CND Practice Questions 2 — 50 Questions

Question 1

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Defender Firewall. Windows Defender Firewall with Advanced Security allows administrators to configure firewall rules to isolate or restrict traffic.

Answer

Disk Management

Answer

Device Manager

Answer

Task Manager

Question 2

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

Accepted Answer

TACACS+ for device administration and RADIUS for dial-in/remote user access. TACACS+ provides granular authorization and separates authentication, authorization, and accounting for device administration.

Answer

DNSSEC for device privilege authorization

Answer

HTTP Basic Authentication for router console access

Answer

SNMPv1 for authentication and TFTP for accounting

Question 3

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Windows Run/RunOnce keys in HKLM and HKCU, along with Winlogon registry entries, are classic persistence vectors.

Answer

HKEY_CLASSES_ROOT\.txt\DefaultIcon

Answer

HKEY_PERFORMANCE_DATA\CurrentPerformance

Question 4

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Accepted Answer

AlienVault Open Threat Exchange (OTX). OSINT sources include publicly accessible threat feeds, vulnerability databases, and security blogs.

Answer

Internal employee performance reviews

Answer

Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

Answer

Classified military signals intelligence intercepts

Question 5

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

Accepted Answer

alert tcp any any -> $HOME_NET 80 (msg:"Directory Traversal Attempt"; content:"../"; http_uri; sid:100001; rev:1;). To inspect HTTP URIs specifically, Snort provides the 'uricontent' or modern 'http_uri' modifier within rule options. The rule must use tcp protocol, specify external/any networks targeting internal web servers, and use the 'http_uri' sticky buffer or modifier to inspect the URI payload for '../'.

Answer

pass tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"Traversal"; content:"../"; http_client_body; sid:100001; rev:1;)

Answer

alert ip any any -> any any (msg:"Directory Traversal"; uricontent:"../"; sid:100001; rev:1;)

Answer

log udp any any -> $HOME_NET 80 (msg:"Directory Traversal"; content:"../"; depth:2; sid:100001; rev:1;)

Question 6

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

Accepted Answer

Active Directory Account Access Logs and Group Memberships. Account management policies and access control lists detailing individual named accounts versus shared accounts are required for individual accountability.

Answer

BGP Routing Table Summaries

Answer

Network Switch Port VLAN Assignments

Answer

DNS Zone File Configurations

Question 7

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

Accepted Answer

Remediation VLAN / Quarantine Network. A remediation or quarantine VLAN isolates non-compliant devices, restricting network access while allowing them to download required updates.

Answer

Unrestricted guest wireless broadcast zone

Answer

Core router management loopback subnet

Answer

DMZ (Demilitarized Zone) web server farm

Question 8

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. PsExec relies heavily on ADMIN$ share access and remote service creation via SMB (TCP ports 445 and 139) and RPC. Restricting inbound SMB access to authorized administrative management subnets and enabling Windows Defender Firewall rules blocking remote service creation prevents PsExec execution.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

Question 9

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

Accepted Answer

Enable DHCP Snooping globally and configure untrusted user access ports as untrusted.. DHCP snooping acts as a firewall between trusted and untrusted DHCP servers. It drops DHCP offer/ack messages coming from untrusted ports while building a trusted DHCP binding database.

Answer

Activate IP Source Guard with static binding entries on all edge switch ports.

Answer

Configure Dynamic ARP Inspection (DAI) on all trunk ports connecting to core switches.

Answer

Enable Port Security with maximum MAC address limits and restrict violation actions.

Question 10

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

Accepted Answer

SSH (Secure Shell) version 2. SSH (Secure Shell) provides encrypted command-line management, replacing unencrypted protocols like Telnet.

Answer

TFTP (Trivial File Transfer Protocol)

Answer

HTTP over port 80

Answer

Telnet over port 23

Question 11

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). A correct Snort rule structure requires the action (alert/drop), protocol (icmp), source/destination IPs and ports, and options such as dsize:1000 to check packet payload size.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 12

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

Accepted Answer

Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.. Fail2ban monitors log files (such as /var/log/auth.log) for patterns of failed authentication attempts and automatically updates firewall rules (iptables or nftables) to ban offending IP addresses for a set duration.

Answer

Deploy Wireshark with a real-time command-line display filter for SSH packets.

Answer

Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.

Answer

Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.

Question 13

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Accepted Answer

DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.. Modern email authentication and hardening rely on Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).

Answer

Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

Answer

Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.

Question 14

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

Accepted Answer

Disabling Telnet and enabling SSH version 2 for CLI management. Securing the management plane requires disabling legacy unencrypted protocols like Telnet and HTTP, and enforcing SSH and HTTPS.

Answer

Leaving default administrator credentials unchanged for ease of initial troubleshooting

Answer

Enabling SNMPv1 community string 'public' with read-write access globally

Answer

Configuring all switch ports with dynamic VLAN trunking protocol (VTP) server mode by default

Question 15

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

Accepted Answer

Deploy behavioral anomaly detection and Endpoint Detection and Response (EDR) solutions across all internal endpoints.. Adaptive defense-in-depth relies on micro-segmentation, Zero Trust network architecture (never trust, always verify), and continuous monitoring/behavioral analytics rather than relying solely on a single perimeter firewall.

Answer

Disable all logging and auditing mechanisms to reduce SIEM ingestion noise and storage costs.

Answer

Rely exclusively on a strong perimeter firewall and demilitarized zone (DMZ) to secure internal assets.

Question 16

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

Accepted Answer

Audit and restrict the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended access rights on the domain object.. DCSync relies on specific Active Directory replication rights: 'Replicating Directory Changes' (GUID 11f46d12-861c-4d42-b41c-50f443a82f7f) and 'Replicating Directory Changes All'. Ensuring that only authorized Domain Controllers hold these extended rights is critical.

Answer

Enforce LDAP signing and channel binding on all domain controller NTDS settings.

Answer

Monitor the 'GenericAll' and 'WriteDacl' permissions on all computer account objects.

Answer

Disable NT LAN Manager (NTLM) authentication and enforce Kerberos ticket granting settings.

Question 17

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

Accepted Answer

Maintain a comprehensive Software Bill of Materials (SBOM) and perform automated Software Composition Analysis (SCA) for third-party libraries.. Supply chain security is reinforced by performing Software Bill of Materials (SBOM) tracking and software composition analysis (SCA) to identify vulnerable dependencies, alongside enforcing strict vendor risk management and access controls.

Answer

Disable all code signing requirements for internal and external software builds.

Answer

Grant third-party vendor support accounts permanent, unmonitored Domain Administrator privileges.

Answer

Rely entirely on vendor self-assessments without conducting independent code audits or penetration testing.

Question 18

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

Accepted Answer

Explicit notification that network activity is monitored and clear disciplinary actions for violations.. An AUP must explicitly state the consequences of policy violations and inform users that their activities on company assets are subject to monitoring.

Answer

The vendor part numbers and firmware release schedules for core network switches.

Answer

The exact physical coordinates and lock combinations of the server room cages.

Answer

Detailed command-line instructions for configuring IPsec VPN tunnels on remote laptops.

Question 19

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Accepted Answer

To act as a hardened, single-purpose server exposed to the internet in a DMZ.. A bastion host is a hardened computer specifically designed and configured to withstand attacks while facing the public internet.

Answer

To serve as the primary domain controller for the internal enterprise network.

Answer

To store encrypted backups of internal databases.

Answer

To bridge wireless clients directly to the wired core.

Question 20

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

Accepted Answer

Honeyd. Honeyd is a low-interaction honeypot daemon that simulates virtual hosts and services on a network, allowing administrators to configure fake TCP/UDP ports and operating system fingerprints.

Answer

Kali Linux Metasploitable

Answer

Snort IDS

Answer

Wireshark