CND Practice Test 24 — 15 Questions

Question 1

A security analyst is reviewing an application that stores user passwords in a database. The analyst finds that passwords are hashed with SHA-256 and a unique salt per user. The organization wants to increase resistance to offline brute-force attacks using GPUs. Which change should the analyst recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace SHA-256 with bcrypt using an appropriate work factor.. Fast hashes like SHA-256, even with salts, are vulnerable to high-speed GPU cracking. bcrypt is intentionally slow and tunable, so increasing its work factor raises the cost of offline attacks. SHA-512, AES encryption of hashes, and Base64 encoding either remain fast or weaken protection, so bcrypt is the correct recommendation.

Answer

Switch to SHA-512 with a longer salt.

Answer

Encrypt the password hashes with AES-256 before storing them.

Answer

Store passwords using Base64 encoding instead of hashing.

Question 2

A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?

Accepted Answer

SSL/TLS offload with full application-layer inspection and Web Application Firewall policy enforcement. Terminating TLS at the ADC is what makes deep inspection possible, because encrypted traffic must be decrypted before HTTP-layer signatures and certificate validation can be applied. Re-encrypting to the backend preserves confidentiality on the internal segment. Stateful filtering, caching, and NAT all operate below or outside the application layer and cannot detect SQL injection or verify client identity.

Answer

Reverse proxy caching that stores static HTTP responses and serves them to repeat visitors

Answer

Network Address Translation that hides the internal web server IP addresses from external clients

Answer

Stateful packet filtering that tracks TCP session state and enforces port 443 access control lists

Question 3

A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?

Accepted Answer

A transparent web proxy that intercepts HTTP and HTTPS traffic inline and applies URL categorization and logging. A transparent proxy is deployed inline and redirects traffic without reconfiguring clients, satisfying the bridge requirement. It inspects the HTTP request line and Host header, enabling URL categorization, malicious-site blocking, and centralized logging. Explicit proxies, host firewalls, and DNS sinkholes each miss at least one requirement, such as client changes, per-endpoint management, or lack of request-level logging.

Answer

A DNS sinkhole that returns a non-routable address for domains on a blocklist

Answer

A web proxy configured in explicit mode with manual browser settings on each workstation

Answer

A host-based firewall installed on every employee workstation with outbound port 80 and 443 rules

Question 4

A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?

Accepted Answer

The attacker is performing a TCP FIN scan to map open ports, and the stateful firewall correctly drops the invalid segments before they reach internal hosts. TCP FIN and SYN-FIN segments without an established session are classic stealth scan techniques used to infer port state from RST responses. A stateful firewall that tracks connection state recognizes these segments as not belonging to any session and drops them, preventing the scan from reaching internal hosts. Session hijacking, UDP amplification, and ARP poisoning involve entirely different mechanisms and are not indicated by these flags.

Answer

The attacker is conducting an ARP poisoning attack, and the firewall should enable dynamic ARP inspection on the internal interface

Answer

The attacker is attempting a TCP session hijack, and the firewall should allow the segments so the internal host can reset the connection

Answer

The attacker is performing a UDP amplification attack, and the firewall should rate-limit the source address rather than drop the segments

Question 5

An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?

Accepted Answer

Dual-vendor firewalls increase complexity in rule management and log correlation, but reduce the risk of a single vendor vulnerability compromising the perimeter. A dual-vendor firewall design provides defense in depth by ensuring that a vulnerability in one vendor's product does not automatically expose the network, since the second platform enforces its own policy. The realistic cost is operational: two rule sets to maintain, two management interfaces, and log formats that must be normalized for correlation. Throughput is limited by the slowest inline device, and rules do not need to match.

Answer

The two firewalls must share the same rule base and firmware version to function, otherwise traffic will be dropped

Answer

Log correlation across two different vendors is straightforward because both use the same syslog format by default

Answer

Placing two firewalls in series doubles throughput because each firewall processes only half of the traffic

Question 6

A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)

Accepted Answer

Set a maximum fragment reassembly timeout and memory limit to bound resource consumption. Fragment reassembly with normalization ensures the firewall inspects the complete datagram and resolves overlapping fragments consistently, defeating evasion. Bounding reassembly with a timeout and memory limit protects the device from resource exhaustion caused by incomplete or malicious fragment sets. Dropping all fragments harms legitimate traffic, while TCP option changes and MTU adjustments do not address fragment-based evasion.

Answer

Increase the maximum transmission unit on the external interface to eliminate fragmentation entirely

Answer

Configure the firewall to drop all fragmented packets regardless of source or protocol

Answer

Disable TCP window scaling and selective acknowledgment to simplify packet inspection

Question 7

A security analyst is examining a memory dump from a compromised Windows 10 host. The analyst suspects that a malicious process injected code into a legitimate process. Which of the following memory analysis techniques is MOST effective for identifying injected code?

Accepted Answer

Scanning for executable pages that are not backed by a file on disk. Scanning for executable memory pages not backed by files on disk is the most effective technique because injected code typically resides in such regions. Other methods, such as process listing, signature checks, and event log analysis, may provide context but do not directly reveal in-memory code injection.

Answer

Listing all running processes and their parent-child relationships

Answer

Analyzing the Windows event log for process creation events

Answer

Checking the digital signatures of loaded modules

Question 8

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

Accepted Answer

High volume of DNS queries with long subdomain labels and high entropy. DNS tunneling exfiltrates data by encoding it into DNS queries, often using long, high-entropy subdomains. Monitoring for such patterns, along with query volume and domain reputation, helps detect this activity. The other options describe less relevant or non-specific indicators that would not effectively identify DNS tunneling in this scenario.

Answer

DNS queries using TCP instead of UDP for large responses

Answer

Frequent DNS zone transfers (AXFR) from internal to external servers

Answer

Repeated DNS queries for the same domain with identical transaction IDs

Question 9

During an incident, a network defender needs to collect volatile evidence from a compromised Linux server before shutting it down. Which of the following commands should be used to capture the current network connections and listening ports?

Accepted Answer

netstat -tulnp. The netstat -tulnp command is the correct choice because it lists active TCP/UDP connections and listening ports with process details. The other commands provide interface, routing, or ARP information, which are not the required volatile network connection data. Collecting this data before shutdown is critical for incident response.

Answer

route -n

Answer

ifconfig -a

Answer

arp -a

Question 10

A network defender is reviewing logs from a Cisco IOS router and notices numerous ICMP echo requests with varying source IP addresses and large payloads. The defender suspects an ICMP tunneling attack. Which of the following is the BEST method to confirm and analyze this activity?

Accepted Answer

Capture full packet data and inspect ICMP payloads for embedded protocols or data. To confirm ICMP tunneling, the defender must inspect packet payloads for embedded data or protocols. Volume-based or policy-based checks are insufficient because they do not examine the content. Full packet capture allows direct observation of tunneling artifacts, making it the best method for confirmation and analysis.

Answer

Enable ICMP rate limiting on the router to mitigate the attack

Answer

Monitor for increased ICMP traffic volume during off-hours

Answer

Check router ACLs to see if ICMP is permitted from external sources

Question 11

A security analyst at a financial firm is reviewing endpoint telemetry and observes a process named 'svchost.exe' with an unusual parent process and a command line containing a Base64-encoded string. The analyst suspects a fileless attack leveraging a built-in Windows utility. Which of the following endpoint detection techniques is MOST effective for identifying this type of malicious activity?

Accepted Answer

Monitoring process creation events with command-line auditing and parent-child process relationships. The attack uses a legitimate Windows binary with an encoded command line and an unusual parent process, which are hallmarks of fileless malware. Monitoring process creation with command-line auditing and parent-child relationships allows detection of such anomalous behavior. Signature-based scanning, firewall logs, and registry autorun checks do not provide the necessary process-level context to identify this activity.

Answer

Signature-based antivirus scanning of the svchost.exe file on disk

Answer

Scanning the Windows Registry for autorun entries associated with svchost.exe

Answer

Reviewing Windows Defender Firewall logs for outbound connections from svchost.exe

Question 12

A security administrator is deploying a Mobile Device Management (MDM) solution for corporate-owned Android devices. The administrator needs to ensure that if a device is lost or stolen, corporate data can be remotely wiped while preserving the user's personal data. Which of the following MDM capabilities should the administrator implement?

Accepted Answer

Selective wipe (corporate data wipe). A selective wipe (corporate data wipe) is designed to remove only corporate data from a device, leaving personal data untouched. This is the appropriate MDM capability when the goal is to protect corporate information on a lost or stolen device without destroying the user's personal data. Full device wipe, remote lock, and device encryption do not achieve selective removal.

Answer

Device encryption

Answer

Full device wipe

Answer

Remote lock

Question 13

A retail company's security team is designing defenses against Distributed Denial of Service (DDoS) attacks targeting its public web tier. The team wants to reduce the impact of volumetric floods while preserving legitimate customer traffic. Which THREE measures are appropriate components of the defense strategy? (Choose three.)

Accepted Answer

Enable rate limiting and connection thresholds on the edge load balancers and reverse proxies. Effective DDoS defense layers global absorption with local traffic shaping. Upstream scrubbing redirects volumetric floods to a provider with massive capacity, anycast distributes load across many points of presence, and edge rate limiting and connection thresholds protect backend resources from whatever reaches the perimeter. Together these preserve availability for legitimate customers while denying attackers a single choke point to saturate.

Answer

Disable TCP SYN cookies on all internet-facing servers to reduce CPU overhead

Answer

Publish the origin server's IP address in a public DNS record so clients bypass the CDN during an attack

Question 14

A CND analyst is reviewing endpoint hardening for a fleet of Windows 11 laptops that use BitLocker with TPM 2.0. The organization wants to prevent an attacker with brief physical access from booting the machine from removable media or reaching a recovery prompt to extract the drive. Which pre-boot control should the analyst verify is enabled in UEFI firmware?

Accepted Answer

UEFI firmware password with boot order locked to the internal drive. The requirement is to stop an attacker with brief physical access from booting alternate media or reaching a recovery prompt to extract the BitLocker-protected drive. A UEFI firmware password combined with a boot order locked to the internal drive directly prevents that alternate boot path. Secure Boot, Network Unlock, and Measured Boot address boot integrity, PIN delivery, and attestation respectively, but none of them blocks a firmware boot-order change.

Answer

Measured Boot with TPM PCR logging

Answer

BitLocker Network Unlock

Answer

Secure Boot

Question 15

A network administrator is configuring a wireless intrusion prevention system (WIPS) to detect and mitigate rogue access points in an enterprise. The administrator needs to ensure that the WIPS can identify and classify access points that are not authorized. Which TWO techniques should the administrator enable? (Choose two.)

Accepted Answer

RF signature analysis. RF signature analysis and rogue AP detection using authorized AP lists are both techniques that enable a WIPS to identify unauthorized access points. RF signature analysis classifies devices based on radio frequency characteristics, while authorized AP lists provide a baseline for comparison. Together, they allow the WIPS to detect and mitigate rogue APs effectively. The other options are client access control or performance features, not detection techniques.

Answer

MAC address filtering

Answer

Band steering

Answer

Client isolation