20+ practice questions focused on Application And Data Protection — one of the most tested topics on the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Application And Data Protection PracticeA security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?
Explanation: To send CSP and X-Frame-Options headers, Apache must load mod_headers and then use the Header directive to set them. Header set X-Frame-Options 'DENY' prevents clickjacking by disallowing framing, and Header set Content-Security-Policy "default-src 'self'" restricts resource loading to the same origin, mitigating XSS. This is the correct directive combination for Apache 2.4.
A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?
Explanation: TLS 1.3 removed the ability to negotiate arbitrary cipher suites via ssl_ciphers; the protocol mandates a fixed set of five AEAD cipher suites (e.g., TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256) that all provide forward secrecy. Configuring ssl_protocols TLSv1.3 and letting the protocol's built-in suites apply is the correct approach. Specifying legacy ssl_ciphers strings has no effect on TLS 1.3 handshakes.
An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?
Explanation: In Oracle Database 19c, column-level TDE encryption is declared inline in the CREATE TABLE statement using the ENCRYPT USING '<algorithm>' clause. The correct syntax is `CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');`, which encrypts the SSN column with AES-256 using the TDE master key stored in the wallet. No IDENTIFIED BY clause is required for TDE column encryption because key management is handled by the Oracle Wallet, not a per-column password.
A security analyst is investigating a web application vulnerability and identifies that user input is reflected directly inside a JavaScript block without adequate sanitization, leading to execution in the victim's browser. What specific type of vulnerability is present?
Explanation: DOM-based XSS occurs when client-side JavaScript reads attacker-controllable data (such as location.hash or document.URL) and writes it into a dangerous sink like innerHTML or eval() without sanitization, causing execution entirely in the browser. The server never sees the payload, so server-side filtering cannot prevent it. The scenario describes input reflected into a JavaScript block and executing in the victim's browser via client-side processing, which is the defining characteristic of DOM XSS.
A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?
Explanation: The allowLinking attribute or docBase security restrictions in Tomcat control whether symbolic links outside the web app base can be followed. Additionally, the privileged context setting manages administrative access.
+15 more Application And Data Protection questions available
Practice all Application And Data Protection questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Application And Data Protection. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Application And Data Protection questions on the CND frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Application And Data Protection is tested as part of the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) blueprint. Practicing with targeted Application And Data Protection questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CND practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Application And Data Protection is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Application And Data Protection practice session with instant scoring and detailed explanations.
Start Application And Data Protection Practice →