CND Enterprise Cloud Virtual And Wireless Network Protection Practice Test 2 — 15 Questions

Question 1

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private Google Access enabled on the subnet. Private Google Access is a subnet-level setting that allows VM instances with only internal (RFC 1918) IP addresses to reach Google APIs and services (Cloud Storage, BigQuery, Pub/Sub, etc.) using their internal IPs, without requiring a Cloud NAT or external IP. Traffic is routed over Google's internal network to the private.googleapis.com or restricted.googleapis.com VIPs (199.36.153.8/30 or 199.36.153.4/30). This is the canonical GCP control for secure, private API access from internal-only instances.

Answer

GCP Cloud NAT gateway attached to the subnet

Answer

External HTTP(S) Load Balancer

Answer

Dedicated Interconnect with partner peering

Question 2

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

Accepted Answer

WPA3-Enterprise 192-bit mode (Suite B compliance). WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Answer

WPA2-Enterprise with AES-CCMP and TKIP fallback

Answer

Enhanced Open (OWE) with opportunistic encryption

Answer

WPA3-Personal with SAE and transition mode enabled

Question 3

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

Accepted Answer

Remove all current security groups and attach an isolation security group with deny-all rules. To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Answer

Terminate the EC2 instance and restore from the latest snapshot

Answer

Modify the instance state to 'stopped' via AWS CLI

Answer

Delete the attached Elastic Network Interface (ENI)

Question 4

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 5

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

Accepted Answer

Amazon S3 Block Public Access (Account-level setting). Amazon S3 Block Public Access at the account level is a centralized control that applies to all buckets in the account, including newly created ones, and overrides bucket-level or object-level public access settings. Enabling it at the account level ensures that any future bucket automatically inherits the block, preventing accidental public exposure. This is the only option that directly addresses S3 public access at the account scope.

Answer

AWS Shield Standard DDoS mitigation

Answer

AWS Trusted Advisor security checks

Answer

AWS IAM Permissions Boundary

Question 6

An enterprise administrator is setting up an AWS Site-to-Site VPN connection between an on-premises data center and an AWS VPC. To ensure maximum data confidentiality and integrity across the public internet, which IPsec cryptographic parameters should be enforced in the VPN tunnel configuration?

Accepted Answer

AES-256 encryption, SHA-2 (SHA-384) integrity, and DH Group 14 or higher. For maximum confidentiality and integrity over an IPsec tunnel, AES-256 provides strong symmetric encryption, SHA-2 (e.g., SHA-384) provides robust integrity/authentication, and DH Group 14 (2048-bit MODP) or higher ensures strong Perfect Forward Secrecy. These parameters align with modern cryptographic best practices and AWS VPN recommendations. Weaker ciphers like DES, RC4, MD5, and low DH groups are deprecated and vulnerable.

Answer

RC4 encryption, SHA-1 integrity, and no PFS

Answer

AES-128 encryption, MD5 integrity, and DH Group 2

Answer

DES encryption, MD5 integrity, and DH Group 1

Question 7

A network security engineer is tasked with securing corporate Wi-Fi clients against Evil Twin attacks where an attacker sets up a fake access point with identical SSID parameters. Which enterprise wireless security practice effectively mitigates client association to fake APs?

Accepted Answer

Enabling 802.1X authentication with strict server certificate validation on clients. 802.1X with strict server certificate validation forces the client to verify the RADIUS server's certificate against a trusted CA before completing authentication. An Evil Twin AP cannot present a valid certificate for the legitimate authentication server, so the client refuses to associate, effectively neutralizing the attack.

Answer

Using MAC address cloning on the enterprise wireless controllers

Answer

Deploying WPA2-Personal with a rotating pre-shared key

Answer

Disabling client roaming capabilities on enterprise controllers

Question 8

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

Accepted Answer

AWS CloudTrail combined with Amazon EventBridge and SNS alerts. AWS CloudTrail records all API activity in the account, including IAM and EC2 security group modifications. Amazon EventBridge can match specific CloudTrail events (e.g., unauthorized ModifyPolicy or AuthorizeSecurityGroupIngress calls) and route them to Amazon SNS for alerting. This combination provides the required monitoring and notification pipeline.

Answer

AWS Direct Connect combined with VPC Flow Logs

Answer

AWS Config rules combined with Amazon Inspector

Answer

AWS WAF combined with Amazon Route 53 DNS logging

Question 9

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

Accepted Answer

Azure Key Vault (Managed HSM or Standard Vault). Azure Key Vault (either a Standard vault or a Managed HSM pool) is the Azure service that stores and manages customer-managed keys (CMK) used for Storage Account encryption at rest. Storage Accounts integrate natively with Key Vault via a system-assigned or user-assigned managed identity, allowing the storage service to unwrap the CMK for encryption/decryption without exposing the key. Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules when the auditor requires keys stored in dedicated HSM hardware.

Answer

Azure Information Protection (AIP)

Answer

Azure Active Directory (Microsoft Entra ID) Identity Protection

Answer

Azure Sentinel (Microsoft Sentinel)

Question 10

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

Accepted Answer

VPC Firewall rules blocking port 22 inbound from 0.0.0.0/0, combined with Identity-Aware Proxy (IAP). To block direct SSH from the internet while still allowing authorized access, you create a VPC firewall rule that denies ingress on TCP/22 from 0.0.0.0/0, and then use Identity-Aware Proxy (IAP) TCP forwarding to grant access based on IAM identity and context. IAP tunnels SSH through Google's infrastructure, so the instance never needs to accept public SSH connections. This is Google's recommended 'zero trust' pattern for administrative access.

Answer

Google Cloud Armor perimeter security

Answer

Google Cloud DNS DNSSEC configuration

Answer

Shared VPC host project firewall restriction

Question 11

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

Accepted Answer

First match based on rule priority number in ascending order. Azure NSGs evaluate rules in ascending order of priority number (100–4096), and the first rule whose source, destination, port, and protocol match the traffic is applied — no further rules are evaluated. This 'first match wins' model means a lower number equals higher precedence. If no rule matches, the default rules (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, etc.) apply.

Answer

Last match evaluated across all security rules

Answer

Explicit allow rules override all deny rules regardless of priority

Answer

Deny rules always take precedence regardless of priority number

Question 12

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

Accepted Answer

Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall. Hub-and-Spoke with User Defined Routes (UDR) pointing to Azure Firewall is correct because it centralizes East-West traffic inspection. In this topology, spoke VNets peer with a hub VNet that hosts Azure Firewall, and UDRs on the spoke subnets force all inter-spoke traffic through the firewall's private IP as the next hop. This satisfies the requirement to inspect all inter-subnet traffic between different virtual networks using a centralized NGFW.

Answer

Full mesh VPC peering between all individual application virtual networks

Answer

Azure ExpressRoute Local circuits with direct peering

Answer

Default Azure Virtual Network peering without route tables

Question 13

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

Accepted Answer

AWS VPC Flow Logs. AWS VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for network interfaces in a VPC, making them the correct feature to analyze outbound communication from EC2 instances to unknown external IPs. They can be published to CloudWatch Logs or S3 and queried with Athena for anomaly detection.

Answer

Amazon GuardDuty Kubernetes audit logs

Answer

AWS Trusted Advisor network optimization checks

Answer

AWS CloudTrail Management Events

Question 14

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

Accepted Answer

Cloud Storage Bucket Lock using Object Retention Policies (WORM). Cloud Storage Bucket Lock with Object Retention Policies enforces WORM (Write Once Read Many) semantics, preventing any user—including project owners and root administrators—from modifying or deleting objects until the retention period expires. Once a retention policy is locked, it cannot be shortened or removed, satisfying the 5-year compliance mandate. This is the only GCP feature that provides immutable, tamper-proof retention at the object level.

Answer

Google Cloud IAM Bucket-Level Access Control with deny policies

Answer

Customer-managed encryption keys (CMEK) with scheduled key rotation

Answer

GCP Storage object versioning with lifecycle rules

Question 15

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

Accepted Answer

Microsoft Entra Conditional Access policies combined with Azure VPN Gateway. Microsoft Entra Conditional Access evaluates user identity, device compliance (via Intune), and sign-in risk (location, behavior) before granting access, which is the core of Zero Trust. Combined with Azure VPN Gateway, it enforces these policies for remote workers connecting to Azure-hosted virtual desktops. This integration provides the identity- and context-aware gate that ZTNA requires.

Answer

Classic RADIUS authentication server on an Azure VM

Answer

Azure Network Security Groups with IP source restrictions

Answer

Azure Application Gateway with cookie-based affinity