CND Timed Practice Test 1 — 10 Questions

Question 1

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

Accepted Answer

-w /etc/passwd -p wa -k identity. Monitoring sensitive files like /etc/passwd and /etc/shadow requires adding watch rules using the -w flag with write permissions (-p w).

Answer

-a always,exclude -F path=/etc/passwd

Answer

sysctl -w kernel.audit=1

Answer

-e 0

Question 2

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

Accepted Answer

Digital Guardian Endpoint Agent with Web Inspection / Browser Control module. Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Answer

Digital Guardian Discovery Server

Answer

Digital Guardian Network Sensor

Answer

Digital Guardian Cloud Analytics Engine (CAE)

Question 3

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Accepted Answer

mod_security (Web Application Firewall engine). mod_headers (for security headers like HSTS and CSP) and mod_security (Web Application Firewall engine) enhance Apache security.

Answer

KeepAlive On and KeepAliveTimeout 5

Answer

DirectoryIndex index.php index.html

Answer

Listen 80 without SSLVirtualHost configuration

Question 4

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

Accepted Answer

sudo cryptsetup luksFormat /dev/sdb1. The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Answer

sudo fdisk /dev/sdb1 --encrypt

Answer

sudo mkfs.ext4 -e encrypted /dev/sdb1

Answer

sudo mount -o encrypt /dev/sdb1 /mnt/secure

Question 5

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

Accepted Answer

aa-complain /usr/sbin/daemon. The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.

Answer

aa-enforce -r /etc/apparmor.d/usr.sbin.daemon

Answer

systemctl set-mode apparmor=complain

Answer

apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon

Question 6

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

Accepted Answer

Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED). Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Answer

Run sp_configure 'enforce network encryption', 1; on the master instance

Answer

Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves

Answer

Enable Transparent Data Encryption (TDE) on the primary replica database

Question 7

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

Accepted Answer

Set allowLinking="false" in the Context element of server.xml. The allowLinking attribute or docBase security restrictions in Tomcat control whether symbolic links outside the web app base can be followed. Additionally, the privileged context setting manages administrative access.

Answer

Set crossContext="true" in the Host configuration

Answer

Set debug="9" and swallowOutput="false"

Answer

Configure Enterprise Security Manager (ESM) connector bindings

Question 8

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

Accepted Answer

Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Answer

Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings

Answer

Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services

Answer

User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker

Question 9

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Accepted Answer

Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files. Storage discovery DLP tools scan repositories like file shares, databases, and cloud storage for sensitive unencrypted data at rest.

Answer

Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

Answer

Intercepting local USB thumb drive file copy operations inline on endpoints

Question 10

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Accepted Answer

Running the WSUS Server Cleanup Wizard periodically. WSUS maintenance requires declining superseded updates and running the Server Cleanup Wizard to optimize performance.

Answer

Configuring WSUS to automatically install all pre-release beta patches on domain controllers

Answer

Manually editing the WSUS SQL database tables directly without backups

Answer

Disabling transport layer security (TLS) for client communication to speed up scans