CND Network Attacks And Defense Strategies Practice Test 2 — 15 Questions

Question 1

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. Restricting inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts blocks PsExec lateral movement, which relies on these protocols to execute commands remotely. Enabling WDAC further prevents unauthorized executables (like PsExec) from running, providing defense in depth.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

Question 2

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 3

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Accepted Answer

Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.. SELinux and AppArmor are Linux kernel security modules that implement mandatory access control (MAC), confining processes to only the resources defined by policy regardless of user privileges. Running them in enforcing mode ensures that policy violations are blocked, not just logged, which is the correct way to restrict processes to only necessary resources.

Answer

Modify standard Linux file permission bits (chmod and chown) for all application binaries.

Answer

Enable the Linux audit daemon (auditd) to log all system call activities.

Answer

Install and configure a host-based firewall using iptables or nftables.

Question 4

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). It uses the proper Snort rule syntax for detecting large ICMP echo requests. The header 'alert icmp any any -> any any' correctly specifies the ICMP protocol and action, while the option 'dsize:>1000' accurately matches packets with payloads greater than 1000 bytes. This combination directly addresses the requirement to detect ICMP echo requests with payloads exceeding 1000 bytes, which could indicate covert channel data exfiltration.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 5

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7, analyze parameters, and block SQL injection signatures using rule sets and anomaly scoring. It sits in front of the web application and can dynamically detect and mitigate SQLi attempts, including union-based queries.

Answer

Configure a reverse proxy load balancer with IP hashing persistence algorithms.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.

Answer

Implement a stateful network firewall configured with Layer 4 packet inspection rules.

Question 6

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

Accepted Answer

Configure and run 'fail2ban' to parse authentication logs and dynamically insert iptables firewall drop rules.. Fail2ban is a log-parsing intrusion prevention tool that monitors authentication logs (such as /var/log/auth.log or /var/log/secure) for repeated failures and dynamically inserts iptables rules to block offending IP addresses. It directly addresses the requirement to automatically inspect logs and block attackers. This is the standard Linux tool for automated brute-force mitigation.

Answer

Deploy Wireshark with a real-time command-line display filter for SSH packets.

Answer

Execute 'tcpdump' with a packet filter expression capturing TCP port 22 traffic.

Answer

Enable the Linux auditd daemon and review audit logs manually using the ausearch utility.

Question 7

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

Accepted Answer

Enable Windows Defender Credential Guard utilizing Virtualization-based Security (VBS).. Credential Guard uses Virtualization-based Security (VBS) to isolate LSA secrets, including NTLM hashes and Kerberos TGTs, in a separate virtualized environment that even a compromised kernel cannot read. This renders harvested hashes unusable for Pass-the-Hash because the attacker cannot extract them from the protected process.

Answer

Enforce User Account Control (UAC) with highest privilege elevation prompts.

Answer

Configure Windows Defender Exploit Guard with Network Protection enabled.

Answer

Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.

Question 8

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

Accepted Answer

Explicitly enforce a whitelist of approved cryptographic signing algorithms (e.g., RS256) and explicitly reject the 'none' algorithm in the JWT validation function.. The vulnerability arises because the JWT validation code trusts the 'alg' header from the token without verifying it against a list of allowed algorithms. An attacker can set 'alg' to 'none' and remove the signature, and if the code accepts it, signature verification is bypassed. The fix is to explicitly whitelist approved algorithms (e.g., RS256) and reject 'none' in the validation function, ensuring the token is signed with an expected algorithm. This prevents algorithm confusion attacks and enforces cryptographic integrity.

Answer

Upgrade the JWT token expiration time (exp claim) to expire within five minutes of creation.

Answer

Implement JSON Web Encryption (JWE) to payload data without verifying headers.

Answer

Store JWT tokens in HTTP-only, Secure cookies instead of local browser storage.

Question 9

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

Accepted Answer

Enable Amazon S3 Block Public Access settings across all AWS accounts and buckets.. Amazon S3 Block Public Access is a preventive control that overrides bucket policies and ACLs to reject any public access, regardless of how the bucket is configured. Enabling it at the account level ensures that even newly created buckets or misconfigured policies cannot expose data publicly. This directly addresses the requirement to prevent public accessibility due to misconfigurations.

Answer

Deploy an AWS WAF web access control list on Amazon CloudFront distributions.

Answer

Configure AWS Security Hub with CIS AWS Foundations Benchmark compliance standards.

Answer

Install a host-based antivirus agent on all EC2 virtual machine instances.

Question 10

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

Accepted Answer

Enable DHCP Snooping globally and configure untrusted user access ports as untrusted.. DHCP Snooping is the switch security feature designed to prevent rogue DHCP servers and DHCP starvation attacks. By enabling it globally and configuring user access ports as untrusted, the switch only allows DHCP server responses (OFFER, ACK) from trusted ports (e.g., uplinks to legitimate DHCP servers), blocking unauthorized DHCP servers.

Answer

Activate IP Source Guard with static binding entries on all edge switch ports.

Answer

Configure Dynamic ARP Inspection (DAI) on all trunk ports connecting to core switches.

Answer

Enable Port Security with maximum MAC address limits and restrict violation actions.

Question 11

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

Accepted Answer

Audit and restrict the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended access rights on the domain object.. DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting password hashes via GetNCChanges. The two extended rights that grant this capability are 'Replicating Directory Changes' (DS-Replication-Get-Changes) and 'Replicating Directory Changes All' (DS-Replication-Get-Changes-All), plus 'Replicating Directory Changes In Filtered Set' in some cases. Auditing and restricting these ACEs on the domain NC head prevents non-DC principals from performing replication.

Answer

Enforce LDAP signing and channel binding on all domain controller NTDS settings.

Answer

Monitor the 'GenericAll' and 'WriteDacl' permissions on all computer account objects.

Answer

Disable NT LAN Manager (NTLM) authentication and enforce Kerberos ticket granting settings.

Question 12

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

Accepted Answer

Execute 'find / -perm /4000 -type f 2>/dev/null' to audit files with the SUID bit set.. The command 'find / -perm /4000 -type f 2>/dev/null' searches the entire filesystem for regular files with the SUID bit set (octal 4000), redirecting permission-denied errors to /dev/null. This allows the engineer to audit and then remove SUID permissions from unauthorized binaries, directly mitigating the privilege escalation vector described.

Answer

Execute 'chmod -R 777 /' to reset all filesystem file permissions to secure defaults.

Answer

Run 'netstat -tulnp' to identify listening network ports associated with SUID processes.

Answer

Run 'iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT' to lock down network access.

Question 13

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

Accepted Answer

Implement SSL/TLS Decryption (SSL Inspection) on the Next-Generation Firewall or Secure Web Gateway.. SSL/TLS Decryption on a Next-Generation Firewall or Secure Web Gateway allows the organization to inspect encrypted outbound traffic for malicious payloads and C2 beaconing patterns. This technique terminates the TLS session, inspects the plaintext, and re-encrypts it, enabling deep packet inspection without violating compliance if proper legal and privacy controls are in place. It is the standard enterprise architecture technique for inspecting HTTPS traffic.

Answer

Enforce strict client-side certificate pinning on all corporate web browsers.

Answer

Configure IPsec VPN tunnels between all endpoints and the corporate perimeter router.

Answer

Deploy a Layer 2 network tap connected to a passive intrusion detection sensor.

Question 14

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

Accepted Answer

Domain Fronting via Content Delivery Networks (CDNs) to obscure the true destination of HTTPS C2 traffic.. Option B is correct because domain fronting exploits CDNs (e.g., CloudFront, Azure CDN) by sending an HTTPS request with a legitimate SNI/host header matching the CDN while the inner HTTP Host header points to the attacker's domain, so the TLS connection appears to terminate at a trusted CDN and the true C2 destination is hidden from network inspection. Option D is correct because DNS tunneling encodes C2 commands or exfiltrated data into subdomain labels of queries sent to an attacker-controlled authoritative nameserver, abusing DNS (typically UDP/TCP 53) as a ubiquitous, often-allowed service to blend malicious traffic with legitimate resolution. Option A is not a common APT obfuscation method because standard FTP with anonymous credentials is cleartext, easily flagged, and not a legitimate service attackers typically masquerade through for covert C2. Option C is incorrect because BGP community strings and static route modifications are routing-policy mechanisms, not a technique for hiding C2 payloads inside legitimate application-layer services. Option E is incorrect because cleartext HTTP on port 80 provides no encryption or encapsulation, making the C2 traffic trivially detectable rather than obfuscated.

Answer

Standard FTP file transfers over TCP ports 20 and 21 using anonymous credentials.

Answer

Static IP routing table modifications on core border routers using BGP community strings.

Answer

Cleartext HTTP communication over port 80 without encryption or encapsulation.

Question 15

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Accepted Answer

DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.. Option A (DKIM) is correct because it adds a cryptographic signature to outbound messages using a private key, with the public key published in a DNS TXT record, allowing receivers to verify message integrity and detect tampering or spoofing. Option C (DMARC) is correct because it builds on SPF and DKIM by publishing a DNS TXT record at _dmarc that tells receivers how to handle messages failing alignment checks (none, quarantine, or reject) and provides aggregate/forensic reporting, directly countering spoofing and credential-harvesting phishing. Option E (SPF) is correct because it publishes a DNS TXT record listing authorized sending hosts (e.g., ip4, ip6, include, -all) so receivers can reject mail from unauthorized servers forging the domain. Option B (DHCP snooping) is incorrect because it is a Layer 2 switch feature that filters rogue DHCP servers and builds IP-to-MAC bindings, unrelated to email authentication. Option D (uRPF) is incorrect because it is a router anti-spoofing technique for validating source IP addresses against the routing table, not an email or DNS control.

Answer

Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

Answer

Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.