CND Practice Test 2 — 25 Questions

Question 1

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conducting periodic vulnerability assessments and reviewing SIEM alert correlation rules.. The Monitor and Evaluate phase of the Network Defense Lifecycle focuses on ongoing situational awareness: conducting vulnerability assessments, reviewing SIEM alerts, analyzing logs, and measuring control effectiveness. Periodic vulnerability assessments and SIEM alert correlation rule reviews are continuous monitoring activities that detect changes in the threat landscape and validate that implemented controls still work.

Answer

Performing business impact analysis (BIA) to classify critical information assets.

Answer

Procuring hardware appliances and racking firewalls in the primary datacenter.

Answer

Drafting the initial high-level security governance charter for board approval.

Question 2

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

Accepted Answer

Setting a strong UEFI/BIOS administrator password to prevent unauthorized configuration changes. Option A is correct because setting a strong UEFI/BIOS administrator password prevents unauthorized users from entering firmware setup and altering security-relevant settings such as boot order, virtualization, or disabling protections, directly mitigating physical/firmware tampering. Option D is correct because UEFI Secure Boot validates the digital signatures of bootloaders and early boot components against trusted keys, blocking unauthorized bootloaders and rootkits from loading before the OS. Option B is wrong because leaving the chassis intrusion detection switch disconnected removes a physical-tamper detection control rather than adding one. Option C is wrong because prioritizing unverified USB boot devices weakens boot security and enables rogue boot media attacks. Option E is wrong because disabling TPM activation removes hardware-rooted key storage and measured-boot capabilities that support integrity and tamper detection.

Answer

Leaving the physical chassis intrusion detection switch disconnected

Answer

Configuring the boot order to prioritize booting from unverified USB flash drives first

Answer

Disabling Trusted Platform Module (TPM) activation across all systems

Question 3

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

Accepted Answer

Implement SSL/TLS Decryption (SSL Inspection) on the Next-Generation Firewall or Secure Web Gateway.. SSL/TLS Decryption on a Next-Generation Firewall or Secure Web Gateway allows the organization to inspect encrypted outbound traffic for malicious payloads and C2 beaconing patterns. This technique terminates the TLS session, inspects the plaintext, and re-encrypts it, enabling deep packet inspection without violating compliance if proper legal and privacy controls are in place. It is the standard enterprise architecture technique for inspecting HTTPS traffic.

Answer

Enforce strict client-side certificate pinning on all corporate web browsers.

Answer

Configure IPsec VPN tunnels between all endpoints and the corporate perimeter router.

Answer

Deploy a Layer 2 network tap connected to a passive intrusion detection sensor.

Question 4

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

Accepted Answer

Stateful Session Synchronization (Cluster State Sync). Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Answer

Strict TCP handshake validation

Answer

Unicast RPF (Reverse Path Forwarding)

Answer

NAT hairpinning

Question 5

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

Accepted Answer

On the internal network boundary between the Finance and Guest VLANs. To enforce ACLs between two internal zones (Finance and Guest), the security device must sit inline on the path between those VLANs — i.e., at the internal boundary where inter-VLAN routing occurs. Placing it there ensures all Finance-to-Guest traffic is inspected and controlled before it can traverse the internal network.

Answer

At the perimeter boundary directly connected to the ISP modem

Answer

On the local loopback interface of each end-user workstation

Answer

Inside the ISP core routing infrastructure

Question 6

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

Accepted Answer

dc3dd. dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Answer

diskpart clean

Answer

chkdsk /f /r

Answer

sfc /scannow

Question 7

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 8

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). Option D is correct because mod_security is a Web Application Firewall (WAF) engine for Apache that inspects HTTP requests and responses against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting (XSS), and other common web attacks. Option E is correct because mod_headers allows Apache to inject response headers, and configuring it to send Strict-Transport-Security (HSTS) forces browsers to use HTTPS for future connections, mitigating protocol downgrade and cookie-hijacking attacks. Option A is not correct because KeepAlive and KeepAliveTimeout only tune TCP connection reuse and have no direct security effect. Option B is not correct because DirectoryIndex merely defines default index files and does not mitigate web threats. Option C is not correct because listening on port 80 without an SSL virtual host leaves traffic unencrypted and does not enhance application security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 9

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

Accepted Answer

Remote Host Isolation / Network Containment. Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Answer

Disk Defragmentation

Answer

Remote Device Wipe

Answer

Cloud Sandbox Submission

Question 10

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

Accepted Answer

User Responsibilities and Data Sharing. The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Answer

Physical Security Controls

Answer

Disaster Recovery Protocols

Answer

Network Infrastructure Redundancy

Question 11

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for secure remote management of Linux servers, providing encrypted authentication and session transport over untrusted networks. It replaces insecure protocols like Telnet by encrypting all traffic, including credentials and commands. SSH operates on TCP port 22 by default and supports key-based authentication for stronger security.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 12

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.

Question 13

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 14

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 15

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service

Question 16

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Accepted Answer

Signature-based detection. Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Answer

Heuristic detection

Answer

Behavioral analytics detection

Answer

Anomaly-based detection

Question 17

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

Accepted Answer

Support for Document Type Definitions (DTDs) and external entity references. XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Answer

Support for HTTP chunked transfer encoding

Answer

Support for UTF-8 character encoding

Answer

Support for JSON serialization and deserialization

Question 18

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 19

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL. Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 20

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

Accepted Answer

Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses. Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.

Answer

Upgrade the IDS hardware to process higher bandwidth capacity

Answer

Convert the IDS into an inline IPS

Answer

Move the IDS from a switch SPAN port to an inline routing position