CND Application And Data Protection — Timed 25 Questions

Question 1

A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?

25 minute time limit — choose an answer to begin.

Accepted Answer

LoadModule headers_module modules/mod_headers.so followed by Header set X-Frame-Options 'DENY' and Header set Content-Security-Policy "default-src 'self'". To send CSP and X-Frame-Options headers, Apache must load mod_headers and then use the Header directive to set them. Header set X-Frame-Options 'DENY' prevents clickjacking by disallowing framing, and Header set Content-Security-Policy "default-src 'self'" restricts resource loading to the same origin, mitigating XSS. This is the correct directive combination for Apache 2.4.

Answer

TraceEnable Off and ServerTokens Prod

Answer

FileETag None and Options -Indexes

Answer

SecurityHeadersEngine On followed by SetFrameOptions DENY

Question 2

A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?

Accepted Answer

ssl_protocols TLSv1.3; and relying on the protocol's mandated secure cipher suites (e.g., TLS_AES_256_GCM_SHA384). TLS 1.3 removed the ability to negotiate arbitrary cipher suites via ssl_ciphers; the protocol mandates a fixed set of five AEAD cipher suites (e.g., TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256) that all provide forward secrecy. Configuring ssl_protocols TLSv1.3 and letting the protocol's built-in suites apply is the correct approach. Specifying legacy ssl_ciphers strings has no effect on TLS 1.3 handshakes.

Answer

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

Answer

ssl_prefer_server_ciphers off; combined with MD5

Answer

ssl_cipher_suites 'TLS_RSA_WITH_AES_128_CBC_SHA';

Question 3

An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?

Accepted Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');. In Oracle Database 19c, column-level TDE encryption is declared inline in the CREATE TABLE statement using the ENCRYPT USING '<algorithm>' clause. The correct syntax is `CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');`, which encrypts the SSN column with AES-256 using the TDE master key stored in the wallet. No IDENTIFIED BY clause is required for TDE column encryption because key management is handled by the Oracle Wallet, not a per-column password.

Answer

CREATE ENCRYPTED TABLE employee (ssn VARCHAR2(11)) STORAGE ENGINE INNODB_TDE;

Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256' IDENTIFIED BY master_key);

Answer

ALTER DATABASE ENCRYPT COLUMN ssn WITH ALGORITHM = 'AES256';

Question 4

A security analyst is investigating a web application vulnerability and identifies that user input is reflected directly inside a JavaScript block without adequate sanitization, leading to execution in the victim's browser. What specific type of vulnerability is present?

Accepted Answer

DOM-based Cross-Site Scripting (DOM XSS). DOM-based XSS occurs when client-side JavaScript reads attacker-controllable data (such as location.hash or document.URL) and writes it into a dangerous sink like innerHTML or eval() without sanitization, causing execution entirely in the browser. The server never sees the payload, so server-side filtering cannot prevent it. The scenario describes input reflected into a JavaScript block and executing in the victim's browser via client-side processing, which is the defining characteristic of DOM XSS.

Answer

Stored Cross-Site Scripting (Stored XSS)

Answer

Server-Side Request Forgery (SSRF)

Answer

Reflected Cross-Site Scripting (Reflected XSS)

Question 5

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

Accepted Answer

Set allowLinking="false" in the Context element of server.xml. The allowLinking attribute or docBase security restrictions in Tomcat control whether symbolic links outside the web app base can be followed. Additionally, the privileged context setting manages administrative access.

Answer

Set crossContext="true" in the Host configuration

Answer

Set debug="9" and swallowOutput="false"

Answer

Configure Enterprise Security Manager (ESM) connector bindings

Question 6

A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?

Accepted Answer

Customer Managed Key (CMK) with automatic annual key rotation enabled and backed by AWS CloudHSM. A Customer Managed Key (CMK) gives the account owner control over rotation policy, and KMS supports automatic annual rotation for symmetric CMKs. To meet the requirement that key material be managed within a dedicated HSM, the CMK must be backed by AWS CloudHSM (via a custom key store). This combination satisfies both the rotation cadence and the HSM custody requirement.

Answer

S3 Master Symmetric Key with client-side PGP encryption keys

Answer

External Key Store (XKS) with static key material managed on-premise without rotation

Answer

AWS Managed Key with manual rotation every 90 days via CLI

Question 7

A web application development team is reviewing the OWASP Top 10 web application security risks. Which TWO vulnerabilities directly involve improper handling of user-supplied data that is subsequently executed or interpreted by backend interpreters?

Accepted Answer

Injection (e.g., SQL Injection, OS Command Injection). Injection flaws (such as SQL, Command, and LDAP injection) and Server-Side Template Injection (SSTI) involve user input being interpreted as code or commands by backend parsers.

Answer

Broken Authentication

Answer

Server-Side Request Forgery (SSRF)

Answer

XML External Entities (XXE)

Answer

Insecure Deserialization

Question 8

A software developer is writing a secure web application and needs to protect sensitive user session cookies against theft and cross-site scripting (XSS) attacks. Which TWO cookie attributes must be set when creating session cookies?

Accepted Answer

Secure. Option D (Secure) is correct because the Secure attribute instructs the browser to transmit the cookie only over HTTPS-encrypted connections, preventing session cookies from being intercepted in cleartext over HTTP and thus mitigating theft via network sniffing. Option E (HttpOnly) is correct because it blocks client-side JavaScript from accessing the cookie via document.cookie, which directly defends against XSS-based session theft. Option A (Max-Age=31536000) is not required and is actually harmful for session cookies, since a one-year lifetime increases exposure and contradicts the short-lived nature of sessions. Option B (Domain=example.com) merely scopes which hosts receive the cookie and provides no protection against theft or XSS. Option C (SameSite=Strict or Lax) is a valuable CSRF defense but is not one of the two attributes specifically required here to counter theft and XSS.

Answer

Max-Age=31536000

Answer

Domain=example.com

Answer

SameSite=Strict or Lax

Question 9

A security analyst is examining a Windows Server 2022 file server that stores payroll records. The analyst discovers that the payroll folder inherits permissions from the parent volume, and members of the Domain Users group have Read access to every payroll file. The company policy requires that only the Payroll department and the CFO may read these files, and that access must be auditable. After removing the inherited permissions and granting NTFS Read to the Payroll group and CFO account, what should the analyst do to ensure the restriction is enforced when users access the share over the network?

Accepted Answer

Configure share permissions on the payroll share to grant Change to the Payroll group and CFO account, and remove access for Domain Users.. When a file is accessed through an SMB share, Windows evaluates both share permissions and NTFS permissions and applies the most restrictive result. Because the payroll folder inherited broad NTFS access from the parent volume, the analyst must also lock down the share so that Domain Users cannot reach the files over the network. Granting Change to the Payroll group and CFO while removing Domain Users at the share level, combined with the tightened NTFS permissions, enforces the policy for both network and local access.

Answer

Configure share permissions on the payroll share to grant Full Control to Domain Users and rely on the NTFS permissions to restrict access.

Answer

Enable access-based enumeration on the payroll share so that users without NTFS Read permission cannot see the folder in the share listing.

Answer

Enable the Windows Firewall rule for File and Printer Sharing and configure an IPsec connection security rule requiring Kerberos authentication for all SMB traffic.

Question 10

A security engineer is hardening a Linux web server that hosts a PHP application. The engineer needs to configure the PHP runtime so that user-supplied input cannot be executed as PHP code, even if an attacker manages to upload a file with a .php extension into an upload directory. Which PHP directive should be set to disable the execution of PHP code in files that are not explicitly intended to be scripts?

Accepted Answer

Set engine to Off for the upload directory using a per-directory php_admin_flag.. The PHP engine directive controls whether the interpreter processes files as PHP scripts. Disabling it for an upload directory ensures that even a file with a .php extension is not executed, neutralizing webshell uploads. Other directives restrict functions or file access but still allow the uploaded script to run, so they do not satisfy the requirement to stop code execution in that directory.

Answer

Set allow_url_include to Off.

Answer

Set disable_functions to include exec, system, and shell_exec.

Answer

Set open_basedir to restrict file access to the web root.

Question 11

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

Accepted Answer

McAfee DLP Endpoint Client. The McAfee DLP Endpoint Client is the agent installed on each workstation that performs local inspection and enforcement, including blocking writes to USB mass storage devices. It enforces policy at the endpoint without requiring a round trip to a network appliance. This is the component that actually intercepts the file-copy operation on the host.

Answer

McAfee DLP Prevent

Answer

McAfee ePolicy Orchestrator (ePO) Relay Server

Answer

McAfee DLP Discover

Question 12

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

Accepted Answer

Use parameterized queries and PreparedStatement objects with placeholder parameters. Parameterized queries using PreparedStatement with placeholder parameters (?) ensure that user input is treated strictly as data, never as executable SQL. The JDBC driver sends the query structure and parameters separately to the database, so injection payloads cannot alter the SQL grammar. This is the definitive remediation for SQL injection in Java applications and is recommended by OWASP.

Answer

Invoke the java.net.URLEncoder.encode() method on all parameters

Answer

Wrap all input strings inside single quotes and strip out semicolon characters

Answer

Sanitize all input characters using HTML entity encoding before passing them to the database driver

Question 13

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

Accepted Answer

Described Content Matching (DCM) with a Data Identifier utilizing Luhn algorithm validation. Described Content Matching (DCM) uses data identifiers — regex patterns combined with validators like the Luhn algorithm — to detect structured data such as credit card numbers in motion. The Luhn checksum (mod-10) confirms the number is mathematically valid, dramatically reducing false positives from random 16-digit strings. This is exactly the mechanism Symantec DLP uses for PCI/credit card detection in Network Monitor policies inspecting HTTP traffic.

Answer

Exact Data Matching (EDM)

Answer

Indexed Document Matching (IDM)

Answer

Vector Machine Learning (VML)

Question 14

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

Accepted Answer

nocase. The nocase modifier in Snort tells the detection engine to perform a case-insensitive match on the preceding content or uricontent pattern. Since the requirement is to match 'admin_login.php' regardless of case (e.g., 'Admin_Login.PHP'), appending nocase to the content/uricontent rule option is the correct approach. Without it, Snort performs a byte-exact case-sensitive comparison and would miss mixed-case variants attackers commonly use to evade signature matching.

Answer

uricontent

Answer

depth

Answer

offset

Question 15

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

Accepted Answer

Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions. PostgreSQL has no native Transparent Data Encryption (TDE) engine in core, so the practical way to encrypt data at rest is at the filesystem/volume layer using dm-crypt/LUKS, which transparently encrypts the disk blocks PostgreSQL writes to. For column-level or field-level cryptographic operations inside the database, the pgcrypto extension provides functions like pgp_sym_encrypt and digest. Combining these two layers gives both at-rest protection and application-visible encryption of specific sensitive columns.

Answer

pg_encrypt_cluster utility

Answer

PostgreSQL Enterprise TDE Daemon

Answer

pg_tde core extension module

Question 16

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 17

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

Accepted Answer

Signature-based detection rules. Signature-based detection rules match HTTP request payloads against known attack patterns — regex or token sequences characteristic of SQL injection, such as ' OR 1=1--, UNION SELECT, or encoded variants. A WAF in front of an online banking portal uses these signatures (e.g., ModSecurity CRS rules 942100, 942110) to inspect parameters, headers, and bodies, then drop matching requests before they reach the origin server. This is the classic negative-security model that blocks known-bad inputs.

Answer

TCP handshake stateful inspection

Answer

Behavioral anomaly machine learning baseline profiling

Answer

Data Loss Prevention (DLP) pattern matching

Question 18

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

Accepted Answer

Freeze global object prototypes using Object.freeze() and validate incoming JSON keys to disallow __proto__ assignments. Prototype pollution occurs when attacker-controlled JSON keys like __proto__ or constructor.prototype are merged into objects, altering Object.prototype and affecting all objects in the Node.js process. The correct remediation is to freeze the global prototypes with Object.freeze(Object.prototype) and to validate/reject incoming JSON keys that contain __proto__, constructor, or prototype before any merge or assignment. This directly blocks the pollution vector at the source rather than trying to sanitize output.

Answer

Sanitize all input parameters using DOMPurify before rendering them

Answer

Configure CORS headers with Access-Control-Allow-Origin set to specific domains

Answer

Implement parameterized SQL queries for all database interactions

Question 19

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 20

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

Accepted Answer

sudo cryptsetup luksFormat /dev/sdb1. The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Answer

sudo fdisk /dev/sdb1 --encrypt

Answer

sudo mkfs.ext4 -e encrypted /dev/sdb1

Answer

sudo mount -o encrypt /dev/sdb1 /mnt/secure