CND Exam Simulation — 200 Questions

Question 1

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

Accepted Answer

-w /etc/passwd -p wa -k identity. Monitoring sensitive files like /etc/passwd and /etc/shadow requires adding watch rules using the -w flag with write permissions (-p w).

Answer

-a always,exclude -F path=/etc/passwd

Answer

sysctl -w kernel.audit=1

Answer

-e 0

Question 2

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

Accepted Answer

Digital Guardian Endpoint Agent with Web Inspection / Browser Control module. Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Answer

Digital Guardian Discovery Server

Answer

Digital Guardian Network Sensor

Answer

Digital Guardian Cloud Analytics Engine (CAE)

Question 3

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). mod_headers (for security headers like HSTS and CSP) and mod_security (Web Application Firewall engine) enhance Apache security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 4

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

Accepted Answer

sudo cryptsetup luksFormat /dev/sdb1. The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Answer

sudo fdisk /dev/sdb1 --encrypt

Answer

sudo mkfs.ext4 -e encrypted /dev/sdb1

Answer

sudo mount -o encrypt /dev/sdb1 /mnt/secure

Question 5

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 6

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 7

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

Accepted Answer

Set allowLinking="false" in the Context element of server.xml. The allowLinking attribute or docBase security restrictions in Tomcat control whether symbolic links outside the web app base can be followed. Additionally, the privileged context setting manages administrative access.

Answer

Set crossContext="true" in the Host configuration

Answer

Set debug="9" and swallowOutput="false"

Answer

Configure Enterprise Security Manager (ESM) connector bindings

Question 8

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 9

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools scan repositories like file shares, databases, and cloud storage for sensitive unencrypted data at rest.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 10

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. WSUS maintenance requires declining superseded updates and running the Server Cleanup Wizard to optimize performance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans

Question 11

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Accepted Answer

Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges. PostgreSQL hardening includes configuring pg_hba.conf for strict IP/authentication, enabling SSL/TLS in postgresql.conf, and managing superuser access properly.

Answer

Set superuser password to null and allow trust authentication for all interfaces

Answer

Disable all logging in postgresql.conf to maximize query execution performance

Question 12

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Accepted Answer

Data in transit across network gateways (Network DLP). Comprehensive DLP solutions cover data in transit (network), data at rest (storage/databases), and data in use (endpoints).

Answer

Data routed through internal Bluetooth beacon devices

Answer

Data processed inside physical server CPU cache registers only

Answer

Data transmitted over analog telephone modem lines

Question 13

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. In Elasticsearch Security (formerly X-Pack), setting xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true enforces node-to-node and client-to-cluster TLS encryption and authentication.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 14

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio (or Linkerd) is a service mesh that injects sidecar proxies (like Envoy) to automatically handle mutual TLS (mTLS) between Kubernetes pods.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service

Question 15

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

Accepted Answer

Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches. Applying the latest cumulative updates (CUs) and security patches provided by Microsoft Exchange team is critical because Exchange vulnerabilities like ProxyLogon and ProxyShell stem from unpatched Exchange web services.

Answer

Configuring an IIS URL Rewrite rule to block GET requests

Answer

Disabling Outlook Web Access (OWA) entirely for all users

Answer

Enabling Basic Authentication across all virtual directories

Question 16

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. TDE protects data at rest on disk and backup files, but does not protect data in transit or data accessed in memory while the database is running.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 17

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

Accepted Answer

Microsoft Entra Conditional Access policies combined with Azure VPN Gateway. Microsoft Entra Conditional Access evaluates signals like user risk, device compliance, and location to enforce access controls before granting access to applications.

Answer

Classic RADIUS authentication server on an Azure VM

Answer

Azure Network Security Groups with IP source restrictions

Answer

Azure Application Gateway with cookie-based affinity

Question 18

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Accepted Answer

Executing remote lock and remote wipe commands for lost or stolen devices. MDM solutions enforce device encryption requirements and remote wipe/lock capabilities.

Answer

Allowing unrestricted installation of custom untrusted firmware packages

Answer

Disabling all over-the-air communication channels permanently

Answer

Removing all screen lock passcode requirements

Question 19

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Accepted Answer

Enforcing SELinux in targeted or multi-category security (MLS) mode. Mandatory Access Control frameworks like SELinux and AppArmor, combined with proper kernel parameter tuning (sysctl), enforce least privilege.

Answer

Setting all user home directory permissions to world-writable (chmod 777)

Answer

Disabling all audit logging and accounting daemons

Question 20

An administrator needs to harden an IoT gateway running Linux by disabling core dumps globally to prevent sensitive application memory from being written to disk if a process crashes. Which configuration should be applied?

Accepted Answer

Setting ProcessCoreDump=false in /etc/systemd/coredump.conf. Core dumps are disabled globally by configuring limits in /etc/security/limits.conf or via systemd's coredump.conf.

Answer

Running chmod 000 /bin/sh

Answer

Editing /etc/fstab to mount /tmp as read-only

Answer

Modifying /etc/resolv.conf to block DNS queries