CND Practice Test 22 — 15 Questions

Question 1

An enterprise cloud security architect is hardening an AWS environment to protect against unauthorized data exfiltration from S3 buckets. Which TWO preventative security measures should be implemented? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Block Public Access at both the account and bucket levels. Option B is correct because enabling S3 Block Public Access at both the account and bucket levels is a preventative control that overrides bucket policies and ACLs to block any public access, directly preventing unauthorized public exposure and exfiltration of S3 data. Option E is correct because S3 bucket policies that restrict access exclusively to specific authorized VPC Endpoints (using conditions like aws:sourceVpce) ensure that only traffic originating from approved private network paths can reach the buckets, blocking access from the public internet or unapproved sources. Option A is wrong because disabling all IAM roles would break legitimate workloads and services that require role-based access, and it is not a targeted preventative measure for S3 exfiltration. Option C is wrong because default S3 ACLs are permissive legacy controls that do not provide robust preventative protection and can inadvertently allow broad access. Option D is wrong because enabling public read access on log buckets directly exposes data to the internet, increasing the risk of unauthorized exfiltration rather than preventing it.

Answer

Disable all IAM roles across the AWS account

Answer

Rely solely on default S3 bucket Access Control Lists (ACLs)

Answer

Enable public read access on all log buckets for transparency

Question 2

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). Amazon S3 Block Public Access at the account level is a centralized control that applies to all buckets in the account, including newly created ones, and overrides bucket-level or object-level public access settings. Enabling it at the account level ensures that any future bucket automatically inherits the block, preventing accidental public exposure. This is the only option that directly addresses S3 public access at the account scope.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary

Question 3

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

Accepted Answer

arp.exe or ipconfig.exe. arp.exe and ipconfig.exe are native, signed Windows utilities that attackers routinely abuse for network discovery — arp -a enumerates the local ARP cache to map hosts, and ipconfig /all reveals IP configuration, DNS servers, and adapters. Because they are legitimate Microsoft binaries, they often bypass application allowlisting and blend into normal admin activity, making them classic living-off-the-land binaries (LotLBs) that EDR behavioral rules must monitor.

Answer

calc.exe

Answer

mspaint.exe

Answer

notepad.exe

Question 4

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

Accepted Answer

Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.. Fail2ban is a log-parsing intrusion prevention tool that monitors authentication logs (such as /var/log/auth.log or /var/log/secure) for repeated failures and dynamically inserts iptables rules to block offending IP addresses. It directly addresses the requirement to automatically inspect logs and block attackers. This is the standard Linux tool for automated brute-force mitigation.

Answer

Deploy Wireshark with a real-time command-line display filter for SSH packets.

Answer

Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.

Answer

Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.

Question 5

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

Accepted Answer

alert tcp any any -> $HOME_NET 80 (msg:"Directory Traversal Attempt"; content:"../"; http_uri; sid:100001; rev:1;). It uses the proper Snort rule structure for detecting a payload pattern in HTTP traffic: an 'alert' action, TCP protocol, port 80 (HTTP), and the 'http_uri' buffer modifier to inspect only the URI component of the request. The 'content:"../"' matches the directory traversal string, and 'http_uri' ensures the match occurs specifically in the URI, which is where traversal attempts typically appear. This configuration accurately detects the attack without false positives from other parts of the HTTP request.

Answer

pass tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"Traversal"; content:"../"; http_client_body; sid:100001; rev:1;)

Answer

alert ip any any -> any any (msg:"Directory Traversal"; uricontent:"../"; sid:100001; rev:1;)

Answer

log udp any any -> $HOME_NET 80 (msg:"Directory Traversal"; content:"../"; depth:2; sid:100001; rev:1;)

Question 6

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

Accepted Answer

Change the specific offending signature action from block/drop to alert (log-only) mode.. The immediate, surgical fix is to change the specific offending signature's action from block/drop to alert (log-only) so the false-positive traffic flows while the IPS still inspects and logs it. This preserves perimeter visibility and detection coverage for all other signatures, and gives the team time to tune the signature or write an exception for the custom protocol. It is the standard 'tune, don't disable' response to IPS false positives.

Answer

Change the firewall default gateway to the backup ISP.

Answer

Disable the entire IPS inspection engine globally.

Answer

Bypass the IPS by moving it from inline mode to out-of-band monitoring mode.

Question 7

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

Accepted Answer

Disabling Telnet and enabling SSH version 2 for CLI management. Option A is correct because Telnet transmits CLI credentials and session data in cleartext, so disabling it and using SSH version 2 provides encrypted, integrity-protected management access with stronger key exchange and authentication. Option C is correct because HTTP exposes web management credentials and configuration data unencrypted, whereas HTTPS (HTTP over TLS) encrypts and authenticates the management session, hardening the management plane. Option B is wrong because default administrator credentials are publicly known and must be changed immediately to prevent unauthorized access. Option D is wrong because SNMPv1 with the 'public' community string and read-write access is insecure, cleartext, and grants broad modification rights. Option E is wrong because placing all ports in VTP server mode by default risks unintended VLAN database propagation and does not secure the management plane.

Answer

Leaving default administrator credentials unchanged for ease of initial troubleshooting

Answer

Enabling SNMPv1 community string 'public' with read-write access globally

Answer

Configuring all switch ports with dynamic VLAN trunking protocol (VTP) server mode by default

Question 8

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

Accepted Answer

Domain Fronting via Content Delivery Networks (CDNs) to obscure the true destination of HTTPS C2 traffic.. Option B is correct because domain fronting exploits CDNs (e.g., CloudFront, Azure CDN) by sending an HTTPS request with a legitimate SNI/host header matching the CDN while the inner HTTP Host header points to the attacker's domain, so the TLS connection appears to terminate at a trusted CDN and the true C2 destination is hidden from network inspection. Option D is correct because DNS tunneling encodes C2 commands or exfiltrated data into subdomain labels of queries sent to an attacker-controlled authoritative nameserver, abusing DNS (typically UDP/TCP 53) as a ubiquitous, often-allowed service to blend malicious traffic with legitimate resolution. Option A is not a common APT obfuscation method because standard FTP with anonymous credentials is cleartext, easily flagged, and not a legitimate service attackers typically masquerade through for covert C2. Option C is incorrect because BGP community strings and static route modifications are routing-policy mechanisms, not a technique for hiding C2 payloads inside legitimate application-layer services. Option E is incorrect because cleartext HTTP on port 80 provides no encryption or encapsulation, making the C2 traffic trivially detectable rather than obfuscated.

Answer

Standard FTP file transfers over TCP ports 20 and 21 using anonymous credentials.

Answer

Static IP routing table modifications on core border routers using BGP community strings.

Answer

Cleartext HTTP communication over port 80 without encryption or encapsulation.

Question 9

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

Accepted Answer

Object Access Auditing via Advanced Audit Policy Configuration. Windows Object Access Auditing, configured through Advanced Audit Policy Configuration (under Security Settings -> Advanced Audit Policy Configuration -> Object Access), lets administrators audit access to files and folders, including modifications. When combined with a System Access Control List (SACL) on critical files, any write, delete, or permission change generates a Security event (e.g., 4663) that can trigger alerts via SIEM or Windows Event Forwarding. This is the built-in mechanism for file integrity monitoring on Windows.

Answer

Disk Management (diskmgmt.msc)

Answer

Windows Server Backup

Answer

Task Scheduler

Question 10

A network security engineer is tasked with securing corporate Wi-Fi clients against Evil Twin attacks where an attacker sets up a fake access point with identical SSID parameters. Which enterprise wireless security practice effectively mitigates client association to fake APs?

Accepted Answer

Enabling 802.1X authentication with strict server certificate validation on clients. 802.1X with strict server certificate validation forces the client to verify the RADIUS server's certificate against a trusted CA before completing authentication. An Evil Twin AP cannot present a valid certificate for the legitimate authentication server, so the client refuses to associate, effectively neutralizing the attack.

Answer

Using MAC address cloning on the enterprise wireless controllers

Answer

Deploying WPA2-Personal with a rotating pre-shared key

Answer

Disabling client roaming capabilities on enterprise controllers

Question 11

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

Accepted Answer

Assume breach: minimize blast radius by micro-segmenting resources and assuming the network is hostile.. Option A is correct because NIST SP 800-207's 'assume breach' tenet requires treating the network as hostile and limiting lateral movement through micro-segmentation to reduce the blast radius of any compromise. Option C is correct because the 'verify explicitly' tenet mandates that every access request be authenticated and authorized using all available data points (identity, device health, context) before granting access, rather than trusting based on network location. Option E is correct because the 'least privilege' tenet requires granting only the minimum access needed, enforced through Just-In-Time (JIT) and Just-Enough-Access (JEA) policies to limit standing permissions. Option B is incorrect because implicit trust of internal LAN devices directly contradicts ZTA principles, which reject trust based on network location. Option D is incorrect because relying solely on perimeter firewall packet filtering reflects a traditional perimeter-based model, whereas ZTA requires identity- and context-based enforcement at every resource, not just the network edge.

Answer

Implicitly trust all devices connected to the internal corporate LAN backbone

Answer

Rely solely on perimeter firewall packet filtering for all internal security enforcement

Question 12

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

Accepted Answer

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. The conntrack match extension with --ctstate ESTABLISHED,RELATED tells iptables to accept packets that belong to connections already tracked by the kernel's connection-tracking subsystem, or that are related to such connections (e.g., FTP data channels, ICMP errors). Placing this rule early in the INPUT chain ensures return traffic for outbound-initiated sessions is permitted without re-evaluating later rules, which is the canonical stateful-firewall pattern.

Answer

iptables -A INPUT -m limit --limit 5/min -j LOG

Answer

iptables -A FORWARD -p tcp --dport 80 -j REJECT

Answer

iptables -A INPUT -m state --state NEW -j DROP

Question 13

A security team is deploying a Microsoft Azure environment with a hub-and-spoke virtual network topology. They need to inspect all traffic between spoke virtual networks and the on-premises datacenter for intrusion detection. Traffic must be forced through a third-party network virtual appliance (NVA) hosted in the hub VNet. Which Azure feature should they configure on the spoke subnets to ensure this traffic redirection occurs?

Accepted Answer

User-defined routes (UDRs). To force traffic from spoke subnets through a network virtual appliance in the hub, you must configure user-defined routes on the spoke subnets. UDRs override Azure's default system routes and let you specify the NVA's private IP as the next hop for traffic destined to on-premises or other spokes. This ensures all relevant flows are inspected by the NVA, satisfying the requirement for intrusion detection without altering the NVA itself.

Answer

Network security groups (NSGs)

Answer

Azure DDoS Protection Standard

Answer

Azure Firewall

Question 14

A CND analyst is conducting post-incident threat prediction after a recent breach. The analyst needs to identify which internal host initiated the most outbound connections to known malicious IP addresses over the past 72 hours to prioritize containment and predict future attack paths. Which data source and analysis technique should the analyst use?

Accepted Answer

NetFlow records exported from core routers, analyzed with a top-talkers report filtered by destination IP reputation.. NetFlow provides scalable, flow-level visibility across the network without full packet capture overhead, making it the most efficient source for identifying internal hosts with high volumes of outbound connections to known malicious IPs. Correlating flow records with threat intelligence enables the analyst to prioritize containment and predict which hosts are most likely compromised or serving as pivot points.

Answer

Windows Security event logs aggregated in a SIEM, analyzed using a failed logon correlation rule.

Answer

Full packet capture (PCAP) from the DMZ interface, analyzed with Wireshark's Conversations view.

Answer

Endpoint Detection and Response (EDR) process telemetry, analyzed for suspicious parent-child process relationships.

Question 15

A SOC analyst reviewing perimeter firewall logs notices a high volume of inbound TCP SYN packets with randomized source IP addresses targeting multiple open ports on a public-facing web server, and the server's connection table is nearly exhausted. The organization wants to stop this activity at the network edge without blocking legitimate clients. Which solution should the analyst recommend?

Accepted Answer

Deploy a firewall feature that performs SYN proxy and rate limiting on inbound connections to the web server.. A SYN flood exhausts the server's half-open connection table using spoofed sources. Mitigating it at the network edge requires a device that validates the handshake before passing traffic to the server, which is exactly what a firewall SYN proxy does. Pairing that with rate limiting preserves service for legitimate clients while dropping spoofed connection attempts before they reach the web server.

Answer

Create an access control list that blocks all inbound traffic to the web server except from the organization's known customer IP ranges.

Answer

Enable port security on the switch port connected to the web server to limit the number of source MAC addresses.

Answer

Enable SYN cookies on the web server and lower the TCP half-open connection timeout.