CND Practice Test 23 — 15 Questions

Question 1

A security engineer is deploying an inline NIPS appliance between the perimeter firewall and the internal core switch. During testing, legitimate TCP sessions from branch offices are being reset mid-transfer, and packet captures show the sensor injecting RST packets to both endpoints. Which configuration change will most directly stop the NIPS from breaking these legitimate flows?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tune the signature set by disabling signatures with a high false-positive rate on the branch-office traffic profile.. The sensor is injecting RST packets because a signature matched legitimate branch-office traffic—a false positive. Inline NIPS devices act on matches by dropping or resetting the session, so the fix is to tune the signature set rather than change failure modes, placement, or resources. Correcting the misclassification preserves inline prevention while restoring the legitimate TCP flows.

Answer

Increase the NIPS inspection queue depth and memory allocation to handle the branch-office session volume.

Answer

Reconfigure the NIPS to operate in passive IDS mode and mirror traffic from the core switch instead of sitting inline.

Answer

Enable fail-open mode so the sensor stops forwarding traffic when the inspection engine is overloaded.

Question 2

A hospital's network team observes that a single internal host is flooding the Layer 2 CAM table of an access switch with thousands of frames, each carrying a different source MAC address. As a result, the switch begins flooding all unicast traffic out of every port, allowing the attacker to capture traffic destined for other hosts. Which attack is being executed, and which countermeasure most directly addresses it?

Accepted Answer

MAC flooding; enable port security with a maximum MAC count and violation action on access ports. The described symptom is a classic MAC flooding attack, where an attacker fills the switch's content-addressable memory with bogus source MAC entries so legitimate entries age out and unknown-unicast frames are flooded to every port. Port security caps the number of MAC addresses learned on an interface and enforces a violation action, which directly prevents CAM table exhaustion and preserves normal forwarding behaviour.

Answer

ARP spoofing; enable Dynamic ARP Inspection with DHCP snooping bindings on the VLAN

Answer

VLAN hopping; change all access ports to trunk ports and prune unused VLANs

Answer

DHCP starvation; configure DHCP snooping with rate limiting on untrusted ports

Question 3

A security engineer is hardening a fleet of Windows 10 endpoints against credential theft. The engineer wants to prevent attackers from extracting plaintext passwords or NTLM hashes from memory. Which of the following Windows features should the engineer enable to achieve this goal?

Accepted Answer

Credential Guard. Credential Guard is designed to isolate and protect credential material using virtualization-based security, preventing extraction from memory. AppLocker, Windows Defender Firewall, and BitLocker address different security concerns—application control, network filtering, and data-at-rest encryption—and do not prevent in-memory credential dumping. Thus, Credential Guard is the appropriate feature to enable.

Answer

Windows Defender Firewall with Advanced Security

Answer

BitLocker Drive Encryption

Answer

AppLocker

Question 4

A security architect is designing network access control for a campus LAN. The requirement is to authenticate users and devices, assign VLANs dynamically based on identity, and quarantine non-compliant endpoints before granting production access. Which combination of protocols and features should the architect implement?

Accepted Answer

802.1X with EAP and RADIUS, plus dynamic VLAN assignment and a remediation VLAN. Identity-based access control on a campus LAN requires 802.1X port authentication with EAP and RADIUS, which enables dynamic VLAN assignment through authorization attributes. A remediation VLAN isolates non-compliant endpoints until they meet policy. MAB, RADIUS accounting, SNMP polling, port security, and TACACS+ either lack identity-based authentication or do not provide dynamic segmentation and quarantine, so they do not meet the full requirement.

Answer

RADIUS accounting with SNMP polling and port security to enforce VLANs

Answer

MAC authentication bypass (MAB) with static VLAN assignment and no remediation VLAN

Answer

TACACS+ for user authentication with static ACLs and no dynamic VLAN or quarantine

Question 5

A cloud security engineer is configuring a Google Cloud VPC firewall rule to allow traffic from an on-premises network to a specific subnet. The engineer wants to restrict access to only a set of known IP addresses. Which Google Cloud firewall rule component should the engineer use to define these IP addresses?

Accepted Answer

Source IPv4 ranges. Google Cloud VPC firewall rules use source IPv4 ranges to filter traffic based on source IP addresses. When traffic originates from an on-premises network, the source is an IP address or range, not a service account or tag. Therefore, specifying the known IP addresses as source IPv4 ranges is the correct way to restrict access. The other options are used for internal Google Cloud resource identification and cannot match on-premises sources.

Answer

Source tags

Answer

Source service accounts

Answer

Source service account and source tags combined

Question 6

A security engineer is evaluating a network intrusion prevention system (NIPS) that must inspect traffic flowing between two internal VLANs at 10 Gbps. The requirement is to detect and block exploits without introducing asymmetric routing, and the device must remain transparent to Layer 2 and Layer 3 topologies. Which deployment mode should the engineer choose?

Accepted Answer

Inline transparent mode using a Layer 2 bridge with fail-open bypass. Inline transparent mode with a Layer 2 bridge allows the NIPS to inspect and drop malicious traffic while remaining invisible to Layer 2 and Layer 3 addressing and routing. Fail-open bypass preserves availability if the device fails. Passive, TAP, and routed inline modes either cannot block reliably or alter the network topology, so they do not meet the transparency and prevention requirements.

Answer

TAP aggregation with out-of-band correlation only

Answer

Passive SPAN port monitoring with TCP reset injection

Answer

Inline routed mode with each interface on a different subnet

Question 7

A CND analyst at a healthcare provider is asked to classify a new data set containing patient appointment notes, physician referrals, and insurance billing codes. The organization follows a four-tier internal classification scheme (Public, Internal, Confidential, Restricted). Which classification level BEST fits this data set?

Accepted Answer

Confidential. The data set contains protected health information, which requires controlled access, encryption, and regulatory safeguards, so it belongs in the Confidential tier. Restricted is too high for routine clinical and billing records, while Public and Internal tiers fail to capture the legal and privacy impact of a leak. Correct classification drives the right handling and control baseline.

Answer

Restricted

Answer

Public

Answer

Internal

Question 8

A security analyst reviewing firewall logs notices periodic outbound connections from an internal engineering workstation to a small set of foreign IP addresses, always at roughly 60-second intervals, with payload sizes that vary slightly and destinations that rotate through a hardcoded list. The traffic uses TCP port 443 but the TLS certificate presented by the remote endpoint is self-signed and the User-Agent string is unusual. Which technique is most consistent with these observations?

Accepted Answer

Command-and-control beaconing with jitter over a custom TLS channel. Regular, jittered callbacks to a rotating set of hardcoded foreign addresses over non-standard TLS strongly indicate malware beaconing to command-and-control infrastructure. The self-signed certificate and unusual User-Agent reinforce that this is not a legitimate cloud service. Analysts should block the destinations, isolate the host, and hunt for the implant rather than dismiss the pattern as normal application traffic.

Answer

Domain fronting through a legitimate content delivery network

Answer

Fast-flux DNS used to rotate malicious A records for a botnet

Answer

A misconfigured software update agent polling a vendor server

Question 9

An attacker on the same wireless network as a corporate user sets up a rogue access point that broadcasts the same SSID as the legitimate corporate network and offers a stronger signal. Users connect automatically, and the attacker captures their credentials through a fake captive portal. Which attack has been performed?

Accepted Answer

Evil twin access point attack. The rogue access point imitating the corporate SSID with a stronger signal, combined with a counterfeit captive portal that captures credentials, is the defining pattern of an evil twin attack. Clients configured to auto-connect to a known SSID will associate with the strongest matching signal, giving the attacker a man-in-the-middle position and a convincing pretext for collecting user logins.

Answer

WPS PIN brute-force against the access point

Answer

Deauthentication flood to force reconnection

Answer

WPA2 four-way handshake capture for offline cracking

Question 10

A company suspects that an insider is using a DNS tunneling tool to exfiltrate small amounts of sensitive data through the corporate recursive resolver. The tool encodes data in the leftmost labels of queries to a domain the company does not own. Which detection approach is most likely to reveal this activity on existing network telemetry?

Accepted Answer

Monitoring for unusually long or high-entropy subdomain labels and abnormally high query volume to a single domain. DNS tunneling smuggles data inside query names, so the detectable footprint is structural: long labels, high entropy, many unique subdomains under one parent, and elevated query rates. These signals are visible in resolver logs and passive DNS without decrypting anything. Blocking outbound port 53 or enabling DNSSEC does not address a tunnel already riding through the sanctioned recursive resolver.

Answer

Inspecting TLS certificate transparency logs for the tunnel domain

Answer

Enabling DNSSEC validation on the recursive resolver

Answer

Blocking outbound TCP port 53 at the perimeter firewall

Question 11

A CND engineer is implementing continuous network defense monitoring for a demilitarized zone that hosts public web servers. The team wants to detect both network-level and host-level anomalies in near real time. Which TWO technologies should be deployed to meet this requirement? (Choose two.)

Accepted Answer

Host-based intrusion detection system agents installed on each web server. Detecting both network-level and host-level anomalies in near real time requires complementary sensors. Network-based intrusion detection on a SPAN port supplies traffic visibility, while host-based agents supply file, process, and log visibility on the servers. Log storage, periodic scanning, and firewall filtering are useful supporting controls but do not by themselves deliver the continuous detection the scenario demands.

Answer

A vulnerability scanner scheduled to run weekly against the DMZ

Answer

A syslog server that only stores device logs for later review

Answer

A firewall rule set that blocks all inbound traffic except TCP 443

Question 12

A CND engineer is preparing for an internal audit of the organization's security awareness program. The auditor wants evidence that employees can recognize and report phishing attempts. Which artifact BEST demonstrates the effectiveness of the program?

Accepted Answer

Results of simulated phishing campaigns showing click rates and report rates over time. Simulated phishing campaigns produce behavioral metrics such as click rate and report rate, which directly measure whether employees recognize and report suspicious messages. Acknowledgments, training completion, and non-completion lists are administrative records that show participation or compliance but not capability. Behavioral evidence is the strongest proof of an awareness program's effectiveness.

Answer

Completion records from the annual computer-based security training module

Answer

A signed acknowledgment form showing each employee read the acceptable use policy

Answer

A list of employees who failed to complete mandatory training on time

Question 13

A financial services company stores customer records in a Microsoft SQL Server 2019 database. A security administrator must ensure that sensitive columns such as credit card numbers are encrypted at rest and that even a database administrator with full server access cannot read the plaintext values without an additional secret. Which SQL Server feature should be implemented to meet this requirement?

Accepted Answer

Always Encrypted with column encryption keys stored outside the database. Always Encrypted separates the keys from the data by keeping column encryption keys in an external key store, so the database engine only handles ciphertext. This ensures that a database administrator with sysadmin rights cannot decrypt sensitive columns. TDE, DDM, and RLS all leave plaintext accessible to privileged database users, so they do not satisfy the stated threat model.

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE)

Question 14

A healthcare organization is implementing a data loss prevention (DLP) program for endpoints running Windows 10. The security team wants to prevent protected health information (PHI) from leaving the organization through email and removable media. Which TWO controls should be enabled in a Microsoft Defender for Endpoint DLP policy to directly block these exfiltration channels? (Choose two.)

Accepted Answer

Create a DLP rule that blocks sending email containing sensitive information types to external recipients.. Endpoint DLP policies work by inspecting content and applying rules to specific channels. A rule restricting sensitive files to USB removable drives blocks one exfiltration path, and a rule blocking email with sensitive information types to external recipients blocks the other. Encryption, firewall port blocking, and disabling cloud clients do not provide content-aware blocking for the required channels.

Answer

Enable Windows Firewall outbound rules to block SMTP traffic on port 25.

Answer

Deploy a Group Policy setting that disables the use of cloud storage sync clients.

Answer

Enable BitLocker Drive Encryption on all endpoint system drives.

Question 15

A small business wants to secure its web application against SQL injection without modifying application code. The application uses a MySQL database and receives user input through web forms. Which defensive measure should be implemented at the database layer to reduce the impact of SQL injection attacks?

Accepted Answer

Create a dedicated database account for the application with only the minimum required privileges.. Least privilege on the application's database account constrains what injected SQL can accomplish, reducing impact even if input validation fails. Logging, port changes, and backups do not block or contain injection. This database-layer hardening is a practical compensating control when code cannot be modified.

Answer

Enable the MySQL general query log to record all SQL statements.

Answer

Change the MySQL default port from 3306 to a non-standard port.

Answer

Enable MySQL binary logging and perform daily backups.