CND Practice Exam 4 — 20 Questions

Question 1

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). A correct Snort rule structure requires the action (alert/drop), protocol (icmp), source/destination IPs and ports, and options such as dsize:1000 to check packet payload size.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 2

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

Accepted Answer

Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.. Fail2ban monitors log files (such as /var/log/auth.log) for patterns of failed authentication attempts and automatically updates firewall rules (iptables or nftables) to ban offending IP addresses for a set duration.

Answer

Deploy Wireshark with a real-time command-line display filter for SSH packets.

Answer

Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.

Answer

Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.

Question 3

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Accepted Answer

DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.. Modern email authentication and hardening rely on Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).

Answer

Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

Answer

Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.

Question 4

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

Accepted Answer

Disabling Telnet and enabling SSH version 2 for CLI management. Securing the management plane requires disabling legacy unencrypted protocols like Telnet and HTTP, and enforcing SSH and HTTPS.

Answer

Leaving default administrator credentials unchanged for ease of initial troubleshooting

Answer

Enabling SNMPv1 community string 'public' with read-write access globally

Answer

Configuring all switch ports with dynamic VLAN trunking protocol (VTP) server mode by default

Question 5

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

Accepted Answer

Deploy behavioral anomaly detection and Endpoint Detection and Response (EDR) solutions across all internal endpoints.. Adaptive defense-in-depth relies on micro-segmentation, Zero Trust network architecture (never trust, always verify), and continuous monitoring/behavioral analytics rather than relying solely on a single perimeter firewall.

Answer

Disable all logging and auditing mechanisms to reduce SIEM ingestion noise and storage costs.

Answer

Rely exclusively on a strong perimeter firewall and demilitarized zone (DMZ) to secure internal assets.

Question 6

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

Accepted Answer

Audit and restrict the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended access rights on the domain object.. DCSync relies on specific Active Directory replication rights: 'Replicating Directory Changes' (GUID 11f46d12-861c-4d42-b41c-50f443a82f7f) and 'Replicating Directory Changes All'. Ensuring that only authorized Domain Controllers hold these extended rights is critical.

Answer

Enforce LDAP signing and channel binding on all domain controller NTDS settings.

Answer

Monitor the 'GenericAll' and 'WriteDacl' permissions on all computer account objects.

Answer

Disable NT LAN Manager (NTLM) authentication and enforce Kerberos ticket granting settings.

Question 7

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

Accepted Answer

Maintain a comprehensive Software Bill of Materials (SBOM) and perform automated Software Composition Analysis (SCA) for third-party libraries.. Supply chain security is reinforced by performing Software Bill of Materials (SBOM) tracking and software composition analysis (SCA) to identify vulnerable dependencies, alongside enforcing strict vendor risk management and access controls.

Answer

Disable all code signing requirements for internal and external software builds.

Answer

Grant third-party vendor support accounts permanent, unmonitored Domain Administrator privileges.

Answer

Rely entirely on vendor self-assessments without conducting independent code audits or penetration testing.

Question 8

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

Accepted Answer

Explicit notification that network activity is monitored and clear disciplinary actions for violations.. An AUP must explicitly state the consequences of policy violations and inform users that their activities on company assets are subject to monitoring.

Answer

The vendor part numbers and firmware release schedules for core network switches.

Answer

The exact physical coordinates and lock combinations of the server room cages.

Answer

Detailed command-line instructions for configuring IPsec VPN tunnels on remote laptops.

Question 9

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A bastion host is a hardened computer specifically designed and configured to withstand attacks while facing the public internet.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.

Question 10

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

Accepted Answer

Honeyd. Honeyd is a low-interaction honeypot daemon that simulates virtual hosts and services on a network, allowing administrators to configure fake TCP/UDP ports and operating system fingerprints.

Answer

Kali Linux Metasploitable

Answer

Snort IDS

Answer

Wireshark

Question 11

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

Accepted Answer

Dynamic ARP Inspection (DAI) leveraging the DHCP snooping database to drop spoofed ARP packets.. Layer 2 hardening includes Port Security (limiting MAC addresses), DHCP Snooping (blocking rogue DHCP), and Dynamic ARP Inspection (stopping ARP poisoning).

Answer

Border Gateway Protocol (BGP) Route Flap Damping to stabilize wide-area inter-domain routing.

Answer

Web Application Firewall (WAF) rule sets for HTTP parameter parsing and inspection.

Question 12

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

Accepted Answer

Monitoring and Evaluation. The Network Defense Lifecycle generally encompasses phases such as Assessment/Planning, Implementation, and Monitoring/Review. Options A, B, and E represent recognized phases in security lifecycle management.

Answer

Unregulated Hardware Decommissioning and Scraping

Answer

Unrestricted Open Source Code Distribution

Question 13

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

Accepted Answer

Insecure Management APIs lacking proper authentication, rate limiting, and input validation.. According to cloud security frameworks (such as the OWASP Cloud Top 10 and CSA), Insecure APIs and Insecure IAM / Excessive Privileges are primary cloud threat vectors.

Answer

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Answer

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Answer

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Question 14

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Accepted Answer

Optical Network Tap (Test Access Point). NIDS sensors are deployed passively using switch SPAN/mirror ports or optical network taps.

Answer

Inline active blocking mechanism that terminates malicious TCP sessions directly

Answer

Directly modifying the TCP/IP stack of external client operating systems

Answer

Using DHCP broadcast packets to rewrite routing tables

Question 15

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

Accepted Answer

Immediately isolate infected endpoints from the network by disconnecting physical links or invoking EDR containment features.. When ransomware strikes, immediate network isolation of infected hosts prevents lateral movement, and disabling compromised user credentials stops ongoing encryption sessions.

Answer

Immediately format all backup tape repositories to delete potentially corrupted backup indexes.

Answer

Delete all firewall access control lists to allow unrestricted threat intelligence sharing.

Answer

Pay the ransom immediately to obtain decryption keys before beginning forensic analysis.

Question 16

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

Accepted Answer

VRRP (Virtual Router Redundancy Protocol). VRRP (Virtual Router Redundancy Protocol) and HSRP are standard redundancy protocols used to provide virtual IP failover.

Answer

RADIUS

Answer

BGP (Border Gateway Protocol)

Answer

DHCP (Dynamic Host Configuration Protocol)

Question 17

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Accepted Answer

Perimeter firewalls controlling traffic entering and leaving the zone. A DMZ typically hosts public-facing servers (like web or mail servers) and relies on perimeter firewalls to control traffic flow.

Answer

Unprotected hubs connecting all corporate workstations

Answer

Internal active directory domain controllers serving workstation logins

Answer

Unrestricted direct fiber connections to employee home routers

Question 18

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (or Inbound/Outbound Inspection) allows the NGFW to decrypt traffic, inspect it for threats, and re-encrypt it.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 19

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

Accepted Answer

Main Mode. Main Mode in IKEv1 protects the identity of the peers and uses Diffie-Hellman exchanges to derive keying material, which ensures Perfect Forward Secrecy (PFS) for the phase 2 keys derived from it. Aggressive Mode does not protect peer identities.

Answer

Transport Mode

Answer

Aggressive Mode

Answer

Quick Mode

Question 20

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

Accepted Answer

Cowrie. Cowrie is a medium-to-high interaction SSH/Telnet honeypot designed to log brute-force attacks and shell interaction. (Alternatively, Honeyd emulates multiple hosts/services). Let's evaluate options.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap