CND Practice Questions 2 — 50 Questions

Question 1

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed to structure, store, and share IoCs in machine-readable formats like STIX and MISP JSON. It supports taxonomies, galaxies, and feeds that let ISACs and SOCs exchange indicators at scale. This makes it the correct answer for structuring and sharing threat intelligence.

Answer

Nmap

Answer

Autopsy

Answer

Wireshark

Question 2

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

Accepted Answer

Private Google Access enabled on the subnet. Private Google Access is a subnet-level setting that allows VM instances with only internal (RFC 1918) IP addresses to reach Google APIs and services (Cloud Storage, BigQuery, Pub/Sub, etc.) using their internal IPs, without requiring a Cloud NAT or external IP. Traffic is routed over Google's internal network to the private.googleapis.com or restricted.googleapis.com VIPs (199.36.153.8/30 or 199.36.153.4/30). This is the canonical GCP control for secure, private API access from internal-only instances.

Answer

GCP Cloud NAT gateway attached to the subnet

Answer

External HTTP(S) Load Balancer

Answer

Dedicated Interconnect with partner peering

Question 3

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

Accepted Answer

Implementing IEEE 802.11w (Protected Management Frames). Option C is correct because IEEE 802.11w Protected Management Frames cryptographically protects management frames such as deauthentication and disassociation, preventing wireless sniffing-based denial-of-service and spoofing attacks against the WLAN. Option D is correct because a WIPS sensor network continuously monitors the RF spectrum to detect and automatically contain rogue APs, evil twins, and unauthorized client devices, directly addressing the unauthorized-device requirement. Option E is correct because 802.1X with a secure RADIUS server and Enterprise PKI enforces certificate-based mutual authentication, ensuring only authorized devices and users can associate and preventing credential theft or rogue supplicant access. Option A is not appropriate because WEP is cryptographically broken and provides no meaningful isolation or protection, and Option B is not appropriate because hidden SSIDs are trivially discovered by sniffers and offer no real security, so neither belongs in a hardened enterprise design.

Answer

Relying on legacy WEP shared keys for guest network isolation

Answer

Configuring hidden SSIDs as the primary security defense

Question 4

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

Accepted Answer

Enable DHCP Snooping globally and configure untrusted user access ports as untrusted.. DHCP Snooping is the switch security feature designed to prevent rogue DHCP servers and DHCP starvation attacks. By enabling it globally and configuring user access ports as untrusted, the switch only allows DHCP server responses (OFFER, ACK) from trusted ports (e.g., uplinks to legitimate DHCP servers), blocking unauthorized DHCP servers.

Answer

Activate IP Source Guard with static binding entries on all edge switch ports.

Answer

Configure Dynamic ARP Inspection (DAI) on all trunk ports connecting to core switches.

Answer

Enable Port Security with maximum MAC address limits and restrict violation actions.

Question 5

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

Accepted Answer

Insecure Management APIs lacking proper authentication, rate limiting, and input validation.. Option C is correct because cloud management APIs are the primary control plane for provisioning and configuring resources, so APIs lacking strong authentication, rate limiting, and input validation are directly exploitable for unauthorized access, resource hijacking, and data exfiltration. Option E is correct because overly permissive IAM policies that grant excessive administrative privileges violate least privilege and are a leading cause of cloud data breaches, allowing compromised credentials or roles to escalate access across accounts and services. The unmarked options do not belong: A and D describe physical attacks against hypervisor memory or data center hardware, which are largely mitigated by cloud provider physical controls and are not primary cloud threat vectors for customers, while B targets local endpoint BIOS firmware and is an endpoint-level rather than cloud-specific vector.

Answer

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Answer

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Answer

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Question 6

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

Accepted Answer

Azure ExpressRoute with MACsec or configured IPsec tunnels. Option B is correct because Azure ExpressRoute can provide private, dedicated connectivity from on-premises datacenters to Azure Virtual Networks, and it can be secured with MACsec at the ExpressRoute Direct link layer or with IPsec tunnels over the ExpressRoute private peering for end-to-end encryption. Option E is correct because an Azure Site-to-Site VPN Gateway establishes an IPsec/IKE-encrypted tunnel over the public internet between on-premises VPN devices and the Azure VPN gateway, ensuring secure transit for cross-premises traffic. Option A is not appropriate because standard unencrypted public IP bindings expose VM traffic without providing an encrypted transit channel. Option C is not appropriate because a standard Azure Load Balancer without TLS offloading does not encrypt traffic between on-premises datacenters and Azure Virtual Networks. Option D is not appropriate because Azure Virtual Network Peering connects virtual networks but does not by itself provide encrypted transit from on-premises datacenters to Azure.

Answer

Standard unencrypted public IP bindings on Azure VMs

Answer

Standard Azure Load Balancer without TLS offloading

Answer

Unencrypted Azure Virtual Network Peering

Question 7

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, the Command and Control (C2) phase involves the attacker establishing a communication channel with the compromised system to control it remotely. DNS tunneling is a common method for C2, so this alert represents the Command and Control phase.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Delivery

Question 8

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

Accepted Answer

Layer 3 router or multilayer switch. VLANs are logically separate Layer 2 broadcast domains, so traffic between the Marketing VLAN and the Sales VLAN cannot be switched at Layer 2 — it must be routed. A Layer 3 router or multilayer switch performs inter-VLAN routing by terminating each VLAN's SVI (or subinterface) and forwarding packets between the two IP subnets. This is the only device class in the options that operates at Layer 3 and can make forwarding decisions based on IP addressing.

Answer

Layer 2 unmanaged switch

Answer

Hub

Answer

Wireless range extender

Question 9

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Option B is correct because setting a restrictive default umask such as 027 in shell profiles (e.g., /etc/profile or /etc/bashrc) ensures newly created files are not world-readable or group-writable, reducing exposure of sensitive data and limiting opportunities for local attackers to tamper with files. Option C is correct because configuring PermitRootLogin no in /etc/ssh/sshd_config prevents direct SSH logins as root, forcing administrators to authenticate as unprivileged users and then escalate via sudo or su, which strengthens accountability and blocks a common brute-force path to full system compromise. The unmarked options do not belong: disabling SELinux or AppArmor (A) removes mandatory access control enforcement and weakens containment of compromised processes, enabling password authentication with zero minimum length in PAM (D) permits weak or empty passwords that are trivially guessed or brute-forced, and mounting all filesystems read-write with suid privileges (E) increases the attack surface by allowing setuid binaries to execute and by permitting modification of system files.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 10

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

Accepted Answer

SNMPv3. SNMPv3 is the only version that provides both encryption (via DES, 3DES, AES) and authentication (via MD5, SHA). It introduces the User-based Security Model (USM) to secure management queries and responses. SNMPv1 and v2c offer only community string authentication, which is sent in cleartext.

Answer

SNMPv2c

Answer

SNMPv1

Answer

SNMPv2u

Question 11

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

Accepted Answer

The Application Identity service (AppIDSvc) is stopped or disabled. AppLocker relies on the Application Identity service (AppIDSvc) to evaluate and enforce rules. If AppIDSvc is stopped or disabled, AppLocker policies are not applied, allowing all executables to run regardless of configured rules. The administrator's rule to allow signed apps would be ignored, and unsigned tools from user-writable directories would execute freely.

Answer

Windows Defender Real-time Protection is enabled

Answer

BitLocker encryption is not enabled on the system drive

Answer

Fast Startup is enabled in the BIOS

Question 12

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Accepted Answer

Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.. SELinux and AppArmor are Linux kernel security modules that implement mandatory access control (MAC), confining processes to only the resources defined by policy regardless of user privileges. Running them in enforcing mode ensures that policy violations are blocked, not just logged, which is the correct way to restrict processes to only necessary resources.

Answer

Modify standard Linux file permission bits (chmod and chown) for all application binaries.

Answer

Enable the Linux audit daemon (auditd) to log all system call activities.

Answer

Install and configure a host-based firewall using iptables or nftables.

Question 13

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Accepted Answer

Analyze the log files to verify if an unauthorized breach has occurred. NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The first phase after preparation is Detection and Analysis, which in this scenario means analyzing log files to verify whether an unauthorized breach has actually occurred. Only after confirming the incident should containment, eradication, or lessons-learned activities begin.

Answer

Contain the compromised host to prevent lateral movement

Answer

Perform post-incident lessons learned activities

Answer

Eradicate the malware from the impacted SSH server

Question 14

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

Accepted Answer

Network tap / SPAN port capturing database protocol traffic or host-based driver interceptors. A DAM sensor captures database activity most accurately by sitting inline or out-of-band on the network path where database protocol traffic flows — typically via a network TAP or SPAN port mirroring the database VLAN — or by using host-based driver interceptors that hook the database client/server libraries. This captures the actual SQL statements on the wire (TDS for SQL Server, TNS for Oracle) independent of what the database chooses to log, which is critical because native audit logs can be tampered with or disabled by a compromised DBA.

Answer

On the perimeter firewall inspecting ICMP echo requests

Answer

At the corporate DNS resolver cache

Answer

As an SMTP email gateway relay filter

Question 15

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

Accepted Answer

The firewall encodes connection parameters into the sequence number (SYN cookie) without allocating memory state until the client responds with an ACK.. SYN cookies mitigate TCP SYN flood attacks by encoding connection parameters (such as source/destination IP and port, and a secret) into the initial sequence number (ISN) of the SYN-ACK. The server does not allocate any state for the half-open connection until it receives the final ACK from the client, which contains the cookie. This prevents the server's connection table from being exhausted by a flood of SYN packets. The firewall/router can implement SYN cookies to protect downstream servers.

Answer

The firewall drops all incoming SYN packets immediately.

Answer

The firewall resets the TCP window size to zero for all external connections.

Answer

The firewall proxies the TCP handshake by establishing a full connection before forwarding traffic to the server.

Question 16

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The question asks which phase immediately follows Containment, Eradication, and Recovery. According to the standard, Post-Incident Activity is the final phase, where lessons learned are captured and improvements are made to prevent future incidents.

Answer

Preparation

Answer

Detection and Analysis

Answer

Threat Hunting

Question 17

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

Accepted Answer

windows.netstat. In Volatility 3, the windows.netstat plugin enumerates network artifacts from a Windows memory image by walking the kernel's TCP/UDP endpoint and listener structures (e.g., tcpip.sys pools). It lists active connections, listening ports, and associated PIDs, which is exactly what an incident responder needs to identify command-and-control channels or exfiltration sockets. Volatility 3 uses a plugin naming convention of ., so windows.netstat is the correct choice for Windows network sockets.

Answer

windows.dlllist

Answer

windows.pslist

Answer

windows.registry.printkey

Question 18

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Accepted Answer

Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.. Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks. Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Answer

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Answer

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

Question 19

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

Accepted Answer

Event ID 4624. Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Answer

Event ID 1102

Answer

Event ID 4698

Answer

Event ID 4720

Question 20

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

Accepted Answer

Configure a Decryption Exclusion / Bypass rule for specific trusted destination URL categories or domains. Configuring a Decryption Exclusion or Bypass rule for specific trusted destination URL categories or domains allows the NGFW to skip SSL decryption for those destinations while continuing to decrypt and inspect all other TLS traffic. This satisfies privacy regulations without disabling overall inspection.

Answer

Create an outbound NAT rule mapping banking IP addresses to a loopback interface.

Answer

Configure a static route directing banking traffic through an uninspected bypass interface.

Answer

Disable all Layer 7 application inspection signatures globally for TCP port 443.