CND Enterprise Cloud Virtual And Wireless Network Protection — 20 Questions

Question 1

A cloud security engineer is hardening an Amazon EC2 instance running in a private subnet. The instance needs to securely communicate with an Amazon S3 bucket without traffic traversing the public internet. Which VPC configuration must be implemented to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A VPC Gateway Endpoint for Amazon S3 with associated route tables. A VPC Gateway Endpoint for Amazon S3 provides private connectivity from a VPC to S3 by adding a prefix-list route to the specified route tables, keeping traffic on the AWS backbone and never traversing the public internet. Gateway endpoints are the only endpoint type that supports S3 and DynamoDB, and they are free of charge. Associating the endpoint with the private subnet's route table is what actually enables the private path.

Answer

An AWS Client VPN Endpoint attached to the VPC

Answer

An interface VPC endpoint using AWS PrivateLink

Answer

A NAT Gateway deployed in the private subnet

Question 2

An enterprise is hardening its enterprise wireless network and migrating legacy authentication protocols. To protect against offline dictionary attacks and provide forward secrecy during the 4-way handshake, which Wi-Fi standard must be deployed?

Accepted Answer

WPA3-Personal with SAE. WPA3-Personal replaces WPA2's PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks and provides forward secrecy. Even if the passphrase is weak, an attacker capturing the handshake cannot perform offline cracking, and past session keys remain secure if the passphrase is later compromised.

Answer

WPA2-Enterprise with TKIP

Answer

WEP with Shared Key Authentication

Answer

WPA-Enterprise with TKIP/AES mixed mode

Question 3

A network engineer is configuring an enterprise wireless network and wants to prevent clients from connecting to unauthorized rogue access points that broadcast the corporate SSID. Which client-side and infrastructure technology should be deployed?

Accepted Answer

Protected Management Frames (PMF / 802.11w). Protected Management Frames (PMF, standardized as 802.11w) cryptographically protects management frames such as deauthentication and disassociation, preventing attackers from spoofing these frames to force clients off a legitimate AP and onto a rogue AP broadcasting the same SSID (an evil-twin attack). Deploying PMF on both the infrastructure (APs/controller) and requiring it on clients blocks this class of attack.

Answer

Static WEP encryption keys

Answer

MAC address filtering on access points

Answer

Disabling SSID broadcast (closed network)

Question 4

An enterprise cloud architect is configuring Google Cloud VPC Network Service Tiers to optimize cost and security for sensitive internal database traffic. Which service tier should be selected to ensure traffic stays entirely within Google's private global backbone network without touching the public internet?

Accepted Answer

Premium Tier Network Routing. Premium Tier Network Routing in Google Cloud ensures that traffic between regions and to the internet is routed over Google's private global backbone network, never touching the public internet. This provides lower latency, higher reliability, and enhanced security for sensitive internal database traffic.

Answer

Hybrid Tier Routing via Cloud Interconnect

Answer

Public IP Tier with SSL offloading

Answer

Standard Tier Network Routing

Question 5

A security administrator is deploying an Azure Kubernetes Service (AKS) cluster in a hub-and-spoke topology. The cluster must be integrated with a virtual network for pod-to-pod communication, and the administrator must ensure that no Azure public IP addresses are assigned to nodes. Which AKS networking configuration should the administrator choose?

Accepted Answer

Azure CNI with a private cluster and a NAT gateway. Azure CNI integrates pods directly with the VNet, enabling pod-to-pod communication across subnets. A private cluster removes the public IP from the API server, and a NAT gateway allows outbound traffic without public IPs on nodes. Together, they satisfy the requirement to avoid public IPs while maintaining connectivity. The other options either leave public IPs on nodes or use kubenet, which is not ideal for enterprise pod networking.

Answer

Azure CNI with a user-defined route table and Azure Firewall

Answer

Azure CNI with a public load balancer and network security group rules

Answer

kubenet with a NAT gateway for outbound connectivity

Question 6

A network defender is implementing wireless security for an enterprise that uses WPA3-Enterprise. The organization requires that each user authenticate with unique credentials and that the authentication server validate the user's identity. Which EAP method should the defender configure to meet these requirements?

Accepted Answer

PEAP-MSCHAPv2. PEAP-MSCHAPv2 is designed for username and password authentication within a secure TLS tunnel, providing unique credentials per user and server-side validation via RADIUS. It is a common and supported EAP method for WPA3-Enterprise. The other methods either rely on certificates, use less secure password protocols, or are proprietary, making them less suitable for the stated requirements.

Answer

EAP-TTLS with PAP

Answer

EAP-FAST

Answer

EAP-TLS

Question 7

A cloud security architect is designing a Google Cloud VPC network to securely connect multiple projects. The architect needs to allow resources in one project to communicate with resources in another project using internal IP addresses, without exposing traffic to the public internet. Which Google Cloud feature should the architect use?

Accepted Answer

VPC Network Peering. VPC Network Peering is the correct choice because it establishes a private connection between two VPC networks, allowing internal IP communication across projects without public internet exposure. It is designed for this exact use case and does not require gateways or VPNs. The other options either connect on-premises to cloud, require a shared administration model, or are not intended for VPC-to-VPC connectivity.

Answer

Cloud VPN

Answer

Cloud Interconnect

Answer

Shared VPC

Question 8

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 9

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

Accepted Answer

Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation. A WIPS with triangulation uses multiple sensors to measure signal strength (RSSI) from a detected rogue AP and calculates its physical location by comparing readings across sensors. This is the only listed technique that both detects the rogue AP and locates its physical source, which is required to remove it. WIPS also correlates BSSIDs, SSIDs, and behavior to distinguish true rogues from neighboring APs.

Answer

Running regular traceroute commands from endpoints

Answer

Enabling port security on enterprise access layer switches

Answer

Configuring static ARP entries on enterprise switches

Question 10

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

Accepted Answer

Azure Firewall with Application Rules. Azure Firewall Application Rules operate at Layer 7 and support fully qualified domain names (FQDNs) as target criteria, allowing outbound HTTP/HTTPS/SQL traffic to be filtered by domain name rather than IP. This is the only native Azure resource that natively supports FQDN-based outbound filtering at the network level. Azure Firewall resolves FQDNs via its own DNS proxy and applies allow/deny rules per domain, which is essential when destinations use dynamic IPs (e.g., Microsoft 365, SaaS endpoints).

Answer

Azure Application Gateway with Web Application Firewall

Answer

Network Security Group (NSG) with custom service tags

Answer

User Defined Routes (UDR) pointing to a load balancer

Question 11

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies are the native GKE feature that allows pod-level traffic control based on labels, namespaces, and ports. They operate at Layer 3/4 and are enforced by the CNI plugin (e.g., Calico on GKE), enabling fine-grained segmentation without relying on IP addresses. This directly meets the requirement to restrict traffic between pods using labels.

Answer

Identity-Aware Proxy (IAP)

Answer

Google Cloud Armor security policies

Answer

VPC Firewall Rules using subnet tags

Question 12

A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?

Accepted Answer

Event Source: sts.amazonaws.com, Event Name: AssumeRole. AWS STS AssumeRole events are logged in CloudTrail with eventSource sts.amazonaws.com and eventName AssumeRole, capturing when an IAM user or role assumes another role, including cross-account role assumption. Searching for this event identifies principals that have obtained administrative privileges via role assumption.

Answer

Event Source: s3.amazonaws.com, Event Name: PutBucketPolicy

Answer

Event Source: organizations.amazonaws.com, Event Name: AcceptHandshake

Answer

Event Source: iam.amazonaws.com, Event Name: CreateUser

Question 13

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

Accepted Answer

AWS Organizations with all features enabled. AWS Organizations with all features enabled is required to create the organizational structure and enable centralized management of Security Hub across all accounts. Security Hub integrates with Organizations to automatically add new accounts and aggregate findings. All features must be enabled to use service control policies and delegated administration, which are necessary for Security Hub's multi-account setup.

Answer

AWS Shield Advanced

Answer

AWS CloudTrail

Answer

AWS Transit Gateway

Question 14

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI powered by Cilium supports transparent data plane encryption using WireGuard, which encrypts node-to-node and pod-to-pod traffic within the AKS cluster. Enabling data plane encryption during cluster creation (or via configuration) satisfies the requirement for encrypted in-transit communication between nodes. This is the native AKS feature designed for intra-cluster transport encryption.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 15

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS jump-host service that provides RDP and SSH access to VMs directly through the Azure portal over TLS (port 443), so RDP 3389 and SSH 22 never need to be exposed to the public internet. It is deployed into a dedicated subnet named AzureBastionSubnet inside the VM's VNet, and it brokers the session without requiring a public IP on the target VM. This directly satisfies the requirement of eliminating open management ports while still allowing administrative access.

Answer

Azure VPN Gateway with point-to-site configuration

Answer

Azure Load Balancer with TCP reset enabled

Answer

Azure Front Door with Web Application Firewall

Question 16

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

Accepted Answer

Private Google Access enabled on the subnet. Private Google Access is a subnet-level setting that allows VM instances with only internal (RFC 1918) IP addresses to reach Google APIs and services (Cloud Storage, BigQuery, Pub/Sub, etc.) using their internal IPs, without requiring a Cloud NAT or external IP. Traffic is routed over Google's internal network to the private.googleapis.com or restricted.googleapis.com VIPs (199.36.153.8/30 or 199.36.153.4/30). This is the canonical GCP control for secure, private API access from internal-only instances.

Answer

GCP Cloud NAT gateway attached to the subnet

Answer

External HTTP(S) Load Balancer

Answer

Dedicated Interconnect with partner peering

Question 17

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

Accepted Answer

WPA3-Enterprise 192-bit mode (Suite B compliance). WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Answer

WPA2-Enterprise with AES-CCMP and TKIP fallback

Answer

Enhanced Open (OWE) with opportunistic encryption

Answer

WPA3-Personal with SAE and transition mode enabled

Question 18

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

Accepted Answer

Remove all current security groups and attach an isolation security group with deny-all rules. To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Answer

Terminate the EC2 instance and restore from the latest snapshot

Answer

Modify the instance state to 'stopped' via AWS CLI

Answer

Delete the attached Elastic Network Interface (ENI)

Question 19

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 20

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). Amazon S3 Block Public Access at the account level is a centralized control that applies to all buckets in the account, including newly created ones, and overrides bucket-level or object-level public access settings. Enabling it at the account level ensures that any future bucket automatically inherits the block, preventing accidental public exposure. This is the only option that directly addresses S3 public access at the account scope.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary