EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) CND Questions 76–150 | Page 2/5

MCQeasy

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

A.Network Intrusion Prevention System (NIPS)

B.Packet filtering router

C.Traditional Stateful Packet Inspection Firewall

D.Web Application Firewall (WAF)

AnswerD

A Web Application Firewall parses HTTP and HTTPS requests at Layer 7, matching payloads against SQL injection signatures and blocking them before they reach the web server. Unlike a network firewall, which filters only by IP address and port, a WAF satisfies the stem's requirement for application-layer inspection and signature-based dropping.

Why this answer

A Web Application Firewall (WAF) operates at Layer 7 and inspects HTTP/HTTPS requests for application-layer attacks like SQL injection, XSS, and command injection, dropping malicious requests before they reach the web server. It understands HTTP semantics (headers, parameters, cookies, bodies) and can apply signature-based and anomaly-based rules specifically tuned for web applications.

Exam trap

CND often tests the boundary between NIPS and WAF — candidates pick NIPS because it 'inspects traffic,' but only a WAF is designed to parse HTTP application-layer content and drop SQLi before it reaches the web server.

How to eliminate wrong answers

Option A is wrong because a NIPS inspects network traffic for protocol and exploit signatures at Layers 3–7 but is not purpose-built to parse HTTP application semantics like a WAF; it may miss obfuscated SQLi in POST bodies and lacks WAF-specific rule sets. Option B is wrong because a packet filtering router only examines Layer 3/4 headers (IP, port, protocol) and cannot inspect HTTP payloads at all. Option C is wrong because a traditional stateful firewall tracks connection state at Layers 3/4 but does not perform deep application-layer inspection of HTTP content, so SQL injection signatures pass through undetected.

Full explanation →

Multi-Selecthard

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

Select 2 answers

A.Immediately format all backup tape repositories to delete potentially corrupted backup indexes.

B.Immediately isolate infected endpoints from the network by disconnecting physical links or invoking EDR containment features.

C.Delete all firewall access control lists to allow unrestricted threat intelligence sharing.

D.Pay the ransom immediately to obtain decryption keys before beginning forensic analysis.

E.Revoke active user sessions and disable compromised user credentials in Active Directory.

AnswersB, E

Severing network connectivity halts lateral spread and blocks command-and-control or encryption traffic to still-connected shares. Disconnecting physical links or triggering EDR network containment satisfies the stem's immediate containment requirement, isolating compromised endpoints before eradication and recovery proceed.

Why this answer

Option B is correct because isolating infected endpoints by disconnecting physical links or using EDR containment features stops the ransomware from spreading laterally across the network and preserves the affected systems for forensic analysis. Option E is correct because revoking active user sessions and disabling compromised credentials in Active Directory prevents attackers from continuing to authenticate, move laterally, or re-encrypt resources using stolen accounts. Option A is wrong because formatting backup repositories destroys the very recovery data needed to restore encrypted shares and endpoints, and corrupted indexes should be preserved for investigation.

Option C is wrong because deleting firewall ACLs removes critical network segmentation and access controls, increasing exposure rather than containing the incident. Option D is wrong because paying the ransom is not an immediate containment or eradication action, does not guarantee decryption, and can fund criminal activity while destroying forensic evidence.

Exam trap

CND often tests whether candidates confuse destructive actions (formatting backups, paying ransom) with legitimate containment steps, or whether they overlook the credential-based persistence that ransomware operators rely on after initial encryption.

Full explanation →

Multi-Selecthard

A GCP cloud security team is auditing a Kubernetes cluster running in Google Kubernetes Engine (GKE). Which THREE security hardening steps should be verified to ensure robust cluster security? (Choose THREE)

Select 3 answers

A.Enable Workload Identity for secure pod-to-GCP-service authentication

B.Expose the Kubernetes master control plane endpoint with public IP accessible from 0.0.0.0/0

C.Configure GKE Private Cluster with master authorized networks enabled

D.Implement Binary Authorization to ensure only cryptographically signed container images are deployed

E.Disable Kubernetes Role-Based Access Control (RBAC) to simplify pod management

AnswersA, C, D

Workload Identity binds Kubernetes service accounts to Google Cloud IAM service accounts, issuing short-lived federated tokens instead of static JSON keys stored in Secrets. This satisfies the stem's pod-to-GCP-service authentication requirement, eliminating long-lived credentials that attackers could exfiltrate from the cluster.

Why this answer

Option A is correct because Workload Identity binds a Kubernetes service account to a Google Cloud IAM service account, letting pods authenticate to GCP APIs via short-lived OAuth 2.0 tokens instead of static, long-lived service account keys. Option C is correct because a GKE Private Cluster gives nodes internal-only IPs and keeps the control plane reachable only through authorized networks, drastically shrinking the external attack surface. Option D is correct because Binary Authorization enforces a deploy-time policy that admits only container images signed by trusted attestors, preventing unsigned or tampered images from running.

Option B is wrong because exposing the master endpoint to 0.0.0.0/0 removes network isolation and invites brute-force and exploitation attempts against the API server. Option E is wrong because disabling RBAC eliminates least-privilege authorization and lets any authenticated principal perform unrestricted actions, weakening rather than hardening the cluster.

Exam trap

CND often tests the misconception that exposing the control plane publicly is acceptable if strong authentication is used — candidates pick option B thinking 'we have RBAC and strong passwords,' but the exam expects recognition that public control plane exposure is a hardening failure regardless of auth strength.

Full explanation →

MCQeasy

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

A.Stop and disable the Windows Plug and Play service

B.Enable BitLocker To Go on all internal drives

C.Disable the USB Enhanced Host Controller Interface (EHCI) in BIOS across all endpoints

D.Configure 'Prevent installation of devices using drivers that match these device setup classes' for USB storage class

AnswerD

Blocking the USB storage device setup class prevents installation of mass storage drivers while leaving smart cards and input devices untouched, since those belong to different device classes. This satisfies the policy's requirement to block only USB mass storage.

Why this answer

Group Policy's 'Prevent installation of devices using drivers that match these device setup classes' setting lets administrators block entire device setup classes (like USB mass storage, GUID {53f56307-b6bf-11d0-94f2-00a0c91efb8b}) while allowing other USB classes such as smart cards and HID input devices. This is the precise, class-based approach required by the policy.

Exam trap

CND often tests whether candidates choose a surgical, class-based GPO restriction versus blunt-force options (disabling PnP, EHCI, or reinstalling the OS) that break legitimate USB devices.

How to eliminate wrong answers

Option A is wrong because disabling Plug and Play would break all device detection, including keyboards, mice, and smart cards — far too broad and disruptive. Option B is wrong because BitLocker To Go encrypts removable drives but does not block them; users could still mount unencrypted or unauthorized USB storage. Option C is wrong because disabling EHCI in BIOS disables all USB 2.0 ports, blocking keyboards, mice, and smart cards along with storage — it also fails on USB 3.0 (xHCI) systems.

Full explanation →

MCQmedium

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

A.Detection and Analysis

B.Preparation

C.Post-Incident Activity

D.Recovery

AnswerD

After eradication removes the malware and closes the entry point, NIST SP 800-61 moves to recovery: restoring systems, validating they are clean, and returning them to production. Containment and lessons learned occur at other stages.

Why this answer

After eradication, the next immediate phase in the NIST SP 800-61 lifecycle is Recovery. Recovery involves restoring systems to normal operation, validating that they are clean, and monitoring for any residual issues. This follows containment and eradication.

Exam trap

CND often tests the order of NIST SP 800-61 phases, and candidates may jump to Post-Incident Activity prematurely, skipping Recovery, which is the immediate next step after eradication.

How to eliminate wrong answers

Option A (Detection and Analysis) is wrong because it is an earlier phase that occurs before containment and eradication. Option B (Preparation) is incorrect because it is the first phase, conducted before an incident occurs. Option C (Post-Incident Activity) is wrong because it comes after recovery, focusing on lessons learned and evidence retention.

Full explanation →

MCQhard

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

A.Configuration Management Baseline Drift

B.Audit and Accountability Retention Policy Violation

C.Network Redundancy Fault Tolerance Failure

D.Access Control Discretionary Discrepancy

AnswerB

Purging logs after 7 days breaches the retention control within the audit and accountability family, which mandates preserving security audit records for defined periods. The 365-day compliance requirement is unmet, so the failure is specifically a retention policy violation.

Why this answer

The scenario describes security audit logs being purged after 7 days when compliance requires 365-day retention. This is a direct failure of the audit and accountability retention policy — the organization's logging retention controls do not meet the mandated retention period. The control family (Audit and Accountability) and the specific failure (retention policy violation) match exactly.

Exam trap

The trap is overthinking the scenario and picking a technical control failure (configuration drift, redundancy) when the question is really about a governance/policy control — candidates must map the symptom (logs purged too soon) to the correct control family (Audit and Accountability).

How to eliminate wrong answers

Option A is wrong because configuration management baseline drift refers to systems deviating from a hardened configuration baseline, not to log retention periods. Option C is wrong because network redundancy fault tolerance failure concerns availability and failover, not log retention. Option D is wrong because access control discretionary discrepancy refers to improper discretionary access controls (e.g., file permissions), not audit log retention.

Full explanation →

MCQeasy

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

A./etc/fstab

B./boot/grub/grub.cfg

C./etc/modprobe.d/blacklist.conf

D./etc/sysctl.conf

AnswerC

Blacklisting modules in `/etc/modprobe.d/blacklist.conf` prevents the kernel from loading USB storage and Bluetooth drivers at boot, directly reducing the minimal Linux kernel's attack surface. This file is read by modprobe during module initialisation, satisfying the industrial IoT constraint of disabling unnecessary kernel modules.

Why this answer

Kernel module blacklisting on Linux is configured in files under /etc/modprobe.d/, conventionally /etc/modprobe.d/blacklist.conf, using the 'blacklist <module>' directive. This prevents the module from being auto-loaded by udev or other mechanisms during boot or hotplug events. For a minimal IoT kernel, this is the standard way to disable USB storage (usb-storage) and Bluetooth (bluetooth, btusb) modules.

Exam trap

The trap is confusing kernel module configuration with bootloader or sysctl configuration — candidates often pick grub.cfg because it 'controls boot behavior', but module blacklisting lives in /etc/modprobe.d/.

How to eliminate wrong answers

Option A is wrong because /etc/fstab defines filesystem mount points and options at boot, not kernel module loading behavior. Option B is wrong because /boot/grub/grub.cfg is the generated GRUB bootloader configuration — while you can pass kernel parameters like 'modprobe.blacklist=' on the kernel command line, the canonical and persistent configuration file for module blacklisting is in /etc/modprobe.d/. Option D is wrong because /etc/sysctl.conf configures runtime kernel parameters (e.g., net.ipv4.ip_forward, kernel.randomize_va_space), not module loading.

Full explanation →

MCQhard

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

A.External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.

B.External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.

C.External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.

D.External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.

AnswerD

The external firewall filters internet traffic into the DMZ, while the internal firewall permits only required service ports from the DMZ to the internal network. This back-to-back arrangement ensures a compromised DMZ host cannot freely reach internal systems.

Why this answer

In a dual-firewall DMZ architecture, the external firewall should inspect and restrict traffic from the internet to the DMZ, while the internal firewall should restrict traffic from the DMZ to the internal network to only required service ports. This implements defense-in-depth: the external firewall protects the DMZ from internet threats, and the internal firewall prevents a compromised DMZ host from pivoting into the internal network. This segmentation is a security best practice.

Exam trap

The trap is assuming that any traffic from DMZ to internal network should be completely blocked, which is option C; however, best practice allows only required service ports, not a blanket block, to maintain functionality while minimizing risk.

How to eliminate wrong answers

Option A is wrong because a transparent bridge on the external firewall does not provide inspection or restriction of traffic; also, NAT on the internal firewall for internet-bound traffic is inefficient and does not align with best practices. Option B is wrong because the external firewall should not route internal traffic; its role is to protect the DMZ, and a honeypot gateway on the internal firewall is not a standard security control. Option C is wrong because permitting all traffic to the DMZ from the external firewall is insecure; the external firewall should restrict and inspect traffic, not allow all.

Additionally, blocking all traffic from DMZ to internal network is overly restrictive and may break necessary services; best practice is to allow only required ports.

Full explanation →

Multi-Selecteasy

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

Select 2 answers

A.Instantaneous identification of exact malware families by name without analysis

B.Ability to detect previously unknown (zero-day) attacks based on baseline deviations

C.Zero computational resource overhead

D.Complete absence of false positive alerts in any network environment

E.Tailored baseline profiling specific to the organization's unique network traffic patterns

AnswersB, E

Anomaly-based detection models normal traffic and flags statistically significant deviations, so malicious behaviour matching no existing signature still triggers alerts. This satisfies the stem's zero-day benefit: signature-based systems only match known patterns, whereas baseline deviation catches novel attack activity.

Why this answer

Option B is correct because anomaly-based detection compares live traffic against a learned baseline of normal behavior, so deviations can reveal zero-day or previously unknown attacks for which no signature exists yet. Option E is correct because anomaly-based systems build profiles from the organization's own traffic, allowing detection thresholds and models to reflect that environment's unique protocols, hosts, and usage patterns. Options A, C, and D are not correct: anomaly-based detection does not name exact malware families instantaneously (that is signature matching), it typically consumes significant CPU/memory for baselining and statistical analysis, and it is well known for generating false positives when legitimate behavior deviates from the baseline.

Exam trap

CND often tests the misconception that anomaly-based detection eliminates false positives or has no overhead, when in reality it trades signature accuracy for baseline-driven detection that can be noisy and resource-intensive.

Full explanation →

MCQhard

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

A.Security Policy rule -> Actions tab -> Profile Setting (Antivirus, Vulnerability Protection)

B.Zone Protection Profile attached to the external zone

C.NAT Policy translation destination field

D.Network Interfaces configuration tab

AnswerA

Security profiles are attached per-rule under the Actions tab's Profile Setting, where Antivirus and Vulnerability Protection are selected. This binds signature-based scanning and exploit prevention to the rule matching web-browsing traffic, satisfying the requirement to inspect and block known threats.

Why this answer

In Palo Alto Networks PAN-OS, threat profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis) are attached to a Security Policy rule under the Actions tab in the Profile Setting section. This is where the firewall applies content inspection to traffic matching the rule, enabling signature-based malware detection and vulnerability exploit prevention.

Exam trap

CND often tests whether candidates know where threat profiles live in PAN-OS — the trap is confusing zone-based protections (Zone Protection Profile) with rule-based content inspection (Security Policy Actions tab).

How to eliminate wrong answers

Option B is wrong because Zone Protection Profiles are attached to zones (Network > Zones) and protect against flood, reconnaissance, and packet-based attacks — they do not perform content inspection for malware or exploits. Option C is wrong because NAT Policy handles address and port translation, not security inspection; the destination translation field has nothing to do with threat profiles. Option D is wrong because Network Interfaces configuration handles Layer 1-3 settings (IP, zones, virtual routers), not security rule actions or threat inspection.

Full explanation →

MCQeasy

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

A.Windows PowerShell Operational Log (Event ID 4104)

B.System Event Log (Event ID 7045)

C.Security Event Log (Event ID 4688)

D.Windows Defender Operational Log (Event ID 1116)

AnswerA

Event ID 4104 in the PowerShell Operational log records script block logging, capturing the decoded content of obfuscated or encoded commands. This directly satisfies the analyst's need to read the plaintext script, which the command-line process auditing (4688) and transcription logs would not reliably reconstruct.

Why this answer

The Windows PowerShell Operational Log records script block logging events, specifically Event ID 4104, which captures the decoded contents of script blocks executed by PowerShell. When an encoded command is run, PowerShell decodes it internally, and if script block logging is enabled, the decoded script is written to this log. This makes Event ID 4104 the correct source for retrieving the actual script contents, not just the encoded command line.

Exam trap

CND often tests the misconception that process creation logging (Event ID 4688) captures decoded script contents, when in fact it only shows the command line as executed, which may be encoded.

How to eliminate wrong answers

Option B is wrong because System Event Log Event ID 7045 indicates a new service was installed, which is unrelated to PowerShell script content. Option C is wrong because Security Event Log Event ID 4688 logs process creation, including the command line, but does not decode encoded PowerShell scripts. Option D is wrong because Windows Defender Operational Log Event ID 1116 reports malware detection events, not PowerShell script block contents.

Full explanation →

Multi-Selectmedium

An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)

Select 2 answers

A.ARP cache poisoning by validating ARP reply frames against DHCP snooping bindings.

B.Cross-Site Scripting (XSS) by inspecting parameters for malicious injected client-side script tags.

C.BGP route hijacking by verifying autonomous system path announcements.

D.DHCP starvation attacks by monitoring DHCP Discover message rates on edge switches.

E.SQL Injection (SQLi) by parsing request parameters for database command syntax.

AnswersB, E

XSS attacks embed client-side script in request parameters, which browsers later execute. WAF rules inspect parameter values for injected script tags and block matching requests, satisfying the requirement to detect and block common web attacks.

Why this answer

Option B is correct because Cross-Site Scripting (XSS) is a classic Layer 7 web application attack in which malicious client-side script (e.g., <script> tags or JavaScript event handlers) is injected through request parameters, headers, or form fields, and a WAF is specifically designed to inspect HTTP/HTTPS traffic and block such payloads. Option E is correct because SQL Injection (SQLi) is another core web application attack where attackers embed database command syntax (such as UNION SELECT, OR 1=1, or stacked queries) into request parameters, and WAF rules tuned to parse and pattern-match these inputs can detect and block it. The other options do not belong: A (ARP cache poisoning) is a Layer 2 LAN attack mitigated by Dynamic ARP Inspection with DHCP snooping bindings, not by a WAF; C (BGP route hijacking) is a Layer 3 inter-domain routing attack mitigated by RPKI, route filtering, and BGPsec, not by a WAF; and D (DHCP starvation) is a Layer 2/3 attack mitigated by DHCP snooping rate limiting and port security on switches, not by a WAF.

Exam trap

CND often tests whether candidates can distinguish application-layer (WAF) controls from network-layer (DAI, uRPF, RPKI) controls — the trap is picking a Layer 2/3 mitigation for a Layer 7 attack type.

Full explanation →

MCQmedium

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

A.Azure Firewall with Application Rules

B.Azure Application Gateway with Web Application Firewall

C.Network Security Group (NSG) with custom service tags

D.User Defined Routes (UDR) pointing to a load balancer

AnswerA

Azure Firewall with Application Rules filters outbound traffic using FQDNs, satisfying the requirement for domain-based filtering rather than IP addresses. Application Rules operate at layer 7, inspecting HTTP/HTTPS and TLS SNI, which Network Rules (layer 3–4, IP-based) cannot do. This makes it the only listed resource that enforces FQDN egress control from the subnet.

Why this answer

Azure Firewall Application Rules operate at Layer 7 and support fully qualified domain names (FQDNs) as target criteria, allowing outbound HTTP/HTTPS/SQL traffic to be filtered by domain name rather than IP. This is the only native Azure resource that natively supports FQDN-based outbound filtering at the network level. Azure Firewall resolves FQDNs via its own DNS proxy and applies allow/deny rules per domain, which is essential when destinations use dynamic IPs (e.g., Microsoft 365, SaaS endpoints).

Exam trap

The trap is confusing inbound Layer 7 inspection (Application Gateway/WAF) with outbound Layer 7 filtering (Azure Firewall Application Rules) — candidates often pick the WAF because it also operates at Layer 7, but it does not filter egress by FQDN.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway with WAF is an inbound Layer 7 load balancer and reverse proxy for web applications — it does not provide outbound FQDN filtering for arbitrary subnet traffic. Option C is wrong because Network Security Groups are Layer 3/4 stateful packet filters that operate on IP addresses, ports, and service tags — they cannot match on FQDN. Option D is wrong because User Defined Routes control the next-hop path of traffic (e.g., forcing traffic through a firewall or NVA) but do not themselves perform FQDN-based filtering; a UDR alone cannot inspect domain names.

Full explanation →

Multi-Selecthard

An organization is establishing forensic readiness to ensure that digital evidence can be legally and technically sound during an investigation. Which THREE practices directly contribute to organizational forensic readiness? (Choose three)

Select 3 answers

A.Disabling audit logging on workstations to preserve local system storage space

B.Relying exclusively on volatile RAM analysis without retaining disk images or backups

C.Enforcing strict chain of custody documentation procedures for all acquired evidence

D.Implementing synchronized Network Time Protocol (NTP) across all network devices and hosts

E.Ensuring centralized, tamper-evident log archiving policies are actively maintained

AnswersC, D, E

Chain of custody documentation records every transfer and handling of evidence, preserving its integrity and admissibility. This directly satisfies the stem's requirement that evidence remain legally sound, since unbroken custody proves the artefacts were not altered before or during investigation.

Why this answer

Option C is correct because strict chain of custody documentation is a foundational forensic readiness practice: it records who handled each piece of evidence, when, where, and how, preserving its integrity and admissibility so the evidence can withstand legal scrutiny. Option D is correct because synchronized NTP across all network devices and hosts ensures consistent, correlatable timestamps, which is essential for reconstructing event timelines and for log evidence to be technically and legally credible. Option E is correct because centralized, tamper-evident log archiving preserves log integrity, prevents alteration or deletion, and supports the availability and authenticity of evidence needed during an investigation.

Option A is not correct because disabling audit logging destroys the very records needed for an investigation and undermines forensic readiness. Option B is not correct because relying exclusively on volatile RAM analysis discards persistent disk images and backups, losing evidence that survives reboots and weakening the overall forensic capability.

Exam trap

CND often tests the misconception that forensic readiness is only about tools — candidates overlook governance practices like chain of custody and NTP synchronization, or they pick options that sound efficient (RAM-only analysis) but actually destroy evidence.

Full explanation →

Multi-Selecteasy

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

Select 2 answers

A.It is deployed on the core internal network without any logging or monitoring.

B.It is used exclusively as a high-performance database cluster for enterprise clients.

C.It replaces the need for any firewalls or perimeter security defenses.

D.It consists of multiple interconnected decoy systems simulating an entire network environment.

E.It provides a broader view of attacker techniques and lateral movement across multiple systems.

AnswersD, E

Multiple interconnected decoy systems let defenders observe lateral movement, credential reuse and multi-stage attack chains across hosts, which a single honeypot cannot capture. This satisfies the stem's requirement for a network-scale deception environment, distinguishing the honeynet's breadth of telemetry from one isolated decoy.

Why this answer

Option D is correct because a honeynet is by definition a collection of two or more honeypots deployed together and interconnected to emulate a realistic network segment, complete with servers, services, and topology, rather than a single isolated decoy host. Option E is correct because this multi-system design lets defenders observe attacker behavior across hosts, including reconnaissance, pivoting, and lateral movement, yielding richer threat intelligence than a lone honeypot can provide. The unmarked options do not belong: A is wrong because honeynets are heavily instrumented with logging, monitoring, and often IDS/IPS sensors, and are typically placed in a controlled DMZ or isolated segment rather than the unprotected core internal network; B is wrong because a honeynet is a deception and threat-intelligence tool, not a production database cluster; and C is wrong because a honeynet is a complementary detection layer and never replaces firewalls or perimeter defenses.

Exam trap

CND often tests the distinction between a honeypot (single decoy) and a honeynet (network of decoys), and candidates may incorrectly assume that a honeynet replaces other security controls or is deployed on the core network without monitoring.

Full explanation →

Multi-Selectmedium

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

Select 2 answers

A.Allowing anonymous public read access on all blob containers by default

B.Removing all Azure Key Vault cryptographic keys

C.Configuring Azure Storage Firewall rules to restrict access to specific Virtual Networks and IP ranges

D.Enabling Microsoft Defender for Storage for threat detection

E.Disabling HTTPS traffic so clients communicate exclusively over unencrypted HTTP

AnswersC, D

Storage firewall rules restrict the data plane to approved virtual networks and public IP ranges, blocking access from arbitrary internet addresses. This satisfies the stem's requirement by shrinking the reachable attack surface, complementing identity controls against unauthorised access and exfiltration.

Why this answer

Option C is correct because configuring Azure Storage Firewall rules (network rules on the storage account) restricts access to specified virtual networks, subnets, and public IP ranges, blocking unauthorized clients and reducing data exfiltration paths. Option D is correct because Microsoft Defender for Storage provides threat detection for anomalous access, suspicious exfiltration attempts, and malicious activity against blobs, files, and other storage services. Option A is wrong because allowing anonymous public read access by default exposes blob data to anyone and directly increases exfiltration risk.

Option B is wrong because removing Azure Key Vault cryptographic keys would break encryption and key management rather than improve protection. Option E is wrong because disabling HTTPS forces unencrypted HTTP traffic, weakening security and violating secure transport requirements.

Exam trap

The trap is that candidates see 'encryption' or 'Key Vault' options and assume they address exfiltration; the exam expects you to recognize that network restriction plus threat detection are the controls that actually prevent and detect unauthorized access.

Full explanation →

MCQhard

A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?

A.The attacker is conducting an ARP poisoning attack, and the firewall should enable dynamic ARP inspection on the internal interface

B.The attacker is attempting a TCP session hijack, and the firewall should allow the segments so the internal host can reset the connection

C.The attacker is performing a UDP amplification attack, and the firewall should rate-limit the source address rather than drop the segments

D.The attacker is performing a TCP FIN scan to map open ports, and the stateful firewall correctly drops the invalid segments before they reach internal hosts

AnswerD

A FIN scan sends a bare FIN segment to a port without completing a handshake; an open port ignores it while a closed port replies with RST, revealing port state. SYN-FIN combinations are likewise malformed. A stateful firewall tracks that no session exists for these segments and drops them, which is the correct defensive behavior and prevents the scan from reaching internal hosts.

Why this answer

TCP FIN and SYN-FIN segments without an established session are classic stealth scan techniques used to infer port state from RST responses. A stateful firewall that tracks connection state recognizes these segments as not belonging to any session and drops them, preventing the scan from reaching internal hosts. Session hijacking, UDP amplification, and ARP poisoning involve entirely different mechanisms and are not indicated by these flags.

Exam trap

The trap here is treating every anomalous TCP flag combination as a session hijack, when bare FIN and SYN-FIN segments are actually port-scanning techniques that a stateful firewall should drop.

Full explanation →

MCQhard

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

A.fdisk partition manager

B.gnupg keychain agent

C.cryptsetup-reencrypt

D.clevis and systemd-cryptsetup

AnswerD

Clevis binds the LUKS volume to TPM 2.0 PCR measurements, sealing the keys so systemd-cryptsetup unlocks the disk automatically at boot without a passphrase. This satisfies the stem's requirement for unattended decryption via the TPM chip, unlike passphrase-only or network-bound alternatives.

Why this answer

Clevis and systemd-cryptsetup are used together to enable automatic decryption of LUKS-encrypted volumes using a TPM 2.0 chip. Clevis provides a framework for automated decryption, and systemd-cryptsetup integrates with systemd to unlock the volume during boot without manual passphrase entry.

Exam trap

CND often tests the specific tools required for TPM-based automatic decryption of LUKS, and candidates may confuse encryption management tools with decryption automation tools.

How to eliminate wrong answers

Option A is wrong because fdisk is a partition management tool and does not handle encryption key decryption. Option B is wrong because gnupg keychain agent is for managing GPG keys and is not used for LUKS automatic decryption via TPM. Option C is wrong because cryptsetup-reencrypt is used to re-encrypt LUKS volumes, not for automatic decryption during boot.

Full explanation →

Multi-Selectmedium

A GCP cloud administrator is setting up Cloud VPN to connect an on-premises datacenter to a GCP VPC. Which TWO components must be configured to establish a functional High Availability (HA) VPN gateway? (Choose TWO)

Select 2 answers

A.A GCP HA VPN gateway providing two public IP addresses automatically

B.A dedicated physical fiber interconnect cable

C.A GCP Cloud Router running Border Gateway Protocol (BGP)

D.A Google Cloud Armor security policy attached to the VPN gateway

E.A standalone legacy target VPN gateway with static routes

AnswersA, C

HA VPN requires a gateway with two interfaces, each holding a distinct public IP, so GCP automatically allocates two external addresses. This dual-interface design provides the redundancy needed for 99.99% SLA availability, satisfying the high-availability constraint in the scenario.

Why this answer

Option A is correct because a GCP HA VPN gateway is the required GCP-side resource for an HA VPN, and it automatically provisions two public IP addresses (one per interface) to provide 99.99% availability when both tunnels are configured. Option C is correct because HA VPN requires dynamic routing via a Cloud Router running BGP to exchange routes between the VPC and the on-premises network, and BGP sessions must be established on each tunnel interface. Option B is incorrect because a dedicated physical fiber interconnect cable is associated with Cloud Interconnect (Dedicated Interconnect), not Cloud VPN, which runs IPsec over the public internet.

Option D is incorrect because Cloud Armor is an edge security service for HTTP(S) load balancers and does not attach to VPN gateways. Option E is incorrect because a legacy target VPN gateway with static routes is the older, non-HA VPN construct and does not satisfy the HA VPN requirement.

Exam trap

CND often tests whether candidates confuse Cloud VPN (IPsec over internet, requires Cloud Router + BGP for HA) with Cloud Interconnect (dedicated/physical link), leading them to select the fiber interconnect option.

Full explanation →

Multi-Selecteasy

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

Select 2 answers

A.AlienVault Open Threat Exchange (OTX)

B.Internal employee performance reviews

C.Proprietary zero-day broker feeds requiring signed NDA and high subscription fees

D.Classified military signals intelligence intercepts

E.National Vulnerability Database (NVD)

AnswersA, E

AlienVault OTX is a free, publicly accessible platform where researchers share indicators of compromise, making it a canonical OSINT source. Its open contribution model and lack of subscription or clearance requirements distinguish it from closed or proprietary feeds.

Why this answer

AlienVault Open Threat Exchange (OTX) is correct because it is a free, publicly accessible community platform where researchers share indicators of compromise (IOCs) such as IP addresses, domains, and file hashes, making it a classic OSINT source for network defenders. The National Vulnerability Database (NVD), maintained by NIST, is also correct because it publicly publishes CVE records, CVSS severity scores, and CPE applicability data that defenders use for vulnerability management without any restricted access. Internal employee performance reviews are not OSINT since they are private organizational records, not publicly available intelligence.

Proprietary zero-day broker feeds requiring an NDA and subscription fees are closed-source (commercial) intelligence, not open-source. Classified military signals intelligence intercepts are classified government intelligence, which by definition falls outside OSINT.

Exam trap

CND often tests the boundary between 'free/public' and 'commercial/classified' intelligence, tricking candidates into selecting paid broker feeds or internal data because they sound like legitimate threat sources — the key discriminator is whether the source is openly accessible without NDA, payment, or clearance.

Full explanation →

MCQmedium

A security analyst at a financial firm is reviewing endpoint telemetry and observes a process named 'svchost.exe' with an unusual parent process and a command line containing a Base64-encoded string. The analyst suspects a fileless attack leveraging a built-in Windows utility. Which of the following endpoint detection techniques is MOST effective for identifying this type of malicious activity?

A.Signature-based antivirus scanning of the svchost.exe file on disk

B.Scanning the Windows Registry for autorun entries associated with svchost.exe

C.Reviewing Windows Defender Firewall logs for outbound connections from svchost.exe

D.Monitoring process creation events with command-line auditing and parent-child process relationships

AnswerD

Fileless attacks often use legitimate system binaries like PowerShell or WMI to execute malicious code. By auditing process creation events (e.g., via Windows Event ID 4688 or Sysmon Event ID 1) and analyzing command-line arguments and parent-child relationships, the analyst can spot anomalies such as a suspicious parent spawning svchost.exe with encoded commands. This behavioral approach detects the attack without relying on file signatures.

Why this answer

The attack uses a legitimate Windows binary with an encoded command line and an unusual parent process, which are hallmarks of fileless malware. Monitoring process creation with command-line auditing and parent-child relationships allows detection of such anomalous behavior. Signature-based scanning, firewall logs, and registry autorun checks do not provide the necessary process-level context to identify this activity.

Exam trap

The trap here is assuming that because svchost.exe is a legitimate system process, it cannot be malicious; attackers often abuse trusted binaries to evade detection.

Full explanation →

MCQhard

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

A.Uninstall the third-party disk encryption driver permanently

B.Boot into Safe Mode and adjust the EDR driver start type or use sensor configuration exclusions

C.Reinstall the Windows operating system with a clean image

D.Disable Secure Boot in UEFI settings

AnswerB

Safe Mode loads only essential drivers, preventing the EDR kernel driver and the encryption filter from loading together, which stops the boot-time BSOD. Adjusting the driver start type or applying sensor exclusions then isolates the conflict before normal boot resumes.

Why this answer

Booting into Safe Mode loads only essential drivers, preventing the EDR kernel-mode driver from starting and allowing administrative access to the system. Once in Safe Mode, the administrator can change the EDR driver's start type (e.g., from boot-start to demand-start) or apply sensor configuration exclusions to prevent the conflict with the third-party disk encryption filter driver. This isolates the conflicting driver without removing critical security controls or data protection.

Exam trap

CND often tests the misconception that disabling Secure Boot or reinstalling the OS is a quick fix for driver conflicts, but the correct first step is always to isolate the conflicting driver using Safe Mode and adjust its start type or exclusions.

How to eliminate wrong answers

Option A is wrong because uninstalling the third-party disk encryption driver permanently would remove full-disk encryption, exposing data at rest and violating compliance requirements; the conflict should be resolved without sacrificing encryption. Option C is wrong because reinstalling Windows with a clean image is a drastic, time-consuming action that would destroy existing configurations and data, and it does not guarantee the conflict won't recur if the same EDR and encryption drivers are reinstalled. Option D is wrong because disabling Secure Boot weakens platform security and does not address the driver conflict; Secure Boot is unrelated to the kernel-mode driver loading order or compatibility.

Full explanation →

Multi-Selecthard

An enterprise security team is hardening an Azure environment. Which THREE actions should be implemented to secure Azure Virtual Machines and management planes? (Choose THREE)

Select 3 answers

A.Disabling Azure Disk Encryption across all operating system disks

B.Enabling Microsoft Defender for Cloud for continuous posture management and threat detection

C.Opening TCP ports 22 and 3389 publicly on all NSGs for easy administrative troubleshooting

D.Implementing Just-In-Time (JIT) VM access to restrict standing administrative port access

E.Deploying Azure Bastion to handle secure browser-based RDP and SSH sessions without public IPs on VMs

AnswersB, D, E

Microsoft Defender for Cloud provides continuous secure score assessment and workload protection across VMs and control planes, satisfying the hardening requirement for posture management plus runtime threat detection spanning both the data and management planes.

Why this answer

Option B is correct because Microsoft Defender for Cloud provides continuous security posture management (secure score, regulatory compliance) and threat detection across Azure VMs and management planes, which is a core hardening control. Option D is correct because Just-In-Time (JIT) VM access in Defender for Cloud removes standing open management ports (22/3389) and grants time-bound, IP-restricted, request-approved access, directly reducing the attack surface. Option E is correct because Azure Bastion delivers browser-based RDP/SSH over TLS through the Azure portal, so VMs need no public IP addresses and management ports need not be exposed to the internet.

Option A is incorrect because disabling Azure Disk Encryption removes OS and data disk encryption at rest, weakening rather than hardening the VM. Option C is incorrect because publicly opening TCP 22 and 3389 on NSGs exposes SSH and RDP to internet scanning and brute-force attacks, the opposite of a hardening action.

Exam trap

CND often tests whether candidates recognize that 'ease of administration' justifications (opening 22/3389 publicly) are anti-patterns, and that disabling encryption is never a hardening action—catching those who prioritize convenience over security.

Full explanation →

MCQeasy

A small business wants to secure its web application against SQL injection without modifying application code. The application uses a MySQL database and receives user input through web forms. Which defensive measure should be implemented at the database layer to reduce the impact of SQL injection attacks?

A.Create a dedicated database account for the application with only the minimum required privileges.

B.Enable the MySQL general query log to record all SQL statements.

C.Change the MySQL default port from 3306 to a non-standard port.

D.Enable MySQL binary logging and perform daily backups.

AnswerA

Applying least privilege to the application's database account limits what an injected statement can do. If the account cannot drop tables, read other schemas, or use FILE privileges, the blast radius of a successful injection is greatly reduced. This is a database-layer control that works without changing application code and directly mitigates impact.

Why this answer

Least privilege on the application's database account constrains what injected SQL can accomplish, reducing impact even if input validation fails. Logging, port changes, and backups do not block or contain injection. This database-layer hardening is a practical compensating control when code cannot be modified.

Exam trap

The trap here is choosing logging or backups as a security control; they aid detection and recovery but do not reduce the impact of a SQL injection at execution time.

Full explanation →

100

MCQmedium

A security administrator is deploying a Mobile Device Management (MDM) solution for corporate-owned Android devices. The administrator needs to ensure that if a device is lost or stolen, corporate data can be remotely wiped while preserving the user's personal data. Which of the following MDM capabilities should the administrator implement?

A.Device encryption

B.Selective wipe (corporate data wipe)

C.Full device wipe

D.Remote lock

AnswerB

A selective wipe, also known as a corporate data wipe, removes only corporate data such as email, documents, and managed apps, while leaving personal data intact. This is ideal for scenarios where the device is lost or stolen and the organization wants to protect sensitive information without affecting the user's personal content. It directly satisfies the requirement.

Why this answer

A selective wipe (corporate data wipe) is designed to remove only corporate data from a device, leaving personal data untouched. This is the appropriate MDM capability when the goal is to protect corporate information on a lost or stolen device without destroying the user's personal data. Full device wipe, remote lock, and device encryption do not achieve selective removal.

Exam trap

The trap here is choosing full device wipe because it sounds more secure, but it fails to preserve personal data, which is explicitly required.

Full explanation →

101

Multi-Selecthard

An enterprise security architect is designing a Zero Trust network segmentation model. Which THREE core principles are foundational to Zero Trust architecture regarding network access and device verification? (Choose three)

Select 3 answers

A.Assuming breach and inspecting all traffic regardless of whether it originates internally or externally

B.Implicit trust of internal network segments once a user connects to the corporate LAN or VPN

C.Enforcement of least privilege access limiting users to only the specific applications they require

D.Continuous verification of user identity and device security posture for every access request

E.Static perimeter firewalls as the sole security control required to protect enterprise assets

AnswersA, C, D

Zero Trust removes implicit trust based on network location, so all traffic is inspected and treated as potentially hostile whether it originates inside or outside the perimeter. This satisfies the architecture's requirement that internal traffic receives no automatic trust during segmentation design.

Why this answer

Option A is correct because Zero Trust assumes breach and inspects all traffic regardless of whether it originates internally or externally, eliminating the notion of a trusted internal network. Option C is correct because least privilege access is a core Zero Trust principle that limits users to only the specific applications and resources they require, reducing lateral movement. Option D is correct because Zero Trust requires continuous verification of user identity and device security posture for every access request, rather than trusting a session after initial authentication.

Option B is incorrect because implicit trust of internal network segments after LAN or VPN connection directly contradicts Zero Trust. Option E is incorrect because static perimeter firewalls as the sole control reflect a traditional perimeter model, not Zero Trust.

Exam trap

CND often tests the misconception that connecting via VPN or being on the internal LAN grants implicit trust — candidates who select option B confuse traditional perimeter security with Zero Trust principles.

Full explanation →

102

Multi-Selectmedium

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

Select 2 answers

A.Traditional firewalls inspect layer 7 payloads while NGFWs are strictly restricted to layer 3 and layer 4 filtering.

B.NGFWs can identify applications regardless of port numbers using Deep Packet Inspection and heuristic analysis.

C.NGFWs rely exclusively on static access control lists based strictly on source IP, destination IP, and TCP/UDP ports.

D.Traditional firewalls require external proxy servers to perform SSL/TLS decryption, whereas NGFWs cannot inspect encrypted traffic.

E.NGFWs integrate user identity awareness (e.g., Active Directory integration) into firewall access control policies.

AnswersB, E

Deep Packet Inspection with heuristic analysis identifies the application itself, so NGFWs enforce policy on the actual protocol even when it tunnels over non-standard ports. This satisfies the differentiation criterion, unlike traditional firewalls that only inspect port and state.

Why this answer

Option B is correct because NGFWs use Deep Packet Inspection (DPI) and heuristic/behavioral analysis to identify applications by their traffic signatures and behavior, allowing them to recognize applications even when they run on non-standard ports or tunnel over HTTP/HTTPS, which traditional port-based firewalls cannot do. Option E is correct because NGFWs integrate user identity awareness, typically via Active Directory or LDAP integration, so access control policies can be written against users and groups rather than only IP addresses, adding an identity dimension to enforcement. Option A is wrong because it reverses the roles: traditional firewalls operate at layers 3 and 4, while NGFWs add layer 7 application inspection.

Option C is wrong because static ACLs based only on source/destination IP and TCP/UDP ports describe traditional firewalls, not NGFWs. Option D is wrong because NGFWs commonly perform SSL/TLS decryption and inspection themselves, and traditional firewalls do not require external proxy servers for that purpose.

Exam trap

CND often tests whether candidates can distinguish NGFW capabilities (App-ID, User-ID, TLS inspection) from traditional firewall capabilities (5-tuple ACLs), and distractors frequently invert the two.

Full explanation →

103

MCQmedium

A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?

A.TUN mode operates at Layer 3 (Network Layer) routing IP packets without layer 2 broadcast traffic.

B.TUN mode only supports TCP transport and cannot function over UDP connections.

C.TUN mode operates at Layer 2 (Data Link Layer) handling Ethernet frames and broadcasts.

D.TUN mode requires the use of MAC-level bridging across all connected client interfaces.

AnswerA

TUN mode presents a point-to-point Layer 3 interface, routing IP packets between peers and carrying no Ethernet frames. This satisfies the stem's constraint by eliminating Layer 2 broadcast and multicast traffic, unlike TAP mode, which bridges a virtual Layer 2 segment.

Why this answer

TUN mode is a Layer 3 (Network Layer) virtual interface that routes IP packets between the client and the VPN server, carrying only unicast IP traffic and no Layer 2 broadcast or multicast frames. This makes it ideal for remote-access VPNs where clients need routed access to corporate subnets, not bridged LAN access. TAP mode, by contrast, operates at Layer 2 and carries Ethernet frames including broadcasts.

Exam trap

CND often tests the Layer 2 vs. Layer 3 distinction between TAP and TUN, tricking candidates into picking the option that describes TAP mode (Ethernet frames, broadcasts, MAC bridging) when the question asks about TUN.

How to eliminate wrong answers

Option B is wrong because TUN mode is transport-agnostic — OpenVPN can run over UDP or TCP regardless of whether TUN or TAP is used; the mode determines the virtual interface layer, not the transport protocol. Option C is wrong because it describes TAP mode, not TUN mode — TAP operates at Layer 2 and handles Ethernet frames and broadcasts, which is the opposite of TUN. Option D is wrong because MAC-level bridging is a TAP mode capability (used for bridging VPN clients into a LAN segment); TUN mode does not bridge at Layer 2 and does not require MAC-level bridging.

Full explanation →

104

MCQmedium

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

A.Block all outbound TCP and UDP port 53 traffic globally across the entire perimeter firewall

B.Force all internal clients to query only designated internal DNS resolvers and block direct outbound port 53 to external IPs

C.Implement an HTTP web proxy to inspect all DNS packets at Layer 7

D.Enable spanning-tree root guard on all switch access ports

AnswerB

Restricting clients to internal resolvers and blocking direct outbound port 53 removes the tunnel's transport path, since internal resolvers can enforce filtering and logging. This satisfies the stem's constraint that the perimeter firewall currently permits DNS to any external IP.

Why this answer

The correct mitigation is to force all internal clients to use designated internal DNS resolvers and block direct outbound UDP/TCP 53 to external IPs at the perimeter. This prevents internal hosts from establishing arbitrary DNS tunnels to attacker-controlled authoritative servers while still allowing legitimate recursive resolution through controlled resolvers that can be monitored and filtered.

Exam trap

The trap is choosing the most aggressive control (block all port 53) rather than the surgical one (restrict to internal resolvers), or confusing DNS inspection with HTTP proxy inspection.

How to eliminate wrong answers

Option A is wrong because blocking all outbound port 53 globally would break legitimate DNS resolution for the entire organization, causing a self-inflicted denial of service. Option C is wrong because HTTP proxies operate at Layer 7 for HTTP/HTTPS traffic and do not inspect DNS packets — DNS tunneling uses the DNS protocol, not HTTP, so a web proxy is the wrong control. Option D is wrong because Spanning Tree root guard is a Layer 2 loop-prevention feature on switches and has no bearing on DNS exfiltration.

Full explanation →

105

MCQeasy

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

A.Delete the rule definition entirely from the Snort local rules file.

B.Modify the Snort rule configuration file to add a 'suppress' rule specifying the event signature ID and target IP.

C.Disable all preprocessor inspection engines within the snort.conf configuration file.

D.Change the sensor mode from inline IPS mode to passive IDS sniffing mode.

AnswerB

A suppress rule in snort.conf tells Snort to stop generating alerts for a specific signature ID, optionally scoped to a target IP, satisfying the stem's need to silence this false-positive signature. It disables alerting without deleting the rule, preserving detection elsewhere.

Why this answer

Snort's suppress directive allows analysts to silence a specific signature (by SID) for a specific target IP without removing the rule entirely. This preserves detection for other hosts while eliminating the false positive noise from the known-benign traffic to the database server. It is the surgical, recommended approach for tuning out false positives.

Exam trap

CND often tests whether candidates choose the nuclear option (deleting rules or disabling preprocessors) instead of the targeted suppress directive that preserves detection while eliminating the specific false positive.

How to eliminate wrong answers

Option A is wrong because deleting the rule removes detection capability entirely, so a real attack using that signature against other hosts would go unnoticed. Option C is wrong because disabling all preprocessor engines cripples Snort's ability to reassemble streams and detect protocol anomalies, causing massive detection gaps. Option D is wrong because switching from inline IPS to passive IDS changes the response mode but does nothing to suppress the specific false-positive signature.

Full explanation →

106

MCQmedium

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

A.Every 30 days continuously across all internal subnets

B.Annually following the completion of the fiscal budget review

C.At least every 6 months and after any significant infrastructure modification

D.Only upon the initial deployment of the cardholder data environment

AnswerC

PCI-DSS v4.0 Requirement 11.3 mandates external penetration testing at least every six months, plus after any significant infrastructure or application change. This recurring cadence and change-triggered retest satisfy the CDE's continuous assurance obligation, rather than the annual testing some frameworks accept.

Why this answer

PCI-DSS v4.0 Requirement 11.3.1 mandates that external penetration testing be performed at least once every 6 months and after any significant change to the CDE infrastructure or applications. This cadence ensures that newly exposed services or configuration changes are validated against real-world attack techniques. The other options misstate the frequency or scope.

Exam trap

PCI-DSS often tests the distinction between external (every 6 months) and internal (annually) penetration testing frequencies — candidates who remember 'annual' from older versions or confuse the two scopes pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because continuous 30-day testing across all internal subnets is not a PCI-DSS requirement — internal penetration testing is required at least annually (11.3.2), not monthly. Option B is wrong because tying testing to a fiscal budget review is arbitrary and not part of the standard; annual testing alone is insufficient for external scope. Option D is wrong because testing only at initial deployment ignores the requirement for recurring validation and post-change testing.

Full explanation →

107

Multi-Selectmedium

An enterprise is reviewing its Disaster Recovery (DR) and Business Continuity (BC) policies. During a risk assessment, the team calculates the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical database systems. Which THREE factors directly influence these metrics? (Choose three)

Select 3 answers

A.The brand name of office breakroom coffee machines

B.Criticality of the business application and financial impact of downtime

C.The geographic color of the exterior data center facility paint

D.Frequency and type of automated database backup schedules (e.g., continuous replication vs. nightly batch)

E.Hardware restoration speed and data recovery throughput capabilities

AnswersB, D, E

Application criticality and downtime cost determine how aggressively RTO and RPO targets are set: revenue-critical systems justify near-zero objectives, while low-impact workloads tolerate longer windows. This business-driven constraint directly shapes the risk assessment's metric calculations.

Why this answer

Option B is correct because the criticality of the business application and the financial impact of downtime directly drive how aggressively RTO and RPO targets are set — a revenue-critical database demands tighter objectives than a low-impact system. Option D is correct because backup frequency and type determine the maximum data loss window (RPO): continuous replication yields near-zero RPO, while nightly batch backups allow up to 24 hours of loss. Option E is correct because hardware restoration speed and data recovery throughput determine how quickly systems can be brought back online, directly bounding the achievable RTO.

Option A is incorrect because coffee machine branding has no bearing on recovery metrics, and option C is incorrect because exterior paint color is irrelevant to RTO/RPO calculations.

Exam trap

The trap is including obviously irrelevant options, but candidates may overthink and select them if they misinterpret the question as asking for all factors, not just the relevant ones.

Full explanation →

108

MCQmedium

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

A.Execute 'chmod -R 777 /' to reset all filesystem file permissions to secure defaults.

B.Run 'netstat -tulnp' to identify listening network ports associated with SUID processes.

C.Execute 'find / -perm /4000 -type f 2>/dev/null' to audit files with the SUID bit set.

D.Run 'iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT' to lock down network access.

AnswerC

The find command with -perm /4000 recursively scans the filesystem for regular files carrying the SUID bit, and 2>/dev/null suppresses permission errors. This enumerates every SUID binary so the engineer can identify and remove unauthorised ones, directly addressing the privilege escalation vector.

Why this answer

The command 'find / -perm /4000 -type f 2>/dev/null' searches the entire filesystem for regular files with the SUID bit set (octal 4000), redirecting permission-denied errors to /dev/null. This allows the engineer to audit and then remove SUID permissions from unauthorized binaries, directly mitigating the privilege escalation vector described.

Exam trap

The trap is picking a command that sounds security-related (like chmod 777 or iptables) without verifying it actually locates SUID binaries; candidates must recognize the octal 4000 permission and the find syntax.

How to eliminate wrong answers

Option A is wrong because 'chmod -R 777 /' sets all files to world-readable/writable/executable, which is a catastrophic security misconfiguration, not a hardening step. Option B is wrong because 'netstat -tulnp' lists listening TCP/UDP ports and associated processes; it does not identify SUID binaries. Option D is wrong because the iptables rule shown accepts established connections and does not address SUID permissions or privilege escalation at all.

Full explanation →

109

MCQhard

A security analyst reviewing firewall logs notices periodic outbound connections from an internal engineering workstation to a small set of foreign IP addresses, always at roughly 60-second intervals, with payload sizes that vary slightly and destinations that rotate through a hardcoded list. The traffic uses TCP port 443 but the TLS certificate presented by the remote endpoint is self-signed and the User-Agent string is unusual. Which technique is most consistent with these observations?

A.Domain fronting through a legitimate content delivery network

B.Command-and-control beaconing with jitter over a custom TLS channel

C.Fast-flux DNS used to rotate malicious A records for a botnet

D.A misconfigured software update agent polling a vendor server

AnswerB

Fixed-interval callbacks with slight payload variation indicate beacon jitter designed to frustrate pattern-based detection, while a self-signed certificate on port 443 signals a non-standard TLS implementation rather than a real web service. The rotating destination list is a fallback mechanism so the implant survives takedowns of individual C2 nodes, all of which is characteristic of custom command-and-control beaconing.

Why this answer

Regular, jittered callbacks to a rotating set of hardcoded foreign addresses over non-standard TLS strongly indicate malware beaconing to command-and-control infrastructure. The self-signed certificate and unusual User-Agent reinforce that this is not a legitimate cloud service. Analysts should block the destinations, isolate the host, and hunt for the implant rather than dismiss the pattern as normal application traffic.

Exam trap

The trap here is assuming that any traffic on TCP port 443 is legitimate web browsing, when port choice alone says nothing about whether the endpoint is trustworthy.

Full explanation →

110

Multi-Selecthard

An organization is aligning its defenses with the NIST SP 800-53 Rev. 5 'Access Control (AC)' control family. Which THREE controls are core requirements within this family? (Choose three)

Select 3 answers

A.AC-3: Access Enforcement

B.AC-2: Account Management

C.AC-5: Separation of Duties

D.PE-3: Physical Access Control

E.IR-4: Incident Handling

AnswersA, B, C

AC-3 Access Enforcement requires the system to enforce approved authorisations for logical access to information and system resources, making it a foundational control within the AC family that translates policy decisions into actual permit or deny outcomes.

Why this answer

AC-3 (Access Enforcement) is a core AC family control because it requires the system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, making it fundamental to the Access Control family. AC-2 (Account Management) is also core to AC because it governs the lifecycle of system accounts—creation, enabling, modification, disabling, and removal—which is prerequisite to enforcing access decisions. AC-5 (Separation of Duties) belongs to the AC family and is a core requirement that divides duties of individuals to prevent malevolent activity without collusion, directly addressing access control governance.

PE-3 (Physical Access Control) is not in the AC family; it belongs to the Physical and Environmental Protection (PE) family, so it does not satisfy the question. IR-4 (Incident Handling) is not in the AC family; it belongs to the Incident Response (IR) family and addresses incident handling capability rather than access control.

Exam trap

CND often tests control family identification by mixing in controls from other families (PE, IR), so candidates who do not memorize the family prefixes (AC, PE, IR) pick the wrong controls.

Full explanation →

111

MCQmedium

A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?

A.Event Source: s3.amazonaws.com, Event Name: PutBucketPolicy

B.Event Source: organizations.amazonaws.com, Event Name: AcceptHandshake

C.Event Source: iam.amazonaws.com, Event Name: CreateUser

D.Event Source: sts.amazonaws.com, Event Name: AssumeRole

AnswerD

Temporary credential acquisition via AWS Security Token Service is recorded as AssumeRole with event source sts.amazonaws.com. Searching CloudTrail for this pair reveals exactly which IAM users or roles obtained administrative sessions across accounts, satisfying the cross-account privilege audit requirement.

Why this answer

AWS STS AssumeRole events are logged in CloudTrail with eventSource sts.amazonaws.com and eventName AssumeRole, capturing when an IAM user or role assumes another role, including cross-account role assumption. Searching for this event identifies principals that have obtained administrative privileges via role assumption.

Exam trap

CND often tests the confusion between IAM management events (CreateUser, AttachPolicy) and STS role assumption events, causing candidates to search iam.amazonaws.com instead of sts.amazonaws.com for privilege assumption.

How to eliminate wrong answers

Option A is wrong because s3.amazonaws.com PutBucketPolicy logs changes to S3 bucket policies, not role assumption or privilege acquisition. Option B is wrong because organizations.amazonaws.com AcceptHandshake logs acceptance of AWS Organizations invitations, unrelated to assuming administrative roles. Option C is wrong because iam.amazonaws.com CreateUser logs creation of IAM users, which is a user management action, not the assumption of existing administrative privileges.

Full explanation →

112

MCQhard

A cloud security engineer is configuring a Google Cloud VPC firewall rule to allow traffic from an on-premises network to a specific subnet. The engineer wants to restrict access to only a set of known IP addresses. Which Google Cloud firewall rule component should the engineer use to define these IP addresses?

A.Source IPv4 ranges

B.Source tags

C.Source service accounts

D.Source service account and source tags combined

AnswerA

Source IPv4 ranges allow the engineer to specify one or more CIDR blocks that identify the source IP addresses of incoming traffic. This is the correct component to restrict access to known on-premises IP addresses because on-premises hosts communicate using IP addresses that can be represented as CIDR ranges. The firewall rule will then only allow traffic from those specified ranges.

Why this answer

Google Cloud VPC firewall rules use source IPv4 ranges to filter traffic based on source IP addresses. When traffic originates from an on-premises network, the source is an IP address or range, not a service account or tag. Therefore, specifying the known IP addresses as source IPv4 ranges is the correct way to restrict access.

The other options are used for internal Google Cloud resource identification and cannot match on-premises sources.

Exam trap

The trap here is confusing source tags or service accounts with source IP ranges; tags and service accounts only apply to Google Cloud resources, not on-premises hosts.

Full explanation →

113

MCQmedium

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

A.SSL/TLS Decryption (Inspection)

B.Layer 2 Bridging

C.Port Forwarding

D.Static NAT

AnswerA

SSL/TLS decryption terminates the encrypted session at the NGFW, decrypts the payload, applies DPI signatures, then re-encrypts before forwarding. Without it, HTTPS traffic remains opaque to signature matching, satisfying the stem's requirement to inspect encrypted session payloads rather than merely metadata.

Why this answer

SSL/TLS Decryption (Inspection) is the feature that allows an NGFW to decrypt encrypted traffic, inspect the plaintext payload against DPI signatures, and then re-encrypt it before forwarding. Without this, HTTPS traffic remains encrypted and DPI cannot see inside, so malicious payloads bypass detection. This is essential for enforcing security policies on encrypted sessions.

Exam trap

CND often tests the misconception that DPI can inspect encrypted traffic without decryption, or that other features like NAT or bridging can somehow enable payload inspection.

How to eliminate wrong answers

Option B is wrong because Layer 2 Bridging operates at the data link layer and simply forwards frames based on MAC addresses; it does not decrypt or inspect encrypted payloads. Option C is wrong because Port Forwarding is a NAT function that redirects traffic to a different port or host, but it does not decrypt SSL/TLS. Option D is wrong because Static NAT translates IP addresses one-to-one and has no capability to decrypt or inspect encrypted traffic.

Full explanation →

114

MCQmedium

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

A.Host-level containment

B.Network-level containment

C.Full enterprise quarantine

D.Application-level containment

AnswerB

Isolating an infected subnet severs network connectivity between that segment and the rest of the corporate network, which is precisely network-level containment. It blocks worm propagation across subnets without halting endpoint processes, distinguishing it from host-level or application-level containment.

Why this answer

Isolating an infected subnet from the rest of the corporate network is a network-level containment strategy because it restricts the blast radius at the network layer rather than on individual hosts or applications. This approach segments the network so the worm cannot spread laterally to other subnets while the team remediates the infected systems. It is a common early step in worm outbreak response.

Exam trap

CND often tests the distinction between containment scopes (host, network, enterprise, application), so the trap is choosing host-level containment when the action described affects an entire subnet rather than individual machines.

How to eliminate wrong answers

Option A is wrong because host-level containment involves isolating or shutting down individual infected machines, not an entire subnet. Option C is wrong because full enterprise quarantine would disconnect the entire organization from all networks, which is broader than isolating one subnet. Option D is wrong because application-level containment targets a specific application or service, not the network segment.

Full explanation →

115

MCQmedium

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

A.Management VLAN

B.Internal Trusted Zone

C.Demilitarized Zone (DMZ)

D.Guest Wireless Zone

AnswerC

The DMZ hosts public-facing services so that if compromised, attackers cannot directly access the internal LAN.

Why this answer

The Demilitarized Zone (DMZ) is the segmented network zone designed to host public-facing services such as web servers, mail relays, and reverse proxies. It sits between the untrusted internet and the trusted internal LAN, with distinct firewall contexts controlling traffic in each direction, so a compromise of a public server does not grant direct access to internal systems.

Exam trap

CND often tests zone placement, and the trap is confusing the DMZ with the internal trusted zone or management VLAN — public-facing services belong in the DMZ, never directly in the trusted LAN.

How to eliminate wrong answers

Option A (Management VLAN) is wrong because it is reserved for out-of-band management of network devices and hypervisors, not public-facing services. Option B (Internal Trusted Zone) is wrong because placing internet-facing servers there exposes the internal LAN directly to compromise. Option D (Guest Wireless Zone) is wrong because it is for untrusted guest user devices, not for hosting production public services.

Full explanation →

116

MCQhard

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

A.pg_encrypt_cluster utility

B.PostgreSQL Enterprise TDE Daemon

C.Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions

D.pg_tde core extension module

AnswerC

PostgreSQL lacks native TDE, so dm-crypt/LUKS encrypts the entire data directory at the block device layer, satisfying data-at-rest protection without schema changes. pgcrypto adds column-level cryptographic functions for granular protection of sensitive fields. Together they deliver encryption at rest using native PostgreSQL tooling rather than unavailable built-in TDE.

Why this answer

PostgreSQL has no native Transparent Data Encryption (TDE) engine in core, so the practical way to encrypt data at rest is at the filesystem/volume layer using dm-crypt/LUKS, which transparently encrypts the disk blocks PostgreSQL writes to. For column-level or field-level cryptographic operations inside the database, the pgcrypto extension provides functions like pgp_sym_encrypt and digest. Combining these two layers gives both at-rest protection and application-visible encryption of specific sensitive columns.

Exam trap

CND often tests whether candidates assume PostgreSQL has native TDE like SQL Server or Oracle — it does not, so the correct answer combines OS-level encryption with the pgcrypto extension rather than a fictional built-in feature.

How to eliminate wrong answers

Option A is wrong because there is no 'pg_encrypt_cluster' utility in PostgreSQL — this is a fabricated command name. Option B is wrong because no 'PostgreSQL Enterprise TDE Daemon' exists; PostgreSQL does not ship an enterprise TDE daemon, and this is an invented product. Option D is wrong because pg_tde is not a core PostgreSQL extension module — while third-party TDE projects exist (e.g., Percona's pg_tde), it is not a core native mechanism, so it cannot be the correct answer for 'core native PostgreSQL mechanism or extension.'

Full explanation →

117

Multi-Selectmedium

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

Select 2 answers

A.Running the WSUS Server Cleanup Wizard periodically

B.Configuring WSUS to automatically install all pre-release beta patches on domain controllers

C.Manually editing the WSUS SQL database tables directly without backups

D.Disabling transport layer security (TLS) for client communication to speed up scans

E.Approving and declining superseded updates regularly

AnswersA, E

Running the Server Cleanup Wizard periodically satisfies the ongoing maintenance requirement by removing superseded updates, unused content files, expired updates and obsolete computers from the WSUS database. Without this, the database and content store grow unchecked, degrading console performance and synchronisation reliability across the internal patch-management environment.

Why this answer

Option A is correct because the WSUS Server Cleanup Wizard removes obsolete updates, unused update revisions, expired updates, and unneeded content files, which prevents the SUSDB from growing unbounded and keeps synchronization and reporting healthy. Option E is correct because regularly approving needed updates and declining superseded or expired ones ensures clients receive only current patches and reduces unnecessary disk usage, scan time, and administrative confusion. Option B is wrong because automatically installing pre-release beta patches on domain controllers is risky and not a maintenance best practice; production servers should receive tested, released updates.

Option C is wrong because directly editing WSUS SQL tables without backups can corrupt the SUSDB and is unsupported. Option D is wrong because disabling TLS weakens client-server communication security and does not constitute healthy WSUS maintenance.

Exam trap

CND often tests the misconception that aggressive automation (auto-installing beta patches) or disabling security (TLS) is acceptable for convenience — candidates must recognize that cleanup and update lifecycle management are the correct maintenance tasks.

Full explanation →

118

MCQhard

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

A.Implement an explicit HTTP Proxy service with SSL/TLS decryption enabled.

B.Configure a static Destination NAT (DNAT) rule mapping port 21 to an internal range of ephemeral ports.

C.Disable stateful tracking for FTP traffic and rely strictly on stateless packet filtering access control lists.

D.Enable Deep Packet Inspection (DPI) with protocol decoding for FTP to dynamically open pinholes for data channels.

AnswerD

FTP negotiates data-channel ports inside the control channel, so the ALG must decode FTP commands via DPI to learn each PORT/PASV pair and open matching pinholes dynamically, satisfying the requirement for ephemeral inbound data connections.

Why this answer

To support active FTP, the firewall must inspect the FTP control channel (port 21) and dynamically open ephemeral data ports based on the PORT/PASV commands. This requires Deep Packet Inspection (DPI) with an FTP protocol decoder, which allows the firewall to understand FTP signaling and create temporary pinholes. Enabling DPI for FTP is the correct mechanism to handle the dynamic nature of FTP data connections.

Exam trap

The trap is confusing stateful inspection with application-layer inspection; candidates might think that stateful tracking alone can handle FTP data channels, but it cannot because the data connection is separate and dynamically negotiated.

How to eliminate wrong answers

Option A is wrong because an HTTP proxy with SSL/TLS decryption is irrelevant to FTP; it does not inspect FTP control channels. Option B is wrong because a static DNAT rule mapping port 21 to a range of ephemeral ports is not feasible and does not dynamically open ports based on control channel negotiations; it would be static and insecure. Option C is wrong because disabling stateful tracking and relying on stateless ACLs would not allow dynamic opening of data channels; it would require pre-opening a wide range of ports, which is insecure and impractical.

Full explanation →

119

MCQeasy

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

A.sudo fdisk /dev/sdb1 --encrypt

B.sudo mkfs.ext4 -e encrypted /dev/sdb1

C.sudo cryptsetup luksFormat /dev/sdb1

D.sudo mount -o encrypt /dev/sdb1 /mnt/secure

AnswerC

`cryptsetup luksFormat` initialises the LUKS header on /dev/sdb1, writing the encryption metadata and master key slot that all subsequent operations depend on. It satisfies the stem's requirement to initialise the encrypted partition first; `luksOpen`, `mkfs` and mounting only work once this header exists.

Why this answer

The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Full explanation →

120

MCQeasy

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

A.Network Segmentation

B.Packet Fragmentation

C.Network Bridging

D.Network Flooding

AnswerA

Network segmentation divides a network into zones, using VLANs and subnets, firewalls, ACLs or microsegmentation, and allows only the traffic each zone needs between them. If one device is compromised, the attacker cannot freely reach everything else, so the damage is contained and lateral movement is slowed and visible at the boundaries. It also reduces compliance scope, for example for PCI DSS.

Why this answer

Network segmentation is the practice of dividing a large network into smaller, isolated subnetworks (segments) using VLANs, subnets, firewalls, or SDN policies to limit the blast radius of a breach and restrict lateral movement. It is a foundational zero-trust and defense-in-depth control.

Exam trap

The trap is confusing segmentation (isolation for security) with bridging (connecting segments) or fragmentation (packet-level splitting) — candidates who focus on the word 'breaking' may incorrectly pick fragmentation.

How to eliminate wrong answers

Option B is wrong because packet fragmentation is an IP-layer mechanism for splitting packets that exceed the MTU, unrelated to network isolation. Option C is wrong because network bridging connects network segments at Layer 2 (e.g., a bridge or switch), which actually extends a broadcast domain rather than isolating it. Option D is wrong because network flooding is an attack or traffic condition (e.g., MAC flooding, SYN flood) that overwhelms a network, not a segmentation technique.

Full explanation →

121

Multi-Selecthard

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

Select 3 answers

A.Enforcing SELinux in targeted or multi-category security (MLS) mode

B.Setting all user home directory permissions to world-writable (chmod 777)

C.Disabling all audit logging and accounting daemons

D.Enforcing AppArmor profiles for critical network-facing daemons

E.Configuring kernel sysctl parameters to restrict core dumps and kernel pointer leaks (e.g., kptr_restrict=2)

AnswersA, D, E

SELinux enforces kernel-level Mandatory Access Control, confining processes to policy-defined domains regardless of user identity. Targeted mode restricts specific daemons, while MLS applies Bell-LaPadula style sensitivity labels, both satisfying the requirement to restrict process privileges beyond discretionary controls.

Why this answer

Option A is correct because SELinux is a Linux MAC implementation, and running it in enforcing mode (targeted or MLS) applies mandatory type/level policy that confines processes beyond standard discretionary permissions. Option D is correct because AppArmor enforces per-program MAC profiles, so confining critical network-facing daemons limits what files, capabilities, and network operations they can access even if compromised. Option E is correct because sysctl hardening such as fs.suid_dumpable=0 and kernel.kptr_restrict=2 restricts privilege-relevant information leaks and core dumps that could expose kernel addresses or sensitive process memory.

Option B is incorrect because chmod 777 makes home directories world-writable, weakening access control rather than enforcing MAC or least privilege. Option C is incorrect because disabling audit logging and accounting removes accountability and monitoring, which does not restrict process privileges and undermines hardening.

Exam trap

CND often tests the misconception that 'hardening' means loosening permissions or disabling logging for convenience, so candidates pick world-writable homes or auditd shutdown as if they were simplifications rather than regressions.

Full explanation →

122

MCQmedium

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

A.stats sum(bytes) by dest_ip

B.rex field=bytes max_match=1

C.table dest_ip, bytes

D.eval bytes_sum = sum(bytes)

AnswerA

The stats command aggregates events and, with sum(bytes) by dest_ip, totals outbound byte counts per destination address, producing the per-IP volumes the alert needs. This satisfies the stem's requirement to group abnormal outbound traffic by destination IP.

Why this answer

The stats command in Splunk is used for aggregating and summarizing data. Using 'stats sum(bytes) by dest_ip' calculates the total outbound bytes for each destination IP address, directly fulfilling the requirement. This is the standard SPL syntax for grouped aggregation.

Exam trap

The trap is confusing eval with stats—candidates may think eval can sum across events, but eval operates per-event, while stats is required for cross-event aggregation.

How to eliminate wrong answers

Option B is wrong because rex is a regex extraction command used to parse fields from raw events, not to aggregate data. Option C is wrong because table only displays selected fields in a tabular format; it does not perform any summation or grouping. Option D is wrong because eval is used to create or modify fields with expressions, but it cannot perform aggregation across multiple events—sum() is not a valid eval function for this purpose.

Full explanation →

123

MCQeasy

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

A.HKEY_LOCAL_MACHINE

B.HKEY_CLASSES_ROOT

C.HKEY_PERFORMANCE_DATA

D.HKEY_CURRENT_USER

AnswerD

HKEY_CURRENT_USER stores per-user startup entries, including Run and RunOnce keys under the user's own profile. This satisfies the stem's requirement for user-specific persistence, since each logged-on account holds its own autorun configuration separate from machine-wide hives such as HKEY_LOCAL_MACHINE.

Why this answer

HKEY_CURRENT_USER (HKCU) stores the profile-specific configuration for the currently logged-on user, including per-user startup entries under paths like HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce. Because these keys are tied to the user's profile (NTUSER.DAT), they are the correct hive to inspect when hunting for user-scoped persistence. HKLM holds machine-wide autoruns that apply to all users, not user-specific ones.

Exam trap

CND often tests the distinction between machine-wide (HKLM) and per-user (HKCU) registry persistence, catching candidates who default to HKLM as the 'main' hive and overlook that user-specific autoruns live in HKEY_CURRENT_USER.

How to eliminate wrong answers

Option A is wrong because HKEY_LOCAL_MACHINE stores system-wide, machine-level configuration (e.g., HKLM\...\Run applies to all users), not user-specific startup entries. Option B is wrong because HKEY_CLASSES_ROOT is a merged view of file association and COM registration data (from HKLM\Software\Classes and HKCU\Software\Classes), not a persistence location for per-user startup programs. Option C is wrong because HKEY_PERFORMANCE_DATA is a volatile hive exposing performance counters via the registry API, not a storage location for autorun entries.

Full explanation →

124

MCQhard

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

A.Enable Kerberos pre-authentication enforcement on all Domain Controller service principal accounts.

B.Configure SMB packet signing globally and disable SMBv1 across all domain member servers.

C.Enforce LDAP signing and channel binding while disabling anonymous LDAP enumeration via Group Policy.

D.Implement NT LAN Manager (NTLM) v2 exclusive authentication and disable NTLM fallback.

AnswerC

Anonymous LDAP binds let the workstation enumerate users and groups without credentials. Enforcing LDAP signing and channel binding via Group Policy authenticates and integrity-protects the session, while disabling anonymous enumeration removes the unauthenticated query path the SIEM detected.

Why this answer

Anonymous LDAP enumeration allows unauthenticated attackers to query the directory for user, group, and attribute information, which is exactly the reconnaissance described. Enforcing LDAP signing and channel binding via Group Policy hardens the LDAP channel against relay and tampering attacks, while disabling anonymous LDAP enumeration blocks the unauthenticated queries. Together these controls directly mitigate the observed technique.

Exam trap

CND often tests the confusion between authentication hardening (Kerberos, NTLM) and directory query hardening (LDAP signing, anonymous bind) — candidates pick the authentication option because it sounds security-relevant, but the scenario is specifically about unauthenticated LDAP enumeration.

How to eliminate wrong answers

Option A is wrong because Kerberos pre-authentication enforcement prevents AS-REP roasting of accounts without pre-auth, but it does not stop unauthenticated LDAP queries — the attacker in this scenario is not using Kerberos. Option B is wrong because SMB signing and disabling SMBv1 address SMB relay and legacy protocol attacks, not LDAP enumeration. Option D is wrong because enforcing NTLMv2 and disabling NTLM fallback hardens authentication against relay and downgrade attacks, but it does not prevent anonymous LDAP binds or enumeration.

Full explanation →

125

MCQhard

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

A.Digital Guardian Discovery Server

B.Digital Guardian Network Sensor

C.Digital Guardian Cloud Analytics Engine (CAE)

D.Digital Guardian Endpoint Agent with Web Inspection / Browser Control module

AnswerD

Digital Guardian's Endpoint Agent hooks browser processes via its Web Inspection module, inspecting HTTPS traffic before encryption leaves the endpoint. This satisfies the stem's browser-level interception constraint: the agent, not a network appliance, identifies the source-code upload to a personal cloud provider and blocks it in real time.

Why this answer

Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Full explanation →

126

MCQhard

An enterprise administrator is setting up an AWS Site-to-Site VPN connection between an on-premises data center and an AWS VPC. To ensure maximum data confidentiality and integrity across the public internet, which IPsec cryptographic parameters should be enforced in the VPN tunnel configuration?

A.RC4 encryption, SHA-1 integrity, and no PFS

B.AES-128 encryption, MD5 integrity, and DH Group 2

C.AES-256 encryption, SHA-2 (SHA-384) integrity, and DH Group 14 or higher

D.DES encryption, MD5 integrity, and DH Group 1

AnswerC

AES-256, SHA-384 and DH Group 14 or higher enforce strong IPsec phase 1 and phase 2 parameters, delivering the confidentiality and integrity the stem demands for traffic crossing the public internet between the data centre and VPC.

Why this answer

For maximum confidentiality and integrity over an IPsec tunnel, AES-256 provides strong symmetric encryption, SHA-2 (e.g., SHA-384) provides robust integrity/authentication, and DH Group 14 (2048-bit MODP) or higher ensures strong Perfect Forward Secrecy. These parameters align with modern cryptographic best practices and AWS VPN recommendations. Weaker ciphers like DES, RC4, MD5, and low DH groups are deprecated and vulnerable.

Exam trap

CND often tests whether candidates recognize deprecated cryptographic algorithms (DES, RC4, MD5, SHA-1, low DH groups) as insecure, catching those who pick 'AES-128' as sufficient without scrutinizing the accompanying weak integrity and key-exchange parameters.

How to eliminate wrong answers

Option A is wrong because RC4 is a deprecated stream cipher with known biases, SHA-1 is collision-prone and no longer considered secure for integrity, and disabling PFS means a compromised long-term key can decrypt past sessions. Option B is wrong because MD5 is cryptographically broken for integrity, and DH Group 2 (1024-bit) is too weak against modern factoring attacks, even though AES-128 is acceptable. Option D is wrong because DES has a 56-bit key that is trivially brute-forced, MD5 is broken, and DH Group 1 (768-bit) is critically weak and deprecated.

Full explanation →

127

MCQhard

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

A.TLS 1.3 separates key exchange parameters from cipher suites, simplifying options to AEAD algorithms

B.TLS 1.3 eliminates symmetric encryption in favor of asynchronous cryptographic operations for all data payloads

C.TLS 1.3 requires all connections to use legacy RSA key transport mechanisms

D.TLS 1.3 mandates the use of pre-shared keys (PSKs) exclusively for all sessions

AnswerA

TLS 1.3 removes the cipher-suite negotiation of key exchange, authentication and bulk encryption combined. Key exchange is negotiated separately via supported groups, leaving only AEAD algorithms such as AES-GCM, which is why legacy ECDHE_RSA suites disappear from the menu.

Why this answer

In TLS 1.3, cipher suites no longer include key exchange and authentication algorithms; they only specify AEAD (Authenticated Encryption with Associated Data) algorithms like AES-GCM or ChaCha20-Poly1305. Key exchange is negotiated separately via extensions like supported_groups, and authentication is handled by the certificate and signature algorithms. This simplifies cipher suite configuration.

Exam trap

CND often tests the misconception that TLS 1.3 cipher suites still include key exchange and authentication like TLS 1.2, leading candidates to think the suites were removed for security reasons rather than re-architected.

How to eliminate wrong answers

Option B is wrong because TLS 1.3 still uses symmetric encryption for data payloads; it does not eliminate it in favor of asynchronous operations, which would be impractical due to performance. Option C is wrong because TLS 1.3 removed legacy RSA key transport in favor of forward-secret key exchanges like ECDHE. Option D is wrong because TLS 1.3 does not mandate PSKs exclusively; PSKs are optional and can be used for session resumption or pre-shared key authentication, but certificates are still widely used.

Full explanation →

128

Multi-Selectmedium

An enterprise security engineer is investigating potential AWS IAM privilege escalation paths and misconfigurations. Which TWO AWS IAM actions or conditions represent known high-risk misconfigurations that can lead to privilege escalation? (Choose TWO)

Select 2 answers

A.Enforcing Multi-Factor Authentication (MFA) on all IAM user sign-ins

B.Allowing unrestricted iam:PassRole combined with permission to launch EC2 instances with administrative IAM roles

C.Attaching AWS managed policies for read-only access to auditing users

D.Requiring IAM password complexity policies

E.Granting wildcard permissions (*:*) on iam:CreatePolicyVersion

AnswersB, E

iam:PassRole lets a principal hand an administrative role to an AWS service. Combined with ec2:RunInstances, the attacker launches an EC2 instance carrying that role, then retrieves its temporary credentials via the instance metadata service, escalating to full administrative privileges.

Why this answer

Option B is correct because iam:PassRole by itself only lets a principal hand a role to an AWS service, but when combined with permissions such as ec2:RunInstances, the user can launch an EC2 instance that assumes an administrative role and then use that instance's credentials to escalate privileges. Option E is correct because granting *:* on iam:CreatePolicyVersion allows a user to create a new version of an existing policy with arbitrary permissions and set it as the default, effectively escalating to any privilege the policy can grant. Option A is not a privilege escalation risk; enforcing MFA on IAM user sign-ins is a security best practice that strengthens authentication.

Option C is not a risk because read-only AWS managed policies for auditing users grant only visibility, not the ability to modify permissions or resources. Option D is not a risk because IAM password complexity policies improve credential strength and do not grant additional privileges.

Exam trap

CND often tests whether candidates confuse general IAM hardening controls (MFA, password policy, read-only managed policies) with actual privilege escalation primitives like iam:PassRole and iam:CreatePolicyVersion.

Full explanation →

129

MCQmedium

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

A.Software Update Groups

B.Maintenance Windows

C.Automatic Deployment Rules (ADR)

D.Client Settings - Computer Restart

AnswerB

Maintenance Windows define precise schedules during which MECM may deploy patches, restarting devices only within that period. Configuring a window outside active hours directly satisfies the minimal-disruption constraint, since installations and reboots are suppressed during business use and enforced only within the defined boundary.

Why this answer

Maintenance Windows in MECM define a scheduled time range during which deployments (including software updates) are permitted to install and, critically, when restarts may occur. Configuring a maintenance window outside active hours ensures patches install and reboots happen without disrupting users. This is the MECM feature purpose-built for controlling when updates apply on a schedule.

Exam trap

The trap is selecting Automatic Deployment Rules because they sound like they control timing — but ADRs govern deployment creation, while Maintenance Windows govern when installation and restarts actually occur on clients.

How to eliminate wrong answers

Option A is wrong because Software Update Groups are containers that organize updates for deployment — they define what to deploy, not when installation and restarts are allowed. Option C is wrong because Automatic Deployment Rules automate the creation and deployment of update groups on a schedule, but they do not control the client-side installation window or restart timing. Option D is wrong because Client Settings - Computer Restart controls restart behavior (countdown, grace period, notifications) but does not define a permitted installation window; without a maintenance window, restarts can still occur during active hours.

Full explanation →

130

MCQmedium

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

A.Google Cloud Armor perimeter security

B.VPC Firewall rules blocking port 22 inbound from 0.0.0.0/0, combined with Identity-Aware Proxy (IAP)

C.Google Cloud DNS DNSSEC configuration

D.Shared VPC host project firewall restriction

AnswerB

Firewall rules denying inbound TCP 22 from 0.0.0.0/0 remove public SSH exposure, while Identity-Aware Proxy tunnels authorised administrative access through Google's infrastructure. This satisfies the constraint that instances remain unreachable directly from the public internet despite having external IP addresses.

Why this answer

To block direct SSH from the internet while still allowing authorized access, you create a VPC firewall rule that denies ingress on TCP/22 from 0.0.0.0/0, and then use Identity-Aware Proxy (IAP) TCP forwarding to grant access based on IAM identity and context. IAP tunnels SSH through Google's infrastructure, so the instance never needs to accept public SSH connections. This is Google's recommended 'zero trust' pattern for administrative access.

Exam trap

The trap is picking IAP alone without the firewall rule, or picking Cloud Armor because it sounds like a network security control — Cloud Armor only protects HTTP(S) load balancers, not SSH.

How to eliminate wrong answers

Option A is wrong because Google Cloud Armor is a WAF/DDoS protection service for external HTTP(S) load balancers, not for controlling SSH access to compute instances. Option C is wrong because Cloud DNS DNSSEC provides cryptographic authentication of DNS responses, which is unrelated to SSH access control. Option D is wrong because Shared VPC host project firewall restrictions control which projects can use shared networks, but do not by themselves prevent public SSH — you still need a firewall rule and an access mechanism like IAP.

Full explanation →

131

MCQeasy

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

A.Detect

B.Respond

C.Identify

D.Recover

AnswerC

Asset categorisation, governance policies and risk assessments all sit within the Identify function, which establishes organisational understanding of systems, assets, data and capabilities. These activities build the asset inventory and risk picture that Protect, Detect, Respond and Recover functions subsequently rely upon.

Why this answer

The NIST CSF Identify function encompasses asset management, governance, risk assessment, and risk management strategy — exactly the activities described (categorizing assets, establishing governance policies, conducting risk assessments). Identify is the foundational function that establishes organizational understanding of cybersecurity risk.

Exam trap

CND often tests the confusion between Identify and Detect — candidates must recognize that asset categorization, governance, and risk assessment are Identify activities, while monitoring and anomaly detection are Detect activities.

How to eliminate wrong answers

Option A is wrong because Detect focuses on monitoring and anomaly detection (continuous monitoring, detection processes), not asset categorization or governance. Option B is wrong because Respond covers incident response activities (response planning, communications, analysis, mitigation), not risk assessment or governance. Option D is wrong because Recover focuses on recovery planning, improvements, and communications after an incident, not pre-incident governance and risk assessment.

Full explanation →

132

MCQhard

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

A.SHA-256 without a salt

B.AES-256-CBC symmetric encryption with a shared database key

C.bcrypt via the pgcrypto extension using the crypt(password, gen_salt('bf', 12)) function

D.MD5 with a hardcoded static salt

AnswerC

bcrypt with a cost factor of 12 is deliberately slow and salted, making offline brute-force attacks computationally expensive. Unlike unsalted MD5 or SHA-256, its adaptive work factor satisfies the modern cryptographic standard the stem demands.

Why this answer

bcrypt is a purpose-built password hashing function that incorporates a per-password random salt and a tunable cost factor. The pgcrypto call crypt(password, gen_salt('bf', 12)) uses the Blowfish-based bcrypt variant with a cost of 12, meaning 2^12 key-expansion iterations, which makes offline brute-force attacks computationally expensive while remaining fast enough for interactive logins.

Exam trap

The trap is confusing fast general-purpose hashes (SHA-256) or reversible encryption (AES) with slow, salted password-hashing functions; the exam tests whether you know that password storage requires a deliberately slow, salted, one-way algorithm like bcrypt.

How to eliminate wrong answers

Option A is wrong because SHA-256 without a salt is a fast general-purpose hash — attackers can precompute rainbow tables and test billions of guesses per second on GPUs, so it is unsuitable for password storage. Option B is wrong because AES-256-CBC is reversible symmetric encryption, not hashing; if the shared database key leaks, every password is immediately recoverable, and encryption does not provide the one-way property password storage requires. Option D is wrong because MD5 is cryptographically broken (collision attacks are trivial) and a hardcoded static salt means every password shares the same salt, so a single rainbow table defeats the entire database.

Full explanation →

133

MCQhard

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

A.File Allocation Table (FAT)

B.Master File Table (MFT)

C.Superblock

D.Inode table

AnswerB

The MFT stores one file record per file, holding attributes such as $STANDARD_INFORMATION timestamps, $FILE_NAME, permissions, and resident or non-resident data run locations. Deleted files too large for the Recycle Bin retain their MFT entries, enabling recovery via that metadata.

Why this answer

The Master File Table (MFT) is the core NTFS metadata structure; it contains one file record per file and directory, storing attributes such as $STANDARD_INFORMATION (timestamps, permissions), $FILE_NAME, and $DATA (resident or non-resident data locations). When files are deleted, their MFT records are marked as unallocated but often remain intact, enabling forensic recovery of files too large for the Recycle Bin.

Exam trap

CND often tests filesystem-specific metadata confusion, so candidates pick inode or FAT structures that belong to other filesystems instead of recognizing the MFT as the NTFS per-file metadata store.

How to eliminate wrong answers

Option A is wrong because the File Allocation Table is the metadata structure for FAT12/16/32 file systems, not NTFS, and it lacks the rich attribute records (timestamps, permissions, resident data) that NTFS provides. Option C is wrong because the superblock is a Unix/Linux filesystem structure (ext2/3/4, XFS) that describes the filesystem as a whole, not per-file metadata on NTFS. Option D is wrong because the inode table is used by Unix-style filesystems (ext family) to store file metadata; NTFS uses MFT records instead, so inodes are not applicable to an NTFS volume.

Full explanation →

134

MCQmedium

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

A.By modifying the DNS records of the database server to point to a sinkhole

B.On the core router's default gateway interface for the entire data center

C.Using a distributed virtual firewall configured at the hypervisor switch layer

D.On the perimeter firewall facing the internet gateway

AnswerC

A distributed virtual firewall enforces policy at the hypervisor vSwitch, filtering traffic before it reaches the database VM. This satisfies the micro-segmentation requirement by permitting only the application server VLAN to reach TCP port 1433, without relying on physical network hops.

Why this answer

Micro-segmentation for a virtualized workload is best enforced at the hypervisor virtual switch layer using a distributed virtual firewall (e.g., VMware NSX Distributed Firewall, Cisco ACI/AVS). This places the enforcement point directly on the vNIC of the database VM, so policy follows the workload regardless of physical topology, and east-west traffic between VMs on the same host is filtered without hairpinning to a physical appliance. This provides optimal granularity and performance.

Exam trap

CND often tests the misconception that a perimeter or core firewall can enforce micro-segmentation — candidates miss that east-west traffic between VMs on the same host bypasses physical firewalls entirely.

How to eliminate wrong answers

Option A is wrong because DNS sinkholing redirects name resolution to a blackhole — it does not enforce L3/L4 access control and can be bypassed by direct IP connections. Option B is wrong because a core router ACL filters at the data center gateway, which is too coarse and does not control intra-host east-west traffic between VMs. Option D is wrong because a perimeter firewall only sees north-south traffic entering/leaving the data center, not inter-VM traffic within the virtualized environment.

Full explanation →

135

MCQmedium

An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?

A.The two firewalls must share the same rule base and firmware version to function, otherwise traffic will be dropped

B.Log correlation across two different vendors is straightforward because both use the same syslog format by default

C.Placing two firewalls in series doubles throughput because each firewall processes only half of the traffic

D.Dual-vendor firewalls increase complexity in rule management and log correlation, but reduce the risk of a single vendor vulnerability compromising the perimeter

AnswerD

Two different firewall platforms avoid a single point of failure from one vendor's software flaw, since an exploit that works against one is unlikely to work against the other. The tradeoff is that administrators must manage two rule sets and normalize logs from two formats, increasing operational overhead. This accurately describes the realistic consideration of the architecture.

Why this answer

A dual-vendor firewall design provides defense in depth by ensuring that a vulnerability in one vendor's product does not automatically expose the network, since the second platform enforces its own policy. The realistic cost is operational: two rule sets to maintain, two management interfaces, and log formats that must be normalized for correlation. Throughput is limited by the slowest inline device, and rules do not need to match.

Exam trap

The trap here is assuming that stacking firewalls in series automatically multiplies performance, when inline devices actually cap throughput at the slowest link and add latency.

Full explanation →

136

MCQhard

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

A.Azure Backup Vault with geo-redundant storage (GRS)

B.Azure ExpressRoute Global Reach

C.Azure Site Recovery (ASR)

D.Azure Traffic Manager with priority routing

AnswerC

Azure Site Recovery continuously replicates VM disks asynchronously to a secondary region, storing replicas in a low-cost state without running secondary compute. This directly satisfies the stem's constraint of cross-region disaster recovery without permanently provisioned standby VMs, enabling failover only when required.

Why this answer

Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Exam trap

The trap is confusing backup (point-in-time restore with high RTO) or traffic routing (Traffic Manager) with true disaster recovery replication — only Azure Site Recovery provides asynchronous disk replication with on-demand secondary VM provisioning.

How to eliminate wrong answers

Option A is wrong because Azure Backup with GRS stores backup copies for restore, not continuous asynchronous disk replication — recovery from backup has a much higher RPO/RTO and does not provide near-real-time failover. Option B is wrong because ExpressRoute Global Reach is a networking feature that connects on-premises networks via Microsoft's backbone; it has nothing to do with VM disk replication or disaster recovery. Option D is wrong because Traffic Manager with priority routing is a DNS-based traffic routing service that directs users to endpoints — it does not replicate VM disks or provision secondary VMs.

Full explanation →

137

MCQeasy

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

A.Disk Management

B.Device Manager

C.Windows Defender Firewall

D.Task Manager

AnswerC

Windows Defender Firewall enforces stateful packet filtering at the host level, letting you set default inbound and outbound block rules while permitting specific pre-configured exceptions. This satisfies the stem's requirement to isolate the compromised workstation from all network traffic except approved flows, without physically disconnecting it.

Why this answer

Windows Defender Firewall is the native Windows tool that can block all inbound and outbound traffic except for explicitly configured exceptions. An administrator can create rules to allow specific ports, IP addresses, or applications while blocking everything else, effectively isolating the workstation at the network layer. This is a common containment technique during incident response when full network isolation is required but some management or monitoring traffic must be permitted.

Exam trap

The trap here is that candidates may think of third-party EDR tools or network isolation features, but the question specifies a native Windows tool — Windows Defender Firewall is the only option that provides rule-based traffic blocking with exceptions.

How to eliminate wrong answers

Option A is wrong because Disk Management is a utility for managing disk partitions, volumes, and drives — it has no network filtering capability. Option B is wrong because Device Manager manages hardware devices and drivers, not network traffic. Option D is wrong because Task Manager shows running processes and resource usage but cannot block network traffic.

Only Windows Defender Firewall provides the rule-based inbound/outbound traffic filtering needed to isolate a host while allowing exceptions.

Full explanation →

138

Multi-Selecthard

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

Select 3 answers

A.Memory regions containing executable code that do not back to any file on disk (unbacked memory)

B.Standard file creation timestamps in the $MFT

C.Default Windows system wallpaper configuration settings

D.Thread start addresses pointing outside of the expected module image bounds

E.Memory regions with PAGE_EXECUTE_READWRITE (RWX) permissions allocated in non-system processes

AnswersA, D, E

Process hollowing unmaps the legitimate module's image and writes malicious code into the vacated region, so scanning for executable memory pages with no corresponding file on disk exposes the injected payload that no legitimate loader would create.

Why this answer

Option A is correct because process hollowing and similar injection techniques often leave executable memory regions that have no corresponding backing file on disk (unbacked memory), which is a strong indicator of injected code since legitimate executable pages normally map to a PE image on disk. Option D is correct because a thread's start address that falls outside the bounds of any loaded module image indicates the thread was created to execute injected code rather than legitimate module code, a hallmark of injection. Option E is correct because memory regions allocated with PAGE_EXECUTE_READWRITE (RWX) permissions in non-system processes are suspicious, as legitimate code pages are typically RX or read-only, and RWX allocations often host injected shellcode.

Option B is not relevant because $MFT file creation timestamps only reflect file system activity and do not reveal in-memory code injection. Option C is not relevant because wallpaper configuration settings have no bearing on detecting process injection.

Exam trap

CND often tests the specific memory and thread artifacts associated with process injection, and candidates may confuse them with general file system or configuration artifacts that are not relevant.

Full explanation →

139

MCQeasy

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

A.Windows Defender Application Control (WDAC)

B.User Account Control (UAC)

C.BitLocker Drive Encryption

D.Windows Defender Credential Guard

AnswerD

Credential Guard uses Virtualisation-Based Security to run LSASS in an isolated Hyper-V-protected container, so NTLM and Kerberos secrets cannot be read by a compromised process. This satisfies the stem's requirement to isolate LSASS memory using virtualisation against pass-the-hash.

Why this answer

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate LSASS and its derived credentials in a separate, hypervisor-protected container. This prevents tools like Mimikatz from reading NTLM hashes or Kerberos tickets out of LSASS memory, directly mitigating pass-the-hash. It requires UEFI Secure Boot, virtualization extensions, and is enabled via Group Policy or Intune.

Exam trap

CND often tests the misconception that disk encryption (BitLocker) or application control (WDAC) protects in-memory credentials, when only VBS-based Credential Guard isolates LSASS.

How to eliminate wrong answers

Option A is wrong because WDAC is an application control mechanism that restricts which binaries can run; it does not isolate LSASS memory or protect credential material. Option B is wrong because UAC gates privilege elevation prompts and token filtering — it has no role in protecting credential storage from memory scraping. Option C is wrong because BitLocker encrypts data at rest on the disk; once the OS is running and credentials are in memory, BitLocker provides no protection against pass-the-hash.

Full explanation →

140

Multi-Selectmedium

A security manager is designing a comprehensive security governance program for a multinational financial institution. Which TWO activities are fundamental responsibilities of security governance? (Choose TWO)

Select 2 answers

A.Writing custom regex signatures for intrusion detection system (IDS) alert tuning.

B.Establishing accountability and oversight mechanisms for security policies and compliance.

C.Manually configuring static routing tables on core layer-3 distribution switches.

D.Aligning information security strategy with overall business goals and risk appetite.

E.Replacing failing power supply units in redundant enterprise chassis routers.

AnswersB, D

Security governance establishes accountability and oversight mechanisms so that security policies and compliance obligations are owned, monitored and enforced. This assigns clear responsibility across the organisation, a fundamental governance duty rather than a technical control implementation.

Why this answer

Option B is correct because security governance is fundamentally about defining accountability structures, oversight bodies (such as a security steering committee), and mechanisms that ensure policies and regulatory compliance are enforced across the organization. Option D is correct because governance requires that the information security strategy be derived from and continuously aligned with the enterprise's business objectives and stated risk appetite, ensuring security investments support organizational goals. Options A, C, and E are incorrect because writing IDS regex signatures, configuring static routes on distribution switches, and swapping failed power supplies are hands-on operational or technical tasks, not governance-level responsibilities, which focus on direction, oversight, and strategic alignment rather than device-level implementation.

Exam trap

CND often tests the difference between governance (strategic oversight, accountability, alignment) and hands-on technical operations, tricking candidates into selecting operational tasks as governance responsibilities.

Full explanation →

141

MCQmedium

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

A.Retirement Phase

B.Maintenance Phase

C.Design Phase

D.Deployment Phase

AnswerC

Threat modelling belongs in the design phase, where architecture and data flows are analysed to surface flaws such as missing authentication or trust boundary weaknesses before code exists. This satisfies the requirement to identify architectural security flaws prior to coding.

Why this answer

Threat modeling is most effective when integrated during the Design Phase because that is when architectural decisions, data flows, and trust boundaries are defined. Identifying threats at this stage allows flaws to be remediated before code is written, which is far cheaper than fixing them later. This aligns with SSDLC best practices (e.g., Microsoft SDL, OWASP SAMM).

Exam trap

The trap is choosing later phases (maintenance, deployment) because they seem 'when security is tested' — but threat modeling must precede coding to influence architecture, making Design the only correct phase.

How to eliminate wrong answers

Option A is wrong because the Retirement Phase deals with decommissioning and data disposal — too late to influence architecture. Option B is wrong because the Maintenance Phase addresses post-deployment patches and updates, after architectural flaws are already baked in. Option D is wrong because the Deployment Phase focuses on release and configuration, where design-level changes are costly and disruptive.

Full explanation →

142

MCQeasy

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

A.iptables -A INPUT -p tcp --syn --fin -j DROP

B.iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

C.iptables -A INPUT -p tcp --flags ALL SYN,FIN -j DROP

D.iptables -A INPUT -p tcp --match flags --syn-fin -j DROP

AnswerB

The --tcp-flags SYN,FIN SYN,FIN match requires both SYN and FIN set in the same packet, the malformed combination described. Appending it to INPUT with -j DROP discards those packets, precisely targeting the attack vector without affecting legitimate TCP traffic.

Why this answer

The --tcp-flags option takes two arguments: a mask of flags to examine and a comparison list of flags that must be set. 'SYN,FIN SYN,FIN' means 'examine the SYN and FIN bits, and match only if both are set,' which precisely targets the malformed SYN+FIN combination. The -j DROP then discards matching packets.

Exam trap

The trap is confusing the two-argument --tcp-flags syntax with a single-flag match — candidates pick options that look plausible but use non-existent flags like --syn-fin or --flags.

How to eliminate wrong answers

Option A is wrong because --syn and --fin are not valid combined flags in iptables; --syn matches SYN packets with ACK and FIN cleared, and there is no --fin match extension. Option C is wrong because --flags is not a valid iptables option — the correct option is --tcp-flags. Option D is wrong because --match flags and --syn-fin are not valid iptables syntax; there is no such match module or flag alias.

Full explanation →

143

MCQhard

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

A.Configure IPsec tunnel-mode policies between all internal client workstations.

B.Restrict inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts and enable Windows Defender Application Control (WDAC).

C.Disable Remote Desktop Protocol (RDP) and Terminal Services across all domain controllers.

D.Enforce User Account Control (UAC) remote restriction registry settings to disable all admin approval modes.

AnswerB

PsExec moves laterally over SMB TCP 445 and RPC, so restricting inbound access on those ports to authorised jump hosts blocks the technique domain-wide. WDAC adds application control, preventing execution of the PsExec binary on non-administrative endpoints.

Why this answer

Restricting inbound SMB (TCP 445) and RPC access to authorized administrative jump hosts blocks PsExec lateral movement, which relies on these protocols to execute commands remotely. Enabling WDAC further prevents unauthorized executables (like PsExec) from running, providing defense in depth.

Exam trap

CND often tests the confusion between RDP and SMB/RPC for lateral movement; candidates may incorrectly think disabling RDP stops PsExec, but PsExec uses SMB/RPC.

How to eliminate wrong answers

Option A is wrong because IPsec tunnel-mode policies between workstations do not specifically block PsExec and are complex to manage; they encrypt traffic but do not restrict SMB/RPC access. Option C is wrong because disabling RDP and Terminal Services does not stop PsExec, which uses SMB/RPC, not RDP. Option D is wrong because UAC remote restrictions, while helpful, do not fully block PsExec and disabling admin approval modes would weaken security, not strengthen it.

Full explanation →

144

Multi-Selecthard

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

Select 3 answers

A.Deploying zone protection or flood protection profiles against SYN and UDP floods

B.Disabling remote management (SSH/HTTPS) on the external untrusted interface

C.Enabling Reverse Path Forwarding (uRPF) to prevent IP spoofing

D.Leaving default administrator credentials unchanged for rapid access

E.Permitting all inbound ICMP echo requests without rate limiting

AnswersA, B, C

Zone protection profiles apply SYN cookies and random early drop to absorb volumetric floods before they saturate state tables, directly satisfying the stem's requirement to harden against volumetric attacks. Flood protection thresholds rate-limit UDP and ICMP per zone, blocking reconnaissance sweeps while preserving legitimate sessions.

Why this answer

Option A is correct because zone protection and flood protection profiles (e.g., on Palo Alto or equivalent firewalls) apply SYN flood, UDP flood, and ICMP flood thresholds to drop volumetric attack traffic before it exhausts session tables. Option B is correct because exposing SSH/HTTPS management on the untrusted external interface invites brute-force and exploitation attempts; management should be restricted to a trusted internal interface or out-of-band path. Option C is correct because unicast Reverse Path Forwarding (uRPF) validates the source address against the routing table, dropping packets with spoofed source IPs commonly used in reconnaissance and reflection attacks.

Option D is wrong because default administrator credentials are publicly known and must always be changed during hardening. Option E is wrong because permitting all inbound ICMP echo requests without rate limiting enables ping sweeps, ICMP floods, and tunneling, so ICMP should be rate-limited or selectively filtered.

Exam trap

The trap is selecting 'permit all ICMP' as a troubleshooting convenience — candidates forget that unrestricted ICMP is itself a DoS vector and a reconnaissance aid.

Full explanation →

145

MCQmedium

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

A.Unrestricted guest wireless broadcast zone

B.Core router management loopback subnet

C.DMZ (Demilitarized Zone) web server farm

D.Remediation VLAN / Quarantine Network

AnswerD

A remediation or quarantine VLAN is a logically isolated segment where non-compliant endpoints are placed after failing posture checks. It blocks access to production resources while permitting limited remediation traffic, directly satisfying the policy requirement that outdated-antivirus endpoints be automatically quarantined rather than admitted.

Why this answer

Non-compliant endpoints in a NAC governance policy should be placed in a remediation VLAN or quarantine network, which is an isolated segment designed to restrict access while allowing remediation resources (e.g., antivirus updates, patch servers). This prevents compromised or non-compliant devices from accessing sensitive internal resources.

Exam trap

CND often tests the misconception that any isolated network (like DMZ or guest) can serve as quarantine, but the correct answer is a dedicated remediation VLAN with restricted access.

How to eliminate wrong answers

Option A is wrong because an unrestricted guest wireless broadcast zone provides internet access and may allow lateral movement, not isolation for remediation. Option B is wrong because the core router management loopback subnet is for device management and would expose critical infrastructure to untrusted endpoints. Option C is wrong because a DMZ web server farm is designed for public-facing services, not for quarantining internal non-compliant endpoints; placing them there could expose web servers to risk.

Full explanation →

146

Multi-Selectmedium

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

Select 2 answers

A.Assigning Layer 3 IP addresses to every data interface participating in packet routing

B.Configuring dynamic BGP peering on all client-facing ports

C.Removing all security rules since Layer 2 devices cannot filter traffic

D.Configuring a management IP address on a management interface or BVI (Bridge Virtual Interface) for device access

E.Placing the bridged interfaces into a common bridge group or zone

AnswersD, E

Transparent mode forwards traffic at Layer 2 without routing, so no data-plane interface holds a routable address. Administrators therefore assign a management IP on a dedicated management interface or BVI to reach the device for configuration and monitoring.

Why this answer

In Transparent (Layer 2) mode, the firewall forwards frames between interfaces in the same bridge domain without acting as a Layer 3 hop, so option D is correct: a management IP must be assigned to a dedicated management interface or a BVI so administrators can reach the device for configuration, monitoring, and updates, since the data interfaces themselves carry no routable addresses. Option E is also correct because the participating interfaces must be bound into a common bridge group (or equivalent Layer 2 zone) so the firewall can bridge traffic between them and apply policy to the bridged flows. Option A is wrong because assigning Layer 3 IPs to every data interface is characteristic of Routed mode, not Transparent mode, where data interfaces remain unnumbered.

Option B is wrong because BGP peering requires Layer 3 adjacency and is irrelevant to a Layer 2 bridge deployment. Option C is wrong because transparent firewalls still enforce security rules on bridged traffic; Layer 2 operation does not disable filtering.

Exam trap

CND often tests the confusion between Transparent and Routed modes, leading candidates to select options that involve IP addresses on data interfaces or routing protocols, which are not applicable in Transparent mode.

Full explanation →

147

MCQmedium

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

A.Configuring an IIS URL Rewrite rule to block GET requests

B.Disabling Outlook Web Access (OWA) entirely for all users

C.Enabling Basic Authentication across all virtual directories

D.Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches

AnswerD

Exchange Cumulative Updates include architectural fixes and hardening that remove the vulnerable web component behaviours exploited for SSRF and insecure deserialisation. Staying current closes those attack paths, satisfying the requirement to prevent both attack types.

Why this answer

Microsoft Exchange SSRF and insecure deserialization vulnerabilities (notably ProxyLogon CVE-2021-26855 and ProxyShell/ProxyOracle chains) are patched through Cumulative Updates and security updates. Applying the latest CU and patches is the single most critical control because these flaws live in Exchange's own web components (e.g., Autodiscover, ECP, OWA) and cannot be reliably mitigated by generic IIS rules or authentication changes.

Exam trap

CND often tests whether candidates reach for generic web hardening (URL Rewrite, disabling OWA, Basic Auth) instead of the specific vendor patch — the trap is treating Exchange SSRF/deserialization as a generic IIS problem rather than a product-specific vulnerability requiring CUs.

How to eliminate wrong answers

Option A is wrong because blocking GET requests via URL Rewrite breaks legitimate Exchange functionality and does not address the POST-based SSRF and deserialization vectors used in ProxyLogon/ProxyShell. Option B is wrong because disabling OWA entirely is a drastic availability trade-off that still leaves ECP, Autodiscover, and other vulnerable virtual directories exposed. Option C is wrong because enabling Basic Authentication weakens security, exposes credentials, and does nothing to remediate SSRF or deserialization flaws in Exchange code.

Full explanation →

148

Multi-Selecthard

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

Select 3 answers

A.Plaintext passwords extracted from HTTPS payload bodies

B.Raw ICMP echo payload strings

C.Server Name Indication (SNI) fields in the TLS Client Hello message

D.JA3 and JA3S TLS cryptographic handshaking fingerprints

E.X.509 digital certificate metadata (issuer, validity dates, self-signed status)

AnswersC, D, E

The SNI field in the TLS Client Hello is transmitted in cleartext before encryption begins, so inspecting it reveals destination hostnames even when payloads are opaque. This satisfies the requirement to identify anomalous encrypted channels without decryption, exposing domain-fronting or beaconing to suspicious destinations.

Why this answer

Option C is correct because the SNI field in the TLS Client Hello is sent in cleartext even when the rest of the session is encrypted, so the analyst can see which hostnames a client is contacting and flag anomalous or DGA-like domains. Option D is correct because JA3 (client) and JA3S (server) fingerprints are derived from the TLS Client Hello and Server Hello parameters (version, cipher suites, extensions, elliptic curves), letting the analyst detect malware families or non-browser TLS stacks even without decrypting traffic. Option E is correct because X.509 certificate metadata such as issuer, validity dates, and self-signed status is observable during the handshake and can reveal suspicious or internally generated certificates used by C2 or exfiltration channels.

Option A does not belong because HTTPS payload bodies are encrypted by TLS, so plaintext passwords are not directly extractable from captured traffic without decryption keys or a TLS-terminating proxy. Option B does not belong because raw ICMP echo payload strings are unrelated to TLS handshake anomalies and would not identify encrypted-channel exfiltration.

Exam trap

The trap is assuming that encrypted traffic yields no useful telemetry — candidates pick the plaintext password option because they think 'we need to decrypt,' but the exam expects knowledge that SNI, JA3/JA3S, and certificate metadata are visible without decryption.

Full explanation →

149

MCQmedium

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

A.RADIUS

B.VRRP (Virtual Router Redundancy Protocol)

C.BGP (Border Gateway Protocol)

D.DHCP (Dynamic Host Configuration Protocol)

AnswerB

VRRP elects a master router that owns a shared virtual IP and MAC, so the standby assumes both within seconds of failure, giving seamless failover with no client reconfiguration. It is the vendor-neutral first-hop redundancy protocol commonly paired with firewall HA.

Why this answer

VRRP (Virtual Router Redundancy Protocol) is designed to provide first-hop redundancy by allowing multiple routers or firewalls to share a virtual IP address and MAC address. The active device owns the virtual IP and forwards traffic, while the standby takes over seamlessly if the active fails, ensuring continuous availability for hosts that use the virtual IP as their default gateway.

Exam trap

The trap here is confusing routing protocols (BGP) or AAA protocols (RADIUS) with first-hop redundancy protocols; candidates often pick BGP because it sounds like it handles failover, but BGP is for route exchange, not virtual IP sharing.

How to eliminate wrong answers

Option A is wrong because RADIUS is an authentication, authorization, and accounting (AAA) protocol used for network access control, not for providing IP failover or virtual IP sharing. Option C is wrong because BGP is a dynamic routing protocol used for exchanging routes between autonomous systems, not for first-hop redundancy or virtual IP failover. Option D is wrong because DHCP is used to dynamically assign IP addresses and configuration parameters to hosts, not to provide gateway redundancy or failover between firewalls.

Full explanation →

150

MCQhard

A security engineer is evaluating a network intrusion prevention system (NIPS) that must inspect traffic flowing between two internal VLANs at 10 Gbps. The requirement is to detect and block exploits without introducing asymmetric routing, and the device must remain transparent to Layer 2 and Layer 3 topologies. Which deployment mode should the engineer choose?

A.TAP aggregation with out-of-band correlation only

B.Passive SPAN port monitoring with TCP reset injection

C.Inline routed mode with each interface on a different subnet

D.Inline transparent mode using a Layer 2 bridge with fail-open bypass

AnswerD

Inline transparent mode bridges two interfaces at Layer 2, so the NIPS inspects and can drop malicious frames without changing IP addressing or routing. Fail-open bypass maintains connectivity if the device fails. This matches the need to block exploits, avoid asymmetric routing, and remain transparent to Layer 2 and Layer 3 topologies, making it the correct deployment mode for this scenario.

Why this answer

Inline transparent mode with a Layer 2 bridge allows the NIPS to inspect and drop malicious traffic while remaining invisible to Layer 2 and Layer 3 addressing and routing. Fail-open bypass preserves availability if the device fails. Passive, TAP, and routed inline modes either cannot block reliably or alter the network topology, so they do not meet the transparency and prevention requirements.

Exam trap

The trap here is assuming that a passive SPAN or TAP deployment can block attacks simply because it detects them.

Full explanation →

EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 76–150