CND Network Attacks And Defense Strategies — Timed 25 Questions

Question 1

An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?

25 minute time limit — choose an answer to begin.

Accepted Answer

Enable Port Security on access switch ports with a maximum MAC address limit of one and sticky learning.. Port Security on access switch ports with a maximum MAC address limit of one and sticky learning prevents port-stealing attacks by ensuring that only the first learned (or statically configured) MAC address can communicate on that port. If an attacker spoofs an authenticated client's MAC on a different port, that port already has a different MAC bound or will exceed the limit, triggering a violation and blocking the spoofed traffic.

Answer

Implement Private VLANs (PVLANs) to isolate user switch ports from communicating with one another.

Answer

Configure Dynamic ARP Inspection (DAI) using the trusted DHCP snooping binding database.

Answer

Enable BPDU Guard and Root Guard on all designated edge switch ports.

Question 2

A network administrator observes continuous SYN flooding targeting a primary public-facing web server on a Cisco ASA 5500-X firewall. To mitigate this attack without disrupting legitimate traffic, which specific feature should the administrator enable globally via the command-line interface?

Accepted Answer

Enable TCP synproxy on the outside interface and apply it to the affected service policy.. TCP synproxy on the Cisco ASA makes the firewall complete the TCP three-way handshake with the client on behalf of the protected server, only forwarding the connection once the handshake succeeds. This absorbs SYN floods because half-open connections never reach the web server, and legitimate clients still complete their connections normally.

Answer

Configure a standard Access Control List (ACL) to block all inbound TCP traffic on port 80.

Answer

Enable the Cisco ASA HTTP inspection engine under the global inspection policy.

Answer

Activate Unicast Reverse Path Forwarding (uRPF) in strict mode on the ingress interface.

Question 3

An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?

Accepted Answer

Deploy Group Managed Service Accounts (gMSAs) and enforce strong, complex passwords (minimum 25 characters) for all service accounts.. Kerberoasting exploits weak service account passwords by requesting a TGS ticket encrypted with the service account's NTLM hash, which can be cracked offline. Group Managed Service Accounts (gMSAs) automatically rotate complex passwords (120 characters by default) and eliminate manual password management, making offline cracking infeasible. Enforcing strong, complex passwords (minimum 25 characters) further increases the computational cost for attackers.

Answer

Implement SMB signing enforcement and disable NTLMv1 authentication protocol.

Answer

Configure Account Lockout Policies to lock accounts after three failed login attempts.

Answer

Enable Kerberos pre-authentication requirement on all domain user and computer accounts.

Question 4

An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?

Accepted Answer

Disable the 'monlist' command and restrict external queries in the ntp.conf configuration file.. The NTP monlist command (mode 6, opcode 0x1A) returns a list of up to 600 recent clients that have communicated with the server, and because the request is small (a single UDP packet) while the response is large, it is a classic amplification vector with ratios exceeding 200x. Disabling monlist (via 'disable monitor' or 'noquery' in ntp.conf, or upgrading to NTP 4.2.7p26+ where monlist is disabled by default) and restricting queries with 'restrict default noquery nomodify notrap' prevents the server from being abused as a reflector.

Answer

Configure NTP authentication using symmetric cryptographic keys for time synchronization.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) in strict mode on internal interfaces.

Answer

Implement ICMP rate-limiting on the enterprise perimeter routing devices.

Question 5

An enterprise wireless network uses WPA2-Enterprise for authentication. A security administrator wants to upgrade the security posture to protect against offline dictionary attacks on handshakes and provide enhanced cryptographic cipher suites. Which standard should be implemented?

Accepted Answer

Upgrade the wireless infrastructure to WPA3-Enterprise using Simultaneous Authentication of Equals (SAE) and Protected Management Frames (PMF).. WPA3 replaces the vulnerable 4-way handshake of WPA2 with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks even if weak passwords are chosen.

Answer

Deploy MAC Authentication Bypass (MAB) with RADIUS accounting enabled.

Answer

Implement WEP encryption with dynamic 802.1X key rotation.

Answer

Configure WPA2-Personal with a pre-shared key (PSK) length exceeding 64 characters.

Question 6

An internal security assessment reveals that an attacker with access to a low-privilege domain user account can enumerate Active Directory group memberships and trust relationships using LDAP. To secure Active Directory against anonymous and excessive unauthenticated enumeration, which specific Active Directory feature and setting should be configured?

Accepted Answer

Restrict anonymous access to the RootDSE and disable anonymous LDAP queries via Group Policy.. Anonymous LDAP binds allow unauthenticated users to read the RootDSE and enumerate directory objects, which is exactly how tools like BloodHound and ldapsearch map group memberships and trusts. Restricting anonymous access to the RootDSE and disabling anonymous LDAP queries via Group Policy closes that unauthenticated enumeration path while still permitting authenticated low-privilege users to query only what their ACLs allow. This directly addresses the assessment finding.

Answer

Enable Kerberos AES encryption enforcement and disable DES/RC4 ciphers.

Answer

Deploy fine-grained password policies requiring 15-character complex passphrases.

Answer

Configure Active Directory Certificate Services (AD CS) with ESC1 template restrictions.

Question 7

An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)

Accepted Answer

Kerberoasting by requesting Service Tickets (TGS) for SPN-associated service accounts and cracking them offline.. Option B (Kerberoasting) is correct because it abuses Kerberos protocol mechanics: any authenticated domain user can request a Service Ticket (TGS) for a target SPN via TGS-REQ, and the ticket is encrypted with the service account's NTLM hash, allowing offline cracking to recover the plaintext password. Option E (AS-REP Roasting) is correct because it exploits accounts configured with 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH); the attacker sends an AS-REQ without preauthentication and receives an AS-REP encrypted with the user's password hash, which can then be cracked offline. Option A (XSS) is incorrect because it is a web application vulnerability exploiting client-side JavaScript execution, unrelated to Kerberos. Option C (SQLi) is incorrect because it targets database query handling in web forms, not Kerberos authentication. Option D (ARP Cache Poisoning) is incorrect because it is a Layer 2 network attack that manipulates ARP tables to intercept Ethernet frames, not a Kerberos protocol abuse.

Answer

Cross-Site Scripting (XSS) via injected JavaScript payloads executed in victim browsers.

Answer

SQL Injection (SQLi) by appending malicious query parameters to authentication web forms.

Answer

ARP Cache Poisoning to intercept local subnet Layer 2 Ethernet frames.

Question 8

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

Accepted Answer

Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.. IMDSv2 requires a session token obtained via a PUT request before metadata can be retrieved, which defeats most SSRF attacks that can only issue simple GET requests. Combining IMDSv2 with strict URL parsing and allow-listing on the web application prevents attackers from crafting requests to 169.254.169.254, addressing both the architectural and application-layer causes.

Answer

Upgrade the web server operating system and apply all vendor-supplied kernel patches.

Answer

Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.

Answer

Install a host-based intrusion detection system (HIDS) to monitor web application log directories.

Question 9

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

Accepted Answer

Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).. Enabling Rogue AP Detection and Automated Containment on the WLC is correct because the WLC can continuously scan for unauthorized APs, classify them as rogue, and automatically send deauthentication frames to contain the threat. This directly addresses the evil twin attack by detecting the unauthorized AP using the corporate SSID and neutralizing it without manual intervention. It is the purpose-built enterprise wireless feature for this scenario.

Answer

Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).

Answer

Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.

Answer

Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.

Question 10

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Accepted Answer

Filter for 'dns' and inspect query strings for abnormally high length, high entropy, or encoded character patterns.. DNS tunneling encapsulates C2 traffic within DNS queries and responses, often encoding data in the query name (e.g., subdomain labels) to bypass firewalls. The analyst should filter for 'dns' in Wireshark and examine query strings for anomalies such as unusually long labels, high entropy (random-looking characters), or Base64/hex encoding patterns. These indicators distinguish malicious tunneling from normal DNS resolution, which typically uses short, human-readable domain names.

Answer

Filter for 'http.request.method == POST' and look for binary attachments.

Answer

Filter for 'tcp.port == 443' and inspect the TLS Server Name Indication (SNI) extension.

Answer

Filter for 'icmp' and examine the payload size of Echo Request packets.

Question 11

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

Accepted Answer

Enforce LDAP signing and channel binding while disabling anonymous LDAP enumeration via Group Policy.. Anonymous LDAP enumeration allows unauthenticated attackers to query the directory for user, group, and attribute information, which is exactly the reconnaissance described. Enforcing LDAP signing and channel binding via Group Policy hardens the LDAP channel against relay and tampering attacks, while disabling anonymous LDAP enumeration blocks the unauthenticated queries. Together these controls directly mitigate the observed technique.

Answer

Enable Kerberos pre-authentication enforcement on all Domain Controller service principal accounts.

Answer

Configure SMB packet signing globally and disable SMBv1 across all domain member servers.

Answer

Implement NT LAN Manager (NTLM) v2 exclusive authentication and disable NTLM fallback.

Question 12

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) bound to the DHCP snooping database.. Dynamic ARP Inspection (DAI) bound to the DHCP snooping database is correct because DAI validates ARP packets on untrusted ports by comparing IP-to-MAC bindings against the trusted DHCP snooping table. This prevents an attacker from poisoning ARP caches with forged mappings, thereby mitigating man-in-the-middle attacks. It is the standard switch-level defense against ARP cache poisoning.

Answer

Activate Unicast Reverse Path Forwarding (uRPF) on the default gateway router.

Answer

Deploy IEEE 802.1Q VLAN trunking with native VLAN mismatch remediation.

Answer

Configure Port Fast and BPDU Guard on all access-layer switch interfaces.

Question 13

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

Accepted Answer

Create a Sender Policy Framework (SPF) TXT record specifying authorized sending IP addresses.. SPF is the DNS TXT record that lists the IP addresses and hostnames authorized to send mail for a domain, allowing receiving servers to verify the envelope sender. Publishing an SPF record directly addresses the requirement to specify authorized sending mail servers. It is the foundational layer of email authentication, complemented by DKIM (cryptographic signature) and DMARC (policy and reporting).

Answer

Configure a DomainKeys Identified Mail (DKIM) CNAME record.

Answer

Implement a Domain-based Message Authentication, Reporting, and Conformance (DMARC) TXT record.

Answer

Deploy a Mail Exchange (MX) record pointing to the internal relay gateway.

Question 14

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Accepted Answer

Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.. Snort's suppress directive allows analysts to silence a specific signature (by SID) for a specific target IP without removing the rule entirely. This preserves detection for other hosts while eliminating the false positive noise from the known-benign traffic to the database server. It is the surgical, recommended approach for tuning out false positives.

Answer

Delete the rule definition entirely from the Snort local rules file.

Answer

Disable all preprocessor inspection engines within the snort.conf configuration file.

Answer

Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

Question 15

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

Accepted Answer

Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.. A Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID can identify applications regardless of port, inspect payloads, and block unauthorized outbound traffic and unknown protocols. This is essential for detecting and stopping data exfiltration over non-standard ports like TCP 4443. Traditional stateless filtering and NAT cannot perform this level of application-aware inspection.

Answer

Configure a stateless packet filtering access control list on the core router interface.

Answer

Activate standard IP source guard on all internal user-facing switch access ports.

Answer

Enable Network Address Translation (NAT) overload (PAT) on the perimeter router.

Question 16

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Accepted Answer

Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).. Restricting inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts blocks PsExec lateral movement, which relies on these protocols to execute commands remotely. Enabling WDAC further prevents unauthorized executables (like PsExec) from running, providing defense in depth.

Answer

Configure IPsec tunnel-mode policies between all internal client workstations.

Answer

Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

Answer

Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

Question 17

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 18

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Accepted Answer

Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.. SELinux and AppArmor are Linux kernel security modules that implement mandatory access control (MAC), confining processes to only the resources defined by policy regardless of user privileges. Running them in enforcing mode ensures that policy violations are blocked, not just logged, which is the correct way to restrict processes to only necessary resources.

Answer

Modify standard Linux file permission bits (chmod and chown) for all application binaries.

Answer

Enable the Linux audit daemon (auditd) to log all system call activities.

Answer

Install and configure a host-based firewall using iptables or nftables.

Question 19

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Accepted Answer

alert icmp any any -> any any (msg:"Large ICMP Payload Detected"; dsize:>1000; sid:1000001; rev:1;). It uses the proper Snort rule syntax for detecting large ICMP echo requests. The header 'alert icmp any any -> any any' correctly specifies the ICMP protocol and action, while the option 'dsize:>1000' accurately matches packets with payloads greater than 1000 bytes. This combination directly addresses the requirement to detect ICMP echo requests with payloads exceeding 1000 bytes, which could indicate covert channel data exfiltration.

Answer

log ip any any -> any any (msg:"ICMP Check"; length:1000; sid:1000001; rev:1;)

Answer

drop tcp any any -> any 80 (msg:"ICMP Large Payload"; payload_size:>1000; sid:1000001; rev:1;)

Answer

pass udp any any -> any 53 (msg:"ICMP Alert"; size:1000; sid:1000001; rev:1;)

Question 20

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Accepted Answer

Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7, analyze parameters, and block SQL injection signatures using rule sets and anomaly scoring. It sits in front of the web application and can dynamically detect and mitigate SQLi attempts, including union-based queries.

Answer

Configure a reverse proxy load balancer with IP hashing persistence algorithms.

Answer

Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.

Answer

Implement a stateful network firewall configured with Layer 4 packet inspection rules.