CND Practice Test 4 — 10 Questions

Question 1

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dc3dd. dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Answer

diskpart clean

Answer

chkdsk /f /r

Answer

sfc /scannow

Question 2

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 3

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). Option D is correct because mod_security is a Web Application Firewall (WAF) engine for Apache that inspects HTTP requests and responses against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting (XSS), and other common web attacks. Option E is correct because mod_headers allows Apache to inject response headers, and configuring it to send Strict-Transport-Security (HSTS) forces browsers to use HTTPS for future connections, mitigating protocol downgrade and cookie-hijacking attacks. Option A is not correct because KeepAlive and KeepAliveTimeout only tune TCP connection reuse and have no direct security effect. Option B is not correct because DirectoryIndex merely defines default index files and does not mitigate web threats. Option C is not correct because listening on port 80 without an SSL virtual host leaves traffic unencrypted and does not enhance application security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 4

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

Accepted Answer

Remote Host Isolation / Network Containment. Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Answer

Disk Defragmentation

Answer

Remote Device Wipe

Answer

Cloud Sandbox Submission

Question 5

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

Accepted Answer

User Responsibilities and Data Sharing. The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Answer

Physical Security Controls

Answer

Disaster Recovery Protocols

Answer

Network Infrastructure Redundancy

Question 6

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

Accepted Answer

SSH (Secure Shell). SSH (Secure Shell) is the standard protocol for secure remote management of Linux servers, providing encrypted authentication and session transport over untrusted networks. It replaces insecure protocols like Telnet by encrypting all traffic, including credentials and commands. SSH operates on TCP port 22 by default and supports key-based authentication for stronger security.

Answer

HTTP

Answer

SNMPv1

Answer

FTP

Question 7

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.

Question 8

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 9

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

Accepted Answer

Windows Defender Credential Guard. Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Answer

Windows Defender Application Control (WDAC)

Answer

User Account Control (UAC)

Answer

BitLocker Drive Encryption

Question 10

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service