CND Timed Hard Questions — 25 Difficult Questions

Question 1

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

15 minute time limit — choose an answer to begin.

Accepted Answer

Digital Guardian Endpoint Agent with Web Inspection / Browser Control module. Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Answer

Digital Guardian Discovery Server

Answer

Digital Guardian Network Sensor

Answer

Digital Guardian Cloud Analytics Engine (CAE)

Question 2

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 3

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 4

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools scan repositories like file shares, databases, and cloud storage for sensitive unencrypted data at rest.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 5

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Accepted Answer

Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges. PostgreSQL hardening includes configuring pg_hba.conf for strict IP/authentication, enabling SSL/TLS in postgresql.conf, and managing superuser access properly.

Answer

Set superuser password to null and allow trust authentication for all interfaces

Answer

Disable all logging in postgresql.conf to maximize query execution performance

Question 6

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. In Elasticsearch Security (formerly X-Pack), setting xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true enforces node-to-node and client-to-cluster TLS encryption and authentication.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 7

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. TDE protects data at rest on disk and backup files, but does not protect data in transit or data accessed in memory while the database is running.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 8

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

Accepted Answer

Microsoft Entra Conditional Access policies combined with Azure VPN Gateway. Microsoft Entra Conditional Access evaluates signals like user risk, device compliance, and location to enforce access controls before granting access to applications.

Answer

Classic RADIUS authentication server on an Azure VM

Answer

Azure Network Security Groups with IP source restrictions

Answer

Azure Application Gateway with cookie-based affinity

Question 9

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Accepted Answer

Enforcing SELinux in targeted or multi-category security (MLS) mode. Mandatory Access Control frameworks like SELinux and AppArmor, combined with proper kernel parameter tuning (sysctl), enforce least privilege.

Answer

Setting all user home directory permissions to world-writable (chmod 777)

Answer

Disabling all audit logging and accounting daemons

Question 10

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Accepted Answer

Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools. Credential dumping leaves specific traces, including abnormal handles opened to LSASS, unexpected processes reading LSASS memory, and specific Event IDs.

Answer

Regular scheduled defragmentation of the system volume by dfrgui.exe

Answer

Standard domain user successfully changing their own account password via Ctrl+Alt+Del

Question 11

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

Accepted Answer

Azure Site Recovery (ASR). Azure Site Recovery orchestrates and manages replication, failover, and recovery of workloads, replicating VM disks across regions.

Answer

Azure Backup Vault with geo-redundant storage (GRS)

Answer

Azure ExpressRoute Global Reach

Answer

Azure Traffic Manager with priority routing

Question 12

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

Accepted Answer

Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall. Azure Virtual Network Hub-and-Spoke architecture routes all inter-spoke traffic through a centralized Hub virtual network containing Azure Firewall or third-party NVA appliances.

Answer

Full mesh VPC peering between all individual application virtual networks

Answer

Azure ExpressRoute Local circuits with direct peering

Answer

Default Azure Virtual Network peering without route tables

Question 13

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The find command with -perm -4000 searches for files with the SUID permission bit set across the file system.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 14

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

Accepted Answer

Azure CNI powered by Cilium with data plane encryption enabled. Azure CNI with Cilium supports network policies and data plane encryption (IPsec/WireGuard) for node-to-node and pod-to-pod traffic in AKS.

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Azure Key Vault provider for Secrets Store CSI driver

Answer

Azure Policy for Kubernetes add-on

Question 15

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

Accepted Answer

AWS PrivateLink with Interface VPC Endpoints. AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications securely without exposing traffic to the public internet.

Answer

AWS Client VPN with split tunneling disabled

Answer

AWS Direct Connect Gateway with transit VIF

Answer

Inter-Region VPC Peering with restrictive Network Security Groups

Question 16

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

Accepted Answer

As a core feature directly connected to Adversary and Victim. In the Diamond Model, Infrastructure and Capability are core meta-features that describe how the Adversary and Victim are connected.

Answer

As a confidence value assigned to the intelligence report

Answer

As an external social-political requirement

Answer

As a meta-feature used exclusively for tracking timestamps

Question 17

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

Accepted Answer

Rkhunter (Rootkit Hunter). Chkrootkit and Rootkit Hunter (Rkhunter) are standard tools used on Linux to scan for rootkits, backdoors, and local exploits.

Answer

Autopsy

Answer

Cisco Firepower

Answer

Volatility

Question 18

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Windows Run/RunOnce keys in HKLM and HKCU, along with Winlogon registry entries, are classic persistence vectors.

Answer

HKEY_CLASSES_ROOT\.txt\DefaultIcon

Answer

HKEY_PERFORMANCE_DATA\CurrentPerformance

Question 19

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

Accepted Answer

alert tcp any any -> $HOME_NET 80 (msg:"Directory Traversal Attempt"; content:"../"; http_uri; sid:100001; rev:1;). To inspect HTTP URIs specifically, Snort provides the 'uricontent' or modern 'http_uri' modifier within rule options. The rule must use tcp protocol, specify external/any networks targeting internal web servers, and use the 'http_uri' sticky buffer or modifier to inspect the URI payload for '../'.

Answer

pass tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"Traversal"; content:"../"; http_client_body; sid:100001; rev:1;)

Answer

alert ip any any -> any any (msg:"Directory Traversal"; uricontent:"../"; sid:100001; rev:1;)

Answer

log udp any any -> $HOME_NET 80 (msg:"Directory Traversal"; content:"../"; depth:2; sid:100001; rev:1;)

Question 20

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. PsExec relies heavily on ADMIN$ share access and remote service creation via SMB (TCP ports 445 and 139) and RPC. Restricting inbound SMB access to authorized administrative management subnets and enabling Windows Defender Firewall rules blocking remote service creation prevents PsExec execution.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.