CND Practice Test 21 — 15 Questions

Question 1

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

bcrypt via the pgcrypto extension using the crypt(password, gen_salt('bf', 12)) function. bcrypt is a purpose-built password hashing function that incorporates a per-password random salt and a tunable cost factor. The pgcrypto call crypt(password, gen_salt('bf', 12)) uses the Blowfish-based bcrypt variant with a cost of 12, meaning 2^12 key-expansion iterations, which makes offline brute-force attacks computationally expensive while remaining fast enough for interactive logins.

Answer

SHA-256 without a salt

Answer

AES-256-CBC symmetric encryption with a shared database key

Answer

MD5 with a hardcoded static salt

Question 2

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core NTFS metadata structure; it contains one file record per file and directory, storing attributes such as $STANDARD_INFORMATION (timestamps, permissions), $FILE_NAME, and $DATA (resident or non-resident data locations). When files are deleted, their MFT records are marked as unallocated but often remain intact, enabling forensic recovery of files too large for the Recycle Bin.

Answer

File Allocation Table (FAT)

Answer

Superblock

Answer

Inode table

Question 3

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

Accepted Answer

Using a distributed virtual firewall configured at the hypervisor switch layer. Micro-segmentation for a virtualized workload is best enforced at the hypervisor virtual switch layer using a distributed virtual firewall (e.g., VMware NSX Distributed Firewall, Cisco ACI/AVS). This places the enforcement point directly on the vNIC of the database VM, so policy follows the workload regardless of physical topology, and east-west traffic between VMs on the same host is filtered without hairpinning to a physical appliance. This provides optimal granularity and performance.

Answer

By modifying the DNS records of the database server to point to a sinkhole

Answer

On the core router's default gateway interface for the entire data center

Answer

On the perimeter firewall facing the internet gateway

Question 4

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

Accepted Answer

Windows Defender Firewall. Windows Defender Firewall is the native Windows tool that can block all inbound and outbound traffic except for explicitly configured exceptions. An administrator can create rules to allow specific ports, IP addresses, or applications while blocking everything else, effectively isolating the workstation at the network layer. This is a common containment technique during incident response when full network isolation is required but some management or monitoring traffic must be permitted.

Answer

Disk Management

Answer

Device Manager

Answer

Task Manager

Question 5

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

Accepted Answer

Memory regions containing executable code that do not back to any file on disk (unbacked memory). Option A is correct because process hollowing and similar injection techniques often leave executable memory regions that have no corresponding backing file on disk (unbacked memory), which is a strong indicator of injected code since legitimate executable pages normally map to a PE image on disk. Option D is correct because a thread's start address that falls outside the bounds of any loaded module image indicates the thread was created to execute injected code rather than legitimate module code, a hallmark of injection. Option E is correct because memory regions allocated with PAGE_EXECUTE_READWRITE (RWX) permissions in non-system processes are suspicious, as legitimate code pages are typically RX or read-only, and RWX allocations often host injected shellcode. Option B is not relevant because $MFT file creation timestamps only reflect file system activity and do not reveal in-memory code injection. Option C is not relevant because wallpaper configuration settings have no bearing on detecting process injection.

Answer

Standard file creation timestamps in the $MFT

Answer

Default Windows system wallpaper configuration settings

Question 6

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. Restricting inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts blocks PsExec lateral movement, which relies on these protocols to execute commands remotely. Enabling WDAC further prevents unauthorized executables (like PsExec) from running, providing defense in depth.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

Question 7

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

Accepted Answer

Deploying zone protection or flood protection profiles against SYN and UDP floods. Option A is correct because zone protection and flood protection profiles (e.g., on Palo Alto or equivalent firewalls) apply SYN flood, UDP flood, and ICMP flood thresholds to drop volumetric attack traffic before it exhausts session tables. Option B is correct because exposing SSH/HTTPS management on the untrusted external interface invites brute-force and exploitation attempts; management should be restricted to a trusted internal interface or out-of-band path. Option C is correct because unicast Reverse Path Forwarding (uRPF) validates the source address against the routing table, dropping packets with spoofed source IPs commonly used in reconnaissance and reflection attacks. Option D is wrong because default administrator credentials are publicly known and must always be changed during hardening. Option E is wrong because permitting all inbound ICMP echo requests without rate limiting enables ping sweeps, ICMP floods, and tunneling, so ICMP should be rate-limited or selectively filtered.

Answer

Leaving default administrator credentials unchanged for rapid access

Answer

Permitting all inbound ICMP echo requests without rate limiting

Question 8

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

Accepted Answer

Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches. Microsoft Exchange SSRF and insecure deserialization vulnerabilities (notably ProxyLogon CVE-2021-26855 and ProxyShell/ProxyOracle chains) are patched through Cumulative Updates and security updates. Applying the latest CU and patches is the single most critical control because these flaws live in Exchange's own web components (e.g., Autodiscover, ECP, OWA) and cannot be reliably mitigated by generic IIS rules or authentication changes.

Answer

Configuring an IIS URL Rewrite rule to block GET requests

Answer

Disabling Outlook Web Access (OWA) entirely for all users

Answer

Enabling Basic Authentication across all virtual directories

Question 9

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

Accepted Answer

Signature-based detection rules. Signature-based detection rules match HTTP request payloads against known attack patterns — regex or token sequences characteristic of SQL injection, such as ' OR 1=1--, UNION SELECT, or encoded variants. A WAF in front of an online banking portal uses these signatures (e.g., ModSecurity CRS rules 942100, 942110) to inspect parameters, headers, and bodies, then drop matching requests before they reach the origin server. This is the classic negative-security model that blocks known-bad inputs.

Answer

TCP handshake stateful inspection

Answer

Behavioral anomaly machine learning baseline profiling

Answer

Data Loss Prevention (DLP) pattern matching

Question 10

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) bound to the DHCP snooping database.. Dynamic ARP Inspection (DAI) bound to the DHCP snooping database is correct because DAI validates ARP packets on untrusted ports by comparing IP-to-MAC bindings against the trusted DHCP snooping table. This prevents an attacker from poisoning ARP caches with forged mappings, thereby mitigating man-in-the-middle attacks. It is the standard switch-level defense against ARP cache poisoning.

Answer

Activate Unicast Reverse Path Forwarding (uRPF) on the default gateway router.

Answer

Deploy IEEE 802.1Q VLAN trunking with native VLAN mismatch remediation.

Answer

Configure Port Fast and BPDU Guard on all access-layer switch interfaces.

Question 11

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

Accepted Answer

Honeyd. Honeyd is a low-interaction honeypot framework that emulates virtual hosts and services at the network level, letting defenders detect scanning and probing without exposing a real OS. It responds to connection attempts with simulated service banners, so there is no actual system to compromise.

Answer

Kali Linux Metasploitable

Answer

Snort IDS

Answer

Wireshark

Question 12

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

Accepted Answer

stat. The stat command displays detailed file metadata including all three timestamps: atime (last access), mtime (last content modification), and ctime (last inode/status change). This is exactly what an investigator needs to build a timeline of when a web shell was dropped, accessed, or altered. Unlike ls, stat shows full-precision timestamps and the inode change time, which is critical for forensic timeline reconstruction.

Answer

find / -name '*.php'

Answer

ls -la

Answer

cat

Question 13

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

Accepted Answer

Application Gateway (Proxy Firewall). An Application Gateway (Proxy Firewall) operates at Layer 7 (application) and understands specific application protocols like HTTP, FTP, and SIP. It acts as an intermediary, terminating client connections and initiating new ones to the server, allowing deep inspection of application-layer payloads for granular filtering. This is also known as a proxy firewall or application-level gateway.

Answer

Unmanaged Switch

Answer

Packet Filtering Firewall

Answer

Hub

Question 14

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

Accepted Answer

Create a Sender Policy Framework (SPF) TXT record specifying authorized sending IP addresses.. SPF is the DNS TXT record that lists the IP addresses and hostnames authorized to send mail for a domain, allowing receiving servers to verify the envelope sender. Publishing an SPF record directly addresses the requirement to specify authorized sending mail servers. It is the foundational layer of email authentication, complemented by DKIM (cryptographic signature) and DMARC (policy and reporting).

Answer

Configure a DomainKeys Identified Mail (DKIM) CNAME record.

Answer

Implement a Domain-based Message Authentication, Reporting, and Conformance (DMARC) TXT record.

Answer

Deploy a Mail Exchange (MX) record pointing to the internal relay gateway.

Question 15

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

Accepted Answer

Monitoring and Evaluation. The Network Defense Lifecycle is a continuous process that begins with Assessment and Planning (E), where the security posture is evaluated, risks are identified, and defensive strategies and policies are designed before any controls are put in place. It then moves to Implementation and Deployment (D), where the selected security controls, tools, and architectures are actually installed, configured, and integrated into the network. The cycle continues with Monitoring and Evaluation (A), where logs, alerts, and performance data are continuously analyzed to verify that defenses work as intended and to feed improvements back into planning. Options B and C are not lifecycle stages: unregulated hardware decommissioning and scraping, and unrestricted open source code distribution, describe unsafe or uncontrolled practices rather than recognized phases of the Network Defense Lifecycle.

Answer

Unregulated Hardware Decommissioning and Scraping

Answer

Unrestricted Open Source Code Distribution