CND Hard Questions — 25 Difficult Questions

Question 1

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring a host-based packet filter firewall (such as nftables or iptables). Option B is correct because a host-based packet filter such as nftables or iptables enforces least-privilege network access on the gateway itself, restricting inbound/outbound traffic to only the ports and protocols the industrial IoT function requires. Option C is correct because reducing the attack surface by removing unnecessary packages and disabling insecure legacy services like Telnet and FTP (which transmit credentials in cleartext) eliminates well-known vectors for compromise on embedded Linux endpoints. Option D is correct because an automated, secure firmware and patch update mechanism ensures known vulnerabilities are remediated promptly and integrity-verified, which is essential for long-lived IoT devices that cannot rely on manual updates. Option A is not a hardening practice: shared static SSH keys and root auto-login destroy accountability and enable lateral movement, whereas best practice is unique per-device keys, disabled root SSH login, and key-based authentication with passphrases. Option E is not a hardening practice: disabling local logging and audit daemons removes the forensic and detection capability needed to identify intrusions and is not an acceptable trade-off for marginal CPU savings.

Answer

Configuring all system accounts with shared static SSH keys and root auto-login

Answer

Disabling local logging and audit daemons to maximize CPU performance

Question 2

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

Accepted Answer

Stateful session synchronization (State Sync / HA heartbeat link). Stateful session synchronization replicates the connection state table between the active and standby firewalls over the HA heartbeat/sync link, so that when failover occurs the standby already knows about every established TCP session. This preserves sequence numbers, session timers, and NAT translations, allowing existing sessions to continue without forcing users to re-authenticate. VRRP handles the virtual IP failover, but it does not carry session state — that is the job of state sync.

Answer

Network Address Translation (NAT) pool overloading

Answer

Asymmetric routing bypass mode

Answer

Dynamic DNS update propagation

Question 3

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 4

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 5

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Accepted Answer

Amazon VPC Security Groups acting as stateful virtual firewall instances. Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets. Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Answer

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Answer

AWS Shield Standard for intra-VPC subnet routing

Question 6

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Accepted Answer

Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results. Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft. Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Answer

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Answer

Granting db_owner permissions to all public database roles by default

Question 7

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 8

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy. Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 9

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 10

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

Accepted Answer

Enable Windows Defender Credential Guard utilizing Virtualization-based Security (VBS).. Credential Guard uses Virtualization-based Security (VBS) to isolate LSA secrets, including NTLM hashes and Kerberos TGTs, in a separate virtualized environment that even a compromised kernel cannot read. This renders harvested hashes unusable for Pass-the-Hash because the attacker cannot extract them from the protected process.

Answer

Enforce User Account Control (UAC) with highest privilege elevation prompts.

Answer

Configure Windows Defender Exploit Guard with Network Protection enabled.

Answer

Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.

Question 11

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

Accepted Answer

Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows. Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows provides continuous, automated log review that satisfies ISO/IEC 27001 A.12.4.1. The SIEM aggregates logs, correlates events, and generates alerts for analyst review, ensuring regular monitoring and governance. This is the most effective automated practice for meeting the control's requirement for regular review.

Answer

Disabling log verbosity to prevent storage overhead on the central syslog collector

Answer

Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter

Answer

Relying entirely on end users to manually report anomalous log entries via email

Question 12

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

Accepted Answer

Stateful Session Synchronization (Cluster State Sync). Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Answer

Strict TCP handshake validation

Answer

Unicast RPF (Reverse Path Forwarding)

Answer

NAT hairpinning

Question 13

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 14

An enterprise perimeter firewall is experiencing a volumetric SYN flood denial-of-service attack. The network administrator wants to mitigate the attack at the firewall level without dropping legitimate client connections or modifying the internal server TCP stack configurations. Which specialized firewall feature should be activated?

Accepted Answer

SYN Cookies. SYN cookies are the specialized firewall feature that mitigates SYN floods without dropping legitimate connections or altering server TCP stacks. When the SYN queue is under pressure, the firewall responds to each SYN with a SYN-ACK containing a cryptographic cookie as the sequence number, and only allocates state when the client returns the ACK, validating the handshake.

Answer

TCP Selective Acknowledgments (SACK)

Answer

TCP Window Scaling

Answer

Reverse Path Forwarding (RPF) strict mode

Question 15

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 16

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 17

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL. Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 18

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Accepted Answer

Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events). Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence. Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Answer

The Master Boot Record (MBR) partition table sectors

Answer

The system HOSTS file in \Windows\System32\drivers\etc\

Question 19

A network defender is analyzing a suspicious packet capture (PCAP) in Wireshark. The attacker is executing a covert channel over ICMP. Which Wireshark display filter isolates ICMP packets whose payload data exceeds the standard 32-byte echo request size?

Accepted Answer

icmp && data.len > 32. The filter 'icmp && data.len > 32' combines a protocol check for ICMP with a length check on the ICMP payload data field, isolating echo requests or replies whose data exceeds the standard 32-byte payload. Standard ping uses 32 bytes of data by default, so anything larger is suspicious and may indicate a covert channel tunneling data inside ICMP. This filter directly targets the anomaly described.

Answer

icmp.type == 8

Answer

udp.length > 32

Answer

ip.proto == 6 && tcp.len > 32

Question 20

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database