Courseiva

EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 1–75

311 questions total · 5 pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 5

Page 2
1
Multi-Selectmedium

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

Select 2 answers
A.Optical Network Tap (Test Access Point)
B.Inline active blocking mechanism that terminates malicious TCP sessions directly
C.Directly modifying the TCP/IP stack of external client operating systems
D.Switch Port Analyzer (SPAN) or Mirror Port
E.Using DHCP broadcast packets to rewrite routing tables
AnswersA, D

An optical network tap sits inline on a fibre link and splits the signal, sending a copy to the NIDS while traffic passes through uninterrupted. It captures full-duplex traffic passively, satisfying the collection requirement without introducing a forwarding device.

Why this answer

Option A (Optical Network Tap, or Test Access Point) is correct because a passive optical tap splits the light signal so a copy of the traffic is sent to the NIDS while the original traffic continues uninterrupted, which is a standard out-of-band collection method. Option D (Switch Port Analyzer, or SPAN/Mirror Port) is correct because SPAN copies frames from one or more switch ports or VLANs to a monitoring port where the NIDS sensor is connected, making it a common way to collect traffic for analysis. Option B is not a collection method but an inline active blocking mechanism, which describes IPS functionality rather than NIDS traffic capture.

Option C is incorrect because modifying external client TCP/IP stacks is not a deployment mode for collecting traffic and would be an endpoint-based approach, not a NIDS collection method. Option E is incorrect because DHCP broadcasts are used for address assignment, not for rewriting routing tables to collect traffic for a NIDS.

Exam trap

The trap is confusing NIDS (passive detection) with IPS (active prevention) — option B describes IPS functionality, and candidates who don't distinguish between the two may select it as a valid 'deployment method.'

Full explanation →
2
MCQmedium

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

A.Scanning internal subnets for unpatched EternalBlue vulnerabilities
B.Querying authentication logs for service accounts logging in interactively via remote desktop
C.Searching endpoint logs for known ransomware string signatures
D.Checking firewall rules for outbound traffic on port 443
AnswerB

T1078 abuse involves legitimate credentials, so detection hinges on anomalous authentication behaviour. Service accounts logging in interactively via RDP violate their non-interactive design, producing a high-fidelity signal that aligns directly with the technique's credential-misuse pattern.

Why this answer

MITRE ATT&CK T1078 (Valid Accounts) describes adversaries using legitimate credentials to authenticate, so the best hunting methodology is to look for anomalous authentication behavior — such as service accounts logging in interactively via RDP, which violates normal service-account usage patterns. Querying authentication logs for that behavior directly aligns with detecting misuse of valid accounts, making B correct.

Exam trap

CND often tests whether candidates confuse vulnerability scanning or signature detection with threat hunting, so the trap is selecting a technical scan (EternalBlue) instead of an authentication-log behavioral query that matches the T1078 technique.

How to eliminate wrong answers

Option A is wrong because scanning for EternalBlue (MS17-010) vulnerabilities relates to exploitation of a specific SMB vulnerability (T1210/T1190), not to abuse of valid accounts. Option C is wrong because searching for ransomware string signatures is signature-based detection of malware artifacts, not hunting for credential misuse. Option D is wrong because checking firewall rules for outbound port 443 is a network-perimeter review and does not address authentication anomalies associated with T1078.

Full explanation →
3
Multi-Selectmedium

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

Select 2 answers
A.Disable all code signing requirements for internal and external software builds.
B.Maintain a comprehensive Software Bill of Materials (SBOM) and perform automated Software Composition Analysis (SCA) for third-party libraries.
C.Grant third-party vendor support accounts permanent, unmonitored Domain Administrator privileges.
D.Rely entirely on vendor self-assessments without conducting independent code audits or penetration testing.
E.Enforce strict vendor access controls, multi-factor authentication (MFA), and just-in-time (JIT) privileged access management.
AnswersB, E

An SBOM inventories every third-party component, while automated SCA continuously detects known vulnerabilities in those dependencies, directly countering supply chain attacks. This satisfies the stem's requirement to harden against compromised third-party software dependencies and vendor integrations.

Why this answer

Option B is correct because maintaining a comprehensive Software Bill of Materials (SBOM) gives the organization visibility into every third-party component and transitive dependency in its software, while automated Software Composition Analysis (SCA) continuously detects known vulnerabilities (CVEs) and license risks in those libraries, directly countering supply chain attacks that hide in dependencies. Option E is correct because strict vendor access controls combined with multi-factor authentication (MFA) and just-in-time (JIT) privileged access management ensure that third-party support accounts receive only time-bound, least-privilege access that is monitored and revoked after use, preventing attackers from abusing persistent vendor credentials to pivot into the environment. Option A is wrong because disabling code signing removes integrity verification of builds and enables tampered or malicious artifacts to run undetected.

Option C is wrong because granting permanent, unmonitored Domain Administrator rights to vendors creates an uncontrolled privileged backdoor and violates least privilege. Option D is wrong because relying solely on vendor self-assessments provides no independent verification and leaves supply chain risks unaudited.

Exam trap

CND often tests the misconception that vendor trust or self-attestation is sufficient for supply chain security, luring candidates toward options that grant broad vendor privileges or skip independent verification instead of combining SBOM/SCA with strict vendor access controls.

Full explanation →
4
MCQmedium

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

A.The proxy's custom Root CA certificate installed into the workstations' Trusted Root Certification Authorities store
B.The public keys of every external website visited by users
C.An expired SSLv2 certificate bundle
D.Self-signed SSH host keys generated on the Squid proxy
AnswerA

SSL interception requires the proxy to re-sign traffic with its own certificate, so clients must trust that issuing CA. Installing the proxy's custom Root CA into the Trusted Root Certification Authorities store lets workstations accept the forged certificates without warnings.

Why this answer

For SSL interception, the Squid proxy generates a forged certificate for each HTTPS site on the fly, signed by its own internal Root CA. For clients to trust these forged certificates without warnings, the proxy's Root CA certificate must be installed in each workstation's Trusted Root Certification Authorities store. This establishes a chain of trust so browsers accept the intercepted TLS sessions transparently.

Exam trap

The trap is thinking the proxy's server certificate or the destination site's public key must be installed, when in fact the trust anchor (Root CA) that signs the dynamically generated leaf certificates is what clients must trust.

How to eliminate wrong answers

Option B is wrong because installing every external website's public key is impractical and technically meaningless — public keys are already presented during the TLS handshake and are not what clients need to trust the proxy. Option C is wrong because SSLv2 is deprecated and insecure, and an expired certificate bundle would cause trust failures rather than enable interception. Option D is wrong because SSH host keys are used for SSH server authentication, not for TLS/HTTPS interception, and are unrelated to the X.509 trust model browsers use.

Full explanation →
5
Multi-Selecteasy

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

Select 2 answers
A.Network switch spanning-tree root bridge priority metrics
B.Endpoint local service status confirming antivirus daemon/service execution and recent scan logs
C.DNS root hint server IP address tables
D.Centralized EDR management console dashboard reporting active agent health and signature update status
E.BGP router autonomous system number (ASN) peering configurations
AnswersB, D

Local service status confirms the antivirus daemon is actually running, and recent scan logs evidence that detection and remediation executed on that endpoint. This provides per-workstation proof of agent function, complementing the fleet-wide view from the management console.

Why this answer

Option B is correct because checking the endpoint's local service status verifies that the antivirus daemon/service is actually running, and reviewing recent scan logs confirms the agent is performing its scanning function rather than merely being installed. Option D is correct because a centralized EDR management console dashboard aggregates agent health telemetry and signature update status across all workstations, which is the most efficient way to confirm fleet-wide functionality and compliance. Option A is incorrect because spanning-tree root bridge priority is a Layer 2 switching parameter unrelated to endpoint security agents.

Option C is incorrect because DNS root hint tables only affect name resolution and reveal nothing about antivirus or EDR operation. Option E is incorrect because BGP ASN peering configurations concern internet routing between autonomous systems, not endpoint protection status.

Exam trap

The trap is selecting network-centric artifacts (STP, DNS, BGP) that sound technical but are irrelevant to endpoint agent health; candidates must focus on host-level service state and centralized management console reporting.

Full explanation →
6
MCQhard

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

A.nftables create filter-table --default-drop
B.iptables -P INPUT DROP
C.nft add table inet filter; nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
D.ufw default deny incoming
AnswerC

This sequence creates an inet family filter table, then adds a base chain bound to the input hook with priority 0 and a drop policy, matching the required table, hook and default-drop configuration in one correct syntax.

Why this answer

The correct nftables command sequence creates a table named 'filter' in the inet family, adds a base chain named 'input' with type filter, hook input, priority 0, and policy drop. This sets up packet filtering with a default drop policy for incoming traffic.

Exam trap

CND often tests the confusion between nftables and iptables/ufw syntax, leading candidates to pick iptables or ufw commands when nftables is explicitly required.

How to eliminate wrong answers

Option A is wrong because 'nftables' is not a valid command; the correct command is 'nft', and the syntax 'create filter-table --default-drop' is invalid. Option B is wrong because 'iptables -P INPUT DROP' sets the default policy for the iptables INPUT chain, not nftables, and does not create a table or base chain. Option D is wrong because 'ufw default deny incoming' configures the Uncomplicated Firewall, a frontend for iptables, not nftables directly.

Full explanation →
7
Multi-Selecthard

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

Select 2 answers
A.Formulating a threat hypothesis based on recent adversary tactics, techniques, and procedures (TTPs)
B.Relying entirely on out-of-the-box SIEM correlation alerts for immediate notification
C.Configuring automated firewall rule drops for known malicious IP feeds
D.Conducting iterative, hypothesis-driven data queries and artifact analysis to uncover undetected threats
E.Executing routine scheduled vulnerability scans against external perimeter assets
AnswersA, D

Formulating a hypothesis from recent adversary TTPs gives hunting its proactive direction, focusing investigation on plausible attacker behaviour rather than waiting for automated alerts. This satisfies the stem's requirement for a core, proactive threat hunting methodology component.

Why this answer

Option A is correct because mature threat hunting begins with a hypothesis derived from current adversary TTPs (e.g., MITRE ATT&CK techniques), which directs hunters toward plausible, high-value threats rather than waiting for alerts. Option D is correct because hunting is an iterative, hypothesis-driven process of querying telemetry (SIEM, EDR, network data) and analyzing artifacts to surface threats that automated detection missed. These two activities are proactive and analyst-led, distinguishing them from reactive alert handling.

Option B is not correct because out-of-the-box SIEM correlation alerts are automated, reactive detection rather than proactive hunting. Option C is not correct because automated firewall drops based on malicious IP feeds are preventive, signature-based controls, not hunting. Option E is not correct because scheduled vulnerability scans are routine, automated assessment activities, not hypothesis-driven threat hunting.

Exam trap

CND often tests the distinction between proactive hunting and reactive detection/prevention — the trap is selecting automated alerting or vulnerability scanning because they sound security-related, when the question specifically asks for hypothesis-driven hunting activities.

Full explanation →
8
MCQhard

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

A.Microsoft-Windows-PowerShell/Operational, Event ID 4104
B.Security log, Event ID 4688
C.System log, Event ID 7045
D.Microsoft-Windows-PowerShell/Operational, Event ID 4103
AnswerA

Microsoft-Windows-PowerShell/Operational with Event ID 4104 records script block text when logging captures executed code, including de-obfuscated content, satisfying the requirement to inspect full LotLBin script blocks. Event ID 4103 only logs pipeline execution details, not the complete block text, so 4104 is the precise channel and ID.

Why this answer

PowerShell script block logging writes events to the Microsoft-Windows-PowerShell/Operational log with Event ID 4104, containing the full text of executed script blocks. This is the primary source for inspecting PowerShell code executed on a Windows system, including obfuscated or malicious scripts.

Exam trap

CND often tests the confusion between Event ID 4104 (script block logging) and 4103 (module logging), or between PowerShell operational logs and Security 4688 process creation events.

How to eliminate wrong answers

Option B is wrong because Security log Event ID 4688 logs process creation, including the command line, but not the full script block content executed by PowerShell. Option C is wrong because System log Event ID 7045 logs service installation, unrelated to PowerShell script block logging. Option D is wrong because Event ID 4103 logs module logging and pipeline execution details, which is less complete than 4104 for full script block text; 4104 is the specific event for script block logging.

Full explanation →
9
MCQeasy

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A.Unmanaged Layer 2 Switch
B.Patch Panel
C.Stateful Inspection Firewall
D.Hub
AnswerC

A stateful inspection firewall tracks connection state in a session table, examining Layer 3 addresses and Layer 4 ports to permit return traffic dynamically. Stateless packet filters and Layer 2 switches cannot make forwarding decisions based on established connection states.

Why this answer

A Stateful Inspection Firewall operates at Layer 3 (network) and Layer 4 (transport) to inspect packet headers and maintain a state table of established connections. It makes dynamic forwarding decisions based on the context of the traffic — for example, allowing return traffic for an outbound session without an explicit rule. This stateful behavior distinguishes it from stateless packet filters.

Exam trap

CND often tests the confusion between stateless packet filtering and stateful inspection, causing candidates to select a packet filtering firewall or a Layer 2 switch when the question emphasizes dynamic decisions based on connection states.

How to eliminate wrong answers

Option A is wrong because an unmanaged Layer 2 switch operates at Layer 2 (data link) and forwards frames based on MAC addresses, with no Layer 3/4 inspection or state tracking. Option B is wrong because a patch panel is a passive physical cabling device that does not inspect or forward packets at any layer. Option D is wrong because a hub is a Layer 1 device that broadcasts all traffic to all ports without any inspection or stateful decision-making.

Full explanation →
10
MCQmedium

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

A.HTTP Compression Schema module
B.IIS Request Filtering with rules to deny double-encoding and path traversal sequences ('..')
C.IP Address and Domain Restrictions module
D.Windows Authentication Provider with Kerberos constraints
AnswerB

Request Filtering inspects decoded URL sequences, so it catches '%2e%2e%2f' traversal attempts that IIS would otherwise normalise into '../' and serve. Denying double-encoded and dot-dot sequences blocks these requests before they reach the application, satisfying the requirement to automatically block path traversal.

Why this answer

IIS Request Filtering is the built-in module that inspects incoming requests and can deny URL sequences, double-encoded characters, and path traversal patterns like '..'. Configuring it to reject double-encoded sequences ('%2e%2e%2f') and traversal strings blocks the attack at the web server layer before it reaches the application. This is the native IIS defense for path traversal and encoded URL attacks.

Exam trap

CND often tests the misconception that IP restrictions or authentication modules block path traversal — candidates must know that only Request Filtering inspects and rejects malicious URL sequences.

How to eliminate wrong answers

Option A is wrong because the HTTP Compression Schema module handles response compression (gzip/deflate) and has no request-inspection or blocking capability. Option C is wrong because IP Address and Domain Restrictions only allow/deny based on source IP or hostname — it cannot detect encoded path traversal in the URL. Option D is wrong because Windows Authentication with Kerberos constraints governs identity and authentication, not URL payload inspection, so it would not block traversal attempts.

Full explanation →
11
MCQmedium

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

A.Upgrade the web server operating system and apply all vendor-supplied kernel patches.
B.Implement a traditional Layer 3 network firewall rule to block all outbound TCP traffic on port 80.
C.Install a host-based intrusion detection system (HIDS) to monitor web application log directories.
D.Enforce Instance Metadata Service Version 2 (IMDSv2) requiring session tokens and configure strict URL parsing libraries on the web application.
AnswerD

IMDSv2 mitigates SSRF by requiring a PUT request to obtain a session token before any metadata query, which attacker-controlled URL parameters cannot supply. Combined with strict URL parsing libraries that reject malformed or redirecting inputs, this directly satisfies the stem's constraint: preventing SSRF exploitation against the instance metadata service.

Why this answer

Option D is correct because IMDSv2 requires a session token obtained via a PUT request before metadata can be retrieved, which defeats most SSRF attacks that can only issue simple GET requests. Combining IMDSv2 with strict URL parsing and allow-listing on the web application prevents attackers from crafting requests to 169.254.169.254, addressing both the architectural and application-layer causes.

Exam trap

CND often tests whether candidates pick generic network or host controls (firewall rules, patching, HIDS) for SSRF remediation, when the correct fix is enforcing IMDSv2 and hardening the application's URL handling.

How to eliminate wrong answers

Option A is wrong because OS and kernel patching does not remediate SSRF, which is an application-layer vulnerability — the attacker abuses legitimate server functionality, not an OS flaw. Option B is wrong because blocking outbound port 80 does not stop SSRF to the metadata service, which listens on 169.254.169.254 over HTTP (port 80) but is reachable internally; a blanket block would also break legitimate traffic and is not targeted at the root cause. Option C is wrong because a HIDS monitoring log directories is detective, not preventive, and does nothing to stop SSRF exploitation against IMDS.

Full explanation →
12
Multi-Selectmedium

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

Select 3 answers
A.NetFlow and IPFIX traffic flow records
B.Master File Table ($MFT) filesystem journals
C.Full Packet Capture (PCAP) files from network taps
D.DNS query and response logs collected at the recursive resolver
E.Windows Security Event Logs (Event ID 4624)
AnswersA, C, D

NetFlow and IPFIX export flow metadata from routers and switches, capturing source, destination, port and byte counts without inspecting endpoint internals. This makes them network-based telemetry, unlike host artefacts such as process logs or file system records.

Why this answer

Network-based telemetry is data collected from the network fabric rather than from an endpoint's operating system. Option A (NetFlow and IPFIX traffic flow records) is correct because these are flow-export protocols generated by routers, switches, and firewalls that summarize IP conversations (5-tuple, byte/packet counts, timestamps) without touching host internals. Option C (Full Packet Capture (PCAP) files from network taps) is correct because PCAPs are captured at taps, SPAN ports, or inline sensors and contain raw packet payloads and headers traversing the wire.

Option D (DNS query and response logs collected at the recursive resolver) is correct because resolver logs record network name-resolution transactions (query name, type, client IP, response) observed on the network infrastructure, not on the endpoint. Option B (Master File Table ($MFT) filesystem journals) is host-based, as the $MFT is an NTFS metadata structure on a Windows volume, and Option E (Windows Security Event Logs, Event ID 4624) is host-based, since 4624 is a logon event written to the endpoint's Security log.

Exam trap

CND often tests the boundary between host-based and network-based telemetry; candidates must recognize that $MFT and Windows Event Logs are host artifacts, while flow records, PCAP, and DNS resolver logs are network-derived.

Full explanation →
13
MCQeasy

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

A.Intrusion Prevention System
B.Stateful Inspection Firewall
C.Proxy Server
D.Honeypot
AnswerD

A honeypot is a deliberately vulnerable decoy host that attracts attackers away from production systems while logging their tools, techniques and procedures. This matches the stem's requirement for a perimeter decoy loaded with vulnerabilities to gather telemetry on adversary tactics.

Why this answer

A honeypot is a deliberately vulnerable decoy system deployed to attract attackers, divert them from production assets, and capture detailed telemetry about their tools, techniques, and procedures (TTPs). Because no legitimate traffic should ever reach a honeypot, any interaction with it is inherently suspicious and provides high-fidelity threat intelligence. This matches the engineer's stated goal of luring attackers and collecting data on their tactics.

Exam trap

The trap here is confusing honeypots with IPS or firewalls — candidates see 'perimeter defense' and pick an active blocking device, missing that the defining characteristic is deception and attacker observation, not prevention.

How to eliminate wrong answers

Option A is wrong because an Intrusion Prevention System is an inline security control that inspects traffic and blocks malicious packets, not a decoy designed to attract attackers. Option B is wrong because a stateful inspection firewall tracks connection state to permit or deny traffic based on policy, but it does not act as a lure or collect attacker TTPs. Option C is wrong because a proxy server brokers client requests to external resources for caching, filtering, or anonymity — it is not a deliberately vulnerable decoy system.

Full explanation →
14
Multi-Selecthard

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

Select 3 answers
A.Sysmon Event ID 10 (ProcessAccess) indicating access to lsass.exe by unverified tools
B.Regular scheduled defragmentation of the system volume by dfrgui.exe
C.Standard domain user successfully changing their own account password via Ctrl+Alt+Del
D.Unsigned or unknown binaries executing from temporary paths (e.g., C:\Users\Public) and opening handles to LSASS
E.Windows Security Event ID 4656 or 4663 showing handle requests to lsass.exe with PROCESS_VM_READ permissions
AnswersA, D, E

Sysmon Event ID 10 logs process access with the granted access mask, so lsass.exe being accessed by unverified tools reveals memory-read attempts against the credential store. This is the specific telemetry artefact indicating credential dumping rather than routine authentication activity.

Why this answer

Option A is correct because Sysmon Event ID 10 (ProcessAccess) specifically logs when a process opens a handle to another process, and access to lsass.exe by unverified or unusual tools is a classic credential-dumping indicator (e.g., Mimikatz or procdump). Option D is correct because unsigned or unknown binaries running from writable user paths like C:\Users\Public and then opening handles to LSASS combine two strong red flags: masquerading/execution from atypical locations plus direct LSASS access. Option E is correct because Windows Security Event IDs 4656/4663 record handle requests to objects, and a request to lsass.exe with PROCESS_VM_READ (0x0010) is exactly the permission needed to read LSASS memory for credential extraction.

Option B is not relevant because dfrgui.exe performing scheduled defragmentation is normal system maintenance and does not touch LSASS memory. Option C is not relevant because a standard user changing their own password via Ctrl+Alt+Del is a legitimate, expected activity that does not involve dumping LSASS credentials.

Exam trap

CND often tests the ability to distinguish normal system activities from malicious credential dumping indicators, and candidates may overlook that legitimate processes can also access LSASS, but the combination of unsigned binaries and specific access rights is key.

Full explanation →
15
MCQmedium

A SOC analyst reviewing perimeter firewall logs notices a high volume of inbound TCP SYN packets with randomized source IP addresses targeting multiple open ports on a public-facing web server, and the server's connection table is nearly exhausted. The organization wants to stop this activity at the network edge without blocking legitimate clients. Which solution should the analyst recommend?

A.Create an access control list that blocks all inbound traffic to the web server except from the organization's known customer IP ranges.
B.Enable port security on the switch port connected to the web server to limit the number of source MAC addresses.
C.Deploy a firewall feature that performs SYN proxy and rate limiting on inbound connections to the web server.
D.Enable SYN cookies on the web server and lower the TCP half-open connection timeout.
AnswerC

A SYN proxy on the firewall completes the TCP three-way handshake on behalf of the protected server, only forwarding connections that successfully finish the handshake, which defeats spoofed-source SYN floods. Combined with per-source rate limiting, legitimate clients still connect while randomized-source floods are absorbed at the perimeter, matching the requirement to mitigate at the network edge.

Why this answer

A SYN flood exhausts the server's half-open connection table using spoofed sources. Mitigating it at the network edge requires a device that validates the handshake before passing traffic to the server, which is exactly what a firewall SYN proxy does. Pairing that with rate limiting preserves service for legitimate clients while dropping spoofed connection attempts before they reach the web server.

Exam trap

The trap here is assuming host-side SYN cookies alone constitute edge mitigation, when the scenario requires stopping the flood before it reaches the server.

Full explanation →
16
Multi-Selectmedium

A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)

Select 2 answers
A.It establishes a baseline of normal network traffic patterns and detects deviations from that baseline.
B.It is highly effective at detecting previously unknown zero-day attacks that lack known signatures.
C.It relies on an up-to-date database of known malware signatures and explicit attack strings.
D.It guarantees zero false positive alerts in high-throughput enterprise network environments.
E.It requires manual updates from vendor threat intelligence feeds every time a new vulnerability is discovered.
AnswersA, B

Anomaly-based IPS detection builds a baseline of normal network traffic patterns, then flags deviations from that baseline as potential threats. This contrasts with signature-based detection, which matches known attack patterns rather than modelling normal behaviour.

Why this answer

Option A is correct because anomaly-based IPS detection works by first profiling legitimate traffic to build a statistical baseline of normal behavior, then flagging activity that deviates from that baseline as suspicious. Option B is correct because, since anomaly detection does not depend on pre-existing signatures, it can identify novel or zero-day attacks whose patterns have never been seen before. Option C is incorrect because relying on an up-to-date database of known malware signatures and attack strings describes signature-based detection, not anomaly-based detection.

Option D is incorrect because anomaly-based systems are actually prone to false positives, since legitimate but unusual traffic can deviate from the baseline, and no IPS guarantees zero false positives in high-throughput environments. Option E is incorrect because anomaly-based engines learn behavior dynamically and do not require vendor signature or threat-intelligence updates for every new vulnerability, which again describes signature-based systems.

Exam trap

CND often tests the signature-vs-anomaly trade-off, and the trap is picking the option claiming anomaly detection has no false positives or requires signature updates — both are signature-engine traits misattributed to anomaly engines.

Full explanation →
17
MCQmedium

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

A.Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall
B.Computer Configuration -> Preferences -> Control Panel Settings -> Network Options
C.Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties -> Outbound connections
D.Computer Configuration -> Policies -> Software Restriction Policies
AnswerC

Configuring the outbound default action to Block in the domain profile's Properties satisfies the requirement to deny all outbound traffic except explicitly permitted rules. This firewall-level default, applied via GPO to all targeted computers, enforces the deny-by-default posture before any allow rules are evaluated.

Why this answer

In Windows Defender Firewall with Advanced Security, the default outbound action (Allow or Block) is configured per profile under Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Defender Firewall with Advanced Security -> Properties, then selecting each profile (Domain, Private, Public) and setting the Outbound connections radio button to Block. This is the only location in GPO where the firewall's default outbound behaviour is defined; individual rules then explicitly permit traffic.

Exam trap

CND often tests whether candidates can distinguish Administrative Templates (which contain legacy firewall toggles) from Security Settings (which contain the actual WFAS profile configuration), so the trap is picking the Administrative Templates path because it also mentions 'Windows Defender Firewall'.

How to eliminate wrong answers

Option A is wrong because Administrative Templates -> Network -> Network Connections -> Windows Defender Firewall contains legacy policy toggles (like 'Prohibit use of Internet Connection Firewall') and does not expose the per-profile default outbound action. Option B is wrong because Preferences -> Control Panel Settings -> Network Options is for deploying legacy network configuration items, not firewall profile behaviour. Option D is wrong because Software Restriction Policies control which executables can run (AppLocker's predecessor), not network traffic direction.

Full explanation →
18
Multi-Selectmedium

An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)

Select 3 answers
A.Hot Standby Router Protocol (HSRP)
B.Gateway Load Balancing Protocol (GLBP)
C.Spanning Tree Protocol (STP) root guard
D.Dynamic Host Configuration Protocol (DHCP) snooping
E.Virtual Router Redundancy Protocol (VRRP)
AnswersA, B, E

HSRP lets a group of Cisco routers share a single virtual IP and MAC address, so a standby router assumes the default gateway role automatically if the active one fails. This directly removes the gateway as a single point of failure.

Why this answer

HSRP (A) is Cisco's first-hop redundancy protocol in which an active and standby router share a virtual IP and MAC address, allowing the standby to take over the default gateway role if the active fails, directly preventing a gateway single point of failure. GLBP (B) is Cisco's advanced FHRP that provides gateway redundancy while also load-balancing traffic across multiple gateways via a virtual IP and multiple virtual MAC addresses, so it both eliminates the single gateway failure and improves availability. VRRP (E) is the standards-based (RFC 5798) first-hop redundancy protocol where a master and backup routers share a virtual router IP/MAC, providing vendor-neutral gateway failover.

STP root guard (C) is a Layer 2 loop-prevention/root-bridge protection feature and does not provide default-gateway redundancy, and DHCP snooping (D) is a Layer 2 security feature that filters rogue DHCP servers and builds a binding table, unrelated to gateway failover.

Exam trap

CND often tests the difference between Layer 2 redundancy protocols (STP) and Layer 3 gateway redundancy protocols (HSRP, VRRP, GLBP), so candidates may incorrectly select STP-related options.

Full explanation →
19
MCQmedium

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

A.Configure a reverse proxy load balancer with IP hashing persistence algorithms.
B.Enable Unicast Reverse Path Forwarding (uRPF) on the network edge routing equipment.
C.Deploy a Web Application Firewall (WAF) configured with SQL injection signature rule sets and request anomaly scoring.
D.Implement a stateful network firewall configured with Layer 4 packet inspection rules.
AnswerC

A WAF terminates HTTP traffic and inspects parameters, headers and bodies against signature rule sets, matching union-based SQLi patterns. Anomaly scoring aggregates suspicious attributes, letting it block malicious requests before they reach the application, satisfying the requirement for dynamic inspection of HTTP parameters.

Why this answer

A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic at Layer 7, analyze parameters, and block SQL injection signatures using rule sets and anomaly scoring. It sits in front of the web application and can dynamically detect and mitigate SQLi attempts, including union-based queries.

Exam trap

The trap is confusing network-layer firewalls with application-layer WAFs, leading candidates to select a stateful firewall that cannot inspect HTTP payloads.

How to eliminate wrong answers

Option A is wrong because a reverse proxy load balancer with IP hashing only distributes traffic and does not inspect application-layer payloads for SQLi. Option B is wrong because uRPF is a network-layer anti-spoofing technique, not an application-layer defense. Option D is wrong because a stateful network firewall operates at Layer 4 and cannot inspect HTTP parameters for SQL injection patterns.

Full explanation →
20
MCQeasy

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

A.Transport Layer Security (TLS) version 1.3
B.Full Disk Encryption (such as BitLocker or FileVault)
C.Dynamic Host Configuration Protocol (DHCP) snooping
D.Intrusion Detection System (IDS) signature files
AnswerB

Full disk encryption protects data at rest by encrypting the entire volume, so files are unreadable if the laptop is lost or stolen. BitLocker and FileVault satisfy the policy requiring cryptographic protection of sensitive data on mobile endpoints.

Why this answer

Full Disk Encryption (FDE) technologies like BitLocker (Windows) and FileVault (macOS) encrypt the entire storage volume at rest, ensuring that if a laptop is lost or stolen, the data cannot be read without the decryption key. This directly satisfies the policy requirement that sensitive data at rest on laptops be cryptographically protected. FDE operates below the file system, protecting OS files, swap space, and user data uniformly.

Exam trap

The trap here is conflating 'data in transit' protections like TLS with 'data at rest' protections; candidates see 'cryptographically protected' and jump to TLS without checking the 'at rest on laptops' qualifier.

How to eliminate wrong answers

Option A is wrong because TLS 1.3 protects data in transit over the network, not data at rest on a laptop's disk. Option C is wrong because DHCP snooping is a Layer 2 switch security feature that prevents rogue DHCP servers and DHCP starvation attacks; it has nothing to do with encrypting stored data. Option D is wrong because IDS signature files are detection content used to identify malicious traffic patterns, not a mechanism for encrypting data at rest.

Full explanation →
21
MCQhard

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

A.As a core feature directly connected to Adversary and Victim
B.As a confidence value assigned to the intelligence report
C.As an external social-political requirement
D.As a meta-feature used exclusively for tracking timestamps
AnswerA

In the Diamond Model, Infrastructure is one of the four core features, positioned as a vertex connected by edges to Adversary and Victim, describing the physical or logical resources the adversary uses to deliver capabilities.

Why this answer

In the Diamond Model of Intrusion Analysis, Infrastructure is one of the four core features, alongside Adversary, Capability, and Victim. It represents the physical or logical resources used by the adversary, such as command-and-control servers, and is directly connected to both Adversary and Victim in the diamond. This classification is fundamental to the model.

Exam trap

The trap is mixing up core features with meta-features—candidates may incorrectly classify Infrastructure as a meta-feature or confidence value, but it is one of the four core vertices.

How to eliminate wrong answers

Option B is wrong because confidence values are meta-features (socio-political, technology, etc.) that describe the reliability of intelligence, not core features. Option C is wrong because external social-political requirements are meta-features, not core features like Infrastructure. Option D is wrong because timestamps are part of the meta-features (e.g., date/time), not a core feature, and Infrastructure is not a meta-feature.

Full explanation →
22
MCQeasy

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

A.On the internal network boundary between the Finance and Guest VLANs
B.At the perimeter boundary directly connected to the ISP modem
C.On the local loopback interface of each end-user workstation
D.Inside the ISP core routing infrastructure
AnswerA

Placing the device on the internal boundary between the Finance and Guest VLANs forces all inter-zone traffic through it, where ACLs can deny or permit flows. This satisfies the isolation requirement without relying on perimeter firewalls that never see internal east-west traffic.

Why this answer

To enforce ACLs between two internal zones (Finance and Guest), the security device must sit inline on the path between those VLANs — i.e., at the internal boundary where inter-VLAN routing occurs. Placing it there ensures all Finance-to-Guest traffic is inspected and controlled before it can traverse the internal network.

Exam trap

CND often tests the misconception that a perimeter firewall protects all internal traffic — candidates forget that east-west (inter-VLAN) traffic never reaches the perimeter and must be controlled by an internal segmentation device.

How to eliminate wrong answers

Option B is wrong because the ISP perimeter boundary only sees north-south traffic entering/leaving the organization; it cannot enforce policy on east-west traffic between two internal VLANs that never leaves the LAN. Option C is wrong because a loopback interface is a logical, host-local interface that never carries transit traffic, so a security device placed there would inspect nothing. Option D is wrong because the ISP core is outside the organization's administrative control and carries no customer-internal VLAN traffic, making policy enforcement there impossible.

Full explanation →
23
MCQmedium

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

A.DNS queries using TCP instead of UDP for large responses
B.Frequent DNS zone transfers (AXFR) from internal to external servers
C.Repeated DNS queries for the same domain with identical transaction IDs
D.High volume of DNS queries with long subdomain labels and high entropy
AnswerD

DNS tunneling encodes data in subdomains, producing queries with unusually long labels (often exceeding 50 characters) and high entropy due to base64 or hex encoding. Monitoring for these patterns, along with query volume to a single domain, is a reliable detection method. This directly addresses the scenario where data is exfiltrated via DNS.

Why this answer

DNS tunneling exfiltrates data by encoding it into DNS queries, often using long, high-entropy subdomains. Monitoring for such patterns, along with query volume and domain reputation, helps detect this activity. The other options describe less relevant or non-specific indicators that would not effectively identify DNS tunneling in this scenario.

Exam trap

The trap here is assuming that any DNS anomaly, such as TCP usage or repeated queries, indicates tunneling, when the key signature is long, high-entropy subdomains.

Full explanation →
24
Multi-Selecteasy

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

Select 2 answers
A.Plaintext Telnet protocol
B.Unencrypted HTTP protocol
C.Transport Layer Security (TLS v1.3)
D.Plaintext File Transfer Protocol (FTP)
E.Internet Protocol Security (IPsec) VPN
AnswersC, E

TLS v1.3 encrypts data in transit using authenticated key exchange and AEAD ciphers, providing confidentiality and integrity across public networks. It satisfies the requirement for a secure communication channel, and version 1.3 removes legacy algorithms such as RSA key transport and CBC modes, hardening the handshake against downgrade attacks.

Why this answer

Option C, Transport Layer Security (TLS v1.3), is correct because TLS provides authenticated, encrypted channels over untrusted networks using modern cipher suites and a handshake that negotiates ephemeral keys, ensuring confidentiality and integrity for protocols such as HTTPS. Option E, Internet Protocol Security (IPsec) VPN, is correct because IPsec operates at the network layer to encrypt and authenticate IP packets, commonly in tunnel mode for site-to-site or remote-access VPNs, protecting data in transit across public networks. The unmarked options do not belong: Telnet (A), HTTP (B), and FTP (D) are all plaintext protocols that transmit credentials and data without encryption, so they cannot provide secure communication channels.

Exam trap

CND often tests whether candidates confuse 'protocol that can be secured' with 'protocol that is secure by default' — Telnet, HTTP, and FTP all have secure variants (SSH, HTTPS, FTPS/SFTP) but the base protocols listed here are plaintext.

Full explanation →
25
MCQeasy

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

A.Windows User Account Control (UAC)
B.Windows Defender Firewall with Advanced Security
C.Windows BitLocker Drive Encryption
D.Windows Subsystem for Linux (WSL)
AnswerB

Windows Defender Firewall with Advanced Security supports rules scoped to application executables, not just IP addresses and ports, evaluating inbound and outbound connections per program. This satisfies the stem's requirement for executable-based host firewall filtering.

Why this answer

Windows Defender Firewall with Advanced Security supports application-based (program-based) rules in addition to port/protocol rules. Each rule can specify the executable path (e.g., C:\Program Files\App\app.exe), and the firewall evaluates inbound/outbound traffic against that program identity. This satisfies the requirement of filtering by application executable name rather than only IP/port.

Exam trap

The trap here is conflating 'host-based firewall' with any Windows security feature; candidates pick UAC or BitLocker because they sound security-related, missing that only Defender Firewall with Advanced Security does application-layer connection filtering.

How to eliminate wrong answers

Option A is wrong because UAC is a privilege-elevation and consent mechanism (admin approval mode), not a packet-filtering firewall — it has no concept of inbound/outbound connection rules. Option C is wrong because BitLocker is full-disk encryption (TPM/PIN-based) protecting data at rest; it does not inspect or filter network connections. Option D is wrong because WSL is a compatibility layer for running Linux binaries on Windows; it provides no host-based firewall capability by itself.

Full explanation →
26
MCQhard

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

A.Change request ticket numbers are generated automatically by software rather than handwritten logs.
B.Change request forms require the signature of the lead network architect rather than the CISO.
C.Firewall change tickets are archived in a digital repository for only 12 months instead of 3 years.
D.Network engineers implement emergency rule modifications directly in production without pre-testing or CAB approval.
AnswerD

Unapproved, untested emergency changes pushed straight to production bypass CAB review and validation, so a faulty firewall rule can immediately disrupt availability or open unintended access. This removes the safeguards that catch errors before they affect live traffic.

Why this answer

Implementing emergency firewall rule changes directly in production without pre-testing or CAB approval represents the highest risk because it bypasses change control, potentially introducing misconfigurations that can cause outages or security breaches. This deficiency directly threatens network availability and security posture by allowing untested changes.

Exam trap

CND often tests the difference between administrative weaknesses (like retention periods) and operational weaknesses that directly impact security, so candidates may choose the retention issue thinking it's a compliance risk, when the lack of change control is the critical risk.

How to eliminate wrong answers

Option A is wrong because automatic ticket number generation is actually a strength, improving traceability and reducing human error, not a deficiency. Option B is wrong because requiring the lead network architect's signature instead of the CISO's is a process variation, not a high-risk deficiency; both are qualified approvers. Option C is wrong because archiving tickets for 12 months instead of 3 years is a records retention issue that may affect audits but does not directly impact network availability or security in real-time.

Full explanation →
27
MCQeasy

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

A.AWS VPC Flow Logs
B.Amazon GuardDuty Kubernetes audit logs
C.AWS Trusted Advisor network optimization checks
D.AWS CloudTrail Management Events
AnswerA

VPC Flow Logs capture IP traffic metadata for elastic network interfaces, including source, destination, ports, and accept or reject decisions. Analysing these records reveals anomalous outbound connections from EC2 instances to unknown external addresses, satisfying the stem's traffic-flow analysis requirement.

Why this answer

AWS VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for network interfaces in a VPC, making them the correct feature to analyze outbound communication from EC2 instances to unknown external IPs. They can be published to CloudWatch Logs or S3 and queried with Athena for anomaly detection.

Exam trap

CND often tests the distinction between network-level telemetry (VPC Flow Logs) and API-level telemetry (CloudTrail), and candidates mistakenly pick CloudTrail thinking it captures all AWS activity including network traffic.

How to eliminate wrong answers

Option B is wrong because GuardDuty Kubernetes audit logs focus on EKS control plane activity (API calls, RBAC events), not VPC-level network flows. Option C is wrong because Trusted Advisor network optimization checks are cost/performance recommendations, not security traffic analysis. Option D is wrong because CloudTrail Management Events record AWS API calls (e.g., RunInstances, CreateUser), not network traffic flows between EC2 instances and external IPs.

Full explanation →
28
Multi-Selectmedium

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

Select 2 answers
A.Executing remote lock and remote wipe commands for lost or stolen devices
B.Allowing unrestricted installation of custom untrusted firmware packages
C.Enforcing device-wide encryption requirements
D.Disabling all over-the-air communication channels permanently
E.Removing all screen lock passcode requirements
AnswersA, C

Remote lock and wipe are core MDM enrolment actions, letting administrators secure lost or stolen tablets by forcing a lock or erasing corporate data over the air. This directly satisfies the scenario's lost-or-stolen device constraint, as MDM agents maintain a persistent management channel to issue these commands regardless of user action.

Why this answer

Option A is correct because MDM platforms universally support remote lock and remote wipe as core security actions, allowing administrators to secure or erase a lost or stolen tablet via push commands over the management channel. Option C is correct because MDM can enforce device-wide encryption requirements, such as mandating BitLocker, FileVault, or Android storage encryption, and can report or block devices that fail to meet this compliance policy. Option B is not a standard MDM security policy, since MDM is designed to restrict untrusted software and firmware rather than permit unrestricted custom firmware installation.

Option D is not standard, as MDM relies on over-the-air communication to manage devices and would not permanently disable all such channels. Option E is not a security policy, because removing screen lock passcode requirements weakens device security rather than enforcing it.

Exam trap

CND often tests whether candidates recognize that MDM policies are about enforcing security controls (lock, wipe, encryption, passcode) — options that describe disabling security or breaking management channels are distractors.

Full explanation →
29
Multi-Selectmedium

An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?

Select 2 answers
A.TPM with a Startup PIN
B.TPM only
C.RADIUS server biometric token verification
D.Active Directory Kerberos ticket delegation
E.Hardware token smart card reader authentication
AnswersA, B

BitLocker natively supports TPM-only, TPM with Startup PIN, and TPM with Startup Key for OS volume protection. TPM with Startup PIN satisfies the stem by requiring both hardware-bound measurement validation and a user-entered secret before the volume unlocks.

Why this answer

Option A (TPM with a Startup PIN) is correct because BitLocker natively supports combining the TPM with a user-entered PIN, which provides multi-factor pre-boot authentication for the OS volume. Option B (TPM only) is correct because BitLocker natively supports a TPM-only protector, where the TPM validates boot integrity and releases the volume master key without user interaction. Options C, D, and E are not native BitLocker OS-volume startup protectors: RADIUS biometric token verification, Kerberos ticket delegation, and hardware token smart card reader authentication are not BitLocker startup authentication methods, though smart cards can be used with BitLocker in some contexts via certificate-based protectors rather than as a native startup authentication option in this list.

Exam trap

CND often tests the distinction between native BitLocker authentication methods and external authentication protocols, causing candidates to confuse smart card or biometric options with built-in TPM-based protectors.

Full explanation →
30
Multi-Selecthard

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

Select 3 answers
A.Traceroute / ping utilities to test end-to-end path connectivity and TTL expiration
B.Network packet analyzers (e.g., tcpdump or Wireshark) capturing traffic on firewall interfaces
C.Firewall packet flow tracing / debug packet tools (e.g., Cisco ASA packet-tracer or Palo Alto global packet diagnostic)
D.Reformatting the firewall hard drive and reinstalling the BIOS firmware
E.Disconnecting all internal switch uplinks permanently
AnswersA, B, C

Traceroute and ping reveal where along the path packets stop returning, exposing TTL expiry and unreachable hops. This satisfies the requirement to locate the drop point by narrowing the failing segment before deeper firewall inspection.

Why this answer

Option A is correct because traceroute and ping utilities test end-to-end path connectivity and reveal where TTL expiration or ICMP unreachables occur, helping localize the hop or firewall at which packets stop traversing the path. Option B is correct because packet analyzers such as tcpdump or Wireshark capturing on the firewall's ingress and egress interfaces show whether packets actually arrive, are malformed, or are dropped before/after inspection, providing ground-truth evidence of the drop point. Option C is correct because firewall packet flow tracing/debug tools like Cisco ASA packet-tracer or Palo Alto's global packet diagnostic simulate or follow a specific flow through the policy, NAT, and inspection stages, explicitly reporting the rule or stage that drops the packet.

Option D does not belong because reformatting the firewall disk and reinstalling BIOS firmware is a destructive hardware/firmware recovery action, not a diagnostic method for identifying where traffic is dropped. Option E does not belong because permanently disconnecting all internal switch uplinks would cause an outage and remove the traffic needed for diagnosis rather than help identify the drop cause.

Exam trap

The trap is choosing destructive or unrelated 'fixes' (reimaging, disconnecting links) instead of diagnostic tools — candidates must recognize that the question asks for identification, not remediation.

Full explanation →
31
MCQmedium

During an incident, a network defender needs to collect volatile evidence from a compromised Linux server before shutting it down. Which of the following commands should be used to capture the current network connections and listening ports?

A.route -n
B.ifconfig -a
C.netstat -tulnp
D.arp -a
AnswerC

The netstat -tulnp command displays TCP and UDP listening ports along with the associated process IDs and program names, providing a snapshot of active network connections and services. This is essential volatile data that can reveal malicious listeners or established connections. It should be collected before shutdown to preserve evidence.

Why this answer

The netstat -tulnp command is the correct choice because it lists active TCP/UDP connections and listening ports with process details. The other commands provide interface, routing, or ARP information, which are not the required volatile network connection data. Collecting this data before shutdown is critical for incident response.

Exam trap

The trap here is confusing general network configuration commands with those that reveal active connections, leading to incomplete volatile evidence collection.

Full explanation →
32
MCQmedium

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

A.Google Cloud IAM Bucket-Level Access Control with deny policies
B.Customer-managed encryption keys (CMEK) with scheduled key rotation
C.GCP Storage object versioning with lifecycle rules
D.Cloud Storage Bucket Lock using Object Retention Policies (WORM)
AnswerD

Bucket Lock with Object Retention Policies enforces WORM semantics, making each object immutable for its retention period. Unlike IAM or bucket-level retention alone, it blocks deletion and modification by every principal, including project owners and root administrators, satisfying the mandated five-year compliance hold that no privileged user can override.

Why this answer

Cloud Storage Bucket Lock with Object Retention Policies enforces WORM (Write Once Read Many) semantics, preventing any user—including project owners and root administrators—from modifying or deleting objects until the retention period expires. Once a retention policy is locked, it cannot be shortened or removed, satisfying the 5-year compliance mandate. This is the only GCP feature that provides immutable, tamper-proof retention at the object level.

Exam trap

The trap here is confusing access control (IAM deny policies) with immutability—candidates assume that denying delete permissions is equivalent to WORM, but only Bucket Lock provides non-repudiable, admin-proof retention.

How to eliminate wrong answers

Option A is wrong because IAM deny policies only restrict permissions—they can always be removed or overridden by an organization admin, so they do not provide immutable retention. Option B is wrong because CMEK with key rotation only controls encryption key lifecycle; rotating or destroying a key does not prevent object deletion or modification and is not a retention mechanism. Option C is wrong because object versioning with lifecycle rules allows objects to be overwritten and versions to be deleted by lifecycle policies or users with permissions—it is not WORM and provides no legal hold guarantee.

Full explanation →
33
MCQmedium

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

A.Event ID 1102
B.Event ID 4698
C.Event ID 4624
D.Event ID 4720
AnswerC

Event ID 4624 logs successful logon events, and its authentication package and logon type fields reveal NTLM-based authentication, exposing Pass-the-Hash activity. This satisfies the requirement to detect authentication via NTLM hash rather than plaintext password.

Why this answer

Event ID 4624 is logged on successful logon and includes a Logon Type field (Type 3 for network, Type 9 for NewCredentials) plus an Authentication Package field that shows NTLM when a hash is used instead of a plaintext password. Analysts filter 4624 events for NTLM authentication to detect Pass-the-Hash activity.

Exam trap

CND often tests the difference between authentication events (4624/4625) and account-management or anti-forensics events (4720, 4698, 1102) — candidates who pick 1102 because it sounds 'security-related' miss that it only records log clearing.

How to eliminate wrong answers

Option A is wrong because Event ID 1102 records that the audit log was cleared, which is a anti-forensics indicator but not an authentication event. Option B is wrong because Event ID 4698 records a scheduled task being created, which is a persistence technique, not authentication. Option D is wrong because Event ID 4720 records a user account being created, which is an account-management event unrelated to NTLM logon.

Full explanation →
34
Multi-Selecthard

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Select 3 answers
A.Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results
B.Always Encrypted to protect sensitive column data from database administrators
C.Transparent Data Encryption (TDE) for encrypting database files at rest on disk
D.Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts
E.Granting db_owner permissions to all public database roles by default
AnswersA, B, C

DDM applies masking rules at query-result level, hiding sensitive columns from non-privileged users without altering stored data. This satisfies the exposure-limiting constraint, complementing encryption and auditing for defence in depth across Microsoft SQL Server 2019.

Why this answer

Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft.

Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Exam trap

CND often tests the misconception that DDM actually encrypts data — it only masks query output, so candidates who pick DDM as a substitute for Always Encrypted or TDE fall into the trap.

Full explanation →
35
MCQmedium

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

A.Configure a stateless packet filtering access control list on the core router interface.
B.Activate standard IP source guard on all internal user-facing switch access ports.
C.Enable Network Address Translation (NAT) overload (PAT) on the perimeter router.
D.Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.
AnswerD

An NGFW with Deep Packet Inspection and App-ID identifies applications regardless of port, so exfiltration over TCP 4443 to an unknown host is recognised and blocked. Port-based filtering alone would miss this, since the traffic uses a non-standard port.

Why this answer

A Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID can identify applications regardless of port, inspect payloads, and block unauthorized outbound traffic and unknown protocols. This is essential for detecting and stopping data exfiltration over non-standard ports like TCP 4443. Traditional stateless filtering and NAT cannot perform this level of application-aware inspection.

Exam trap

CND often tests the difference between stateless/stateful packet filtering and application-aware inspection, catching candidates who choose NAT or ACLs for threats that require Layer 7 visibility and control.

How to eliminate wrong answers

Option A is wrong because a stateless packet filtering ACL on a core router only inspects headers (source/destination IP, port) without tracking sessions or application context, so it cannot identify or block unknown protocols or application-layer exfiltration. Option B is wrong because IP source guard prevents IP spoofing on switch access ports by binding to DHCP snooping entries; it does not inspect outbound application traffic. Option C is wrong because NAT overload (PAT) translates many internal addresses to one public address for connectivity, providing no security inspection or blocking capability.

Full explanation →
36
MCQeasy

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

A.DNS Sinkholing
B.Active Response / Process Termination
C.Passive Log Alerting
D.Vulnerability Patch Management
AnswerB

Active response is the HIPS capability that acts on a detected intrusion rather than merely alerting. Terminating the offending process is process termination, an active response that stops the injection attack immediately, matching the proactive preventive action described.

Why this answer

When a HIPS detects an injection attack and immediately terminates the offending process, it is performing an active response — a proactive preventive action that stops the attack in real time rather than merely logging it. Process termination is a classic active-response capability of host-based IPS tools such as OSSEC, Wazuh, or commercial HIPS platforms.

Exam trap

CND often tests the distinction between passive detection (logging/alerting) and active response (blocking/terminating), tricking candidates into selecting a logging option when the scenario explicitly describes a preventive action.

How to eliminate wrong answers

Option A is wrong because DNS sinkholing redirects DNS queries to a controlled server to block malicious domains — it does not terminate processes and is not what the HIPS did here. Option C is wrong because passive log alerting only records and notifies; it takes no preventive action, whereas the scenario explicitly states the process was terminated. Option D is wrong because vulnerability patch management is a separate remediation workflow that fixes the underlying flaw, not an in-line response to a detected attack.

Full explanation →
37
MCQeasy

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

A.Analyze the log files to verify if an unauthorized breach has occurred
B.Contain the compromised host to prevent lateral movement
C.Perform post-incident lessons learned activities
D.Eradicate the malware from the impacted SSH server
AnswerA

NIST SP 800-61 begins with preparation, but once an event is detected the first active phase is analysis and validation. Examining the SSH logs confirms whether the failed attempts and root login constitute a genuine breach before containment.

Why this answer

NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The first phase after preparation is Detection and Analysis, which in this scenario means analyzing log files to verify whether an unauthorized breach has actually occurred. Only after confirming the incident should containment, eradication, or lessons-learned activities begin.

Exam trap

The trap is jumping to containment or eradication because the scenario sounds like a confirmed breach — but NIST's first phase after preparation is detection and analysis, and the question asks for the first action.

How to eliminate wrong answers

Option B is wrong because containment is the third phase (after detection and analysis) — you must first verify the incident before isolating the host, otherwise you may disrupt operations for a false positive. Option C is wrong because post-incident lessons learned is the final phase, performed after recovery is complete. Option D is wrong because eradication is part of the third phase and comes after containment — you cannot eradicate malware before confirming and containing the incident.

Full explanation →
38
MCQmedium

A company suspects that an insider is using a DNS tunneling tool to exfiltrate small amounts of sensitive data through the corporate recursive resolver. The tool encodes data in the leftmost labels of queries to a domain the company does not own. Which detection approach is most likely to reveal this activity on existing network telemetry?

A.Inspecting TLS certificate transparency logs for the tunnel domain
B.Enabling DNSSEC validation on the recursive resolver
C.Monitoring for unusually long or high-entropy subdomain labels and abnormally high query volume to a single domain
D.Blocking outbound TCP port 53 at the perimeter firewall
AnswerC

DNS tunneling encodes payload data into query names, producing unusually long labels, high character entropy, and a flood of unique subdomains under one parent domain. These are observable in resolver logs and passive DNS metadata without any decryption, making them the most reliable indicator. Baseline deviation on query length, entropy, and volume per domain exposes the tunnel even when the encoded content itself is unreadable.

Why this answer

DNS tunneling smuggles data inside query names, so the detectable footprint is structural: long labels, high entropy, many unique subdomains under one parent, and elevated query rates. These signals are visible in resolver logs and passive DNS without decrypting anything. Blocking outbound port 53 or enabling DNSSEC does not address a tunnel already riding through the sanctioned recursive resolver.

Exam trap

The trap here is assuming that restricting outbound DNS traffic prevents DNS tunnelling, when the channel is already flowing through the permitted corporate resolver.

Full explanation →
39
MCQhard

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

A.Azure Application Gateway Ingress Controller (AGIC)
B.Azure CNI powered by Cilium with data plane encryption enabled
C.Azure Key Vault provider for Secrets Store CSI driver
D.Azure Policy for Kubernetes add-on
AnswerB

Azure CNI powered by Cilium with data plane encryption enabled encrypts pod-to-pod traffic between nodes using IPsec or WireGuard at the network layer, directly satisfying the requirement for encrypted node-to-node communication within the AKS cluster. Enabling it at cluster creation ensures all east-west traffic is protected in transit.

Why this answer

Azure CNI powered by Cilium supports transparent data plane encryption using WireGuard, which encrypts node-to-node and pod-to-pod traffic within the AKS cluster. Enabling data plane encryption during cluster creation (or via configuration) satisfies the requirement for encrypted in-transit communication between nodes. This is the native AKS feature designed for intra-cluster transport encryption.

Exam trap

CND often tests the difference between ingress traffic encryption (AGIC, TLS termination) and intra-cluster data plane encryption (Cilium WireGuard), so candidates who pick an ingress or secrets-management feature for a node-to-node encryption requirement get trapped.

How to eliminate wrong answers

Option A is wrong because AGIC is an ingress controller that manages inbound HTTP/HTTPS traffic from outside the cluster to services — it does not encrypt node-to-node traffic inside the cluster. Option C is wrong because the Key Vault provider for Secrets Store CSI driver mounts secrets from Azure Key Vault into pods; it handles secret management, not transport encryption. Option D is wrong because Azure Policy for Kubernetes enforces governance and compliance rules on cluster resources; it does not provide data plane encryption.

Full explanation →
40
MCQeasy

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

A.TFTP (Trivial File Transfer Protocol)
B.HTTP over port 80
C.Telnet over port 23
D.SSH (Secure Shell) version 2
AnswerD

SSH version 2 encrypts the entire session, including authentication and commands, over the network. This directly satisfies the policy requiring remote administrators to use an encrypted tunnel for command-line switch administration, unlike Telnet or unencrypted SNMP.

Why this answer

SSH version 2 provides strong encryption for all traffic, including authentication and command-line sessions, using algorithms like AES and Diffie-Hellman key exchange. This satisfies the policy requirement for an encrypted tunnel during remote administration. Telnet, TFTP, and HTTP transmit data in cleartext, offering no confidentiality.

Therefore, SSHv2 is the only listed protocol that meets the encryption mandate.

Exam trap

The trap here is confusing 'encrypted tunnel' with any remote administration protocol; candidates might incorrectly assume Telnet or HTTP can be secured with add-ons, but only SSH natively provides encryption.

How to eliminate wrong answers

Option A is wrong because TFTP is a UDP-based file transfer protocol that sends data in cleartext and lacks any encryption or authentication mechanisms. Option B is wrong because HTTP over port 80 transmits all data, including credentials, in plaintext without encryption. Option C is wrong because Telnet over port 23 sends all session data, including passwords, in cleartext, making it vulnerable to eavesdropping.

Full explanation →
41
MCQmedium

A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?

A.Reverse proxy caching that stores static HTTP responses and serves them to repeat visitors
B.SSL/TLS offload with full application-layer inspection and Web Application Firewall policy enforcement
C.Network Address Translation that hides the internal web server IP addresses from external clients
D.Stateful packet filtering that tracks TCP session state and enforces port 443 access control lists
AnswerB

SSL/TLS offload lets the ADC decrypt inbound HTTPS so it can inspect the plaintext request, validate the client certificate during the handshake, apply WAF signatures for SQL injection, then re-encrypt to the backend servers. Because inspection occurs after decryption, the SQL injection payload is visible in the HTTP layer and can be blocked before it reaches the web farm.

Why this answer

Terminating TLS at the ADC is what makes deep inspection possible, because encrypted traffic must be decrypted before HTTP-layer signatures and certificate validation can be applied. Re-encrypting to the backend preserves confidentiality on the internal segment. Stateful filtering, caching, and NAT all operate below or outside the application layer and cannot detect SQL injection or verify client identity.

Exam trap

The trap here is assuming that any perimeter device terminating TLS automatically inspects the decrypted content, when many load balancers only offload encryption without applying WAF or certificate-validation policy.

Full explanation →
42
MCQhard

A network defender is reviewing logs from a Cisco IOS router and notices numerous ICMP echo requests with varying source IP addresses and large payloads. The defender suspects an ICMP tunneling attack. Which of the following is the BEST method to confirm and analyze this activity?

A.Enable ICMP rate limiting on the router to mitigate the attack
B.Monitor for increased ICMP traffic volume during off-hours
C.Check router ACLs to see if ICMP is permitted from external sources
D.Capture full packet data and inspect ICMP payloads for embedded protocols or data
AnswerD

ICMP tunneling embeds data within the payload of ICMP packets. Capturing full packets and analyzing payloads for non-standard content, such as TCP headers or encoded data, can confirm tunneling. This method provides definitive evidence by examining the actual payload, which is necessary to distinguish tunneling from normal ping traffic.

Why this answer

To confirm ICMP tunneling, the defender must inspect packet payloads for embedded data or protocols. Volume-based or policy-based checks are insufficient because they do not examine the content. Full packet capture allows direct observation of tunneling artifacts, making it the best method for confirmation and analysis.

Exam trap

The trap here is focusing on traffic volume or ACLs as indicators, when the definitive evidence of tunneling lies in the packet payload.

Full explanation →
43
MCQmedium

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

A.Application sideloading enforcement
B.Containerized workspace isolation
C.Remote wipe capability for lost devices
D.Network protection and Wi-Fi security inspection
AnswerD

Network protection with Wi-Fi security inspection operates at layers 2 and 3, analysing 802.11 frames and traffic patterns to identify evil-twin access points, ARP spoofing and SSL-stripping MitM attempts. This directly satisfies the stem's requirement for network-layer detection, which app-level or device-posture capabilities cannot deliver.

Why this answer

Network protection and Wi-Fi security inspection is the MTD capability that detects rogue access points, evil twins, and man-in-the-middle attacks by monitoring the device's network connections and analyzing Wi-Fi traffic for anomalies. This directly addresses the requirement to detect network-layer threats such as rogue APs and MitM attacks.

Exam trap

CND often tests the confusion between device-management capabilities (remote wipe, containerization) and threat-detection capabilities (network inspection), tricking candidates into selecting a remediation or isolation feature when the question asks for detection of network-layer attacks.

How to eliminate wrong answers

Option A is wrong because application sideloading enforcement addresses the risk of users installing apps from untrusted sources — it is an app-layer control, not a network-layer detection capability, and does nothing to detect rogue Wi-Fi or MitM attacks. Option B is wrong because containerized workspace isolation separates corporate and personal data on the device, which protects data confidentiality but does not detect or prevent network-layer attacks like rogue APs. Option C is wrong because remote wipe is a remediation capability for lost or stolen devices, not a detection capability for network threats, and it is irrelevant to the rogue AP/MitM scenario.

Full explanation →
44
MCQhard

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

A.Isolating compromised VLANs from the core routing backbone during an active attack
B.Restoring critical database backups from immutable offsite storage vaults
C.Establishing the CSIRT, defining escalation paths, and drafting incident response procedures
D.Performing root-cause analysis on active command-and-control channels
AnswerC

Governance during a major breach requires a defined CSIRT with clear roles, escalation paths and documented procedures. These are the core Planning and Preparation deliverables under ISO/IEC 27035, enabling coordinated detection, response and communication before an incident occurs.

Why this answer

ISO/IEC 27035's 'Planning and Preparation' phase is about building the incident management capability before incidents occur — establishing the CSIRT, defining escalation paths, and drafting incident response procedures. These governance activities ensure that when a major breach happens, roles, communication channels, and playbooks are already in place. The other options describe actions taken during detection, response, or post-incident phases.

Exam trap

The trap is that all four options sound like legitimate incident response activities — candidates must map each to the correct ISO 27035 phase and recognize that only governance/setup activities belong in Planning and Preparation.

How to eliminate wrong answers

Option A is wrong because isolating compromised VLANs is a containment action performed during the 'Detection and Reporting' or 'Assessment and Decision' phase, not during planning. Option B is wrong because restoring backups is a recovery activity that occurs after containment and eradication. Option D is wrong because root-cause analysis is a post-incident activity covered in the 'Lessons Learned' phase, not preparation.

Full explanation →
45
Multi-Selecthard

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

Select 2 answers
A.Using Wired Equivalent Privacy (WEP) with static 40-bit pre-shared keys.
B.Configuring hidden SSIDs across all access points as the primary perimeter defense mechanism.
C.Mandatory Protected Management Frames (PMF / 802.11w) to prevent forged deauthentication and disassociation attacks.
D.Disabling all encryption ciphers to maximize wireless throughput and signal range.
E.Wireless Intrusion Detection Systems (WIDS / wIPS) to monitor radio frequencies and alert on rogue APs or MAC spoofing.
AnswersC, E

Mandatory Protected Management Frames cryptographically authenticate unicast and broadcast management frames, blocking forged deauthentication and disassociation frames that attackers use to force client disconnections and capture handshakes. This directly satisfies the stem's requirement for advanced hardening against sophisticated wireless attacks, closing a gap that WPA2 alone leaves open.

Why this answer

Option C is correct because mandatory Protected Management Frames (PMF, standardized as 802.11w) cryptographically protects unicast and broadcast management frames such as deauthentication and disassociation, preventing forged-frame denial-of-service and disassociation attacks that are common in advanced wireless threats. Option E is correct because a Wireless Intrusion Detection/Prevention System (WIDS/wIPS) continuously monitors the RF spectrum, detects rogue access points, evil twins, MAC spoofing, and other anomalies, and can alert or automatically contain them, which is a core defense-in-depth layer for enterprise WLANs. Option A is wrong because WEP with static 40-bit pre-shared keys is cryptographically broken and trivially cracked, so it weakens rather than hardens security.

Option B is wrong because hiding SSIDs is only weak obscurity, easily discovered by passive monitoring, and can disrupt legitimate clients without providing real protection. Option D is wrong because disabling encryption exposes all wireless traffic in cleartext, eliminating confidentiality and integrity regardless of throughput gains.

Exam trap

The trap here is selecting 'hidden SSIDs' as a security control — a persistent myth — instead of recognizing that PMF and WIDS/wIPS are the actual advanced hardening mechanisms tested on the CND exam.

Full explanation →
46
MCQmedium

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

A.Enable Amazon S3 Block Public Access settings across all AWS accounts and buckets.
B.Deploy an AWS WAF web access control list on Amazon CloudFront distributions.
C.Configure AWS Security Hub with CIS AWS Foundations Benchmark compliance standards.
D.Install a host-based antivirus agent on all EC2 virtual machine instances.
AnswerA

Amazon S3 Block Public Access applies account-level and bucket-level controls that override bucket policies and ACLs, preventing public exposure at the source rather than merely detecting it afterwards. This satisfies the stem's requirement for an automated preventive control across all AWS accounts, blocking misconfigured public access before it occurs.

Why this answer

Amazon S3 Block Public Access is a preventive control that overrides bucket policies and ACLs to reject any public access, regardless of how the bucket is configured. Enabling it at the account level ensures that even newly created buckets or misconfigured policies cannot expose data publicly. This directly addresses the requirement to prevent public accessibility due to misconfigurations.

Exam trap

CND often tests the difference between preventive controls (Block Public Access) and detective controls (Security Hub, Config rules), so candidates who pick compliance monitoring tools instead of enforcement mechanisms fall into the trap.

How to eliminate wrong answers

Option B is wrong because AWS WAF protects web applications from HTTP exploits (SQLi, XSS) at CloudFront or ALB, not S3 bucket ACLs or policies — it does not prevent public S3 exposure. Option C is wrong because AWS Security Hub with CIS benchmarks is a detective control that identifies non-compliance after the fact; it does not prevent public access. Option D is wrong because host-based antivirus on EC2 instances has no bearing on S3 bucket permissions, which are managed at the storage service layer, not the compute layer.

Full explanation →
47
MCQhard

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

A.Performing manual penetration testing once every five years
B.Conducting automated authenticated vulnerability scans of all internal and external assets on a regular schedule
C.Deploying hardware token multi-factor authentication for VPN users
D.Restricting administrative access to local console connections only
AnswerB

CIS Control 4 requires continuous vulnerability management, evidenced by automated authenticated scans covering all internal and external assets on a defined recurring schedule. Authentication reveals software-level weaknesses that unauthenticated scans miss, and automation plus scheduling satisfies the continuous element.

Why this answer

CIS Control 4 (Continuous Vulnerability Management) requires automated, authenticated vulnerability scanning of all internal and external assets on a regular schedule, with remediation tracked. Authenticated scans provide deeper visibility into installed software and missing patches than unauthenticated scans. This is the core activity auditors look for to demonstrate compliance with Control 4.

Exam trap

CND often tests the mapping of activities to specific CIS Controls — candidates pick MFA or pen testing because they sound security-relevant, but Control 4 is specifically about continuous, automated vulnerability scanning and remediation.

How to eliminate wrong answers

Option A is wrong because manual penetration testing once every five years is neither continuous nor vulnerability management — it is a point-in-time assessment and does not satisfy the 'continuous' requirement. Option C is wrong because hardware token MFA for VPN users maps to CIS Control 6 (Access Control Management), not Control 4. Option D is wrong because restricting administrative access to local console maps to CIS Control 4's sibling controls around privileged access (Control 5/6), not vulnerability management.

Full explanation →
48
MCQhard

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

A.PL (Planning)
B.SR (Supply Chain Risk Management)
C.CA (Assessment, Authorization, and Monitoring)
D.SC (System and Communications Protection)
AnswerB

The SR family directly covers supply chain risk management controls, including policies, plans, and processes governing suppliers and third parties. It is the NIST SP 800-53 Rev. 5 family that operationalises the Govern function's cybersecurity supply chain risk management outcomes.

Why this answer

NIST SP 800-53 Revision 5 introduced the SR (Supply Chain Risk Management) control family specifically to address supply chain risk governance, including processes for identifying, assessing, and mitigating risks from suppliers and third parties. The NIST CSF v2.0 Govern function's supply chain risk management outcomes map directly to the SR family controls.

Exam trap

CND often tests control family mapping, so candidates pick PL or CA for supply chain governance when the dedicated SR family is the correct NIST SP 800-53 Rev. 5 answer.

How to eliminate wrong answers

Option A is wrong because the PL (Planning) family addresses security planning, rules of behavior, and system security plans, not supply chain risk management processes. Option C is wrong because CA (Assessment, Authorization, and Monitoring) covers control assessments, authorization decisions, and continuous monitoring, which are related to assurance but not the primary supply chain governance family. Option D is wrong because SC (System and Communications Protection) covers cryptographic protection, boundary defense, and network segmentation, not supply chain risk management.

Full explanation →
49
MCQeasy

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

A.AWS Direct Connect combined with VPC Flow Logs
B.AWS Config rules combined with Amazon Inspector
C.AWS WAF combined with Amazon Route 53 DNS logging
D.AWS CloudTrail combined with Amazon EventBridge and SNS alerts
AnswerD

CloudTrail records every AWS API call, including IAM policy and security group modifications, capturing the identity of the caller. EventBridge filters these management events against rules matching unauthorised principals, then routes matches to SNS for immediate alerting. This satisfies the requirement to detect and notify on attempted changes to critical IAM policies and security group rules.

Why this answer

AWS CloudTrail records all API activity in the account, including IAM and EC2 security group modifications. Amazon EventBridge can match specific CloudTrail events (e.g., unauthorized ModifyPolicy or AuthorizeSecurityGroupIngress calls) and route them to Amazon SNS for alerting. This combination provides the required monitoring and notification pipeline.

Exam trap

CND often tests service-to-purpose mapping, catching candidates who confuse monitoring services (CloudTrail for API activity) with configuration/vulnerability services (Config, Inspector) or network inspection tools (WAF, Flow Logs).

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection and VPC Flow Logs capture IP-level traffic metadata, neither of which monitors API calls or IAM/security group changes. Option B is wrong because AWS Config evaluates resource configuration compliance and Amazon Inspector scans for vulnerabilities; neither generates real-time alerts on unauthorized API calls. Option C is wrong because AWS WAF filters HTTP(S) web traffic at the application layer and Route 53 DNS logging records DNS queries, neither of which detects IAM policy or security group API modifications.

Full explanation →
50
MCQmedium

A hospital's network team observes that a single internal host is flooding the Layer 2 CAM table of an access switch with thousands of frames, each carrying a different source MAC address. As a result, the switch begins flooding all unicast traffic out of every port, allowing the attacker to capture traffic destined for other hosts. Which attack is being executed, and which countermeasure most directly addresses it?

A.MAC flooding; enable port security with a maximum MAC count and violation action on access ports
B.ARP spoofing; enable Dynamic ARP Inspection with DHCP snooping bindings on the VLAN
C.VLAN hopping; change all access ports to trunk ports and prune unused VLANs
D.DHCP starvation; configure DHCP snooping with rate limiting on untrusted ports
AnswerA

MAC flooding exhausts the finite CAM table, forcing the switch to behave like a hub and flood unicast frames to all ports, enabling passive capture. Port security limits the number of source MAC addresses learned per interface and can restrict, protect, or shut down the port on violation, directly restoring the integrity of the forwarding table and preventing the overflow condition.

Why this answer

The described symptom is a classic MAC flooding attack, where an attacker fills the switch's content-addressable memory with bogus source MAC entries so legitimate entries age out and unknown-unicast frames are flooded to every port. Port security caps the number of MAC addresses learned on an interface and enforces a violation action, which directly prevents CAM table exhaustion and preserves normal forwarding behaviour.

Exam trap

The trap here is assuming that any switch-level traffic capture attack must be ARP spoofing, when the flooding of all ports is actually the signature of CAM table exhaustion.

Full explanation →
51
MCQmedium

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

A.First match based on rule priority number in ascending order
B.Last match evaluated across all security rules
C.Explicit allow rules override all deny rules regardless of priority
D.Deny rules always take precedence regardless of priority number
AnswerA

Azure evaluates NSG rules by priority number, processing the lowest value first and stopping at the first match. This satisfies the stem's requirement to identify the evaluation principle: traffic is permitted or denied by whichever rule has the smallest priority number that matches, so a deny rule at priority 100 overrides an allow rule at 200.

Why this answer

Azure NSGs evaluate rules in ascending order of priority number (100–4096), and the first rule whose source, destination, port, and protocol match the traffic is applied — no further rules are evaluated. This 'first match wins' model means a lower number equals higher precedence. If no rule matches, the default rules (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, etc.) apply.

Exam trap

The trap is assuming deny always beats allow (as in some firewall models) or that all rules are evaluated — Azure's first-match-by-ascending-priority model is the opposite of 'last match wins' and does not give deny any inherent precedence.

How to eliminate wrong answers

Option B is wrong because Azure does not evaluate all rules and take the last match — it stops at the first match, so later rules are never consulted once a match occurs. Option C is wrong because there is no concept of explicit allow overriding deny in Azure NSGs; precedence is determined solely by priority number, and a deny rule with a lower number will block traffic even if an allow rule exists with a higher number. Option D is wrong because deny rules do not inherently take precedence — a deny rule only wins if its priority number is lower than any matching allow rule.

Full explanation →
52
MCQmedium

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

A.Documenting the business justification, performing risk assessment, and obtaining CAB approval
B.Deleting all existing firewall rules to ensure a clean rulebase state
C.Immediately pushing the rule via automated script without prior peer review to minimize downtime
D.Disabling change logging to save disk space on the management server
AnswerA

Before production deployment, the change must be documented with business justification, risk-assessed, and approved by the Change Advisory Board. This governance gate ensures the firewall modification is authorised and its impact understood, satisfying the stem's mandatory pre-deployment step in the change lifecycle.

Why this answer

Firewall rule changes in production require documented business justification, a risk assessment of the change's impact, and approval from the Change Advisory Board (CAB) before deployment. This ensures the change is authorized, auditable, and aligned with the organization's risk appetite. Skipping any of these steps violates ITIL-aligned change management and can introduce security gaps or outages.

Exam trap

CND often tests whether candidates recognize that change management is about authorization and documentation — the trap is selecting speed-oriented options like automated pushes without review, which violate governance controls.

How to eliminate wrong answers

Option B is wrong because deleting all existing firewall rules would create a completely open or broken network, causing massive outages and security exposure — it is not a change management step at all. Option C is wrong because pushing rules via automated script without peer review bypasses the control that catches errors and malicious changes, directly violating change management principles. Option D is wrong because disabling change logging destroys the audit trail required for compliance and incident investigation, and it is never an acceptable step in change management.

Full explanation →
53
MCQmedium

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

A.Freeze global object prototypes using Object.freeze() and validate incoming JSON keys to disallow __proto__ assignments
B.Sanitize all input parameters using DOMPurify before rendering them
C.Configure CORS headers with Access-Control-Allow-Origin set to specific domains
D.Implement parameterized SQL queries for all database interactions
AnswerA

Object.freeze() on Object.prototype prevents modification of the prototype chain, blocking injected __proto__ properties from altering inherited behaviour, while key validation rejects malicious JSON payloads. Together they neutralise prototype pollution at the parsing and object-model layers.

Why this answer

Prototype pollution occurs when attacker-controlled JSON keys like __proto__ or constructor.prototype are merged into objects, altering Object.prototype and affecting all objects in the Node.js process. The correct remediation is to freeze the global prototypes with Object.freeze(Object.prototype) and to validate/reject incoming JSON keys that contain __proto__, constructor, or prototype before any merge or assignment. This directly blocks the pollution vector at the source rather than trying to sanitize output.

Exam trap

The trap here is that candidates see 'input sanitization' and pick DOMPurify or parameterized queries, conflating prototype pollution with XSS or SQL injection — the exam tests whether you know prototype pollution is a JavaScript object-model flaw, not an injection-into-HTML or SQL issue.

How to eliminate wrong answers

Option B is wrong because DOMPurify is an HTML sanitizer for XSS — it has no effect on JavaScript object prototype chains and does nothing to stop __proto__ injection during object merges. Option C is wrong because CORS headers control which browser origins can read responses; they do not prevent server-side prototype pollution from malicious JSON payloads. Option D is wrong because parameterized SQL queries prevent SQL injection, not prototype pollution — the vulnerability is in JavaScript object handling, not database query construction.

Full explanation →
54
Multi-Selectmedium

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

Select 2 answers
A.Application awareness and identification (App-ID)
B.Strict restriction to operating exclusively at Layer 2 (Data Link layer)
C.Inability to inspect encrypted HTTPS traffic under any circumstances
D.Exclusive reliance on static MAC address filtering for access control
E.Integrated user identification and policy enforcement (User-ID)
AnswersA, E

App-ID identifies applications regardless of port, protocol or encryption, then enforces policy on that classification. This satisfies the scenario's requirement for a distinguishing NGFW feature, because traditional stateful inspection firewalls match only static five-tuple header data and cannot recognise the actual application generating the traffic.

Why this answer

Option A is correct because Enterprise NGFWs use deep packet inspection and application signatures (e.g., Palo Alto App-ID, Cisco NBAR) to identify applications regardless of port or protocol, which traditional stateful firewalls cannot do since they only track TCP/UDP sessions and ports. Option E is correct because NGFWs integrate user identification (e.g., User-ID via Active Directory, LDAP, or Captive Portal) to enforce policies based on user or group identity rather than just IP addresses, a capability absent from traditional stateful firewalls. Option B is incorrect because NGFWs operate at Layers 3 through 7, not exclusively at Layer 2.

Option C is incorrect because NGFWs commonly decrypt and inspect HTTPS traffic via SSL/TLS decryption. Option D is incorrect because NGFWs use identity, application, and content-based controls, not static MAC address filtering.

Exam trap

The trap here is confusing NGFW features with generic firewall or switch capabilities — candidates may select Layer 2 restrictions or MAC filtering because they sound like security controls, but NGFWs are defined by Layer 7 application and user awareness.

Full explanation →
55
MCQmedium

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

A.Strategic threat intelligence
B.Operational threat intelligence
C.Tactical threat intelligence
D.Technical threat intelligence
AnswerA

Strategic threat intelligence addresses adversary motivations, campaign histories and long-term intent at a high level for executive decision-making. This matches the stem's provision of detailed campaign histories and adversary motivations, distinguishing it from tactical or operational intelligence.

Why this answer

Strategic threat intelligence is high-level, long-term intelligence focused on the adversary's intent, motivations, campaign histories, and overall risk posture. It is consumed by executives and decision-makers to shape security strategy and investment. The scenario describes detailed campaign histories and adversary motivations, which are hallmarks of strategic intelligence rather than operational, tactical, or technical feeds.

Exam trap

CND often tests the four threat intelligence levels by describing a scenario and asking you to classify it — candidates confuse strategic (motivations, campaign history) with operational (specific impending attacks) because both sound 'high-level.'

How to eliminate wrong answers

Option B is wrong because operational threat intelligence focuses on specific impending attacks — details about when, where, and how an adversary is likely to strike in the near term, not broad campaign histories and motivations. Option C is wrong because tactical threat intelligence covers the specific TTPs an adversary uses (e.g., MITRE ATT&CK techniques) to help defenders tune detections, not the strategic 'why' behind campaigns. Option D is wrong because technical threat intelligence is the most granular level — indicators of compromise such as IP addresses, hashes, and domains used in automated detection systems, not narrative campaign analysis.

Full explanation →
56
Multi-Selectmedium

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

Select 2 answers
A.Unencrypted UDP Syslog (Port 514)
B.Encrypted log forwarding via HTTPS REST APIs to the SIEM collector
C.Syslog over TLS (TCP Port 6514)
D.Unauthenticated TFTP log backup transfers
E.SNMPv1 trap forwarding
AnswersB, C

Forwarding logs over HTTPS REST APIs to the SIEM collector encrypts payloads with TLS and authenticates the endpoint, protecting confidentiality and integrity in transit. This meets the stem's requirement for secure log transmission from edge firewalls and switches.

Why this answer

Option B is correct because forwarding logs via HTTPS REST APIs encrypts the data in transit with TLS and allows the SIEM collector to authenticate the sender and validate integrity through the TLS channel and HTTP-level authentication. Option C is correct because Syslog over TLS, standardized on TCP port 6514, wraps syslog messages in a TLS session that provides confidentiality, server authentication, and message integrity, which is exactly what secure centralized log transmission requires. The unmarked options do not belong: unencrypted UDP Syslog on port 514 (A) sends cleartext datagrams with no integrity or authentication, TFTP (D) is an unauthenticated, unencrypted file transfer protocol, and SNMPv1 traps (E) are sent in cleartext with weak community-string authentication and no integrity protection.

Exam trap

CND often tests the misconception that any TCP-based syslog is secure — candidates must distinguish plain TCP syslog (no encryption) from syslog over TLS (RFC 5425, port 6514) and recognize that UDP 514, TFTP, and SNMPv1 are all insecure.

Full explanation →
57
Multi-Selecteasy

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Select 2 answers
A.Data routed through internal Bluetooth beacon devices
B.Data processed inside physical server CPU cache registers only
C.Data in transit across network gateways (Network DLP)
D.Data transmitted over analog telephone modem lines
E.Data at rest on endpoint hard drives and file shares (Storage/Discovery DLP)
AnswersC, E

Network DLP inspects traffic crossing perimeter gateways, catching intellectual property as it leaves via email, web uploads or file transfers. This satisfies the requirement to monitor data in transit, complementing endpoint and cloud coverage so exfiltration attempts are detected before reaching external destinations.

Why this answer

Option C is correct because Network DLP monitors data in transit as it crosses network gateways, inspecting protocols such as HTTP/S, SMTP, and FTP to detect and block sensitive intellectual property leaving the perimeter. Option E is correct because Storage/Discovery DLP scans data at rest on endpoint hard drives and file shares, using content fingerprinting and regex rules to locate and remediate stored sensitive files. Together, these cover the two fundamental data states—in motion and at rest—that a comprehensive DLP architecture must address.

Option A is not a standard DLP monitoring location, as Bluetooth beacon devices are proximity/telemetry hardware, not data transport channels for DLP inspection. Option B is incorrect because CPU cache registers are transient internal processor state and are not a monitored DLP data state. Option D is incorrect because analog modem lines are legacy dial-up channels, not a recognized DLP monitoring location in modern architectures.

Exam trap

CND often tests the three data states — candidates may pick obscure options like Bluetooth or CPU cache, but DLP focuses on at rest, in motion, and in use.

Full explanation →
58
Multi-Selecthard

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Select 3 answers
A.Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges
B.Load the pgcrypto extension and configure encryption for sensitive columns
C.Set superuser password to null and allow trust authentication for all interfaces
D.Enable SSL/TLS in postgresql.conf by setting ssl = on along with valid server certificate file paths
E.Disable all logging in postgresql.conf to maximize query execution performance
AnswersA, B, D

Editing pg_hba.conf to require scram-sha-256 replaces weaker md5 or trust authentication, while host-range restrictions limit which remote addresses may connect. Together these satisfy the stem's access-control constraint, blocking unauthorised hosts and preventing password-cracking against stored credentials.

Why this answer

Option A is correct because pg_hba.conf is the host-based access control file that determines which clients may connect and how they authenticate; enforcing scram-sha-256 (the strongest built-in password method, replacing md5) and narrowing remote CIDR ranges blocks unauthorized hosts and prevents password-hash replay attacks. Option B is correct because loading the pgcrypto extension enables column-level encryption functions (e.g., pgp_sym_encrypt) so sensitive data is encrypted at rest within the database, protecting it even if table files or backups are exposed. Option D is correct because setting ssl = on in postgresql.conf together with ssl_cert_file and ssl_key_file (valid server certificate paths) encrypts client-server traffic in transit, preventing credential and data interception.

Option C is wrong because null superuser passwords with trust authentication allow anyone to connect as superuser without credentials, a critical vulnerability. Option E is wrong because disabling logging removes the audit trail needed to detect and investigate unauthorized access, and it does nothing to secure access or data at rest.

Exam trap

CND often tests whether candidates confuse 'hardening' with 'performance tuning' — options that disable logging or weaken authentication are distractors that sound like optimizations but destroy security posture.

Full explanation →
59
MCQeasy

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

A.Heuristic detection
B.Behavioral analytics detection
C.Signature-based detection
D.Anomaly-based detection
AnswerC

Snort compares packet payloads against a database of known attack patterns. The alert fired because the traffic matched a stored signature for the 'SELECT * FROM users WHERE' SQL injection string, so detection relies on predefined signatures rather than anomaly or behaviour baselines.

Why this answer

Snort is matching a specific string pattern ('SELECT * FROM users WHERE') against network traffic, which is the hallmark of signature-based detection — it compares packets against a database of known attack patterns. The rule in question is a content-match signature, not a statistical or behavioral model, so signature-based detection is the correct classification.

Exam trap

CND often tests whether candidates confuse signature-based detection (exact pattern match) with anomaly-based or heuristic detection (statistical/behavioral deviation), causing them to overthink a straightforward content match.

How to eliminate wrong answers

Option A is wrong because heuristic detection uses rules of thumb or scoring to identify suspicious behavior that may not match a known signature, whereas Snort here is matching an exact literal string. Option B is wrong because behavioral analytics detection (often UEBA) baselines normal activity and flags deviations over time, which is not what a static content match does. Option D is wrong because anomaly-based detection builds statistical profiles and alerts on deviations from the baseline; Snort's literal string match is deterministic, not statistical.

Full explanation →
60
Multi-Selectmedium

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

Select 3 answers
A.Designing corporate marketing websites
B.Replacing physical data center firewalls with robotic hardware arms
C.Executing automated containment playbooks (e.g., isolating a host upon high-fidelity alert)
D.Automated enrichment of IOCs via external threat intelligence APIs
E.Streamlining incident case management and ticket generation in platforms like Jira or ServiceNow
AnswersC, D, E

SOAR executes machine-speed containment playbooks, calling EDR or firewall APIs to isolate a compromised host the moment a high-fidelity alert fires. This removes analyst latency from the response loop, satisfying the stem's containment use case rather than detection or enrichment.

Why this answer

Option C is correct because SOAR platforms are built to run orchestrated playbooks that trigger automated containment actions, such as isolating an endpoint via EDR API or disabling an account when a high-fidelity alert fires, reducing mean time to respond. Option D is correct because SOAR natively performs automated IOC enrichment by querying external threat intelligence APIs (e.g., VirusTotal, MISP, Recorded Future) to add context like reputation, geolocation, and related campaigns to alerts. Option E is correct because SOAR integrates with ITSM and case management tools such as Jira and ServiceNow to auto-create, update, and track incident tickets, streamlining workflow and documentation.

Option A is incorrect because designing marketing websites is a web development function unrelated to security orchestration or incident response. Option B is incorrect because SOAR is software orchestration, not physical robotics, and it does not replace data center firewalls with robotic hardware arms.

Exam trap

The trap is selecting options that sound technical but are unrelated to SOAR's actual scope — candidates may pick anything mentioning 'automation' or 'firewalls' without verifying it aligns with SOAR's orchestration, enrichment, and case management functions.

Full explanation →
61
MCQhard

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

A.Authenticated Encryption with Associated Data (AEAD) using GCM mode
B.Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key exchanges
C.Anti-replay protection using sequence number windows
D.RSA signature-based peer authentication
AnswerB

PFS generates unique ephemeral Diffie-Hellman keys per session, so session keys are never derived from the long-term preshared or private keys. Compromising those long-term secrets later cannot decrypt previously captured traffic, satisfying the requirement that past sessions stay protected.

Why this answer

Perfect Forward Secrecy (PFS) ensures that session keys are derived from ephemeral Diffie-Hellman exchanges and are not recoverable from long-term keys. Even if an attacker later compromises the preshared key or private key, past session keys cannot be reconstructed, so captured traffic remains undecryptable. This is exactly the property the security team requires.

Exam trap

CND often tests the difference between confidentiality mechanisms (AEAD, encryption) and key-exchange properties (PFS) — candidates pick GCM because it sounds strong, missing that only ephemeral DH provides protection against future key compromise.

How to eliminate wrong answers

Option A is wrong because AEAD with GCM provides confidentiality and integrity for the current session but does not protect past sessions if the long-term key is compromised — it is a cipher mode, not a key-exchange property. Option C is wrong because anti-replay protection prevents attackers from re-injecting captured packets; it does not prevent decryption of captured traffic. Option D is wrong because RSA signature-based authentication verifies peer identity but does not provide forward secrecy unless combined with ephemeral DH; RSA key transport actually lacks PFS.

Full explanation →
62
MCQmedium

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

A.Enforcing a passcode policy with complexity and auto-lock requirements
B.Disabling Apple Push Notification service (APNs)
C.Enabling AirDrop for all contacts
D.Enabling iCloud Backup for all application data
AnswerA

A passcode policy with complexity and auto-lock enforces cryptographic key derivation from user credentials, so iOS and iPadOS encrypt data at rest via the Secure Enclave and Data Protection classes. Without it, files remain unprotected once the device locks, failing the baseline's data-at-rest requirement.

Why this answer

Data-at-rest protection on iOS/iPadOS is anchored in the Secure Enclave and the Data Protection API, which derives encryption keys from the device passcode. Without a strong passcode policy enforced via MDM (complexity, minimum length, auto-lock timeout), the encryption keys are trivially derivable and data at rest is effectively unprotected. MDM payloads such as com.apple.security.FDERecoveryKeyEscrow and Passcode Policy enforce these controls across supervised devices.

Exam trap

CND often tests the difference between controls that protect data in transit (APNs, TLS) and data at rest (passcode/Data Protection) — the trap is selecting a cloud or connectivity feature that sounds security-related but does not encrypt local storage.

How to eliminate wrong answers

Option B is wrong because disabling APNs would break MDM communication and push notifications — APNs is the transport for MDM commands and has nothing to do with data-at-rest encryption. Option C is wrong because enabling AirDrop for all contacts increases the attack surface for data exfiltration and unauthorized file transfer; it does not protect data at rest. Option D is wrong because enabling iCloud Backup for all application data actually moves corporate data off-device to Apple's cloud, which may violate data residency and increases exposure rather than protecting data at rest.

Full explanation →
63
MCQhard

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

A.Configuring the IPS as an out-of-band active response server using SNMP traps.
B.Placing the IPS behind a load balancer using round-robin DNS routing.
C.Deploying the IPS inline equipped with hardware fail-open optical/electrical bypass tap modules
D.Deploying the IPS in passive tap mode using a network packet broker span session.
AnswerC

Inline deployment gives true traffic inspection, while hardware bypass tap modules physically bridge the links if the IPS loses power or fails. This fail-open behaviour preserves network uptime, satisfying the requirement to avoid a single point of failure without sacrificing inline prevention.

Why this answer

Option C is correct because deploying the IPS inline with hardware fail-open bypass modules ensures that traffic is actively inspected in the data path, but if the IPS fails or loses power, the bypass module physically bridges the connection to maintain network uptime. This provides both intrusion prevention (blocking malicious traffic) and high availability, meeting the requirement of minimizing latency and avoiding a single point of failure. Hardware bypass operates at the physical layer, so it does not rely on software or external power to fail open.

Exam trap

CND often tests the misconception that any inline IPS deployment automatically provides high availability, confusing hardware bypass with software failover or passive monitoring.

How to eliminate wrong answers

Option A is wrong because an out-of-band active response server using SNMP traps does not inspect traffic inline; it only reacts after receiving alerts, so it cannot prevent intrusions in real time and introduces no hardware bypass. Option B is wrong because placing the IPS behind a load balancer with round-robin DNS does not provide inline inspection; DNS round-robin distributes connections but does not guarantee that all traffic passes through the IPS, and it lacks any hardware bypass mechanism. Option D is wrong because passive tap mode with a network packet broker only copies traffic for monitoring; it cannot block attacks and therefore does not provide intrusion prevention, and it has no inline bypass capability.

Full explanation →
64
MCQeasy

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

A.AWS Shield Advanced
B.AWS Organizations with all features enabled
C.AWS CloudTrail
D.AWS Transit Gateway
AnswerB

AWS Organizations with all features enabled creates the organizational management structure Security Hub requires for centralised findings aggregation. All-features mode, rather than consolidated billing only, permits service-managed policies and delegated administrator designation, enabling automatic ingestion across every member account. Without this prerequisite, cross-account centralisation cannot be configured.

Why this answer

AWS Organizations with all features enabled is required to create the organizational structure and enable centralized management of Security Hub across all accounts. Security Hub integrates with Organizations to automatically add new accounts and aggregate findings. All features must be enabled to use service control policies and delegated administration, which are necessary for Security Hub's multi-account setup.

Exam trap

CND often tests the prerequisite services for centralized security management, and candidates may confuse AWS Organizations with other services like CloudTrail or Shield, not realizing that Organizations is the foundational structure.

How to eliminate wrong answers

Option A is wrong because AWS Shield Advanced is a DDoS protection service, not an organizational management tool. Option C is wrong because AWS CloudTrail is for logging API activity, not for creating organizational structures. Option D is wrong because AWS Transit Gateway is a network transit hub, not related to organizational management.

Full explanation →
65
MCQhard

A security architect is designing network access control for a campus LAN. The requirement is to authenticate users and devices, assign VLANs dynamically based on identity, and quarantine non-compliant endpoints before granting production access. Which combination of protocols and features should the architect implement?

A.RADIUS accounting with SNMP polling and port security to enforce VLANs
B.MAC authentication bypass (MAB) with static VLAN assignment and no remediation VLAN
C.802.1X with EAP and RADIUS, plus dynamic VLAN assignment and a remediation VLAN
D.TACACS+ for user authentication with static ACLs and no dynamic VLAN or quarantine
AnswerC

802.1X provides port-based authentication, EAP carries identity credentials, and RADIUS returns authorization attributes such as VLAN assignment. Dynamic VLAN assignment places users into the correct network based on identity, and a remediation VLAN quarantines non-compliant endpoints until they meet policy. Together these features satisfy authentication, dynamic segmentation, and quarantine requirements in this campus LAN scenario.

Why this answer

Identity-based access control on a campus LAN requires 802.1X port authentication with EAP and RADIUS, which enables dynamic VLAN assignment through authorization attributes. A remediation VLAN isolates non-compliant endpoints until they meet policy. MAB, RADIUS accounting, SNMP polling, port security, and TACACS+ either lack identity-based authentication or do not provide dynamic segmentation and quarantine, so they do not meet the full requirement.

Exam trap

The trap here is confusing TACACS+ device administration with 802.1X endpoint access control.

Full explanation →
66
MCQmedium

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

A.Configure firewall rulebases to block all inbound traffic by default.
B.Draft the incident response playbook according to NIST SP 800-61.
C.Deploy a Security Information and Event Management (SIEM) solution for continuous monitoring.
D.Perform a comprehensive risk assessment and align the identified risks against Annex A control objectives.
AnswerD

A comprehensive risk assessment is the prerequisite for the Statement of Applicability, since ISO/IEC 27001 requires control selection and any exclusions to be justified by identified risk. Aligning findings against Annex A control objectives produces the documented rationale the CISO needs, satisfying the standard's risk-based control selection requirement.

Why this answer

ISO/IEC 27001 requires that the Statement of Applicability (SoA) be derived from the results of a formal risk assessment. The risk assessment identifies which threats and vulnerabilities apply to the organization, and Annex A controls are then selected (or excluded with justification) based on those findings. Without completing the risk assessment first, the SoA has no defensible basis for inclusion or exclusion of controls.

Exam trap

CND often tests the misconception that implementing a specific technical control (firewall, SIEM) satisfies ISO 27001 compliance, when the framework actually requires risk-assessment-driven control selection documented in the SoA.

How to eliminate wrong answers

Option A is wrong because configuring default-deny firewall rules is a technical control implementation, not the prerequisite activity that drives SoA content under ISO/IEC 27001. Option B is wrong because drafting an incident response playbook per NIST SP 800-61 is a downstream operational activity that supports Annex A.16 (incident management) but does not determine which controls belong in the SoA. Option C is wrong because deploying a SIEM is a monitoring control implementation (Annex A.12.4) and is itself selected as a result of the risk assessment, not a precursor to it.

Full explanation →
67
MCQeasy

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

A.Network Packet Capture (PCAP)
B.Hardware Diagnostics
C.Process Lineage and Tree Visualization
D.Disk Defragmentation
AnswerC

Process lineage and tree visualisation reconstructs parent-child relationships from recorded process-creation events, letting the analyst trace the suspicious child back through its spawning chain. This directly satisfies the stem's requirement to review the process lineage tree, exposing the originating parent and any intermediate processes that other EDR views, such as raw event logs, would obscure.

Why this answer

Process lineage and tree visualization reconstructs the parent-child relationships between processes (e.g., winword.exe → powershell.exe → cmd.exe), letting analysts see the full execution chain that led to a suspicious child process. This is a core EDR capability because it exposes attack patterns like Office macros spawning scripting engines — a hallmark of phishing and fileless malware. Without lineage, an isolated alert on the child process lacks the context needed to determine whether it is malicious.

Exam trap

The trap here is confusing network-centric evidence (PCAP) with endpoint process telemetry — candidates who equate 'investigation' with packet capture pick the wrong tool.

How to eliminate wrong answers

Option A is wrong because PCAP captures raw network packets and provides no visibility into local process parent-child relationships on the endpoint. Option B is wrong because hardware diagnostics (CPU, memory, disk health) are unrelated to process execution analysis. Option D is wrong because disk defragmentation is a storage optimization task with zero forensic or investigative value.

Full explanation →
68
MCQeasy

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A.To passively monitor and analyze network traffic copies for malicious signatures and anomalies.
B.To actively block and drop malicious packets inline.
C.To act as the default gateway for the DMZ network.
D.To perform Network Address Translation for internal hosts.
AnswerA

Promiscuous mode lets the interface accept frames not addressed to it, so the span/mirror port delivers copies of perimeter traffic. The NIDS then passively inspects those copies for malicious signatures and anomalies without inline blocking or altering traffic flow.

Why this answer

A NIDS deployed in promiscuous mode on a SPAN/mirror port receives copies of all traffic traversing the monitored segment, allowing it to passively inspect packets for malicious signatures and anomalies without affecting traffic flow. Promiscuous mode lets the NIC accept frames not addressed to it, which is essential for seeing all mirrored traffic.

Exam trap

The trap is conflating NIDS (passive detection on a mirror port) with IPS (inline active blocking) — candidates often pick the 'block' answer because it sounds more protective.

How to eliminate wrong answers

Option B is wrong because active blocking/dropping requires an inline IPS deployment, not a passive SPAN-port NIDS — a mirrored port receives copies and cannot drop original packets. Option C is wrong because a NIDS is a monitoring device, not a router; it does not forward traffic or act as a default gateway. Option D is wrong because NAT is a routing function performed by firewalls/routers, not by a passive monitoring sensor.

Full explanation →
69
MCQeasy

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

A.Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).
B.Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).
C.Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.
D.Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.
AnswerA

Rogue AP Detection with Automated Containment lets the WLC classify access points by comparing their wired MAC addresses against the known authorised list, then issue 802.11 deauthentication frames to clients associated with the offending BSSID. This directly satisfies the stem's requirement to automatically detect and contain the evil twin without manual intervention.

Why this answer

Enabling Rogue AP Detection and Automated Containment on the WLC is correct because the WLC can continuously scan for unauthorized APs, classify them as rogue, and automatically send deauthentication frames to contain the threat. This directly addresses the evil twin attack by detecting the unauthorized AP using the corporate SSID and neutralizing it without manual intervention. It is the purpose-built enterprise wireless feature for this scenario.

Exam trap

The trap here is assuming that stronger encryption (WPA3) or hiding the SSID stops an evil twin; in reality, only active rogue AP detection and containment addresses the unauthorized AP itself.

How to eliminate wrong answers

Option B is wrong because migrating to WPA3-Enterprise (SAE) improves authentication and encryption but does not detect or contain a rogue AP broadcasting the same SSID. Option C is wrong because hiding the SSID is a weak obscurity measure; the evil twin can still broadcast the hidden SSID, and clients that probe for it remain vulnerable. Option D is wrong because MAC filtering only restricts which client hardware addresses can associate; it does not detect or stop an unauthorized AP from operating.

Full explanation →
70
MCQhard

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

A.Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall
B.Full mesh VPC peering between all individual application virtual networks
C.Azure ExpressRoute Local circuits with direct peering
D.Default Azure Virtual Network peering without route tables
AnswerA

A hub-and-spoke topology centralises inspection by routing all spoke-to-spoke East-West traffic through Azure Firewall in the hub, enforced via User Defined Routes. This satisfies the requirement to inspect inter-subnet traffic between virtual networks with centralised next-generation firewalls.

Why this answer

Hub-and-Spoke with User Defined Routes (UDR) pointing to Azure Firewall is correct because it centralizes East-West traffic inspection. In this topology, spoke VNets peer with a hub VNet that hosts Azure Firewall, and UDRs on the spoke subnets force all inter-spoke traffic through the firewall's private IP as the next hop. This satisfies the requirement to inspect all inter-subnet traffic between different virtual networks using a centralized NGFW.

Exam trap

The trap here is confusing AWS terminology (VPC peering, full mesh) with Azure VNet peering, and assuming that peering alone provides inspection — peering is direct and bypasses firewalls unless UDRs force traffic through a virtual appliance.

How to eliminate wrong answers

Option B is wrong because full mesh VPC peering (a term borrowed from AWS; Azure uses VNet peering) creates direct spoke-to-spoke paths that bypass any centralized firewall, defeating the inspection requirement. Option C is wrong because ExpressRoute Local circuits provide private connectivity from on-premises to an Azure region and have nothing to do with inspecting East-West traffic between Azure VNets. Option D is wrong because default VNet peering without route tables allows direct spoke-to-spoke communication that never traverses a firewall, so no inspection occurs.

Full explanation →
71
MCQeasy

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

A.Azure Information Protection (AIP)
B.Azure Active Directory (Microsoft Entra ID) Identity Protection
C.Azure Key Vault (Managed HSM or Standard Vault)
D.Azure Sentinel (Microsoft Sentinel)
AnswerC

Azure Key Vault stores and controls customer-managed keys, with Managed HSM providing FIPS 140-2 Level 3 validated hardware protection. Integrating it with Storage Accounts enables envelope encryption where the key-encryption key never leaves the HSM, satisfying the auditor's hardware-module requirement.

Why this answer

Azure Key Vault (either a Standard vault or a Managed HSM pool) is the Azure service that stores and manages customer-managed keys (CMK) used for Storage Account encryption at rest. Storage Accounts integrate natively with Key Vault via a system-assigned or user-assigned managed identity, allowing the storage service to unwrap the CMK for encryption/decryption without exposing the key. Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules when the auditor requires keys stored in dedicated HSM hardware.

Exam trap

The trap is confusing data classification/labeling services (AIP/Purview) or identity risk services (Identity Protection) with key management — only Key Vault (or Managed HSM) stores and controls the CMK used for storage encryption.

How to eliminate wrong answers

Option A is wrong because Azure Information Protection (now part of Microsoft Purview Information Protection) is a data classification and labeling service for documents and emails — it does not store encryption keys for Storage Account at-rest encryption. Option B is wrong because Entra ID Identity Protection is a risk-detection and conditional access service for user identities; it has no role in managing storage encryption keys. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for security analytics and incident response — it does not provide key management or HSM-backed key storage.

Full explanation →
72
MCQhard

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

A.Resource Public Key Infrastructure (RPKI) with Route Origin Validation (ROV)
B.DNSSEC zone signing across all authoritative name servers
C.OSPFv3 authentication trailers using HMAC-SHA-256
D.IPsec Transport Mode with pre-shared keys
AnswerA

RPKI signs Route Origin Authorisations binding prefixes to authorised origin ASNs, and ROV on edge routers drops or deprioritises BGP announcements whose origin does not match a valid ROA. This cryptographically verifies prefix origin, directly countering the hijacking attempt described in the stem.

Why this answer

RPKI with Route Origin Validation (ROV) is the cryptographic mechanism that binds IP prefixes to their authorized origin AS numbers via signed Route Origin Authorizations (ROAs). Edge routers performing ROV query RPKI validators (e.g., Routinator, OctoRPKI) and mark BGP announcements as Valid, Invalid, or NotFound, allowing operators to drop Invalid routes and prevent prefix hijacking. This directly addresses origin authentication of BGP announcements.

Exam trap

CND often tests the confusion between DNS security (DNSSEC) and routing security (RPKI) — candidates pick DNSSEC because it sounds like the cryptographic origin-validation answer, but it protects DNS, not BGP.

How to eliminate wrong answers

Option B is wrong because DNSSEC signs DNS zone data to prevent DNS spoofing/cache poisoning — it has no role in BGP route origin validation. Option C is wrong because OSPFv3 authentication secures OSPFv3 LSAs within an IGP domain, not inter-domain BGP prefix origin. Option D is wrong because IPsec Transport Mode encrypts/authenticates point-to-point IP packets but does not validate BGP prefix ownership or origin AS.

Full explanation →
73
MCQeasy

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

A.Patch Management Policy
B.Information Security Policy
C.Remote Access Policy
D.Firewall Configuration Policy
AnswerB

An Information Security Policy is the umbrella document that defines data classification tiers, handling rules and disposal requirements, giving the administrator the baseline mandate from which standards and procedures flow. It directly satisfies the stem's need to govern classification, handling and disposal before drafting narrower supporting policies.

Why this answer

An Information Security Policy is the top-level, umbrella document that establishes the organization's overall security objectives, scope, roles, and principles — including how data is classified, handled, and disposed of. All other policies (patch management, remote access, firewall configuration) derive from and must align with it. Drafting it first creates the baseline expectations that subordinate policies implement.

Exam trap

The trap is that all four options are legitimate policy types, so candidates must recognize the hierarchy — the question asks for the foundational policy that establishes baseline expectations, not a domain-specific one.

How to eliminate wrong answers

Option A is wrong because a Patch Management Policy is a subordinate, tactical policy that addresses vulnerability remediation timelines and does not govern data classification or disposal. Option C is wrong because a Remote Access Policy governs how users connect to the network, not how data is classified and handled. Option D is wrong because a Firewall Configuration Policy is a technical control document that specifies rule standards, not an overarching governance framework.

Full explanation →
74
MCQeasy

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

A.Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings
B.Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services
C.User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker
D.Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives
AnswerD

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives contains the "Require additional authentication at startup" setting, where the TPM startup PIN is enforced. This path satisfies the stem's requirement to mandate a startup PIN on TPM-equipped systems through Group Policy.

Why this answer

To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Full explanation →
75
MCQeasy

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

A.Identifying and cataloging all network assets, data flows, and current vulnerabilities
B.Conducting incident containment following a zero-day breach
C.Deploying next-generation firewalls across core network segments
D.Decommissioning obsolete routers and end-of-life switches
AnswerA

Assessment and Analysis establishes the baseline the rest of the lifecycle depends on. Cataloguing network assets, mapping data flows and recording current vulnerabilities gives defenders the visibility needed to prioritise later protection, detection and response activities.

Why this answer

The Assessment and Analysis phase of the Network Defense Lifecycle is the discovery and baseline phase: you must inventory assets, map data flows, and identify current vulnerabilities before you can design or deploy defenses. Without this baseline, subsequent phases (design, implementation, monitoring) lack the context to prioritize controls. This aligns with frameworks like NIST CSF's Identify function and the CND methodology's emphasis on situational awareness first.

Exam trap

CND often tests the misconception that the first lifecycle phase involves deploying tools or responding to incidents — candidates confuse 'assessment' with 'implementation' or 'response,' when the correct answer is always about discovery, inventory, and baseline analysis.

How to eliminate wrong answers

Option B is wrong because incident containment belongs to the response/recovery phase, not the initial assessment phase — you cannot contain an incident before you have assessed the environment. Option C is wrong because deploying next-gen firewalls is an implementation activity that occurs after assessment and design, not during the initial analysis phase. Option D is wrong because decommissioning obsolete equipment is a lifecycle/asset management action that follows assessment findings, not the assessment itself.

Full explanation →

Page 1 of 5

Page 2

All pages

12345

Practice CND by domain

Target a specific domain to shore up weak areas.

Enterprise Cloud Virtual And Wireless Network ProtectionNetwork Security Controls Protocols And DevicesNetwork Defense ManagementIncident Detection Response And Threat PredictionNetwork Attacks And Defense StrategiesApplication And Data ProtectionEndpoint ProtectionNetwork Perimeter Protection
See all domains with question counts →