configuring resources, so APIs lacking strong authentication, rate limiting, and input validation are directly exploitable for unauthorized access, resource hijacking, and data exfiltration. Option E is correct because overly permissive IAM policies that grant excessive administrative privileges violate least privilege and are a leading cause of cloud data breaches, allowing compromised credentials or roles to escalate access across accounts and services. The unmarked options do not belong: A and D describe physical attacks against hypervisor memory or data center hardware, which are largely mitigated by cloud provider physical controls and are not primary cloud threat vectors for customers, while B targets local endpoint BIOS firmware and is an endpoint-level rather than cloud-specific vector.

Answer

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Answer

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Answer

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Question 16

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

Accepted Answer

Azure ExpressRoute with MACsec or configured IPsec tunnels. Option B is correct because Azure ExpressRoute can provide private, dedicated connectivity from on-premises datacenters to Azure Virtual Networks, and it can be secured with MACsec at the ExpressRoute Direct link layer or with IPsec tunnels over the ExpressRoute private peering for end-to-end encryption. Option E is correct because an Azure Site-to-Site VPN Gateway establishes an IPsec/IKE-encrypted tunnel over the public internet between on-premises VPN devices and the Azure VPN gateway, ensuring secure transit for cross-premises traffic. Option A is not appropriate because standard unencrypted public IP bindings expose VM traffic without providing an encrypted transit channel. Option C is not appropriate because a standard Azure Load Balancer without TLS offloading does not encrypt traffic between on-premises datacenters and Azure Virtual Networks. Option D is not appropriate because Azure Virtual Network Peering connects virtual networks but does not by itself provide encrypted transit from on-premises datacenters to Azure.

Answer

Standard unencrypted public IP bindings on Azure VMs

Answer

Standard Azure Load Balancer without TLS offloading

Answer

Unencrypted Azure Virtual Network Peering

Question 17

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, the Command and Control (C2) phase involves the attacker establishing a communication channel with the compromised system to control it remotely. DNS tunneling is a common method for C2, so this alert represents the Command and Control phase.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 18

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

Accepted Answer

Layer 3 router or multilayer switch. VLANs are logically separate Layer 2 broadcast domains, so traffic between the Marketing VLAN and the Sales VLAN cannot be switched at Layer 2 — it must be routed. A Layer 3 router or multilayer switch performs inter-VLAN routing by terminating each VLAN's SVI (or subinterface) and forwarding packets between the two IP subnets. This is the only device class in the options that operates at Layer 3 and can make forwarding decisions based on IP addressing.

Answer

Layer 2 unmanaged switch

Answer

Hub

Answer

Wireless range extender

Question 19

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Option B is correct because setting a restrictive default umask such as 027 in shell profiles (e.g., /etc/profile or /etc/bashrc) ensures newly created files are not world-readable or group-writable, reducing exposure of sensitive data and limiting opportunities for local attackers to tamper with files. Option C is correct because configuring PermitRootLogin no in /etc/ssh/sshd_config prevents direct SSH logins as root, forcing administrators to authenticate as unprivileged users and then escalate via sudo or su, which strengthens accountability and blocks a common brute-force path to full system compromise. The unmarked options do not belong: disabling SELinux or AppArmor (A) removes mandatory access control enforcement and weakens containment of compromised processes, enabling password authentication with zero minimum length in PAM (D) permits weak or empty passwords that are trivially guessed or brute-forced, and mounting all filesystems read-write with suid privileges (E) increases the attack surface by allowing setuid binaries to execute and by permitting modification of system files.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 20

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Accepted Answer

SNMPv3. SNMPv3 is the only version that provides both encryption (via DES, 3DES, AES) and authentication (via MD5, SHA). It introduces the User-based Security Model (USM) to secure management queries and responses. SNMPv1 and v2c offer only community string authentication, which is sent in cleartext.

Answer

SNMPv2c

Answer

SNMPv1

Answer

SNMPv2u