CND Application And Data Protection — Timed 10 Questions

Question 1

A web application development team is reviewing the OWASP Top 10 web application security risks. Which TWO vulnerabilities directly involve improper handling of user-supplied data that is subsequently executed or interpreted by backend interpreters?

10 minute time limit — choose an answer to begin.

Accepted Answer

Injection (e.g., SQL Injection, OS Command Injection). Injection flaws (such as SQL, Command, and LDAP injection) and Server-Side Template Injection (SSTI) involve user input being interpreted as code or commands by backend parsers.

Answer

Broken Authentication

Answer

Server-Side Request Forgery (SSRF)

Answer

XML External Entities (XXE)

Answer

Insecure Deserialization

Question 2

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

Accepted Answer

McAfee DLP Endpoint Client. McAfee DLP Endpoint uses an agent client containing the McAfee DLP Endpoint Client driver that hooks into the operating system I/O stack to monitor and control peripheral device access.

Answer

McAfee DLP Prevent

Answer

McAfee ePolicy Orchestrator (ePO) Relay Server

Answer

McAfee DLP Discover

Question 3

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

Accepted Answer

Use parameterized queries and PreparedStatement objects with placeholder parameters. Using parameterized queries (PreparedStatements) ensures that user-supplied input is treated strictly as data, never as executable SQL commands, neutralizing SQL injection.

Answer

Invoke the java.net.URLEncoder.encode() method on all parameters

Answer

Wrap all input strings inside single quotes and strip out semicolon characters

Answer

Sanitize all input characters using HTML entity encoding before passing them to the database driver

Question 4

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

Accepted Answer

Described Content Matching (DCM) with a Data Identifier utilizing Luhn algorithm validation. Symantec DLP uses Exact Data Matching (EDM), Described Content Matching (DCM) / Regular Expressions with Luhn validation, or Indexed Document Matching (IDM). DCM combined with validation algorithms matches standard patterns like credit cards.

Answer

Exact Data Matching (EDM)

Answer

Indexed Document Matching (IDM)

Answer

Vector Machine Learning (VML)

Question 5

A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?

Accepted Answer

LoadModule headers_module modules/mod_headers.so followed by Header set X-Frame-Options 'DENY' and Header set Content-Security-Policy "default-src 'self'". Header set Content-Security-Policy and Header set X-Frame-Options are the standard Apache directives (using mod_headers) to enforce security headers.

Answer

TraceEnable Off and ServerTokens Prod

Answer

FileETag None and Options -Indexes

Answer

SecurityHeadersEngine On followed by SetFrameOptions DENY

Question 6

A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?

Accepted Answer

ssl_protocols TLSv1.3; and relying on the protocol's mandated secure cipher suites (e.g., TLS_AES_256_GCM_SHA384). TLS 1.3 cipher suites are predefined by the protocol standard (RFC 8446) and do not allow cipher suite negotiation in the same manner as TLS 1.2. The directive ssl_ciphers applies to TLS 1.2, whereas TLS 1.3 ciphers are controlled via ssl_conf_command or default built-in parameters like TLS_AES_256_GCM_SHA384.

Answer

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

Answer

ssl_prefer_server_ciphers off; combined with MD5

Answer

ssl_cipher_suites 'TLS_RSA_WITH_AES_128_CBC_SHA';

Question 7

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

Accepted Answer

nocase. The nocase modifier in Snort tells the detection engine to ignore case sensitivity when matching pattern content.

Answer

uricontent

Answer

depth

Answer

offset

Question 8

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

Accepted Answer

Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions. PostgreSQL does not have a native, monolithic Transparent Data Encryption (TDE) feature built into the core open-source engine like Microsoft SQL Server or Oracle. Instead, organizations must rely on extensions like pgcrypto for column-level encryption or rely on underlying filesystem-level encryption (such as dm-crypt/LUKS).

Answer

pg_encrypt_cluster utility

Answer

PostgreSQL Enterprise TDE Daemon

Answer

pg_tde core extension module

Question 9

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 10

An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?

Accepted Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');. In Oracle TDE Column Encryption, the ENCRYPT specification with the desired algorithm (e.g., USING 'AES256') is declared directly on the column definition within the CREATE TABLE statement.

Answer

CREATE ENCRYPTED TABLE employee (ssn VARCHAR2(11)) STORAGE ENGINE INNODB_TDE;

Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256' IDENTIFIED BY master_key);

Answer

ALTER DATABASE ENCRYPT COLUMN ssn WITH ALGORITHM = 'AES256';