CND Timed Practice Test 1 — 10 Questions

Question 1

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

10 minute time limit — choose an answer to begin.

Accepted Answer

Configuring a host-based packet filter firewall (such as nftables or iptables). Option B is correct because a host-based packet filter such as nftables or iptables enforces least-privilege network access on the gateway itself, restricting inbound/outbound traffic to only the ports and protocols the industrial IoT function requires. Option C is correct because reducing the attack surface by removing unnecessary packages and disabling insecure legacy services like Telnet and FTP (which transmit credentials in cleartext) eliminates well-known vectors for compromise on embedded Linux endpoints. Option D is correct because an automated, secure firmware and patch update mechanism ensures known vulnerabilities are remediated promptly and integrity-verified, which is essential for long-lived IoT devices that cannot rely on manual updates. Option A is not a hardening practice: shared static SSH keys and root auto-login destroy accountability and enable lateral movement, whereas best practice is unique per-device keys, disabled root SSH login, and key-based authentication with passphrases. Option E is not a hardening practice: disabling local logging and audit daemons removes the forensic and detection capability needed to identify intrusions and is not an acceptable trade-off for marginal CPU savings.

Answer

Configuring all system accounts with shared static SSH keys and root auto-login

Answer

Disabling local logging and audit daemons to maximize CPU performance

Question 2

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

Accepted Answer

Stateful session synchronization (State Sync / HA heartbeat link). Stateful session synchronization replicates the connection state table between the active and standby firewalls over the HA heartbeat/sync link, so that when failover occurs the standby already knows about every established TCP session. This preserves sequence numbers, session timers, and NAT translations, allowing existing sessions to continue without forcing users to re-authenticate. VRRP handles the virtual IP failover, but it does not carry session state — that is the job of state sync.

Answer

Network Address Translation (NAT) pool overloading

Answer

Asymmetric routing bypass mode

Answer

Dynamic DNS update propagation

Question 3

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

Accepted Answer

Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation. A WIPS with triangulation uses multiple sensors to measure signal strength (RSSI) from a detected rogue AP and calculates its physical location by comparing readings across sensors. This is the only listed technique that both detects the rogue AP and locates its physical source, which is required to remove it. WIPS also correlates BSSIDs, SSIDs, and behavior to distinguish true rogues from neighboring APs.

Answer

Running regular traceroute commands from endpoints

Answer

Enabling port security on enterprise access layer switches

Answer

Configuring static ARP entries on enterprise switches

Question 4

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Accepted Answer

Multi-Factor Authentication (MFA) for all authentication attempts. Option B is correct because Multi-Factor Authentication (MFA) ensures that even if a remote employee's password is compromised, an attacker cannot authenticate to internal corporate resources without the additional factor, directly mitigating credential-theft and phishing risks inherent to home environments. Option E is correct because an encrypted VPN tunnel using IPsec or TLS provides confidentiality and integrity for data in transit between the remote endpoint and the corporate network, preventing eavesdropping or tampering on untrusted home or public networks. Options A, C, and D are incorrect: disabling endpoint firewall protection weakens host defenses and exposes the device to inbound attacks, sharing credentials with family members violates least-privilege and non-repudiation principles, and connecting directly over unencrypted public Wi-Fi without tunneling exposes all traffic to interception and man-in-the-middle attacks.

Answer

Disabling endpoint firewall protection to improve home network gaming performance

Answer

Sharing corporate laptop credentials with family members for household convenience

Answer

Connecting directly via unencrypted public Wi-Fi without any protective tunneling

Question 5

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

Accepted Answer

find / -perm -4000 -type f 2>/dev/null. The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Answer

find / -attr +s -type d

Answer

locate -i suid_binaries

Answer

chmod -R 755 /

Question 6

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Accepted Answer

Set the 'HttpOnly' and 'Secure' attributes on all session cookies.. The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Answer

Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

Answer

Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

Answer

Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

Question 7

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

Accepted Answer

sha256sum evidence.raw. The sha256sum command computes a SHA-256 cryptographic hash of the specified file, producing a unique fixed-length digest that serves as a digital fingerprint. Any modification to the evidence file—even a single bit flip—will produce a completely different hash value, allowing an analyst to later re-hash the file and compare digests to prove integrity. SHA-256 is collision-resistant and widely accepted in forensic and legal contexts as a standard for evidence authentication. Unlike MD5 or SHA-1, it has no known practical collision attacks, making it suitable for cryptographic proof.

Answer

dd if=/dev/sdb of=/evidence.raw --hash=md5

Answer

ftk_imager --verify --md5 evidence.raw

Answer

volatility -f evidence.raw --hash

Question 8

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Accepted Answer

Amazon VPC Security Groups acting as stateful virtual firewall instances. Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets. Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Answer

Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

Answer

AWS Shield Standard for intra-VPC subnet routing

Question 9

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Accepted Answer

Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results. Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft. Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Answer

Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts

Answer

Granting db_owner permissions to all public database roles by default

Question 10

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Accepted Answer

Inline placement directly in the path of network traffic flow to allow active packet dropping.. Option A is correct because a NIPS is typically deployed inline, sitting directly in the traffic path so it can actively drop or block malicious packets in real time rather than merely alerting. Option E is correct because many NIPS platforms can terminate or disrupt an in-progress attack by injecting TCP RST packets to reset the offending connection, which is an active prevention capability. Options B and D describe passive, detection-only behavior characteristic of a NIDS (e.g., SPAN port/TAP monitoring or syslog alerting without affecting traffic), so they do not represent prevention. Option C is incorrect because a NIPS must inspect Layer 3 and Layer 4 headers (and often higher layers) to identify and block malicious traffic, so operating as a pure Layer 2 bridge without inspection is not a NIPS feature.

Answer

Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

Answer

Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

Answer

Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.