CND Network Attacks And Defense Strategies — 25 Questions

Question 1

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 2

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.. Cloud providers (such as AWS) utilize IMDSv2, which requires session tokens, putting an explicit protection barrier against standard SSRF attacks. Additionally, restricting outbound application network calls and using IMDSv2 limits exposure.

Answer

Upgrade the web server operating system and apply all vendor-supplied kernel patches.

Answer

Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.

Answer

Install a host-based intrusion detection system (HIDS) to monitor web application log directories.

Question 3

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

Accepted Answer

Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).. Cisco Wireless LAN Controllers feature Rogue AP Detection and Automatic Containment (using Rogue Management and Adaptive Wireless Intrusion Prevention System - wIPS) which detects unauthorized APs broadcasting corporate SSIDs and sends deauthentication frames to isolate associated clients.

Answer

Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).

Answer

Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.

Answer

Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.

Question 4

An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?

Accepted Answer

Enable Port Security on access switch ports with a maximum MAC address limit of one and sticky learning.. Port security on Cisco switches allows an administrator to limit the number of valid MAC addresses allowed on a port and secure it against MAC spoofing and port stealing by learning specific addresses or setting maximum limits. Additionally, Dynamic ARP Inspection (DAI) and IP Source Guard help, but port security specifically addresses MAC duplication and port stealing across switch ports.

Answer

Implement Private VLANs (PVLANs) to isolate user switch ports from communicating with one another.

Answer

Configure Dynamic ARP Inspection (DAI) using the trusted DHCP snooping binding database.

Answer

Enable BPDU Guard and Root Guard on all designated edge switch ports.

Question 5

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Accepted Answer

Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.. DNS tunneling embeds arbitrary data within DNS queries (typically in the subdomain labels). Filtering for DNS traffic and analyzing exceptionally long query names containing high entropy or Base64-encoded strings is the standard methodology to detect DNS tunneling.

Answer

Filter for 'http.request.method == POST' and look for binary attachments.

Answer

Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.

Answer

Filter for 'icmp' and examine the payload size of Echo Request packets.

Question 6

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

Accepted Answer

Enforce LDAP signing and channel binding while disabling anonymous LDAP enumeration via Group Policy.. Active Directory enumeration and enumeration tools like BloodHound rely on standard LDAP queries. Implementing LDAP signing and channel binding, combined with restricting unauthenticated or anonymous LDAP binds through Group Policy (NTDS settings), mitigates this vector.

Answer

Enable Kerberos pre-authentication enforcement on all Domain Controller service principal accounts.

Answer

Configure SMB packet signing globally and disable SMBv1 across all domain member servers.

Answer

Implement NT LAN Manager (NTLM) v2 exclusive authentication and disable NTLM fallback.

Question 7

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) bound to the DHCP snooping database.. DHCP snooping builds a trusted binding database of IP-to-MAC addresses. Dynamic ARP Inspection (DAI) uses this DHCP snooping database to intercept, log, and discard ARP packets with invalid IP-to-MAC address bindings, effectively stopping ARP poisoning.

Answer

Activate Unicast Reverse Path Forwarding (uRPF) on the default gateway router.

Answer

Deploy IEEE 802.1Q VLAN trunking with native VLAN mismatch remediation.

Answer

Configure Port Fast and BPDU Guard on all access-layer switch interfaces.

Question 8

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

Accepted Answer

Create a Sender Policy Framework (SPF) TXT record specifying authorized sending IP addresses.. Sender Policy Framework (SPF) is implemented as a DNS TXT record that lists all authorized IP addresses and mail servers permitted to send emails on behalf of a domain.

Answer

Configure a DomainKeys Identified Mail (DKIM) CNAME record.

Answer

Implement a Domain-based Message Authentication, Reporting, and Conformance (DMARC) TXT record.

Answer

Deploy a Mail Exchange (MX) record pointing to the internal relay gateway.

Question 9

A network administrator observes continuous SYN flooding targeting a primary public-facing web server on a Cisco ASA 5500-X firewall. To mitigate this attack without disrupting legitimate traffic, which specific feature should the administrator enable globally via the command-line interface?

Accepted Answer

Enable TCP synproxy on the outside interface and apply it to the affected service policy.. Enabling TCP synproxy on the Cisco ASA intercepts the TCP handshake by sending a SYN-ACK cookie to the client. This ensures that the ASA only establishes a connection to the backend web server after the client successfully completes the three-way handshake, preventing resource exhaustion during a SYN flood.

Answer

Configure a standard Access Control List (ACL) to block all inbound TCP traffic on port 80.

Answer

Enable the Cisco ASA HTTP inspection engine under the global inspection policy.

Answer

Activate Unicast Reverse Path Forwarding (uRPF) in strict mode on the ingress interface.

Question 10

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Accepted Answer

Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.. In Snort, the suppress rule configuration allows administrators to suppress specific alerts for specific IP addresses or subnets without completely disabling the signature rule globally. Alternatively, modifying rules using threshold or classification is used, but suppress is the direct action for silencing false positives.

Answer

Delete the rule definition entirely from the Snort local rules file.

Answer

Disable all preprocessor inspection engines within the snort.conf configuration file.

Answer

Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

Question 11

An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?

Accepted Answer

Deploy Group Managed Service Accounts (gMSAs) and enforce strong, complex passwords (minimum 25 characters) for all service accounts.. Kerberoasting targets service accounts with weak passwords. Mitigation involves enforcing strong, complex passwords (12+ characters) or utilizing Group Managed Service Accounts (gMSAs), which automatically manage complex passwords and rotate them frequently.

Answer

Implement SMB signing enforcement and disable NTLMv1 authentication protocol.

Answer

Configure Account Lockout Policies to lock accounts after three failed login attempts.

Answer

Enable Kerberos pre-authentication requirement on all domain user and computer accounts.

Question 12

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

Accepted Answer

Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.. Next-Generation Firewalls (NGFW) utilize Deep Packet Inspection (DPI) and App-ID features to identify applications regardless of port numbers, allowing administrators to enforce strict outbound application control policies.

Answer

Configure a stateless packet filtering access control list on the core router interface.

Answer

Activate standard IP source guard on all internal user-facing switch access ports.

Answer

Enable Network Address Translation (NAT) overload (PAT) on the perimeter router.

Question 13

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. PsExec relies heavily on ADMIN$ share access and remote service creation via SMB (TCP ports 445 and 139) and RPC. Restricting inbound SMB access to authorized administrative management subnets and enabling Windows Defender Firewall rules blocking remote service creation prevents PsExec execution.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

Question 14

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Accepted Answer

Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.. SELinux (Security-Enhanced Linux) and AppArmor are Linux Security Modules (LSM) that provide Mandatory Access Control (MAC) policies. SELinux uses security contexts and policies to constrain process privileges.

Answer

Modify standard Linux file permission bits (chmod and chown) for all application binaries.

Answer

Enable the Linux audit daemon (auditd) to log all system call activities.

Answer

Install and configure a host-based firewall using iptables or nftables.

Question 15

An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?

Accepted Answer

Disable the 'monlist' command and restrict external queries in the ntp.conf configuration file.. The NTP 'monlist' (monitor list) command returns the IP addresses of recent clients interacting with the NTP server, making it a prime vector for UDP amplification attacks. Disabling monlist or upgrading NTP to versions where monlist is disabled by default mitigates this risk.

Answer

Configure NTP authentication using symmetric cryptographic keys for time synchronization.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) in strict mode on internal interfaces.

Answer

Implement ICMP rate-limiting on the enterprise perimeter routing devices.

Question 16

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). A correct Snort rule structure requires the action (alert/drop), protocol (icmp), source/destination IPs and ports, and options such as dsize:1000 to check packet payload size.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 17

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.. A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic specifically at Layer 7, utilizing signature matching, anomaly detection, and parser normalization to block attacks like SQL injection and XSS.

Answer

Configure a reverse proxy load balancer with IP hashing persistence algorithms.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.

Answer

Implement a stateful network firewall configured with Layer 4 packet inspection rules.

Question 18

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

Accepted Answer

Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.. Fail2ban monitors log files (such as /var/log/auth.log) for patterns of failed authentication attempts and automatically updates firewall rules (iptables or nftables) to ban offending IP addresses for a set duration.

Answer

Deploy Wireshark with a real-time command-line display filter for SSH packets.

Answer

Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.

Answer

Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.

Question 19

An enterprise wireless network uses WPA2-Enterprise for authentication. A security administrator wants to upgrade the security posture to protect against offline dictionary attacks on handshakes and provide enhanced cryptographic cipher suites. Which standard should be implemented?

Accepted Answer

Upgrade the wireless infrastructure to WPA3-Enterprise using Simultaneous Authentication of Equals (SAE) and Protected Management Frames (PMF).. WPA3 replaces the vulnerable 4-way handshake of WPA2 with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks even if weak passwords are chosen.

Answer

Deploy MAC Authentication Bypass (MAB) with RADIUS accounting enabled.

Answer

Implement WEP encryption with dynamic 802.1X key rotation.

Answer

Configure WPA2-Personal with a pre-shared key (PSK) length exceeding 64 characters.

Question 20

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

Accepted Answer

Enable Windows Defender Credential Guard utilizing Virtualization-based Security (VBS).. Credential Guard utilizes virtualization-based security (VBS) to isolate secrets (such as NTLM hashes and Kerberos tickets) so that they cannot be stolen or reused even if the LSASS process is compromised.

Answer

Enforce User Account Control (UAC) with highest privilege elevation prompts.

Answer

Configure Windows Defender Exploit Guard with Network Protection enabled.

Answer

Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.