CND Practice Exam 4 — 20 Questions

Question 1

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Application Identity service (AppIDSvc) is stopped or disabled. AppLocker relies on the Application Identity service (AppIDSvc) to evaluate and enforce rules. If AppIDSvc is stopped or disabled, AppLocker policies are not applied, allowing all executables to run regardless of configured rules. The administrator's rule to allow signed apps would be ignored, and unsigned tools from user-writable directories would execute freely.

Answer

Windows Defender Real-time Protection is enabled

Answer

BitLocker encryption is not enabled on the system drive

Answer

Fast Startup is enabled in the BIOS

Question 2

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Accepted Answer

Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.. SELinux and AppArmor are Linux kernel security modules that implement mandatory access control (MAC), confining processes to only the resources defined by policy regardless of user privileges. Running them in enforcing mode ensures that policy violations are blocked, not just logged, which is the correct way to restrict processes to only necessary resources.

Answer

Modify standard Linux file permission bits (chmod and chown) for all application binaries.

Answer

Enable the Linux audit daemon (auditd) to log all system call activities.

Answer

Install and configure a host-based firewall using iptables or nftables.

Question 3

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Accepted Answer

Analyze the log files to verify if an unauthorized breach has occurred. NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The first phase after preparation is Detection and Analysis, which in this scenario means analyzing log files to verify whether an unauthorized breach has actually occurred. Only after confirming the incident should containment, eradication, or lessons-learned activities begin.

Answer

Contain the compromised host to prevent lateral movement

Answer

Perform post-incident lessons learned activities

Answer

Eradicate the malware from the impacted SSH server

Question 4

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

Accepted Answer

Network tap / SPAN port capturing database protocol traffic or host-based driver interceptors. A DAM sensor captures database activity most accurately by sitting inline or out-of-band on the network path where database protocol traffic flows — typically via a network TAP or SPAN port mirroring the database VLAN — or by using host-based driver interceptors that hook the database client/server libraries. This captures the actual SQL statements on the wire (TDS for SQL Server, TNS for Oracle) independent of what the database chooses to log, which is critical because native audit logs can be tampered with or disabled by a compromised DBA.

Answer

On the perimeter firewall inspecting ICMP echo requests

Answer

At the corporate DNS resolver cache

Answer

As an SMTP email gateway relay filter

Question 5

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

Accepted Answer

The firewall encodes connection parameters into the sequence number (SYN cookie) without allocating memory state until the client responds with an ACK.. SYN cookies mitigate TCP SYN flood attacks by encoding connection parameters (such as source/destination IP and port, and a secret) into the initial sequence number (ISN) of the SYN-ACK. The server does not allocate any state for the half-open connection until it receives the final ACK from the client, which contains the cookie. This prevents the server's connection table from being exhausted by a flood of SYN packets. The firewall/router can implement SYN cookies to protect downstream servers.

Answer

The firewall drops all incoming SYN packets immediately.

Answer

The firewall resets the TCP window size to zero for all external connections.

Answer

The firewall proxies the TCP handshake by establishing a full connection before forwarding traffic to the server.

Question 6

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The question asks which phase immediately follows Containment, Eradication, and Recovery. According to the standard, Post-Incident Activity is the final phase, where lessons learned are captured and improvements are made to prevent future incidents.

Answer

Preparation

Answer

Detection and Analysis

Answer

Threat Hunting

Question 7

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

Accepted Answer

windows.netstat. In Volatility 3, the windows.netstat plugin enumerates network artifacts from a Windows memory image by walking the kernel's TCP/UDP endpoint and listener structures (e.g., tcpip.sys pools). It lists active connections, listening ports, and associated PIDs, which is exactly what an incident responder needs to identify command-and-control channels or exfiltration sockets. Volatility 3 uses a plugin naming convention of ., so windows.netstat is the correct choice for Windows network sockets.

Answer

windows.dlllist

Answer

windows.pslist

Answer

windows.registry.printkey

Question 8

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Accepted Answer

Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.. Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks. Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Answer

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Answer

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

Question 9

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

Accepted Answer

Event ID 4624. Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Answer

Event ID 1102

Answer

Event ID 4698

Answer

Event ID 4720

Question 10

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

Accepted Answer

Configure a Decryption Exclusion / Bypass rule for specific trusted destination URL categories or domains. Configuring a Decryption Exclusion or Bypass rule for specific trusted destination URL categories or domains allows the NGFW to skip SSL decryption for those destinations while continuing to decrypt and inspect all other TLS traffic. This satisfies privacy regulations without disabling overall inspection.

Answer

Create an outbound NAT rule mapping banking IP addresses to a loopback interface.

Answer

Configure a static route directing banking traffic through an uninspected bypass interface.

Answer

Disable all Layer 7 application inspection signatures globally for TCP port 443.

Question 11

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?

Accepted Answer

Failing to strictly validate the JWT algorithm header, allowing 'none' or asymmetric-to-symmetric key confusion (RS256 to HS256). The JWT algorithm header (alg) is attacker-controlled and must be strictly validated server-side against an allowlist. If the application accepts 'none' or trusts the alg field to select the verification key, an attacker can forge tokens — the classic RS256-to-HS256 confusion attack lets the attacker sign with the public RSA key as an HMAC secret, which the server then accepts. This directly enables signature forgery and privilege escalation.

Answer

Setting an expiration time (exp claim) of 15 minutes

Answer

Storing the JWT inside an HTTP-only Secure cookie instead of localStorage

Answer

Including the user's role claim inside the public payload section

Question 12

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

Accepted Answer

Audit and restrict the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended access rights on the domain object.. DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting password hashes via GetNCChanges. The two extended rights that grant this capability are 'Replicating Directory Changes' (DS-Replication-Get-Changes) and 'Replicating Directory Changes All' (DS-Replication-Get-Changes-All), plus 'Replicating Directory Changes In Filtered Set' in some cases. Auditing and restricting these ACEs on the domain NC head prevents non-DC principals from performing replication.

Answer

Enforce LDAP signing and channel binding on all domain controller NTDS settings.

Answer

Monitor the 'GenericAll' and 'WriteDacl' permissions on all computer account objects.

Answer

Disable NT LAN Manager (NTLM) authentication and enforce Kerberos ticket granting settings.

Question 13

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

Accepted Answer

alert. The 'alert' rule action keyword in Snort generates an alert and logs the packet when a rule matches, without dropping or blocking the traffic. This is the default and most common action for intrusion detection mode. When Snort runs in IDS mode, 'alert' is the appropriate keyword to detect and notify without interfering with the packet flow.

Answer

sdrop

Answer

reject

Answer

drop

Question 14

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

Accepted Answer

Explicit notification that network activity is monitored and clear disciplinary actions for violations.. The essential element for enforceability in an AUP is explicit notification that network activity is monitored and clear disciplinary actions for violations. Without informing employees that their activity is monitored, the policy may be legally unenforceable due to privacy expectations. Clear disciplinary actions provide the necessary consequences to deter violations and ensure consistent enforcement. This combination establishes both transparency and accountability, which are fundamental to a valid AUP.

Answer

The vendor part numbers and firmware release schedules for core network switches.

Answer

The exact physical coordinates and lock combinations of the server room cages.

Answer

Detailed command-line instructions for configuring IPsec VPN tunnels on remote laptops.

Question 15

An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?

Accepted Answer

Architecture diagrams and firewall rulebases demonstrating that out-of-scope networks cannot reach the CDE without strict filtering.. PCI-DSS segmentation evidence requires demonstrating that out-of-scope networks cannot reach the cardholder data environment (CDE) without passing through a controlled, filtered boundary. Architecture diagrams show the intended segmentation, and firewall rulebases prove the actual enforcement — together they are the standard artifacts auditors request to validate that the CDE is isolated and that all access is explicitly authorized and restricted.

Answer

Antivirus signature update logs from all workstation endpoints.

Answer

Software asset inventory spreadsheets listing operating system versions.

Answer

HR onboarding records showing background checks for all employees with physical access to the building.

Question 16

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

Accepted Answer

Active Directory Account Access Logs and Group Memberships. To verify that administrative accounts are not sharing credentials and to validate individual accountability, the auditor must inspect Active Directory account access logs and group memberships. These artifacts show which accounts exist, who is a member of privileged groups, and when each account was used to log on. If multiple administrators are using the same account, the logon events will show the same account name from different workstations or at overlapping times, which is the evidence of shared credentials.

Answer

BGP Routing Table Summaries

Answer

Network Switch Port VLAN Assignments

Answer

DNS Zone File Configurations

Question 17

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 18

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). Signature-based detection is a core IDPS methodology: the sensor compares packet payloads and headers against a database of known attack patterns, byte sequences, and Snort/Suricata-style rules, generating an alert when a match occurs. Option E is also correct because anomaly-based detection builds a statistical or behavioral baseline of normal traffic (protocols, ports, bandwidth, connection rates) and flags deviations from that baseline as potential intrusions, which allows it to catch novel or previously unseen attacks. The remaining options are not IDPS detection methods: A describes illicit exploit acquisition, not traffic inspection; B is a nonsensical signal-conversion idea unrelated to packet analysis; and D is a manual network-availability action, not a detection technique.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours

Question 19

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

Accepted Answer

Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.. The vulnerability arises because the JWT validation code trusts the 'alg' header from the token without verifying it against a list of allowed algorithms. An attacker can set 'alg' to 'none' and remove the signature, and if the code accepts it, signature verification is bypassed. The fix is to explicitly whitelist approved algorithms (e.g., RS256) and reject 'none' in the validation function, ensuring the token is signed with an expected algorithm. This prevents algorithm confusion attacks and enforces cryptographic integrity.

Answer

Upgrade the JWT token expiration time (exp claim) to expire within five minutes of creation.

Answer

Implement JSON Web Encryption (JWE) to payload data without verifying headers.

Answer

Store JWT tokens in HTTP-only, Secure cookies instead of local browser storage.

Question 20

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

Accepted Answer

First match based on rule priority number in ascending order. Azure NSGs evaluate rules in ascending order of priority number (100–4096), and the first rule whose source, destination, port, and protocol match the traffic is applied — no further rules are evaluated. This 'first match wins' model means a lower number equals higher precedence. If no rule matches, the default rules (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, etc.) apply.

Answer

Last match evaluated across all security rules

Answer

Explicit allow rules override all deny rules regardless of priority

Answer

Deny rules always take precedence regardless of priority number