CND Practice Test 22 — 15 Questions

Question 1

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mandatory Protected Management Frames (PMF / 802.11w) to prevent forged deauthentication and disassociation attacks.. Enterprise wireless security is enhanced by implementing WPA3-Enterprise with Protected Management Frames (PMF) to prevent deauthentication spoofing, and deploying Wireless Intrusion Detection Systems (WIDS/wIPS) to detect rogue APs and attacks.

Answer

Using Wired Equivalent Privacy (WEP) with static 40-bit pre-shared keys.

Answer

Configuring hidden SSIDs across all access points as the primary perimeter defense mechanism.

Answer

Disabling all encryption ciphers to maximize wireless throughput and signal range.

Question 2

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

Accepted Answer

Conducting periodic vulnerability assessments and reviewing SIEM alert correlation rules.. The 'Monitor and Evaluate' phase focuses on continuous assessment, log analysis, vulnerability scanning, and security metric tracking to ensure defenses remain effective against evolving threats.

Answer

Performing business impact analysis (BIA) to classify critical information assets.

Answer

Procuring hardware appliances and racking firewalls in the primary datacenter.

Answer

Drafting the initial high-level security governance charter for board approval.

Question 3

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

Accepted Answer

Employee completion rate for mandatory annual cybersecurity awareness training.. Effective governance metrics measure policy adherence, vulnerability remediation velocity, and employee awareness training completion rather than raw technical counts that lack context.

Answer

Total number of physical packets traversing the core external internet gateway daily.

Answer

Total gigabytes of log data stored in the centralized SIEM archival repository.

Question 4

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

Accepted Answer

Identify. The 'Govern' and 'Identify' functions of the NIST CSF involve understanding the organization's business context, assets, governance, and risk management strategy.

Answer

Detect

Answer

Respond

Answer

Recover

Question 5

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

Accepted Answer

Identifying and cataloging all network assets, data flows, and current vulnerabilities. The Assessment and Analysis phase evaluates existing network assets, vulnerabilities, and baseline security posture to inform defense strategies.

Answer

Conducting incident containment following a zero-day breach

Answer

Deploying next-generation firewalls across core network segments

Answer

Decommissioning obsolete routers and end-of-life switches

Question 6

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping logs to MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques, enabling precise detection engineering and gap analysis.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 7

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

Accepted Answer

Assume breach: minimize blast radius by micro-segmenting resources and assuming the network is hostile.. NIST SP 800-207 Zero Trust tenets include continuous verification of trust, least privilege access enforcement, and dynamic policy evaluation based on all available telemetry.

Answer

Implicitly trust all devices connected to the internal corporate LAN backbone

Answer

Rely solely on perimeter firewall packet filtering for all internal security enforcement

Question 8

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

Accepted Answer

Encrypted log forwarding via HTTPS REST APIs to the SIEM collector. Standard Syslog (UDP 514) transmits logs in cleartext. Secure transmission requires Syslog over TLS or encrypted forwarding mechanisms like SECURE SNMP/SFTP/HTTPS log shipping.

Answer

Unencrypted UDP Syslog (Port 514)

Answer

Unauthenticated TFTP log backup transfers

Answer

SNMPv1 trap forwarding

Question 9

An enterprise is aligning its network defense governance model with ISO/IEC 27001. During the implementation of Clause 6 (Planning), the security team must identify information security risks. Which specific ISO/IEC 27001:2013 standard provides the catalog of controls that must be mapped to these identified risks?

Accepted Answer

ISO/IEC 27002. ISO/IEC 27002 provides the code of practice for information security controls, serving as the companion reference for ISO/IEC 27001 risk treatment.

Answer

ISO/IEC 27005

Answer

ISO/IEC 27701

Answer

ISO/IEC 27035

Question 10

A security compliance engineer is configuring an enterprise vulnerability management program using CVSS v3.1. When calculating the Environmental Metric Group to contextualize vulnerability severity for specific organizational assets, which THREE metrics must be evaluated? (Choose three)

Accepted Answer

Security Requirements (Confidentiality Requirement, Integrity Requirement, Availability Requirement). CVSS v3.1 Environmental metrics include Modified Base Metrics, Collateral Damage Potential (CDP), and Requirements for Confidentiality, Integrity, and Availability (CR, IR, AR).

Answer

Remediation Level (RL) of official vendor security patches

Answer

Exploit Code Maturity (ECM) of public exploit kits

Question 11

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

Accepted Answer

Configure MAC Authentication Bypass (MAB) with a specific device profiling and authorization profile on the RADIUS server.. For non-supplicant devices like IoT equipment, switch ports can be configured with MAC Authentication Bypass (MAB), which uses the device's MAC address as credentials against a RADIUS server, combined with a restricted VLAN.

Answer

Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

Answer

Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

Answer

Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.

Question 12

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

Accepted Answer

LLMNR/NBT-NS poisoning and credential relay attacks. Disabling LLMNR and NBT-NS mitigates spoofing and responder attacks (such as LLMNR/NBT-NS poisonings) used to capture NTLMv2 password hashes.

Answer

SQL injection vulnerabilities in web application forms

Answer

BGP prefix hijacking and route table poisoning

Answer

DNS zone transfer enumeration via nslookup

Question 13

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Accepted Answer

Multi-Factor Authentication (MFA) for all authentication attempts. Remote workers must use encrypted VPN tunnels and Multi-Factor Authentication (MFA) to securely access internal corporate resources.

Answer

Disabling endpoint firewall protection to improve home network gaming performance

Answer

Sharing corporate laptop credentials with family members for household convenience

Answer

Connecting directly via unencrypted public Wi-Fi without any protective tunneling

Question 14

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

Accepted Answer

Network engineers implement emergency rule modifications directly in production without pre-testing or CAB approval.. Bypassing the formal change advisory board (CAB) review, testing, and emergency authorization process for rule changes introduces undocumented risks and potential outages.

Answer

Change request ticket numbers are generated automatically by software rather than handwritten logs.

Answer

Change request forms require the signature of the lead network architect rather than the CISO.

Answer

Firewall change tickets are archived in a digital repository for only 12 months instead of 3 years.

Question 15

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Accepted Answer

SNMPv3. SNMPv3 provides essential security features including message confidentiality (encryption via DES or AES), integrity (via HMAC-MD5 or SHA), and authentication (usm user-based security model). SNMPv1 and SNMPv2c lack encryption.

Answer

SNMPv2c

Answer

SNMPv1

Answer

SNMPv2u