CND Timed Practice Test 2 — 10 Questions

Question 1

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Accepted Answer

Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges. PostgreSQL hardening includes configuring pg_hba.conf for strict IP/authentication, enabling SSL/TLS in postgresql.conf, and managing superuser access properly.

Answer

Set superuser password to null and allow trust authentication for all interfaces

Answer

Disable all logging in postgresql.conf to maximize query execution performance

Question 2

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Accepted Answer

Data in transit across network gateways (Network DLP). Comprehensive DLP solutions cover data in transit (network), data at rest (storage/databases), and data in use (endpoints).

Answer

Data routed through internal Bluetooth beacon devices

Answer

Data processed inside physical server CPU cache registers only

Answer

Data transmitted over analog telephone modem lines

Question 3

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Accepted Answer

xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml. In Elasticsearch Security (formerly X-Pack), setting xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true enforces node-to-node and client-to-cluster TLS encryption and authentication.

Answer

http.cors.enabled: true and http.cors.allow-origin: "*"

Answer

cluster.routing.allocation.enable: all and network.host: 0.0.0.0

Answer

discovery.type: single-node without password configuration

Question 4

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Accepted Answer

Istio with Envoy sidecar proxies enforcing automatic mTLS. Istio (or Linkerd) is a service mesh that injects sidecar proxies (like Envoy) to automatically handle mutual TLS (mTLS) between Kubernetes pods.

Answer

Kubernetes Ingress Controller with basic HTTP routing

Answer

Docker Swarm overlay networking with IPsec tunneling

Answer

Apache ZooKeeper configuration management service

Question 5

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

Accepted Answer

Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches. Applying the latest cumulative updates (CUs) and security patches provided by Microsoft Exchange team is critical because Exchange vulnerabilities like ProxyLogon and ProxyShell stem from unpatched Exchange web services.

Answer

Configuring an IIS URL Rewrite rule to block GET requests

Answer

Disabling Outlook Web Access (OWA) entirely for all users

Answer

Enabling Basic Authentication across all virtual directories

Question 6

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Accepted Answer

TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data. TDE protects data at rest on disk and backup files, but does not protect data in transit or data accessed in memory while the database is running.

Answer

TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

Answer

TDE eliminates the need for database user access controls and role-based permissions

Question 7

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

Accepted Answer

Microsoft Entra Conditional Access policies combined with Azure VPN Gateway. Microsoft Entra Conditional Access evaluates signals like user risk, device compliance, and location to enforce access controls before granting access to applications.

Answer

Classic RADIUS authentication server on an Azure VM

Answer

Azure Network Security Groups with IP source restrictions

Answer

Azure Application Gateway with cookie-based affinity

Question 8

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Accepted Answer

Executing remote lock and remote wipe commands for lost or stolen devices. MDM solutions enforce device encryption requirements and remote wipe/lock capabilities.

Answer

Allowing unrestricted installation of custom untrusted firmware packages

Answer

Disabling all over-the-air communication channels permanently

Answer

Removing all screen lock passcode requirements

Question 9

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Accepted Answer

Enforcing SELinux in targeted or multi-category security (MLS) mode. Mandatory Access Control frameworks like SELinux and AppArmor, combined with proper kernel parameter tuning (sysctl), enforce least privilege.

Answer

Setting all user home directory permissions to world-writable (chmod 777)

Answer

Disabling all audit logging and accounting daemons

Question 10

An administrator needs to harden an IoT gateway running Linux by disabling core dumps globally to prevent sensitive application memory from being written to disk if a process crashes. Which configuration should be applied?

Accepted Answer

Setting ProcessCoreDump=false in /etc/systemd/coredump.conf. Core dumps are disabled globally by configuring limits in /etc/security/limits.conf or via systemd's coredump.conf.

Answer

Running chmod 000 /bin/sh

Answer

Editing /etc/fstab to mount /tmp as read-only

Answer

Modifying /etc/resolv.conf to block DNS queries