CND Practice Test 2 — 30 Questions

Question 1

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dc3dd. dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Answer

diskpart clean

Answer

chkdsk /f /r

Answer

sfc /scannow

Question 2

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 3

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). Option D is correct because mod_security is a Web Application Firewall (WAF) engine for Apache that inspects HTTP requests and responses against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting (XSS), and other common web attacks. Option E is correct because mod_headers allows Apache to inject response headers, and configuring it to send Strict-Transport-Security (HSTS) forces browsers to use HTTPS for future connections, mitigating protocol downgrade and cookie-hijacking attacks. Option A is not correct because KeepAlive and KeepAliveTimeout only tune TCP connection reuse and have no direct security effect. Option B is not correct because DirectoryIndex merely defines default index files and does not mitigate web threats. Option C is not correct because listening on port 80 without an SSL virtual host leaves traffic unencrypted and does not enhance application security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 4

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

Accepted Answer

Remote Host Isolation / Network Containment. Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Answer

Disk Defragmentation

Answer

Remote Device Wipe

Answer

Cloud Sandbox Submission

Question 5

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

Accepted Answer

User Responsibilities and Data Sharing. The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Answer

Physical Security Controls

Answer

Disaster Recovery Protocols

Answer

Network Infrastructure Redundancy

Question 6

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for secure remote management of Linux servers, providing encrypted authentication and session transport over untrusted networks. It replaces insecure protocols like Telnet by encrypting all traffic, including credentials and commands. SSH operates on TCP port 22 by default and supports key-based authentication for stronger security.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 7

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.

Question 8

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 9

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 10

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service

Question 11

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Accepted Answer

Signature-based detection. Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Answer

Heuristic detection

Answer

Behavioral analytics detection

Answer

Anomaly-based detection

Question 12

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

Accepted Answer

Support for Document Type Definitions (DTDs) and external entity references. XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Answer

Support for HTTP chunked transfer encoding

Answer

Support for UTF-8 character encoding

Answer

Support for JSON serialization and deserialization

Question 13

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 14

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL. Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 15

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

Accepted Answer

Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses. Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.

Answer

Upgrade the IDS hardware to process higher bandwidth capacity

Answer

Convert the IDS into an inline IPS

Answer

Move the IDS from a switch SPAN port to an inline routing position

Question 16

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

Accepted Answer

McAfee DLP Endpoint Client. The McAfee DLP Endpoint Client is the agent installed on each workstation that performs local inspection and enforcement, including blocking writes to USB mass storage devices. It enforces policy at the endpoint without requiring a round trip to a network appliance. This is the component that actually intercepts the file-copy operation on the host.

Answer

McAfee DLP Prevent

Answer

McAfee ePolicy Orchestrator (ePO) Relay Server

Answer

McAfee DLP Discover

Question 17

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Accepted Answer

Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events). Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence. Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Answer

The Master Boot Record (MBR) partition table sectors

Answer

The system HOSTS file in \Windows\System32\drivers\etc\

Question 18

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 19

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

Accepted Answer

Environmental monitoring sensors tracking temperature and humidity thresholds. Option B is correct because ISO/IEC 27001 Annex A (A.11.2.1/A.7.5 in the 2022 revision) requires protection against environmental threats, and temperature/humidity sensors with defined thresholds detect conditions that could damage servers and storage. Option C is correct because Annex A physical entry controls (A.11.1.2/A.7.2) require visitor records, identity verification, and escorting of unauthorized persons to prevent unauthorized physical access. Option D is correct because Annex A requires secure areas to be protected by appropriate entry controls such as biometric or card-key systems, and logging all entry/exit events provides the audit trail needed for accountability and incident investigation. Option A is not acceptable because storing unencrypted backup tapes with sensitive PII in unlocked hallways violates both physical protection of media (A.11.2.3/A.7.10) and confidentiality requirements. Option E is not acceptable because propping open emergency exits defeats physical perimeter security and violates secure-area access control requirements, even if done for cooling convenience.

Answer

Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways

Answer

Leaving data center exterior emergency exit doors propped open for convenient cooling

Question 20

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

Accepted Answer

nocase. The nocase modifier in Snort tells the detection engine to perform a case-insensitive match on the preceding content or uricontent pattern. Since the requirement is to match 'admin_login.php' regardless of case (e.g., 'Admin_Login.PHP'), appending nocase to the content/uricontent rule option is the correct approach. Without it, Snort performs a byte-exact case-sensitive comparison and would miss mixed-case variants attackers commonly use to evade signature matching.

Answer

uricontent

Answer

depth

Answer

offset