CND Practice Test 4 — 25 Questions

Question 1

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active Directory Account Access Logs and Group Memberships. To verify that administrative accounts are not sharing credentials and to validate individual accountability, the auditor must inspect Active Directory account access logs and group memberships. These artifacts show which accounts exist, who is a member of privileged groups, and when each account was used to log on. If multiple administrators are using the same account, the logon events will show the same account name from different workstations or at overlapping times, which is the evidence of shared credentials.

Answer

BGP Routing Table Summaries

Answer

Network Switch Port VLAN Assignments

Answer

DNS Zone File Configurations

Question 2

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 3

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). Signature-based detection is a core IDPS methodology: the sensor compares packet payloads and headers against a database of known attack patterns, byte sequences, and Snort/Suricata-style rules, generating an alert when a match occurs. Option E is also correct because anomaly-based detection builds a statistical or behavioral baseline of normal traffic (protocols, ports, bandwidth, connection rates) and flags deviations from that baseline as potential intrusions, which allows it to catch novel or previously unseen attacks. The remaining options are not IDPS detection methods: A describes illicit exploit acquisition, not traffic inspection; B is a nonsensical signal-conversion idea unrelated to packet analysis; and D is a manual network-availability action, not a detection technique.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours

Question 4

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

Accepted Answer

Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.. The vulnerability arises because the JWT validation code trusts the 'alg' header from the token without verifying it against a list of allowed algorithms. An attacker can set 'alg' to 'none' and remove the signature, and if the code accepts it, signature verification is bypassed. The fix is to explicitly whitelist approved algorithms (e.g., RS256) and reject 'none' in the validation function, ensuring the token is signed with an expected algorithm. This prevents algorithm confusion attacks and enforces cryptographic integrity.

Answer

Upgrade the JWT token expiration time (exp claim) to expire within five minutes of creation.

Answer

Implement JSON Web Encryption (JWE) to payload data without verifying headers.

Answer

Store JWT tokens in HTTP-only, Secure cookies instead of local browser storage.

Question 5

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

Accepted Answer

First match based on rule priority number in ascending order. Azure NSGs evaluate rules in ascending order of priority number (100–4096), and the first rule whose source, destination, port, and protocol match the traffic is applied — no further rules are evaluated. This 'first match wins' model means a lower number equals higher precedence. If no rule matches, the default rules (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, etc.) apply.

Answer

Last match evaluated across all security rules

Answer

Explicit allow rules override all deny rules regardless of priority

Answer

Deny rules always take precedence regardless of priority number

Question 6

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

Accepted Answer

Use parameterized queries and PreparedStatement objects with placeholder parameters. Parameterized queries using PreparedStatement with placeholder parameters (?) ensure that user input is treated strictly as data, never as executable SQL. The JDBC driver sends the query structure and parameters separately to the database, so injection payloads cannot alter the SQL grammar. This is the definitive remediation for SQL injection in Java applications and is recommended by OWASP.

Answer

Invoke the java.net.URLEncoder.encode() method on all parameters

Answer

Wrap all input strings inside single quotes and strip out semicolon characters

Answer

Sanitize all input characters using HTML entity encoding before passing them to the database driver

Question 7

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

Accepted Answer

/etc/profile. /etc/profile is a system-wide shell initialization script sourced by login shells for all users, making it the correct place to set a default umask that applies globally. Setting 'umask 027' or 'umask 077' here ensures every new file created by users inherits restrictive permissions. This is the standard Linux hardening practice for fleet-wide permission defaults.

Answer

/etc/ssh/sshd_config

Answer

/etc/security/limits.conf

Answer

/etc/environment

Question 8

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping SIEM logs to MITRE ATT&CK enriches alerts with context about which adversary tactic or technique the observed behavior represents (e.g., T1059 Command and Scripting Interpreter). This lets defenders prioritize, correlate, and communicate incidents in a shared vocabulary tied to real-world threat actor behavior. It transforms raw log events into actionable intelligence aligned to the kill chain, improving detection engineering and response.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 9

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

Accepted Answer

unhide. unhide is a forensic utility specifically designed to detect hidden processes and TCP/UDP ports by cross-referencing multiple data sources, including the kernel system call table (via /proc and syscall hooks) against direct kernel memory reads. User-space rootkits commonly hook syscalls like getdents or read on /proc to filter out malicious PIDs from tools like ps, so a tool that bypasses those hooks is required. unhide's 'checkbrute' and 'checkall' modes compare /proc listings, /bin/ps output, and kernel memory to expose discrepancies.

Answer

lsof -i

Answer

netstat -anp

Answer

ps aux --forest

Question 10

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

Accepted Answer

Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions. PostgreSQL has no native Transparent Data Encryption (TDE) engine in core, so the practical way to encrypt data at rest is at the filesystem/volume layer using dm-crypt/LUKS, which transparently encrypts the disk blocks PostgreSQL writes to. For column-level or field-level cryptographic operations inside the database, the pgcrypto extension provides functions like pgp_sym_encrypt and digest. Combining these two layers gives both at-rest protection and application-visible encryption of specific sensitive columns.

Answer

pg_encrypt_cluster utility

Answer

PostgreSQL Enterprise TDE Daemon

Answer

pg_tde core extension module

Question 11

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Accepted Answer

Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.. DNS tunneling encapsulates C2 traffic within DNS queries and responses, often encoding data in the query name (e.g., subdomain labels) to bypass firewalls. The analyst should filter for 'dns' in Wireshark and examine query strings for anomalies such as unusually long labels, high entropy (random-looking characters), or Base64/hex encoding patterns. These indicators distinguish malicious tunneling from normal DNS resolution, which typically uses short, human-readable domain names.

Answer

Filter for 'http.request.method == POST' and look for binary attachments.

Answer

Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.

Answer

Filter for 'icmp' and examine the payload size of Echo Request packets.

Question 12

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

Accepted Answer

Execute 'find / -perm /4000 -type f 2>/dev/null' to audit files with the SUID bit set.. The command 'find / -perm /4000 -type f 2>/dev/null' searches the entire filesystem for regular files with the SUID bit set (octal 4000), redirecting permission-denied errors to /dev/null. This allows the engineer to audit and then remove SUID permissions from unauthorized binaries, directly mitigating the privilege escalation vector described.

Answer

Execute 'chmod -R 777 /' to reset all filesystem file permissions to secure defaults.

Answer

Run 'netstat -tulnp' to identify listening network ports associated with SUID processes.

Answer

Run 'iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT' to lock down network access.

Question 13

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Accepted Answer

Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.. Snort's suppress directive allows analysts to silence a specific signature (by SID) for a specific target IP without removing the rule entirely. This preserves detection for other hosts while eliminating the false positive noise from the known-benign traffic to the database server. It is the surgical, recommended approach for tuning out false positives.

Answer

Delete the rule definition entirely from the Snort local rules file.

Answer

Disable all preprocessor inspection engines within the snort.conf configuration file.

Answer

Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

Question 14

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

Accepted Answer

Deploying the IPS inline equipped with hardware fail-open optical/electrical bypass tap modules. Deploying the IPS inline with hardware fail-open bypass modules ensures that traffic is actively inspected in the data path, but if the IPS fails or loses power, the bypass module physically bridges the connection to maintain network uptime. This provides both intrusion prevention (blocking malicious traffic) and high availability, meeting the requirement of minimizing latency and avoiding a single point of failure. Hardware bypass operates at the physical layer, so it does not rely on software or external power to fail open.

Answer

Configuring the IPS as an out-of-band active response server using SNMP traps.

Answer

Placing the IPS behind a load balancer using round-robin DNS routing.

Answer

Deploying the IPS in passive tap mode using a network packet broker span session.

Question 15

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. Option A is correct because the WSUS Server Cleanup Wizard removes obsolete updates, unused update revisions, expired updates, and unneeded content files, which prevents the SUSDB from growing unbounded and keeps synchronization and reporting healthy. Option E is correct because regularly approving needed updates and declining superseded or expired ones ensures clients receive only current patches and reduces unnecessary disk usage, scan time, and administrative confusion. Option B is wrong because automatically installing pre-release beta patches on domain controllers is risky and not a maintenance best practice; production servers should receive tested, released updates. Option C is wrong because directly editing WSUS SQL tables without backups can corrupt the SUSDB and is unsupported. Option D is wrong because disabling TLS weakens client-server communication security and does not constitute healthy WSUS maintenance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans

Question 16

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

Accepted Answer

WPA3-Enterprise 192-bit mode (Suite B compliance). WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Answer

WPA2-Enterprise with AES-CCMP and TKIP fallback

Answer

Enhanced Open (OWE) with opportunistic encryption

Answer

WPA3-Personal with SAE and transition mode enabled

Question 17

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

Accepted Answer

Remove all current security groups and attach an isolation security group with deny-all rules. To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Answer

Terminate the EC2 instance and restore from the latest snapshot

Answer

Modify the instance state to 'stopped' via AWS CLI

Answer

Delete the attached Elastic Network Interface (ENI)

Question 18

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

Accepted Answer

Endpoint local service status confirming antivirus daemon/service execution and recent scan logs. Option B is correct because checking the endpoint's local service status verifies that the antivirus daemon/service is actually running, and reviewing recent scan logs confirms the agent is performing its scanning function rather than merely being installed. Option D is correct because a centralized EDR management console dashboard aggregates agent health telemetry and signature update status across all workstations, which is the most efficient way to confirm fleet-wide functionality and compliance. Option A is incorrect because spanning-tree root bridge priority is a Layer 2 switching parameter unrelated to endpoint security agents. Option C is incorrect because DNS root hint tables only affect name resolution and reveal nothing about antivirus or EDR operation. Option E is incorrect because BGP ASN peering configurations concern internet routing between autonomous systems, not endpoint protection status.

Answer

Network switch spanning-tree root bridge priority metrics

Answer

DNS root hint server IP address tables

Answer

BGP router autonomous system number (ASN) peering configurations

Question 19

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Accepted Answer

Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert). Option C is correct because SOAR platforms are built to run orchestrated playbooks that trigger automated containment actions, such as isolating an endpoint via EDR API or disabling an account when a high-fidelity alert fires, reducing mean time to respond. Option D is correct because SOAR natively performs automated IOC enrichment by querying external threat intelligence APIs (e.g., VirusTotal, MISP, Recorded Future) to add context like reputation, geolocation, and related campaigns to alerts. Option E is correct because SOAR integrates with ITSM and case management tools such as Jira and ServiceNow to auto-create, update, and track incident tickets, streamlining workflow and documentation. Option A is incorrect because designing marketing websites is a web development function unrelated to security orchestration or incident response. Option B is incorrect because SOAR is software orchestration, not physical robotics, and it does not replace data center firewalls with robotic hardware arms.

Answer

Designing corporate marketing websites

Answer

Replacing physical data center firewalls with robotic hardware arms

Question 20

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

Accepted Answer

Azure Key Vault (Managed HSM or Standard Vault). Azure Key Vault (either a Standard vault or a Managed HSM pool) is the Azure service that stores and manages customer-managed keys (CMK) used for Storage Account encryption at rest. Storage Accounts integrate natively with Key Vault via a system-assigned or user-assigned managed identity, allowing the storage service to unwrap the CMK for encryption/decryption without exposing the key. Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules when the auditor requires keys stored in dedicated HSM hardware.

Answer

Azure Information Protection (AIP)

Answer

Azure Active Directory (Microsoft Entra ID) Identity Protection

Answer

Azure Sentinel (Microsoft Sentinel)