CND Multiple Select — 50 Questions

Question 1

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). mod_headers (for security headers like HSTS and CSP) and mod_security (Web Application Firewall engine) enhance Apache security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 2

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools scan repositories like file shares, databases, and cloud storage for sensitive unencrypted data at rest.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 3

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. WSUS maintenance requires declining superseded updates and running the Server Cleanup Wizard to optimize performance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans

Question 4

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Accepted Answer

Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges. PostgreSQL hardening includes configuring pg_hba.conf for strict IP/authentication, enabling SSL/TLS in postgresql.conf, and managing superuser access properly.

Answer

Set superuser password to null and allow trust authentication for all interfaces

Answer

Disable all logging in postgresql.conf to maximize query execution performance

Question 5

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Accepted Answer

Data in transit across network gateways (Network DLP). Comprehensive DLP solutions cover data in transit (network), data at rest (storage/databases), and data in use (endpoints).

Answer

Data routed through internal Bluetooth beacon devices

Answer

Data processed inside physical server CPU cache registers only

Answer

Data transmitted over analog telephone modem lines

Question 6

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. TDE protects data at rest on disk and backup files, but does not protect data in transit or data accessed in memory while the database is running.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 7

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Accepted Answer

Executing remote lock and remote wipe commands for lost or stolen devices. MDM solutions enforce device encryption requirements and remote wipe/lock capabilities.

Answer

Allowing unrestricted installation of custom untrusted firmware packages

Answer

Disabling all over-the-air communication channels permanently

Answer

Removing all screen lock passcode requirements

Question 8

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Accepted Answer

Enforcing SELinux in targeted or multi-category security (MLS) mode. Mandatory Access Control frameworks like SELinux and AppArmor, combined with proper kernel parameter tuning (sysctl), enforce least privilege.

Answer

Setting all user home directory permissions to world-writable (chmod 777)

Answer

Disabling all audit logging and accounting daemons

Question 9

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Accepted Answer

Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools. Credential dumping leaves specific traces, including abnormal handles opened to LSASS, unexpected processes reading LSASS memory, and specific Event IDs.

Answer

Regular scheduled defragmentation of the system volume by dfrgui.exe

Answer

Standard domain user successfully changing their own account password via Ctrl+Alt+Del

Question 10

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

Accepted Answer

Enforces separation of corporate apps and data from personal user applications. Containerized work profiles separate work apps/data from personal data and allow IT to wipe corporate data independently.

Answer

Requires rooting or jailbreaking the mobile device during enrollment

Answer

Prevents the use of any passcode on the device

Answer

Gives IT full administrative control over personal photos, messages, and personal app usage

Question 11

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Accepted Answer

Setting a restrictive default umask (such as 027) in shell profiles. Disabling root SSH login and enforcing strict file permissions (umask) are standard Linux hardening best practices.

Answer

Disabling SELinux or AppArmor enforcement

Answer

Enabling password authentication with zero minimum length in PAM

Answer

Mounting all filesystems with read-write and suid privileges

Question 12

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

Accepted Answer

Configuring Azure Storage Firewall rules to restrict access to specific Virtual Networks and IP ranges. Enabling Storage firewall rules (virtual network and IP restrictions) and Microsoft Defender for Storage protects storage accounts.

Answer

Allowing anonymous public read access on all blob containers by default

Answer

Removing all Azure Key Vault cryptographic keys

Answer

Disabling HTTPS traffic so clients communicate exclusively over unencrypted HTTP

Question 13

An organization is updating its incident response policy based on NIST SP 800-61. Which TWO phases are part of the post-incident activity stage? (Choose TWO)

Accepted Answer

Evidence Retention and Reporting. According to NIST SP 800-61, the post-incident phase encompasses learning lessons from the incident and retaining evidence/reporting.

Answer

Containment

Answer

Vulnerability Assessment

Answer

System Eradication

Question 14

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Accepted Answer

Potential operational downtime and business impact. Containment strategy decisions depend on potential business disruption, service availability requirements, and evidence preservation needs.

Answer

The color of the Ethernet cables connected to the rack

Answer

The office desk location of the IT director

Answer

The brand name of the server manufacturer

Question 15

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Windows Run/RunOnce keys in HKLM and HKCU, along with Winlogon registry entries, are classic persistence vectors.

Answer

HKEY_CLASSES_ROOT\.txt\DefaultIcon

Answer

HKEY_PERFORMANCE_DATA\CurrentPerformance

Question 16

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Accepted Answer

AlienVault Open Threat Exchange (OTX). OSINT sources include publicly accessible threat feeds, vulnerability databases, and security blogs.

Answer

Internal employee performance reviews

Answer

Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

Answer

Classified military signals intelligence intercepts

Question 17

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Accepted Answer

DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.. Modern email authentication and hardening rely on Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).

Answer

Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

Answer

Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.

Question 18

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

Accepted Answer

Disabling Telnet and enabling SSH version 2 for CLI management. Securing the management plane requires disabling legacy unencrypted protocols like Telnet and HTTP, and enforcing SSH and HTTPS.

Answer

Leaving default administrator credentials unchanged for ease of initial troubleshooting

Answer

Enabling SNMPv1 community string 'public' with read-write access globally

Answer

Configuring all switch ports with dynamic VLAN trunking protocol (VTP) server mode by default

Question 19

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

Accepted Answer

Deploy behavioral anomaly detection and Endpoint Detection and Response (EDR) solutions across all internal endpoints.. Adaptive defense-in-depth relies on micro-segmentation, Zero Trust network architecture (never trust, always verify), and continuous monitoring/behavioral analytics rather than relying solely on a single perimeter firewall.

Answer

Disable all logging and auditing mechanisms to reduce SIEM ingestion noise and storage costs.

Answer

Rely exclusively on a strong perimeter firewall and demilitarized zone (DMZ) to secure internal assets.

Question 20

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

Accepted Answer

Maintain a comprehensive Software Bill of Materials (SBOM) and perform automated Software Composition Analysis (SCA) for third-party libraries.. Supply chain security is reinforced by performing Software Bill of Materials (SBOM) tracking and software composition analysis (SCA) to identify vulnerable dependencies, alongside enforcing strict vendor risk management and access controls.

Answer

Disable all code signing requirements for internal and external software builds.

Answer

Grant third-party vendor support accounts permanent, unmonitored Domain Administrator privileges.

Answer

Rely entirely on vendor self-assessments without conducting independent code audits or penetration testing.