CND Application And Data Protection Practice Test 2 — 15 Questions

Question 1

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 2

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

Accepted Answer

Signature-based detection rules. Signature-based detection rules match HTTP request payloads against known attack patterns — regex or token sequences characteristic of SQL injection, such as ' OR 1=1--, UNION SELECT, or encoded variants. A WAF in front of an online banking portal uses these signatures (e.g., ModSecurity CRS rules 942100, 942110) to inspect parameters, headers, and bodies, then drop matching requests before they reach the origin server. This is the classic negative-security model that blocks known-bad inputs.

Answer

TCP handshake stateful inspection

Answer

Behavioral anomaly machine learning baseline profiling

Answer

Data Loss Prevention (DLP) pattern matching

Question 3

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

Accepted Answer

Freeze global object prototypes using Object.freeze() and validate incoming JSON keys to disallow __proto__ assignments. Prototype pollution occurs when attacker-controlled JSON keys like __proto__ or constructor.prototype are merged into objects, altering Object.prototype and affecting all objects in the Node.js process. The correct remediation is to freeze the global prototypes with Object.freeze(Object.prototype) and to validate/reject incoming JSON keys that contain __proto__, constructor, or prototype before any merge or assignment. This directly blocks the pollution vector at the source rather than trying to sanitize output.

Answer

Sanitize all input parameters using DOMPurify before rendering them

Answer

Configure CORS headers with Access-Control-Allow-Origin set to specific domains

Answer

Implement parameterized SQL queries for all database interactions

Question 4

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 5

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

Accepted Answer

sudo cryptsetup luksFormat /dev/sdb1. The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Answer

sudo fdisk /dev/sdb1 --encrypt

Answer

sudo mkfs.ext4 -e encrypted /dev/sdb1

Answer

sudo mount -o encrypt /dev/sdb1 /mnt/secure

Question 6

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

Accepted Answer

Digital Guardian Endpoint Agent with Web Inspection / Browser Control module. Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Answer

Digital Guardian Discovery Server

Answer

Digital Guardian Network Sensor

Answer

Digital Guardian Cloud Analytics Engine (CAE)

Question 7

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

Accepted Answer

Support for Document Type Definitions (DTDs) and external entity references. XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Answer

Support for HTTP chunked transfer encoding

Answer

Support for UTF-8 character encoding

Answer

Support for JSON serialization and deserialization

Question 8

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

Accepted Answer

bcrypt via the pgcrypto extension using the crypt(password, gen_salt('bf', 12)) function. bcrypt is a purpose-built password hashing function that incorporates a per-password random salt and a tunable cost factor. The pgcrypto call crypt(password, gen_salt('bf', 12)) uses the Blowfish-based bcrypt variant with a cost of 12, meaning 2^12 key-expansion iterations, which makes offline brute-force attacks computationally expensive while remaining fast enough for interactive logins.

Answer

SHA-256 without a salt

Answer

AES-256-CBC symmetric encryption with a shared database key

Answer

MD5 with a hardcoded static salt

Question 9

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

Accepted Answer

IIS Request Filtering with rules to deny double-encoding and path traversal sequences ('..'). IIS Request Filtering is the built-in module that inspects incoming requests and can deny URL sequences, double-encoded characters, and path traversal patterns like '..'. Configuring it to reject double-encoded sequences ('%2e%2e%2f') and traversal strings blocks the attack at the web server layer before it reaches the application. This is the native IIS defense for path traversal and encoded URL attacks.

Answer

HTTP Compression Schema module

Answer

IP Address and Domain Restrictions module

Answer

Windows Authentication Provider with Kerberos constraints

Question 10

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

Accepted Answer

Validate the file's magic bytes (header signature), enforce an extension whitelist, and store files outside the web root. Preventing arbitrary file upload RCE requires validating the file's actual content (magic bytes/header signature), enforcing a strict extension whitelist, and storing uploaded files outside the web root so they cannot be executed. This triple control defeats both extension-spoofing (e.g., 'shell.php.jpg') and direct execution of uploaded payloads. Magic-byte validation ensures the file truly is the claimed type, not a renamed script.

Answer

Pass the uploaded file directly to the operating system's eval() function

Answer

Compress the uploaded file using ZIP format before saving

Answer

Check only the filename extension provided in the client's HTTP multipart header

Question 11

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 12

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service

Question 13

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

Accepted Answer

Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches. Microsoft Exchange SSRF and insecure deserialization vulnerabilities (notably ProxyLogon CVE-2021-26855 and ProxyShell/ProxyOracle chains) are patched through Cumulative Updates and security updates. Applying the latest CU and patches is the single most critical control because these flaws live in Exchange's own web components (e.g., Autodiscover, ECP, OWA) and cannot be reliably mitigated by generic IIS rules or authentication changes.

Answer

Configuring an IIS URL Rewrite rule to block GET requests

Answer

Disabling Outlook Web Access (OWA) entirely for all users

Answer

Enabling Basic Authentication across all virtual directories

Question 14

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

Accepted Answer

Network tap / SPAN port capturing database protocol traffic or host-based driver interceptors. A DAM sensor captures database activity most accurately by sitting inline or out-of-band on the network path where database protocol traffic flows — typically via a network TAP or SPAN port mirroring the database VLAN — or by using host-based driver interceptors that hook the database client/server libraries. This captures the actual SQL statements on the wire (TDS for SQL Server, TNS for Oracle) independent of what the database chooses to log, which is critical because native audit logs can be tampered with or disabled by a compromised DBA.

Answer

On the perimeter firewall inspecting ICMP echo requests

Answer

At the corporate DNS resolver cache

Answer

As an SMTP email gateway relay filter

Question 15

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

Accepted Answer

The proxy's custom Root CA certificate installed into the workstations' Trusted Root Certification Authorities store. For SSL interception, the Squid proxy generates a forged certificate for each HTTPS site on the fly, signed by its own internal Root CA. For clients to trust these forged certificates without warnings, the proxy's Root CA certificate must be installed in each workstation's Trusted Root Certification Authorities store. This establishes a chain of trust so browsers accept the intercepted TLS sessions transparently.

Answer

The public keys of every external website visited by users

Answer

An expired SSLv2 certificate bundle

Answer

Self-signed SSH host keys generated on the Squid proxy