CND Practice Test 9 — 10 Questions

Question 1

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use parameterized queries and PreparedStatement objects with placeholder parameters. Parameterized queries using PreparedStatement with placeholder parameters (?) ensure that user input is treated strictly as data, never as executable SQL. The JDBC driver sends the query structure and parameters separately to the database, so injection payloads cannot alter the SQL grammar. This is the definitive remediation for SQL injection in Java applications and is recommended by OWASP.

Answer

Invoke the java.net.URLEncoder.encode() method on all parameters

Answer

Wrap all input strings inside single quotes and strip out semicolon characters

Answer

Sanitize all input characters using HTML entity encoding before passing them to the database driver

Question 2

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

Accepted Answer

/etc/profile. /etc/profile is a system-wide shell initialization script sourced by login shells for all users, making it the correct place to set a default umask that applies globally. Setting 'umask 027' or 'umask 077' here ensures every new file created by users inherits restrictive permissions. This is the standard Linux hardening practice for fleet-wide permission defaults.

Answer

/etc/ssh/sshd_config

Answer

/etc/security/limits.conf

Answer

/etc/environment

Question 3

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

Accepted Answer

It contextualizes detection alerts against known adversary tactics, techniques, and procedures (TTPs). Mapping SIEM logs to MITRE ATT&CK enriches alerts with context about which adversary tactic or technique the observed behavior represents (e.g., T1059 Command and Scripting Interpreter). This lets defenders prioritize, correlate, and communicate incidents in a shared vocabulary tied to real-world threat actor behavior. It transforms raw log events into actionable intelligence aligned to the kill chain, improving detection engineering and response.

Answer

It enforces static IP address allocation across dynamic DHCP scopes

Answer

It compresses network packet captures to reduce storage overhead

Answer

It automatically patches operating system zero-day vulnerabilities upon log ingestion

Question 4

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

Accepted Answer

unhide. unhide is a forensic utility specifically designed to detect hidden processes and TCP/UDP ports by cross-referencing multiple data sources, including the kernel system call table (via /proc and syscall hooks) against direct kernel memory reads. User-space rootkits commonly hook syscalls like getdents or read on /proc to filter out malicious PIDs from tools like ps, so a tool that bypasses those hooks is required. unhide's 'checkbrute' and 'checkall' modes compare /proc listings, /bin/ps output, and kernel memory to expose discrepancies.

Answer

lsof -i

Answer

netstat -anp

Answer

ps aux --forest

Question 5

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

Accepted Answer

Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions. PostgreSQL has no native Transparent Data Encryption (TDE) engine in core, so the practical way to encrypt data at rest is at the filesystem/volume layer using dm-crypt/LUKS, which transparently encrypts the disk blocks PostgreSQL writes to. For column-level or field-level cryptographic operations inside the database, the pgcrypto extension provides functions like pgp_sym_encrypt and digest. Combining these two layers gives both at-rest protection and application-visible encryption of specific sensitive columns.

Answer

pg_encrypt_cluster utility

Answer

PostgreSQL Enterprise TDE Daemon

Answer

pg_tde core extension module

Question 6

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Accepted Answer

Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.. DNS tunneling encapsulates C2 traffic within DNS queries and responses, often encoding data in the query name (e.g., subdomain labels) to bypass firewalls. The analyst should filter for 'dns' in Wireshark and examine query strings for anomalies such as unusually long labels, high entropy (random-looking characters), or Base64/hex encoding patterns. These indicators distinguish malicious tunneling from normal DNS resolution, which typically uses short, human-readable domain names.

Answer

Filter for 'http.request.method == POST' and look for binary attachments.

Answer

Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.

Answer

Filter for 'icmp' and examine the payload size of Echo Request packets.

Question 7

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

Accepted Answer

Execute 'find / -perm /4000 -type f 2>/dev/null' to audit files with the SUID bit set.. The command 'find / -perm /4000 -type f 2>/dev/null' searches the entire filesystem for regular files with the SUID bit set (octal 4000), redirecting permission-denied errors to /dev/null. This allows the engineer to audit and then remove SUID permissions from unauthorized binaries, directly mitigating the privilege escalation vector described.

Answer

Execute 'chmod -R 777 /' to reset all filesystem file permissions to secure defaults.

Answer

Run 'netstat -tulnp' to identify listening network ports associated with SUID processes.

Answer

Run 'iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT' to lock down network access.

Question 8

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Accepted Answer

Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.. Snort's suppress directive allows analysts to silence a specific signature (by SID) for a specific target IP without removing the rule entirely. This preserves detection for other hosts while eliminating the false positive noise from the known-benign traffic to the database server. It is the surgical, recommended approach for tuning out false positives.

Answer

Delete the rule definition entirely from the Snort local rules file.

Answer

Disable all preprocessor inspection engines within the snort.conf configuration file.

Answer

Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

Question 9

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

Accepted Answer

Deploying the IPS inline equipped with hardware fail-open optical/electrical bypass tap modules. Deploying the IPS inline with hardware fail-open bypass modules ensures that traffic is actively inspected in the data path, but if the IPS fails or loses power, the bypass module physically bridges the connection to maintain network uptime. This provides both intrusion prevention (blocking malicious traffic) and high availability, meeting the requirement of minimizing latency and avoiding a single point of failure. Hardware bypass operates at the physical layer, so it does not rely on software or external power to fail open.

Answer

Configuring the IPS as an out-of-band active response server using SNMP traps.

Answer

Placing the IPS behind a load balancer using round-robin DNS routing.

Answer

Deploying the IPS in passive tap mode using a network packet broker span session.

Question 10

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. Option A is correct because the WSUS Server Cleanup Wizard removes obsolete updates, unused update revisions, expired updates, and unneeded content files, which prevents the SUSDB from growing unbounded and keeps synchronization and reporting healthy. Option E is correct because regularly approving needed updates and declining superseded or expired ones ensures clients receive only current patches and reduces unnecessary disk usage, scan time, and administrative confusion. Option B is wrong because automatically installing pre-release beta patches on domain controllers is risky and not a maintenance best practice; production servers should receive tested, released updates. Option C is wrong because directly editing WSUS SQL tables without backups can corrupt the SUSDB and is unsupported. Option D is wrong because disabling TLS weakens client-server communication security and does not constitute healthy WSUS maintenance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans