CND Multiple Select — 20 Questions

Question 1

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring a host-based packet filter firewall (such as nftables or iptables). Option B is correct because a host-based packet filter such as nftables or iptables enforces least-privilege network access on the gateway itself, restricting inbound/outbound traffic to only the ports and protocols the industrial IoT function requires. Option C is correct because reducing the attack surface by removing unnecessary packages and disabling insecure legacy services like Telnet and FTP (which transmit credentials in cleartext) eliminates well-known vectors for compromise on embedded Linux endpoints. Option D is correct because an automated, secure firmware and patch update mechanism ensures known vulnerabilities are remediated promptly and integrity-verified, which is essential for long-lived IoT devices that cannot rely on manual updates. Option A is not a hardening practice: shared static SSH keys and root auto-login destroy accountability and enable lateral movement, whereas best practice is unique per-device keys, disabled root SSH login, and key-based authentication with passphrases. Option E is not a hardening practice: disabling local logging and audit daemons removes the forensic and detection capability needed to identify intrusions and is not an acceptable trade-off for marginal CPU savings.

Answer

Configuring all system accounts with shared static SSH keys and root auto-login

Answer

Disabling local logging and audit daemons to maximize CPU performance

Question 2

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Accepted Answer

Multi-Factor Authentication (MFA) for all authentication attempts. Option B is correct because Multi-Factor Authentication (MFA) ensures that even if a remote employee's password is compromised, an attacker cannot authenticate to internal corporate resources without the additional factor, directly mitigating credential-theft and phishing risks inherent to home environments. Option E is correct because an encrypted VPN tunnel using IPsec or TLS provides confidentiality and integrity for data in transit between the remote endpoint and the corporate network, preventing eavesdropping or tampering on untrusted home or public networks. Options A, C, and D are incorrect: disabling endpoint firewall protection weakens host defenses and exposes the device to inbound attacks, sharing credentials with family members violates least-privilege and non-repudiation principles, and connecting directly over unencrypted public Wi-Fi without tunneling exposes all traffic to interception and man-in-the-middle attacks.

Answer

Disabling endpoint firewall protection to improve home network gaming performance

Answer

Sharing corporate laptop credentials with family members for household convenience

Answer

Connecting directly via unencrypted public Wi-Fi without any protective tunneling

Question 3

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Accepted Answer

Amazon VPC Security Groups acting as stateful virtual firewall instances. Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets. Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Answer

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Answer

AWS Shield Standard for intra-VPC subnet routing

Question 4

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Accepted Answer

Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results. Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft. Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Answer

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Answer

Granting db_owner permissions to all public database roles by default

Question 5

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Accepted Answer

Inline placement directly in the path of network traffic flow to allow active packet dropping.. Option A is correct because a NIPS is typically deployed inline, sitting directly in the traffic path so it can actively drop or block malicious packets in real time rather than merely alerting. Option E is correct because many NIPS platforms can terminate or disrupt an in-progress attack by injecting TCP RST packets to reset the offending connection, which is an active prevention capability. Options B and D describe passive, detection-only behavior characteristic of a NIDS (e.g., SPAN port/TAP monitoring or syslog alerting without affecting traffic), so they do not represent prevention. Option C is incorrect because a NIPS must inspect Layer 3 and Layer 4 headers (and often higher layers) to identify and block malicious traffic, so operating as a pure Layer 2 bridge without inspection is not a NIPS feature.

Answer

Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

Answer

Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

Answer

Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.

Question 6

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

Accepted Answer

Prohibiting the creation and download of user-managed service account keys where possible. Option B is correct because user-managed service account keys are long-lived credentials that, once downloaded, can be exfiltrated and used to impersonate the service account; prohibiting their creation and download (and instead using short-lived credentials via Workload Identity Federation, service account impersonation, or attached service accounts) directly reduces credential theft risk. Option C is correct because enforcing least privilege with predefined or custom IAM roles limits each principal to only the permissions required, which prevents privilege escalation paths that arise when identities hold excessive permissions. Option A is wrong because disabling Cloud Audit Logs removes the audit trail needed to detect and investigate unauthorized privilege escalation or credential misuse, and it does not improve IAM hygiene. Option D is wrong because assigning primitive roles like Owner or Editor grants broad, excessive permissions that violate least privilege and enable privilege escalation. Option E is wrong because publishing service account JSON keys publicly exposes credentials to anyone, directly enabling credential theft and unauthorized access.

Answer

Disabling Google Cloud Audit Logs to reduce storage overhead

Answer

Assigning broad primitive roles (Owner, Editor) to all project contributors

Answer

Sharing service account JSON keys publicly in public GitHub repositories for collaboration

Question 7

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy. Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 8

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

Accepted Answer

Setting a strong UEFI/BIOS administrator password to prevent unauthorized configuration changes. Option A is correct because setting a strong UEFI/BIOS administrator password prevents unauthorized users from entering firmware setup and altering security-relevant settings such as boot order, virtualization, or disabling protections, directly mitigating physical/firmware tampering. Option D is correct because UEFI Secure Boot validates the digital signatures of bootloaders and early boot components against trusted keys, blocking unauthorized bootloaders and rootkits from loading before the OS. Option B is wrong because leaving the chassis intrusion detection switch disconnected removes a physical-tamper detection control rather than adding one. Option C is wrong because prioritizing unverified USB boot devices weakens boot security and enables rogue boot media attacks. Option E is wrong because disabling TPM activation removes hardware-rooted key storage and measured-boot capabilities that support integrity and tamper detection.

Answer

Leaving the physical chassis intrusion detection switch disconnected

Answer

Configuring the boot order to prioritize booting from unverified USB flash drives first

Answer

Disabling Trusted Platform Module (TPM) activation across all systems

Question 9

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). Option D is correct because mod_security is a Web Application Firewall (WAF) engine for Apache that inspects HTTP requests and responses against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting (XSS), and other common web attacks. Option E is correct because mod_headers allows Apache to inject response headers, and configuring it to send Strict-Transport-Security (HSTS) forces browsers to use HTTPS for future connections, mitigating protocol downgrade and cookie-hijacking attacks. Option A is not correct because KeepAlive and KeepAliveTimeout only tune TCP connection reuse and have no direct security effect. Option B is not correct because DirectoryIndex merely defines default index files and does not mitigate web threats. Option C is not correct because listening on port 80 without an SSL virtual host leaves traffic unencrypted and does not enhance application security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 10

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL. Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 11

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Accepted Answer

Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events). Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence. Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Answer

The Master Boot Record (MBR) partition table sectors

Answer

The system HOSTS file in \Windows\System32\drivers\etc\

Question 12

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

Accepted Answer

Environmental monitoring sensors tracking temperature and humidity thresholds. Option B is correct because ISO/IEC 27001 Annex A (A.11.2.1/A.7.5 in the 2022 revision) requires protection against environmental threats, and temperature/humidity sensors with defined thresholds detect conditions that could damage servers and storage. Option C is correct because Annex A physical entry controls (A.11.1.2/A.7.2) require visitor records, identity verification, and escorting of unauthorized persons to prevent unauthorized physical access. Option D is correct because Annex A requires secure areas to be protected by appropriate entry controls such as biometric or card-key systems, and logging all entry/exit events provides the audit trail needed for accountability and incident investigation. Option A is not acceptable because storing unencrypted backup tapes with sensitive PII in unlocked hallways violates both physical protection of media (A.11.2.3/A.7.10) and confidentiality requirements. Option E is not acceptable because propping open emergency exits defeats physical perimeter security and violates secure-area access control requirements, even if done for cooling convenience.

Answer

Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways

Answer

Leaving data center exterior emergency exit doors propped open for convenient cooling

Question 13

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

Accepted Answer

Implementing IEEE 802.11w (Protected Management Frames). Option C is correct because IEEE 802.11w Protected Management Frames cryptographically protects management frames such as deauthentication and disassociation, preventing wireless sniffing-based denial-of-service and spoofing attacks against the WLAN. Option D is correct because a WIPS sensor network continuously monitors the RF spectrum to detect and automatically contain rogue APs, evil twins, and unauthorized client devices, directly addressing the unauthorized-device requirement. Option E is correct because 802.1X with a secure RADIUS server and Enterprise PKI enforces certificate-based mutual authentication, ensuring only authorized devices and users can associate and preventing credential theft or rogue supplicant access. Option A is not appropriate because WEP is cryptographically broken and provides no meaningful isolation or protection, and Option B is not appropriate because hidden SSIDs are trivially discovered by sniffers and offer no real security, so neither belongs in a hardened enterprise design.

Answer

Relying on legacy WEP shared keys for guest network isolation

Answer

Configuring hidden SSIDs as the primary security defense

Question 14

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

Accepted Answer

Insecure Management APIs lacking proper authentication, rate limiting, and input validation.. Option C is correct because cloud management APIs are the primary control plane for provisioning and configuring resources, so APIs lacking strong authentication, rate limiting, and input validation are directly exploitable for unauthorized access, resource hijacking, and data exfiltration. Option E is correct because overly permissive IAM policies that grant excessive administrative privileges violate least privilege and are a leading cause of cloud data breaches, allowing compromised credentials or roles to escalate access across accounts and services. The unmarked options do not belong: A and D describe physical attacks against hypervisor memory or data center hardware, which are largely mitigated by cloud provider physical controls and are not primary cloud threat vectors for customers, while B targets local endpoint BIOS firmware and is an endpoint-level rather than cloud-specific vector.

Answer

Direct physical bus-sniffing attacks against hypervisor memory modules on multi-tenant hosts.

Answer

BIOS firmware flashing attacks against local endpoint motherboard EEPROMs.

Answer

Physical access tampering of rack-mounted server hardware within third-party data center cages.

Question 15

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

Accepted Answer

Azure ExpressRoute with MACsec or configured IPsec tunnels. Option B is correct because Azure ExpressRoute can provide private, dedicated connectivity from on-premises datacenters to Azure Virtual Networks, and it can be secured with MACsec at the ExpressRoute Direct link layer or with IPsec tunnels over the ExpressRoute private peering for end-to-end encryption. Option E is correct because an Azure Site-to-Site VPN Gateway establishes an IPsec/IKE-encrypted tunnel over the public internet between on-premises VPN devices and the Azure VPN gateway, ensuring secure transit for cross-premises traffic. Option A is not appropriate because standard unencrypted public IP bindings expose VM traffic without providing an encrypted transit channel. Option C is not appropriate because a standard Azure Load Balancer without TLS offloading does not encrypt traffic between on-premises datacenters and Azure Virtual Networks. Option D is not appropriate because Azure Virtual Network Peering connects virtual networks but does not by itself provide encrypted transit from on-premises datacenters to Azure.

Answer

Standard unencrypted public IP bindings on Azure VMs

Answer

Standard Azure Load Balancer without TLS offloading

Answer

Unencrypted Azure Virtual Network Peering

Question 16

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Option B is correct because setting a restrictive default umask such as 027 in shell profiles (e.g., /etc/profile or /etc/bashrc) ensures newly created files are not world-readable or group-writable, reducing exposure of sensitive data and limiting opportunities for local attackers to tamper with files. Option C is correct because configuring PermitRootLogin no in /etc/ssh/sshd_config prevents direct SSH logins as root, forcing administrators to authenticate as unprivileged users and then escalate via sudo or su, which strengthens accountability and blocks a common brute-force path to full system compromise. The unmarked options do not belong: disabling SELinux or AppArmor (A) removes mandatory access control enforcement and weakens containment of compromised processes, enabling password authentication with zero minimum length in PAM (D) permits weak or empty passwords that are trivially guessed or brute-forced, and mounting all filesystems read-write with suid privileges (E) increases the attack surface by allowing setuid binaries to execute and by permitting modification of system files.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 17

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Accepted Answer

Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.. Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks. Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Answer

Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

Answer

Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

Question 18

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Accepted Answer

Signature-based detection (matching known attack patterns and byte sequences). Signature-based detection is a core IDPS methodology: the sensor compares packet payloads and headers against a database of known attack patterns, byte sequences, and Snort/Suricata-style rules, generating an alert when a match occurs. Option E is also correct because anomaly-based detection builds a statistical or behavioral baseline of normal traffic (protocols, ports, bandwidth, connection rates) and flags deviations from that baseline as potential intrusions, which allows it to catch novel or previously unseen attacks. The remaining options are not IDPS detection methods: A describes illicit exploit acquisition, not traffic inspection; B is a nonsensical signal-conversion idea unrelated to packet analysis; and D is a manual network-availability action, not a detection technique.

Answer

Automatically purchasing new zero-day exploits from underground forums

Answer

Converting all network packets into analog audio signals for manual listening

Answer

Manually shutting down all enterprise internet circuits during off-peak hours

Question 19

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. Option A is correct because the WSUS Server Cleanup Wizard removes obsolete updates, unused update revisions, expired updates, and unneeded content files, which prevents the SUSDB from growing unbounded and keeps synchronization and reporting healthy. Option E is correct because regularly approving needed updates and declining superseded or expired ones ensures clients receive only current patches and reduces unnecessary disk usage, scan time, and administrative confusion. Option B is wrong because automatically installing pre-release beta patches on domain controllers is risky and not a maintenance best practice; production servers should receive tested, released updates. Option C is wrong because directly editing WSUS SQL tables without backups can corrupt the SUSDB and is unsupported. Option D is wrong because disabling TLS weakens client-server communication security and does not constitute healthy WSUS maintenance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans

Question 20

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

Accepted Answer

Endpoint local service status confirming antivirus daemon/service execution and recent scan logs. Option B is correct because checking the endpoint's local service status verifies that the antivirus daemon/service is actually running, and reviewing recent scan logs confirms the agent is performing its scanning function rather than merely being installed. Option D is correct because a centralized EDR management console dashboard aggregates agent health telemetry and signature update status across all workstations, which is the most efficient way to confirm fleet-wide functionality and compliance. Option A is incorrect because spanning-tree root bridge priority is a Layer 2 switching parameter unrelated to endpoint security agents. Option C is incorrect because DNS root hint tables only affect name resolution and reveal nothing about antivirus or EDR operation. Option E is incorrect because BGP ASN peering configurations concern internet routing between autonomous systems, not endpoint protection status.

Answer

Network switch spanning-tree root bridge priority metrics

Answer

DNS root hint server IP address tables

Answer

BGP router autonomous system number (ASN) peering configurations