CND Practice Test 2 — 30 Questions

Question 1

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Disabling root SSH login and enforcing strict file permissions (umask) are standard Linux hardening best practices.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 2

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI with Cilium supports network policies and data plane encryption (IPsec/WireGuard) for node-to-node and pod-to-pod traffic in AKS.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 3

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

Accepted Answer

Cloud Storage Bucket Lock using Object Retention Policies (WORM). Cloud Storage Bucket Lock using Object Retention Policies (WORM storage) enforces Write Once, Read Many compliance protections that cannot be bypassed even by bucket owners.

Answer

Google Cloud IAM Bucket-Level Access Control with deny policies

Answer

Customer-managed encryption keys (CMEK) with scheduled key rotation

Answer

GCP Storage object versioning with lifecycle rules

Question 4

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications securely without exposing traffic to the public internet.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 5

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Accepted Answer

stats sum(bytes) by dest_ip. The 'stats' command in Splunk is used for statistical aggregation, such as summing total bytes per destination IP.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 6

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model, Infrastructure and Capability are core meta-features that describe how the Adversary and Victim are connected.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 7

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). AWS S3 Account-Level Block Public Access settings prevent any S3 bucket within the account from being made public, regardless of individual bucket policies.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary

Question 8

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 9

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting all serial numbers, model details, and completing a proper evidence custody form is vital for maintaining the legal chain of custody.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 10

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

Accepted Answer

Rkhunter (Rootkit Hunter). Chkrootkit and Rootkit Hunter (Rkhunter) are standard tools used on Linux to scan for rootkits, backdoors, and local exploits.

Answer

Autopsy

Answer

Cisco Firepower

Answer

Volatility

Question 11

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

Accepted Answer

Querying authentication logs for service accounts logging in interactively via remote desktop. Detecting valid accounts abuse involves hunting for anomalous login locations, impossible travel, or unusual privilege escalations.

Answer

Scanning internal subnets for unpatched EternalBlue vulnerabilities

Answer

Searching endpoint logs for known ransomware string signatures

Answer

Checking firewall rules for outbound traffic on port 443

Question 12

An organization experiences a data breach involving personal identifiable information (PII). Regulatory compliance mandates notifying authorities within 72 hours. Which phase of the incident response process includes fulfilling external reporting and stakeholder communication requirements?

Accepted Answer

Post-Incident Activity. Post-incident activities include reporting to regulatory bodies, management briefings, and lessons learned.

Answer

Eradication

Answer

Preparation

Answer

Containment

Question 13

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

Accepted Answer

Network-level containment. Isolating a subnet or segment of the network to prevent propagation while maintaining internal analysis capabilities is a form of network segmentation and physical/logical isolation.

Answer

Host-level containment

Answer

Full enterprise quarantine

Answer

Application-level containment

Question 14

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

Accepted Answer

where. The KQL 'where' operator is used to filter records based on a boolean expression.

Answer

extend

Answer

project

Answer

summarize

Question 15

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

Accepted Answer

Configuring Azure Storage Firewall rules to restrict access to specific Virtual Networks and IP ranges. Enabling Storage firewall rules (virtual network and IP restrictions) and Microsoft Defender for Storage protects storage accounts.

Answer

Allowing anonymous public read access on all blob containers by default

Answer

Removing all Azure Key Vault cryptographic keys

Answer

Disabling HTTPS traffic so clients communicate exclusively over unencrypted HTTP

Question 16

An organization is updating its incident response policy based on NIST SP 800-61. Which TWO phases are part of the post-incident activity stage? (Choose TWO)

Accepted Answer

Evidence Retention and Reporting. According to NIST SP 800-61, the post-incident phase encompasses learning lessons from the incident and retaining evidence/reporting.

Answer

Containment

Answer

Vulnerability Assessment

Answer

System Eradication

Question 17

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

Accepted Answer

Recovery. Following Eradication comes the Recovery phase, where systems are restored to normal operation and validated.

Answer

Detection and Analysis

Answer

Preparation

Answer

Post-Incident Activity

Question 18

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Accepted Answer

Potential operational downtime and business impact. Containment strategy decisions depend on potential business disruption, service availability requirements, and evidence preservation needs.

Answer

The color of the Ethernet cables connected to the rack

Answer

The office desk location of the IT director

Answer

The brand name of the server manufacturer

Question 19

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

Accepted Answer

Strategic threat intelligence. Strategic threat intelligence provides high-level information regarding campaigns, adversary motivations, and trends for executive decision-makers.

Answer

Operational threat intelligence

Answer

Tactical threat intelligence

Answer

Technical threat intelligence

Question 20

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

Accepted Answer

alert. The 'alert' action tells Snort to generate an alert and log the packet, allowing traffic to pass.

Answer

sdrop

Answer

reject

Answer

drop