CND Practice Test 4 — 10 Questions

Question 1

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Disabling root SSH login and enforcing strict file permissions (umask) are standard Linux hardening best practices.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 2

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI with Cilium supports network policies and data plane encryption (IPsec/WireGuard) for node-to-node and pod-to-pod traffic in AKS.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 3

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

Accepted Answer

Cloud Storage Bucket Lock using Object Retention Policies (WORM). Cloud Storage Bucket Lock using Object Retention Policies (WORM storage) enforces Write Once, Read Many compliance protections that cannot be bypassed even by bucket owners.

Answer

Google Cloud IAM Bucket-Level Access Control with deny policies

Answer

Customer-managed encryption keys (CMEK) with scheduled key rotation

Answer

GCP Storage object versioning with lifecycle rules

Question 4

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications securely without exposing traffic to the public internet.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 5

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

Accepted Answer

stats sum(bytes) by dest_ip. The 'stats' command in Splunk is used for statistical aggregation, such as summing total bytes per destination IP.

Answer

rex field=bytes max_match=1

Answer

table dest_ip, bytes

Answer

eval bytes_sum = sum(bytes)

Question 6

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model, Infrastructure and Capability are core meta-features that describe how the Adversary and Victim are connected.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 7

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). AWS S3 Account-Level Block Public Access settings prevent any S3 bucket within the account from being made public, regardless of individual bucket policies.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary

Question 8

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

Accepted Answer

Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged. Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.

Answer

Configuring automatic disk encryption using BitLocker with a TPM chip

Answer

Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

Answer

Enabling centralized syslog forwarding over encrypted TLS channels

Question 9

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

Accepted Answer

Document the make, model, serial number, and sign an evidence custody form. Documenting all serial numbers, model details, and completing a proper evidence custody form is vital for maintaining the legal chain of custody.

Answer

Calculate an MD5 or SHA-256 cryptographic hash of the raw drive

Answer

Defragment the partition to speed up future forensic analysis

Answer

Boot the drive in a live environment to check for rootkits

Question 10

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

Accepted Answer

Rkhunter (Rootkit Hunter). Chkrootkit and Rootkit Hunter (Rkhunter) are standard tools used on Linux to scan for rootkits, backdoors, and local exploits.

Answer

Autopsy

Answer

Cisco Firepower

Answer

Volatility