20+ practice questions focused on Endpoint Protection — one of the most tested topics on the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Endpoint Protection PracticeAn Incident Responder analyzing a compromised Linux server suspects a rootkit has modified system binaries. The responder runs the package manager verification command on Debian/Ubuntu to check installed packages against the package database. Which command is appropriate?
Explanation: On Debian/Ubuntu systems, dpkg is the low-level package manager and maintains a database of installed packages including MD5 checksums of every file. Running 'dpkg --verify' (or '-V') compares the current on-disk files against the recorded checksums and metadata, revealing binaries modified by a rootkit. This is the native Debian equivalent of RPM's verification capability.
A security engineer is configuring mobile device management (MDM) for corporate-owned iOS devices. To prevent users from installing unauthorized apps while still allowing access to enterprise applications, which feature should be deployed?
Explanation: Volume Purchase Program (VPP) with Managed Distribution lets organizations purchase and assign apps to supervised devices via MDM without requiring an Apple ID, and combined with MDM restrictions it prevents users from installing unauthorized apps from the App Store. This satisfies both requirements: blocking unauthorized installs while still delivering approved enterprise applications. VPP Managed Distribution is the standard Apple mechanism for corporate app deployment on supervised iOS devices.
An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?
Explanation: The aa-complain command is used to put a specific AppArmor profile into complain mode, which logs violations instead of blocking them.
A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?
Explanation: Monitoring sensitive files like /etc/passwd and /etc/shadow requires adding watch rules using the -w flag with write permissions (-p w).
An administrator needs to harden an IoT gateway running Linux by disabling core dumps globally to prevent sensitive application memory from being written to disk if a process crashes. Which configuration should be applied?
Explanation: Core dumps are disabled globally by configuring limits in /etc/security/limits.conf or via systemd's coredump.conf.
+15 more Endpoint Protection questions available
Practice all Endpoint Protection questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Endpoint Protection. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Endpoint Protection questions on the CND frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Endpoint Protection is tested as part of the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) blueprint. Practicing with targeted Endpoint Protection questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CND practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Endpoint Protection is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Endpoint Protection practice session with instant scoring and detailed explanations.
Start Endpoint Protection Practice →