CND Practice Test 3 — 10 Questions

Question 1

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 2

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

Accepted Answer

Enable Windows Defender Credential Guard utilizing Virtualization-based Security (VBS).. Credential Guard uses Virtualization-based Security (VBS) to isolate LSA secrets, including NTLM hashes and Kerberos TGTs, in a separate virtualized environment that even a compromised kernel cannot read. This renders harvested hashes unusable for Pass-the-Hash because the attacker cannot extract them from the protected process.

Answer

Enforce User Account Control (UAC) with highest privilege elevation prompts.

Answer

Configure Windows Defender Exploit Guard with Network Protection enabled.

Answer

Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.

Question 3

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

Accepted Answer

Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows. Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows provides continuous, automated log review that satisfies ISO/IEC 27001 A.12.4.1. The SIEM aggregates logs, correlates events, and generates alerts for analyst review, ensuring regular monitoring and governance. This is the most effective automated practice for meeting the control's requirement for regular review.

Answer

Disabling log verbosity to prevent storage overhead on the central syslog collector

Answer

Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter

Answer

Relying entirely on end users to manually report anomalous log entries via email

Question 4

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS jump-host service that provides RDP and SSH access to VMs directly through the Azure portal over TLS (port 443), so RDP 3389 and SSH 22 never need to be exposed to the public internet. It is deployed into a dedicated subnet named AzureBastionSubnet inside the VM's VNet, and it brokers the session without requiring a public IP on the target VM. This directly satisfies the requirement of eliminating open management ports while still allowing administrative access.

Answer

Azure VPN Gateway with point-to-site configuration

Answer

Azure Load Balancer with TCP reset enabled

Answer

Azure Front Door with Web Application Firewall

Question 5

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

Accepted Answer

TACACS+ for device administration and RADIUS for dial-in/remote user access. TACACS+ and RADIUS together represent the industry-standard AAA combination for network device administration. TACACS+ is preferred for device administration because it separates authentication, authorization, and accounting into distinct functions and encrypts the entire payload, while RADIUS is commonly used for dial-in and remote user access with its UDP-based, attribute-value pair model. This split is a long-standing Cisco and general networking best practice.

Answer

DNSSEC for device privilege authorization

Answer

HTTP Basic Authentication for router console access

Answer

SNMPv1 for authentication and TFTP for accounting

Question 6

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

Accepted Answer

Conducting periodic vulnerability assessments and reviewing SIEM alert correlation rules.. The Monitor and Evaluate phase of the Network Defense Lifecycle focuses on ongoing situational awareness: conducting vulnerability assessments, reviewing SIEM alerts, analyzing logs, and measuring control effectiveness. Periodic vulnerability assessments and SIEM alert correlation rule reviews are continuous monitoring activities that detect changes in the threat landscape and validate that implemented controls still work.

Answer

Performing business impact analysis (BIA) to classify critical information assets.

Answer

Procuring hardware appliances and racking firewalls in the primary datacenter.

Answer

Drafting the initial high-level security governance charter for board approval.

Question 7

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

Accepted Answer

Setting a strong UEFI/BIOS administrator password to prevent unauthorized configuration changes. Option A is correct because setting a strong UEFI/BIOS administrator password prevents unauthorized users from entering firmware setup and altering security-relevant settings such as boot order, virtualization, or disabling protections, directly mitigating physical/firmware tampering. Option D is correct because UEFI Secure Boot validates the digital signatures of bootloaders and early boot components against trusted keys, blocking unauthorized bootloaders and rootkits from loading before the OS. Option B is wrong because leaving the chassis intrusion detection switch disconnected removes a physical-tamper detection control rather than adding one. Option C is wrong because prioritizing unverified USB boot devices weakens boot security and enables rogue boot media attacks. Option E is wrong because disabling TPM activation removes hardware-rooted key storage and measured-boot capabilities that support integrity and tamper detection.

Answer

Leaving the physical chassis intrusion detection switch disconnected

Answer

Configuring the boot order to prioritize booting from unverified USB flash drives first

Answer

Disabling Trusted Platform Module (TPM) activation across all systems

Question 8

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

Accepted Answer

Implement SSL/TLS Decryption (SSL Inspection) on the Next-Generation Firewall or Secure Web Gateway.. SSL/TLS Decryption on a Next-Generation Firewall or Secure Web Gateway allows the organization to inspect encrypted outbound traffic for malicious payloads and C2 beaconing patterns. This technique terminates the TLS session, inspects the plaintext, and re-encrypts it, enabling deep packet inspection without violating compliance if proper legal and privacy controls are in place. It is the standard enterprise architecture technique for inspecting HTTPS traffic.

Answer

Enforce strict client-side certificate pinning on all corporate web browsers.

Answer

Configure IPsec VPN tunnels between all endpoints and the corporate perimeter router.

Answer

Deploy a Layer 2 network tap connected to a passive intrusion detection sensor.

Question 9

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

Accepted Answer

Stateful Session Synchronization (Cluster State Sync). Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Answer

Strict TCP handshake validation

Answer

Unicast RPF (Reverse Path Forwarding)

Answer

NAT hairpinning

Question 10

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

Accepted Answer

On the internal network boundary between the Finance and Guest VLANs. To enforce ACLs between two internal zones (Finance and Guest), the security device must sit inline on the path between those VLANs — i.e., at the internal boundary where inter-VLAN routing occurs. Placing it there ensures all Finance-to-Guest traffic is inspected and controlled before it can traverse the internal network.

Answer

At the perimeter boundary directly connected to the ISP modem

Answer

On the local loopback interface of each end-user workstation

Answer

Inside the ISP core routing infrastructure