EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) CND Questions 226–300 | Page 4/5

226

MCQmedium

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

A.Running regular traceroute commands from endpoints

B.Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation

C.Enabling port security on enterprise access layer switches

D.Configuring static ARP entries on enterprise switches

AnswerB

A WIPS with triangulation continuously monitors the RF spectrum, flags unauthorised BSSIDs spoofing the corporate SSID, and uses signal-strength readings from multiple sensors to calculate the rogue AP's physical location. This directly satisfies the stem's requirement to both detect the rogue device and locate its physical source.

Why this answer

A WIPS with triangulation uses multiple sensors to measure signal strength (RSSI) from a detected rogue AP and calculates its physical location by comparing readings across sensors. This is the only listed technique that both detects the rogue AP and locates its physical source, which is required to remove it. WIPS also correlates BSSIDs, SSIDs, and behavior to distinguish true rogues from neighboring APs.

Exam trap

The trap is picking a wired-side control (port security, static ARP) for a wireless problem — CND tests whether candidates match the layer and medium of the control to the threat.

How to eliminate wrong answers

Option A is wrong because traceroute operates at Layer 3 and cannot identify or locate a wireless AP, which is a Layer 2 device. Option C is wrong because port security on wired switches blocks unauthorized MAC addresses on wired ports and has no visibility into wireless rogue APs. Option D is wrong because static ARP entries mitigate ARP spoofing on the wired LAN but do nothing to detect or locate a rogue wireless AP.

Full explanation →

227

MCQeasy

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

A.Identity-Aware Proxy (IAP)

B.Kubernetes Network Policies

C.Google Cloud Armor security policies

D.VPC Firewall Rules using subnet tags

AnswerB

Kubernetes Network Policies select pods by label and define ingress and egress rules between them, so traffic filtering works on identity rather than IP addresses. GKE enforces these policies through its network plugin, satisfying the label-based pod restriction requirement.

Why this answer

Kubernetes Network Policies are the native GKE feature that allows pod-level traffic control based on labels, namespaces, and ports. They operate at Layer 3/4 and are enforced by the CNI plugin (e.g., Calico on GKE), enabling fine-grained segmentation without relying on IP addresses. This directly meets the requirement to restrict traffic between pods using labels.

Exam trap

The trap here is confusing network-level security services (Cloud Armor, VPC firewall) with pod-level segmentation, and overlooking that Kubernetes Network Policies are the only native label-based mechanism for pod traffic control.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) is an application-level access control for HTTP(S) services, not for pod-to-pod network traffic. Option C is wrong because Google Cloud Armor provides DDoS protection and WAF at the edge for external HTTP(S) load balancers, not for internal pod communication. Option D is wrong because VPC Firewall Rules apply to VM instances and use network tags, not Kubernetes labels, and they operate at the subnet level, not pod level.

Full explanation →

228

Multi-Selecteasy

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

Select 2 answers

A.Potential operational downtime and business impact

B.The color of the Ethernet cables connected to the rack

C.The office desk location of the IT director

D.Need for evidence preservation (e.g., maintaining RAM state)

E.The brand name of the server manufacturer

AnswersA, D

Containment choices hinge on balancing threat neutralisation against service continuity. Assessing potential operational downtime and business impact lets defenders select proportionate isolation—such as segmenting the host versus full shutdown—so the compromised web server is contained without causing disproportionate harm to critical operations.

Why this answer

Option A is correct because selecting a containment strategy requires weighing the operational downtime and business impact of taking the compromised web server offline, since containment actions such as isolating the host, blocking ports, or shutting it down can disrupt critical services and must be balanced against the severity of the threat. Option D is correct because evidence preservation is a key containment consideration; volatile data such as RAM contents, running processes, and network connections can be lost if the server is powered off or rebooted, so defenders may choose network isolation over shutdown to preserve forensic artifacts. The remaining options are not relevant: Ethernet cable color (B), the IT director's desk location (C), and the server manufacturer's brand name (E) have no bearing on containment strategy selection.

Exam trap

CND often tests whether candidates can distinguish operational/forensic factors from irrelevant physical or organizational trivia — the trap is overthinking distractors that sound technical but have no bearing on containment.

Full explanation →

229

MCQmedium

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

A.Implicit deny all traffic by default, explicitly permitting only necessary destination ports and IPs

B.Implement stateful inspection only on inbound perimeter traffic, trusting all outbound traffic

C.Disable firewall packet filtering on internal interfaces to maximize application throughput

D.Permit all internal traffic by default, blocking only known malicious signatures

AnswerA

Default-deny with explicit allow rules for only required destination ports and IPs enforces least privilege between DMZ and application tier, minimising exposed attack surface. This satisfies the stem's requirement to structure firewall rules per least privilege in the network defence lifecycle.

Why this answer

The principle of least privilege requires that firewall rules between the DMZ and the internal application tier follow an implicit deny posture, permitting only the specific destination ports and IP addresses required for legitimate application traffic. This limits lateral movement if the DMZ is compromised, since an attacker cannot reach arbitrary internal hosts or services. Explicitly enumerating allowed flows also produces an auditable rule set that supports network defense lifecycle management (design, implement, monitor, maintain).

Exam trap

CND often tests the misconception that internal network traffic is inherently trusted, so candidates pick options that permit all internal traffic or only inspect the perimeter instead of applying default-deny least privilege between internal tiers.

How to eliminate wrong answers

Option B is wrong because trusting all outbound traffic while only inspecting inbound perimeter traffic ignores east-west threats and exfiltration from compromised internal hosts; stateful inspection must apply to both directions and to internal segments. Option C is wrong because disabling packet filtering on internal interfaces removes a core defense-in-depth layer and exposes the application tier directly to any DMZ compromise, trading security for throughput that can be achieved through hardware scaling instead. Option D is wrong because a default-permit posture with signature-only blocking is a blacklist model that fails against unknown or encrypted threats and violates least privilege; firewalls should default-deny, not default-allow.

Full explanation →

230

Multi-Selecteasy

An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)

Select 2 answers

A.Acceptable Use Policy (AUP)

B.Access Control Policy

C.Spanning Tree Protocol Priority Table

D.BGP Routing Advertisement Standard

E.OSPF Area Design Specification

AnswersA, B

The Acceptable Use Policy is a foundational sub-policy because it defines how employees may use organisational assets, directly satisfying the governance umbrella's need for enforceable user-conduct rules. It translates high-level policy intent into specific, auditable behavioural constraints, covering email, internet, and device usage, which the framework requires.

Why this answer

The Acceptable Use Policy (AUP) (A) is a foundational sub-policy because it defines how employees may use organizational IT assets, covering email, internet, and device usage, which directly supports the governance umbrella of an Information Security Policy framework. The Access Control Policy (B) is also foundational because it specifies rules for granting, reviewing, and revoking access to systems and data, establishing least privilege and need-to-know principles that underpin security governance. Options C, D, and E are not policy documents but technical network configuration artifacts: Spanning Tree Protocol priority values, BGP route advertisement rules, and OSPF area design are operational networking details, not governance-level security policies.

Exam trap

CND often tests whether candidates can distinguish governance documents (AUP, Access Control Policy) from technical network configuration artifacts (STP, BGP, OSPF), so avoid picking options that sound technical but are not policies.

Full explanation →

231

Multi-Selecteasy

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

Select 2 answers

A.Disabling endpoint firewall protection to improve home network gaming performance

B.Multi-Factor Authentication (MFA) for all authentication attempts

C.Sharing corporate laptop credentials with family members for household convenience

D.Connecting directly via unencrypted public Wi-Fi without any protective tunneling

E.Encrypted Virtual Private Network (VPN) tunnel with IPsec or TLS

AnswersB, E

MFA directly satisfies the policy's requirement for strong authentication on every access attempt to internal resources. By demanding a second factor beyond a password, it neutralises credential theft and replay attacks, which are the primary risks when remote sessions traverse untrusted home networks. This enforces identity assurance regardless of location.

Why this answer

Option B is correct because Multi-Factor Authentication (MFA) ensures that even if a remote employee's password is compromised, an attacker cannot authenticate to internal corporate resources without the additional factor, directly mitigating credential-theft and phishing risks inherent to home environments. Option E is correct because an encrypted VPN tunnel using IPsec or TLS provides confidentiality and integrity for data in transit between the remote endpoint and the corporate network, preventing eavesdropping or tampering on untrusted home or public networks. Options A, C, and D are incorrect: disabling endpoint firewall protection weakens host defenses and exposes the device to inbound attacks, sharing credentials with family members violates least-privilege and non-repudiation principles, and connecting directly over unencrypted public Wi-Fi without tunneling exposes all traffic to interception and man-in-the-middle attacks.

Exam trap

CND often tests the misconception that a VPN alone is sufficient without MFA, or that home network security is adequate, leading candidates to overlook the need for both encryption and strong authentication.

Full explanation →

232

MCQmedium

A security analyst is reviewing an application that stores user passwords in a database. The analyst finds that passwords are hashed with SHA-256 and a unique salt per user. The organization wants to increase resistance to offline brute-force attacks using GPUs. Which change should the analyst recommend?

A.Switch to SHA-512 with a longer salt.

B.Encrypt the password hashes with AES-256 before storing them.

C.Replace SHA-256 with bcrypt using an appropriate work factor.

D.Store passwords using Base64 encoding instead of hashing.

AnswerC

bcrypt is a password-hashing function designed to be slow and tunable via a cost factor, making GPU-based brute-force attacks much more expensive. It also handles salting internally. Replacing fast SHA-256 with bcrypt directly addresses the need to increase resistance to offline cracking, so it is the appropriate recommendation.

Why this answer

Fast hashes like SHA-256, even with salts, are vulnerable to high-speed GPU cracking. bcrypt is intentionally slow and tunable, so increasing its work factor raises the cost of offline attacks. SHA-512, AES encryption of hashes, and Base64 encoding either remain fast or weaken protection, so bcrypt is the correct recommendation.

Exam trap

The trap here is assuming a stronger or longer fast hash improves password security; speed is the weakness, and only a deliberately slow algorithm such as bcrypt addresses GPU cracking.

Full explanation →

233

Multi-Selectmedium

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

Select 2 answers

A.It is hypothesis-driven, focusing on assumptions that adversaries are already inside the network

B.It is performed only after a major ransomware encryption event completes

C.It involves human-led, iterative searches through endpoint and network telemetry

D.It replaces network firewalls and endpoint protection agents completely

E.It relies exclusively on automated SIEM alerts to trigger response actions

AnswersA, C

Hypothesis-driven hunting assumes adversaries already reside inside the network, then tests that assumption through targeted searches. This contrasts with reactive SOC monitoring, which waits for alerts; the stem asks what differentiates proactive hunting, and this assumption-led approach is the defining characteristic.

Why this answer

Option A is correct because proactive threat hunting is fundamentally hypothesis-driven: hunters assume adversaries may already be present and form testable hypotheses (e.g., 'attackers are using living-off-the-land binaries for lateral movement') to guide their searches, rather than waiting for an alert. Option C is correct because threat hunting is a human-led, iterative process in which analysts manually and repeatedly query endpoint telemetry (EDR process trees, command lines) and network telemetry (NetFlow, DNS, proxy logs) to validate or refute hypotheses, refining the hunt as findings emerge. These two traits distinguish hunting from reactive SOC monitoring, which is alert-driven and typically triggered by SIEM correlation rules or IDS signatures after suspicious activity is detected.

Option B is wrong because hunting is proactive and occurs before or independent of a completed ransomware event, not only afterward. Option D is wrong because hunting complements, but does not replace, preventive controls such as firewalls and endpoint protection agents. Option E is wrong because exclusive reliance on automated SIEM alerts describes reactive monitoring, the very approach hunting is meant to augment.

Exam trap

CND often tests the distinction between proactive threat hunting and reactive SOC monitoring, and candidates may incorrectly associate threat hunting with post-incident activities or automated alerting.

Full explanation →

234

MCQhard

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

A.find / -attr +s -type d

B.find / -perm -4000 -type f 2>/dev/null

C.locate -i suid_binaries

D.chmod -R 755 /

AnswerB

The -perm -4000 predicate matches files whose permission bits include the SUID bit, and -type f restricts results to regular files. Redirecting stderr to /dev/null suppresses permission-denied noise, satisfying the requirement to enumerate SUID binaries across the root partition.

Why this answer

The SUID bit is represented by the octal permission value 4000, so 'find / -perm -4000 -type f' locates all regular files with that bit set. The '-type f' restricts results to files (not directories), and '2>/dev/null' suppresses permission-denied errors from unreadable directories. This is the canonical command for auditing SUID binaries during Linux hardening.

Exam trap

The trap is confusing the SUID octal value — candidates may pick 1000 (sticky bit) or 2000 (SGID) instead of 4000, or forget that '-type f' is needed to exclude directories.

How to eliminate wrong answers

Option A is wrong because '-attr +s' is not a valid find predicate for the SUID bit — the correct attribute syntax uses '-perm' with octal or symbolic modes, and '-type d' would search directories, which cannot carry SUID meaningfully. Option C is wrong because 'locate' queries a prebuilt filename database and cannot filter by permission bits; it also has no concept of SUID. Option D is wrong because 'chmod -R 755 /' would recursively strip SUID/SGID bits and set world-readable/executable permissions across the entire filesystem, breaking the system rather than auditing it.

Full explanation →

235

MCQhard

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

A.Three-legged firewall architecture creating separate internal, external, and DMZ zones

B.Placing all web and database servers on the same internal VLAN protected by host firewalls

C.Single-firewall dual-homed architecture with a software loopback filter

D.Direct flat bridging between the external router and the internal core switch

AnswerA

A three-legged firewall uses three distinct physical or logical interfaces to isolate the internal network, external network, and DMZ into separate security zones.

Why this answer

A three-legged firewall architecture (also called a tri-homed firewall) uses three separate network interfaces to create distinct security zones: external (internet), internal (trusted LAN), and DMZ (public-facing services). This enforces segmentation so that compromised public web servers in the DMZ cannot directly reach internal database servers, and all traffic between zones must pass through the firewall's inspection policy. It directly satisfies the requirement for an intermediary inspection zone between public web servers and internal databases.

Exam trap

CND often tests the misconception that a dual-homed firewall plus a host-based filter provides equivalent segmentation to a true three-legged DMZ design — candidates pick the 'simpler' dual-homed option without recognizing it cannot create a third isolated zone.

How to eliminate wrong answers

Option B is wrong because placing web and database servers on the same internal VLAN eliminates network segmentation, so a web server compromise gives attackers a direct Layer 2 path to the database servers regardless of host firewalls. Option C is wrong because a dual-homed firewall only provides two interfaces (external and internal), so it cannot create a separate DMZ inspection zone — the loopback filter is a host-level control, not a zone separation mechanism. Option D is wrong because flat bridging between the external router and internal core switch bypasses all firewall inspection entirely, merging the untrusted and trusted networks into one broadcast domain.

Full explanation →

236

Multi-Selecthard

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Select 3 answers

A.Allow internal users unrestricted, unmonitored access to all DMZ administrative portals by default.

B.Never allow direct, uninspected traffic from the external zone to pass straight through the DMZ into the internal network.

C.Place public-facing web and DNS servers inside the DMZ zone.

D.Enforce the principle of least privilege using granular firewall rules between the DMZ and internal network.

E.Disable all logging on perimeter firewalls to conserve CPU cycles.

AnswersB, C, D

Traffic from the external zone must terminate in the DMZ rather than transit it into the internal network. Blocking uninspected pass-through traffic enforces zone separation, so a compromised DMZ host cannot relay external connections inward, satisfying the stem's secure DMZ design principle.

Why this answer

Option B is correct because a core DMZ design rule is that traffic from the external/untrusted zone must never be permitted to traverse the DMZ and reach the internal network without being terminated, inspected, or proxied by a security control; this prevents attackers from using the DMZ as a pivot point. Option C is correct because public-facing services such as web and DNS servers are the classic DMZ residents — they must be reachable from the internet, so placing them in the DMZ isolates them from the protected internal network. Option D is correct because least privilege applied through granular firewall rules between the DMZ and the internal network limits lateral movement; only specific, required flows (for example, a web server initiating a single TCP port to a specific backend database) should be allowed.

Option A is incorrect because granting internal users unrestricted, unmonitored access to DMZ administrative portals violates least privilege and monitoring requirements, turning the DMZ into an unmanaged attack path. Option E is incorrect because disabling perimeter firewall logging destroys the audit trail needed for detection, incident response, and compliance; logging should be retained and tuned, not turned off.

Exam trap

The trap here is that candidates see 'DMZ' and assume any traffic touching it is automatically safe, forgetting that the DMZ is itself semi-trusted and must be treated as a potential pivot point requiring inspection and least privilege.

Full explanation →

237

MCQeasy

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

A.extend

B.project

C.summarize

D.where

AnswerD

The where operator filters a table by a boolean predicate, returning only rows matching the condition. Applied to DeviceProcessEvents with FileName == "cmd.exe", it satisfies the stem's requirement to include only process creation events whose file name matches cmd.exe.

Why this answer

The `where` operator in KQL is the filtering operator — it returns only rows from a table that satisfy a given predicate, such as `DeviceProcessEvents | where FileName == 'cmd.exe'`. This is exactly the behavior required to include only rows where the file name matches 'cmd.exe'. It is the KQL equivalent of a SQL WHERE clause and is the standard operator used in Microsoft Defender for Endpoint advanced hunting queries.

Exam trap

The trap here is confusing row-filtering operators (`where`) with column-shaping operators (`project`, `extend`) or aggregation operators (`summarize`); candidates who skim often pick `project` because it sounds like 'selecting' data.

How to eliminate wrong answers

Option A is wrong because `extend` creates new calculated columns from existing data rather than filtering rows, so it cannot restrict output to matching file names. Option B is wrong because `project` selects, renames, or drops columns (a column-level operation) and does not filter rows by predicate. Option C is wrong because `summarize` performs aggregation (count, sum, avg, etc.) grouped by keys, producing summary rows rather than filtering raw events.

Full explanation →

238

MCQhard

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

A.Set the 'HttpOnly' and 'Secure' attributes on all session cookies.

B.Configure the 'SameSite=Strict' and 'Max-Age' attributes on session cookies.

C.Implement the 'Domain' and 'Path' restriction attributes on all authentication cookies.

D.Enable the 'Partitioned' (CHIPS) attribute and 'HttpOnly' flag on cookies.

AnswerA

HttpOnly blocks JavaScript access to the cookie, defeating document.cookie theft during XSS execution. Secure ensures the cookie transmits only over HTTPS, preventing interception through network sniffing. Together they satisfy both stated attack vectors, whereas either flag alone leaves one exposure unaddressed.

Why this answer

The HttpOnly flag prevents client-side scripts (such as JavaScript in XSS attacks) from accessing document.cookie. The Secure flag ensures that the cookie is transmitted only over encrypted (HTTPS) connections, preventing network sniffing.

Full explanation →

239

MCQeasy

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

A.Nmap

B.MISP

C.Autopsy

D.Wireshark

AnswerB

MISP is an open-source threat intelligence platform purpose-built to structure, store and share IoCs such as file hashes and IP addresses in machine-readable formats, including STIX and its own MISP core format, enabling automated exchange between organisations.

Why this answer

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed to structure, store, and share IoCs in machine-readable formats like STIX and MISP JSON. It supports taxonomies, galaxies, and feeds that let ISACs and SOCs exchange indicators at scale. This makes it the correct answer for structuring and sharing threat intelligence.

Exam trap

CND often tests whether candidates can distinguish threat intelligence sharing platforms (MISP) from scanning, forensics, or packet analysis tools — the trap is picking a familiar security tool that does not handle IoC structuring or sharing.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning and host discovery tool, not a threat intelligence platform. Option C is wrong because Autopsy is a digital forensics platform for disk image analysis, not for sharing IoCs. Option D is wrong because Wireshark is a packet capture and protocol analysis tool, not a threat intelligence framework.

Full explanation →

240

MCQeasy

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

A.dd if=/dev/sdb of=/evidence.raw --hash=md5

B.ftk_imager --verify --md5 evidence.raw

C.volatility -f evidence.raw --hash

D.sha256sum evidence.raw

AnswerD

sha256sum produces a 256-bit SHA-2 digest of the evidence file; any later modification alters the hash, giving cryptographic proof of integrity. Recording this value at acquisition and recomputing it during investigation verifies the disk image remains unaltered, satisfying the forensic chain-of-custody requirement.

Why this answer

The sha256sum command computes a SHA-256 cryptographic hash of the specified file, producing a unique fixed-length digest that serves as a digital fingerprint. Any modification to the evidence file—even a single bit flip—will produce a completely different hash value, allowing an analyst to later re-hash the file and compare digests to prove integrity. SHA-256 is collision-resistant and widely accepted in forensic and legal contexts as a standard for evidence authentication.

Unlike MD5 or SHA-1, it has no known practical collision attacks, making it suitable for cryptographic proof.

Exam trap

CND often tests the misconception that any hashing algorithm (like MD5) or any tool with a 'hash' flag is sufficient for cryptographic proof, when in fact only a secure algorithm like SHA-256 and the correct command syntax provide legally defensible integrity verification.

How to eliminate wrong answers

Option A is wrong because dd does not have a --hash parameter; while dd can compute hashes via separate commands (e.g., md5sum), the syntax shown is invalid and MD5 is cryptographically broken due to collision vulnerabilities. Option B is wrong because ftk_imager is a forensic imaging tool, not a general-purpose hashing utility, and the --verify --md5 flags are not standard for generating a hash of an existing file; moreover, MD5 is unsuitable for cryptographic proof. Option C is wrong because volatility is a memory forensics framework, not a disk hashing tool, and the --hash parameter does not exist in its command-line interface for this purpose.

Full explanation →

241

Multi-Selecthard

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Select 3 answers

A.Amazon VPC Security Groups acting as stateful virtual firewall instances

B.Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering

C.AWS Network Firewall for managed stateful inspection and intrusion prevention

D.Amazon VPC Network ACLs (NACLs) acting as stateless subnet-level firewalls

E.AWS Shield Standard for intra-VPC subnet routing

AnswersA, C, D

Amazon VPC Security Groups operate at the instance and ENI level, permitting or denying traffic through stateful rule evaluation — return traffic is automatically allowed regardless of inbound rules. This satisfies the stem's requirement for traffic filtering within the VPC, providing the stateful virtual firewall capability needed to enforce network isolation across multi-tier applications.

Why this answer

Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets.

Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Exam trap

CND often tests the specific roles of AWS network security services, and candidates may confuse DNS firewall or Shield with packet filtering services.

Full explanation →

242

MCQhard

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

A.Create an outbound NAT rule mapping banking IP addresses to a loopback interface.

B.Configure a static route directing banking traffic through an uninspected bypass interface.

C.Configure a Decryption Exclusion / Bypass rule for specific trusted destination URL categories or domains

D.Disable all Layer 7 application inspection signatures globally for TCP port 443.

AnswerC

A decryption exclusion or bypass rule scoped to specific trusted destinations lets the NGFW skip TLS interception for those banking applications while continuing DPI elsewhere. This satisfies the privacy constraint without disabling inspection globally, preserving visibility for all other traffic.

Why this answer

Configuring a Decryption Exclusion or Bypass rule for specific trusted destination URL categories or domains allows the NGFW to skip SSL decryption for those destinations while continuing to decrypt and inspect all other TLS traffic. This satisfies privacy regulations without disabling overall inspection.

Exam trap

The trap is assuming that any rule affecting traffic flow (NAT, routing) can bypass decryption, when only specific decryption exclusion policies achieve selective SSL bypass without disabling global inspection.

How to eliminate wrong answers

Option A is wrong because NAT rules affect addressing, not decryption policy, and would not bypass SSL inspection. Option B is wrong because static routes control path selection, not inspection behavior, and an 'uninspected bypass interface' is not a standard decryption bypass mechanism. Option D is wrong because disabling all Layer 7 inspection for port 443 globally would eliminate inspection for all TLS traffic, violating the requirement to maintain overall inspection.

Full explanation →

243

MCQhard

A security engineer is hardening a fleet of Windows 10 endpoints against credential theft. The engineer wants to prevent attackers from extracting plaintext passwords or NTLM hashes from memory. Which of the following Windows features should the engineer enable to achieve this goal?

A.Windows Defender Firewall with Advanced Security

B.BitLocker Drive Encryption

C.AppLocker

D.Credential Guard

AnswerD

Credential Guard uses virtualization-based security to isolate secrets such as NTLM hashes and Kerberos tickets in a protected process that only system software can access. This prevents tools like Mimikatz from extracting credentials from LSASS memory. Enabling Credential Guard directly addresses the goal of preventing credential theft from memory, making it the correct choice for this scenario.

Why this answer

Credential Guard is designed to isolate and protect credential material using virtualization-based security, preventing extraction from memory. AppLocker, Windows Defender Firewall, and BitLocker address different security concerns—application control, network filtering, and data-at-rest encryption—and do not prevent in-memory credential dumping. Thus, Credential Guard is the appropriate feature to enable.

Exam trap

The trap here is confusing data-at-rest protection (BitLocker) or application control (AppLocker) with in-memory credential protection, which requires virtualization-based isolation.

Full explanation →

244

Multi-Selecthard

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

Select 3 answers

A.Relying on legacy WEP shared keys for guest network isolation

B.Configuring hidden SSIDs as the primary security defense

C.Implementing IEEE 802.11w (Protected Management Frames)

D.Deploying a Wireless Intrusion Prevention System (WIPS) sensor network

E.Enabling 802.1X authentication backed by a secure RADIUS / Enterprise PKI infrastructure

AnswersC, D, E

802.11w encrypts and integrity-protects management frames such as deauthentication and disassociation, preventing attackers from forging them to force client disconnections or capture handshakes. This satisfies the stem's requirement to counter wireless sniffing and rogue-device interference at the frame level.

Why this answer

Option C is correct because IEEE 802.11w Protected Management Frames cryptographically protects management frames such as deauthentication and disassociation, preventing wireless sniffing-based denial-of-service and spoofing attacks against the WLAN. Option D is correct because a WIPS sensor network continuously monitors the RF spectrum to detect and automatically contain rogue APs, evil twins, and unauthorized client devices, directly addressing the unauthorized-device requirement. Option E is correct because 802.1X with a secure RADIUS server and Enterprise PKI enforces certificate-based mutual authentication, ensuring only authorized devices and users can associate and preventing credential theft or rogue supplicant access.

Option A is not appropriate because WEP is cryptographically broken and provides no meaningful isolation or protection, and Option B is not appropriate because hidden SSIDs are trivially discovered by sniffers and offer no real security, so neither belongs in a hardened enterprise design.

Exam trap

CND often tests whether candidates treat hidden SSIDs and WEP as legitimate security controls, when both are ineffective — hidden SSIDs offer no protection and WEP is trivially broken.

Full explanation →

245

MCQhard

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

A.xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml

B.http.cors.enabled: true and http.cors.allow-origin: "*"

C.cluster.routing.allocation.enable: all and network.host: 0.0.0.0

D.discovery.type: single-node without password configuration

AnswerA

Enabling `xpack.security.enabled: true` activates Elasticsearch's native authentication and role-based access control, blocking anonymous index access, while `xpack.security.transport.ssl.enabled: true` encrypts node-to-node transport, preventing interception of PII and financial records in transit. Together they satisfy the stem's requirement to enforce both authentication and transport layer security.

Why this answer

To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Exam trap

The trap here is that candidates see a security-sounding setting like http.cors or network.host and assume it hardens the cluster, when in fact CORS wildcards and 0.0.0.0 binding are common misconfigurations that expose Elasticsearch — the exam tests whether you know the actual xpack.security flags that enable auth and TLS.

How to eliminate wrong answers

Option B is wrong because http.cors.enabled with a wildcard origin actually weakens security by allowing any web origin to make cross-origin requests to the cluster, and it does nothing for authentication or transport encryption. Option C is wrong because cluster.routing.allocation.enable: all is a shard allocation setting and network.host: 0.0.0.0 binds Elasticsearch to all interfaces, exposing it broadly rather than securing it. Option D is wrong because discovery.type: single-node without password configuration leaves the cluster unauthenticated and unencrypted, which is the opposite of the required hardening.

Full explanation →

246

Multi-Selecteasy

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Select 2 answers

A.Inline placement directly in the path of network traffic flow to allow active packet dropping.

B.Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).

C.Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.

D.Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.

E.The ability to reset active TCP connections using TCP reset (RST) injections when malicious payloads are detected.

AnswersA, E

Inline placement lets the NIPS inspect every packet in real time and drop malicious traffic before it reaches the target, satisfying the requirement for active prevention rather than passive detection. Out-of-band, SPAN-based tools can only alert or reset after the fact, so they cannot block packets directly.

Why this answer

Option A is correct because a NIPS is typically deployed inline, sitting directly in the traffic path so it can actively drop or block malicious packets in real time rather than merely alerting. Option E is correct because many NIPS platforms can terminate or disrupt an in-progress attack by injecting TCP RST packets to reset the offending connection, which is an active prevention capability. Options B and D describe passive, detection-only behavior characteristic of a NIDS (e.g., SPAN port/TAP monitoring or syslog alerting without affecting traffic), so they do not represent prevention.

Option C is incorrect because a NIPS must inspect Layer 3 and Layer 4 headers (and often higher layers) to identify and block malicious traffic, so operating as a pure Layer 2 bridge without inspection is not a NIPS feature.

Exam trap

The trap is conflating NIDS and NIPS capabilities — candidates pick passive monitoring or alert-only options because they sound like standard IDS features, forgetting that prevention requires inline placement and active response actions like packet drops or RST injection.

Full explanation →

247

MCQmedium

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

A.Pass the uploaded file directly to the operating system's eval() function

B.Validate the file's magic bytes (header signature), enforce an extension whitelist, and store files outside the web root

C.Compress the uploaded file using ZIP format before saving

D.Check only the filename extension provided in the client's HTTP multipart header

AnswerB

Magic-byte validation confirms the file's true type regardless of its name, the extension whitelist blocks executable formats, and storing files outside the web root prevents direct execution. Together these controls stop uploaded scripts from being interpreted and executed by the server.

Why this answer

Preventing arbitrary file upload RCE requires validating the file's actual content (magic bytes/header signature), enforcing a strict extension whitelist, and storing uploaded files outside the web root so they cannot be executed. This triple control defeats both extension-spoofing (e.g., 'shell.php.jpg') and direct execution of uploaded payloads. Magic-byte validation ensures the file truly is the claimed type, not a renamed script.

Exam trap

CND often tests the misconception that checking the file extension or Content-Type header is sufficient — candidates must recognize that only magic-byte validation plus storage outside the web root prevents RCE.

How to eliminate wrong answers

Option A is wrong because passing user-uploaded content to eval() is a direct remote code execution vulnerability — it executes arbitrary attacker-supplied code, the exact opposite of a mitigation. Option C is wrong because compressing a file with ZIP does not sanitize it; the archive can still contain a malicious payload, and if extracted server-side, the payload executes. Option D is wrong because checking only the client-supplied filename extension is trivially bypassed — attackers can rename 'shell.php' to 'shell.jpg' or use double extensions, and the Content-Type header is also client-controlled.

Full explanation →

248

MCQeasy

A CND analyst at a healthcare provider is asked to classify a new data set containing patient appointment notes, physician referrals, and insurance billing codes. The organization follows a four-tier internal classification scheme (Public, Internal, Confidential, Restricted). Which classification level BEST fits this data set?

A.Confidential

B.Restricted

C.Public

D.Internal

AnswerA

Confidential is the appropriate tier because the data contains protected health information that must be restricted to authorized clinical and billing staff, encrypted in transit and at rest, and handled under HIPAA safeguards. It is sensitive but not classified at the highest Restricted tier, which is typically reserved for data whose disclosure would cause catastrophic organizational harm.

Why this answer

The data set contains protected health information, which requires controlled access, encryption, and regulatory safeguards, so it belongs in the Confidential tier. Restricted is too high for routine clinical and billing records, while Public and Internal tiers fail to capture the legal and privacy impact of a leak. Correct classification drives the right handling and control baseline.

Exam trap

The trap here is assuming any regulated data must automatically be classified at the highest tier rather than matching the tier to the actual impact of disclosure.

Full explanation →

249

MCQmedium

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

A.Control Plane Policing (CoPP)

B.Spanning Tree Root Guard

C.Port Security

D.Dynamic ARP Inspection (DAI)

AnswerA

CoPP applies a policer to control-plane traffic, rate-limiting packets destined for the route processor before they reach the CPU. This directly prevents external floods from exhausting router CPU, satisfying the stated requirement to protect the control plane against CPU exhaustion attacks.

Why this answer

Control Plane Policing (CoPP) is a Cisco IOS feature that allows administrators to apply a QoS policy to traffic destined for the router's control plane (the CPU). It rate-limits or drops excessive control-plane traffic, such as routing protocol updates, ICMP, and management access, preventing CPU exhaustion attacks from external floods. By protecting the control plane, CoPP ensures the router remains stable and available even under attack.

Exam trap

CND often tests the distinction between control plane protection and Layer 2 security features; candidates may confuse CoPP with features like Port Security or DAI because they all involve 'protection', but only CoPP directly safeguards the router's CPU from excessive control-plane traffic.

How to eliminate wrong answers

Option B is wrong because Spanning Tree Root Guard is a Layer 2 feature that prevents a switch port from becoming the root port, mitigating rogue root bridge attacks, not CPU exhaustion on a router. Option C is wrong because Port Security restricts MAC addresses on a switch port to prevent MAC flooding and unauthorized access, which is a Layer 2 access control mechanism, not control plane protection. Option D is wrong because Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing, a Layer 2 security feature, and does not address control plane CPU exhaustion.

Full explanation →

250

Multi-Selecthard

A network security engineer is designing a secure enterprise wireless network architecture to mitigate modern wireless attacks. Which THREE security configurations and protocols should be mandated? (Choose THREE)

Select 3 answers

A.Open authentication with MAC address filtering

B.WPA3-Enterprise with 192-bit cryptographic strength

C.Protected Management Frames (PMF / 802.11w)

D.WEP shared key authentication for legacy device compatibility

E.Wireless Intrusion Prevention System (WIPS) for rogue AP mitigation

AnswersB, C, E

WPA3-Enterprise with 192-bit mode enforces CNSA-grade cryptography, using GCMP-256 and SHA-384 to resist offline dictionary and downgrade attacks. This satisfies the scenario's mandate against modern wireless attacks, unlike WPA2-Enterprise, whose weaker ciphers and handshake remain exploitable.

Why this answer

Option B is correct because WPA3-Enterprise with 192-bit cryptographic strength (Suite-B, using GCMP-256, HMAC-SHA-384, and ECDHE) provides the strongest standardized wireless encryption and is mandated for high-security environments to defeat offline dictionary and downgrade attacks. Option C is correct because Protected Management Frames (PMF, defined in 802.11w) cryptographically protects deauthentication, disassociation, and action frames, preventing spoofing and deauth/disassoc denial-of-service attacks that plague WPA2 networks. Option E is correct because a Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, detects and automatically contains rogue APs, evil twins, and misconfigured clients, which is essential for mitigating modern wireless threats.

Option A is not appropriate because open authentication with MAC address filtering offers no real confidentiality or integrity, and MAC addresses are trivially spoofed. Option D is not appropriate because WEP shared key authentication is cryptographically broken (RC4 with weak IVs) and enables trivial key recovery, so it must never be mandated even for legacy compatibility.

Exam trap

CND often tests whether candidates still recommend WEP or MAC filtering as 'legacy compatibility' options — any answer that mandates deprecated crypto is wrong regardless of the compatibility justification.

Full explanation →

251

MCQeasy

A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?

A.A DNS sinkhole that returns a non-routable address for domains on a blocklist

B.A web proxy configured in explicit mode with manual browser settings on each workstation

C.A host-based firewall installed on every employee workstation with outbound port 80 and 443 rules

D.A transparent web proxy that intercepts HTTP and HTTPS traffic inline and applies URL categorization and logging

AnswerD

A transparent proxy sits inline as a bridge, so clients keep their existing IP configuration and traffic is redirected without browser changes. It can categorize URLs, block known malicious destinations, and log every request. This matches the no-budget, no-client-change constraints while still providing the required filtering and audit trail.

Why this answer

A transparent proxy is deployed inline and redirects traffic without reconfiguring clients, satisfying the bridge requirement. It inspects the HTTP request line and Host header, enabling URL categorization, malicious-site blocking, and centralized logging. Explicit proxies, host firewalls, and DNS sinkholes each miss at least one requirement, such as client changes, per-endpoint management, or lack of request-level logging.

Exam trap

The trap here is equating DNS sinkholing with web filtering, when a sinkhole only affects name resolution and cannot see the full URL or log the actual HTTP request.

Full explanation →

252

Multi-Selecthard

A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)

Select 2 answers

A.Increase the maximum transmission unit on the external interface to eliminate fragmentation entirely

B.Configure the firewall to drop all fragmented packets regardless of source or protocol

C.Disable TCP window scaling and selective acknowledgment to simplify packet inspection

D.Set a maximum fragment reassembly timeout and memory limit to bound resource consumption

E.Enable IP fragment reassembly and normalization on the firewall before policy evaluation

AnswersD, E

Fragment reassembly consumes memory and CPU, so enforcing a timeout and a maximum buffer size prevents an attacker from exhausting resources with incomplete fragment sets, a technique known as a fragment exhaustion attack. These limits allow legitimate fragmented traffic within bounds while protecting the firewall's own stability.

Why this answer

Fragment reassembly with normalization ensures the firewall inspects the complete datagram and resolves overlapping fragments consistently, defeating evasion. Bounding reassembly with a timeout and memory limit protects the device from resource exhaustion caused by incomplete or malicious fragment sets. Dropping all fragments harms legitimate traffic, while TCP option changes and MTU adjustments do not address fragment-based evasion.

Exam trap

The trap here is believing that dropping every fragmented packet is a safe hardening step, when it actually breaks legitimate protocols and leaves the firewall unable to inspect fragmented traffic correctly.

Full explanation →

253

Multi-Selectmedium

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

Select 2 answers

A.Disabling Google Cloud Audit Logs to reduce storage overhead

B.Prohibiting the creation and download of user-managed service account keys where possible

C.Enforcing the principle of least privilege using predefined or custom IAM roles

D.Assigning broad primitive roles (Owner, Editor) to all project contributors

E.Sharing service account JSON keys publicly in public GitHub repositories for collaboration

AnswersB, C

Prohibiting user-managed service account keys removes long-lived credentials that, once downloaded, cannot be revoked centrally and are easily exfiltrated. This directly satisfies the stem's credential-theft constraint: short-lived tokens issued via workload identity federation or attached service accounts eliminate the static secrets attackers harvest for privilege escalation.

Why this answer

Option B is correct because user-managed service account keys are long-lived credentials that, once downloaded, can be exfiltrated and used to impersonate the service account; prohibiting their creation and download (and instead using short-lived credentials via Workload Identity Federation, service account impersonation, or attached service accounts) directly reduces credential theft risk. Option C is correct because enforcing least privilege with predefined or custom IAM roles limits each principal to only the permissions required, which prevents privilege escalation paths that arise when identities hold excessive permissions. Option A is wrong because disabling Cloud Audit Logs removes the audit trail needed to detect and investigate unauthorized privilege escalation or credential misuse, and it does not improve IAM hygiene.

Option D is wrong because assigning primitive roles like Owner or Editor grants broad, excessive permissions that violate least privilege and enable privilege escalation. Option E is wrong because publishing service account JSON keys publicly exposes credentials to anyone, directly enabling credential theft and unauthorized access.

Exam trap

CND often tests whether candidates recognize that primitive roles and downloadable service account keys are anti-patterns — the trap is choosing convenience-oriented options that actually expand the attack surface.

Full explanation →

254

Multi-Selecthard

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Select 3 answers

A.Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files

B.Scanning file shares and NAS devices for unencrypted sensitive files (e.g., PII, financial records)

C.Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation

D.Querying relational databases (e.g., Oracle, SQL Server) for columns containing unprotected credit card numbers

E.Intercepting local USB thumb drive file copy operations inline on endpoints

AnswersA, B, D

Storage discovery DLP tools can act directly on data at rest, quarantining, encrypting or deleting files once sensitive content is identified. This satisfies the stem's requirement for a standard storage-vector capability, distinguishing it from endpoint or network DLP, which intercept data in motion rather than remediating stored files.

Why this answer

Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy.

Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Full explanation →

255

MCQhard

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

A.Classic RADIUS authentication server on an Azure VM

B.Azure Network Security Groups with IP source restrictions

C.Azure Application Gateway with cookie-based affinity

D.Microsoft Entra Conditional Access policies combined with Azure VPN Gateway

AnswerD

Microsoft Entra Conditional Access evaluates user identity, device compliance state and sign-in location risk before granting access, and Azure VPN Gateway enforces that decision at the network tunnel. This satisfies the stem's requirement that all three signals be assessed prior to session establishment.

Why this answer

Microsoft Entra Conditional Access evaluates user identity, device compliance (via Intune), and sign-in risk (location, behavior) before granting access, which is the core of Zero Trust. Combined with Azure VPN Gateway, it enforces these policies for remote workers connecting to Azure-hosted virtual desktops. This integration provides the identity- and context-aware gate that ZTNA requires.

Exam trap

The trap is selecting network-layer controls (NSGs, RADIUS, load balancers) that cannot evaluate identity, device compliance, and location risk, which are the essence of Zero Trust.

How to eliminate wrong answers

Option A is wrong because a classic RADIUS server only performs authentication/authorization based on credentials and does not evaluate device compliance or location risk. Option B is wrong because NSGs are Layer 3/4 IP and port filters and cannot assess user identity or device posture. Option C is wrong because Application Gateway with cookie-based affinity is a load-balancing feature, not an identity or compliance evaluation mechanism.

Full explanation →

256

Multi-Selecthard

A network administrator is implementing defense-in-depth measures against ARP spoofing and man-in-the-middle attacks on a Cisco switched enterprise network. Which THREE switch security features should be enabled on access layer ports? (Choose three)

Select 3 answers

A.DHCP Snooping

B.Dynamic ARP Inspection (DAI)

C.EtherChannel load balancing using source-destination MAC hashing

D.IP Source Guard

E.Port Aggregation Protocol (PAgP)

AnswersA, B, D

DHCP Snooping builds the trusted binding table of IP, MAC, and port mappings, and marks uplinks trusted while blocking rogue DHCP servers. It supplies the prerequisite data DAI and IP Source Guard rely on, countering the spoofing described in the stem.

Why this answer

DHCP Snooping (A) is correct because it builds and maintains the trusted DHCP snooping binding table (IP-to-MAC-to-VLAN-to-port mappings) that DAI and IP Source Guard rely on, and it blocks rogue DHCP servers by rate-limiting and trusting only uplink ports. Dynamic ARP Inspection (DAI) (B) is correct because it intercepts ARP packets on untrusted access ports and validates them against the DHCP snooping binding table (or static ARP ACLs), dropping ARP spoofing attempts that enable man-in-the-middle attacks. IP Source Guard (D) is correct because it uses the DHCP snooping binding table to filter traffic on access ports, permitting only frames whose source IP and source MAC match the binding entry, which prevents IP/MAC spoofing at Layer 2.

EtherChannel load balancing with source-destination MAC hashing (C) is not a security feature; it only affects how traffic is distributed across bundled links and provides no protection against ARP spoofing. PAgP (E) is a Cisco-proprietary link aggregation negotiation protocol for forming EtherChannels and likewise offers no defense against ARP spoofing or MITM attacks.

Exam trap

CND often tests the misconception that link aggregation or load balancing features provide security against ARP spoofing, when only DHCP Snooping, DAI, and IP Source Guard are the correct defense-in-depth trio.

Full explanation →

257

MCQhard

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

A.Enforce User Account Control (UAC) with highest privilege elevation prompts.

B.Enable Windows Defender Credential Guard utilizing Virtualization-based Security (VBS).

C.Configure Windows Defender Exploit Guard with Network Protection enabled.

D.Deploy BitLocker Drive Encryption with TPM 2.0 hardware backing on all endpoints.

AnswerB

Credential Guard uses Virtualization-based Security to isolate NTLM password hashes and derived credentials in a separate virtualised process, so harvested hashes cannot be replayed for authentication. This directly neutralises pass-the-hash lateral movement at the host level.

Why this answer

Credential Guard uses Virtualization-based Security (VBS) to isolate LSA secrets, including NTLM hashes and Kerberos TGTs, in a separate virtualized environment that even a compromised kernel cannot read. This renders harvested hashes unusable for Pass-the-Hash because the attacker cannot extract them from the protected process.

Exam trap

CND often tests the confusion between disk encryption (BitLocker), exploit mitigation (Exploit Guard), and credential isolation (Credential Guard) — candidates must recognize that only VBS-backed Credential Guard removes NTLM hashes from reachable memory.

How to eliminate wrong answers

Option A is wrong because UAC controls privilege elevation prompts and does not protect credential material in memory. Option C is wrong because Exploit Guard Network Protection blocks outbound connections to malicious sites and does not shield NTLM hashes. Option D is wrong because BitLocker encrypts data at rest on disk and has no effect on in-memory credential theft or Pass-the-Hash.

Full explanation →

258

MCQhard

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

A.Configuring devices in personal use profile mode

B.Disabling installation from unknown sources and enforcing Managed Google Play accounts

C.Disabling factory reset protection (FRP)

D.Enabling USB debugging mode for all users

AnswerB

Disabling unknown sources blocks sideloading of APKs outside Managed Google Play, while Managed Google Play accounts deliver and auto-update approved corporate apps. Together these satisfy both constraints: preventing untrusted installs and ensuring automatic updates through the managed store.

Why this answer

To prevent users from installing apps from unknown sources and ensure corporate apps update automatically, the EMM/MDM policy should disable installation from unknown sources and enforce Managed Google Play accounts. This configuration restricts app installation to approved sources and allows automatic updates through Managed Google Play.

Exam trap

CND often tests Android Enterprise security policies, and candidates may confuse personal use profiles with work profiles or overlook the importance of Managed Google Play for automatic updates.

How to eliminate wrong answers

Option A is wrong because personal use profile mode does not enforce corporate app management and may allow unknown sources. Option C is wrong because disabling factory reset protection (FRP) is unrelated to app installation policies and could weaken security. Option D is wrong because enabling USB debugging mode for all users increases attack surface and does not prevent unknown source installations.

Full explanation →

259

MCQhard

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

A.Disabling log verbosity to prevent storage overhead on the central syslog collector

B.Exporting raw log text files to an unindexed USB drive stored in a desk drawer once per quarter

C.Relying entirely on end users to manually report anomalous log entries via email

D.Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows

AnswerD

A SIEM ingests logs centrally, correlates events automatically and drives scheduled analyst triage, directly fulfilling A.12.4.1's requirement that logs be produced, kept and regularly reviewed. Manual periodic reading cannot evidence consistent review at scale, so this satisfies the governance constraint.

Why this answer

Integrating logs into a SIEM platform with automated alert correlation and daily analyst review workflows provides continuous, automated log review that satisfies ISO/IEC 27001 A.12.4.1. The SIEM aggregates logs, correlates events, and generates alerts for analyst review, ensuring regular monitoring and governance. This is the most effective automated practice for meeting the control's requirement for regular review.

Exam trap

CND often tests whether candidates confuse log collection with log review, so picking options that only store or export logs without regular automated review leads to the wrong answer.

How to eliminate wrong answers

Option A is wrong because disabling log verbosity reduces the data available for review, directly undermining the control's requirement to record user activities, exceptions, and security events. Option B is wrong because exporting raw logs to an unindexed USB drive once per quarter is neither regular nor automated, and it lacks integrity controls, making review impractical and non-compliant. Option C is wrong because relying on end users to manually report anomalies is not a systematic, automated review process and does not satisfy the governance requirement for regular log review.

Full explanation →

260

MCQeasy

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

A.Azure Bastion

B.Azure VPN Gateway with point-to-site configuration

C.Azure Load Balancer with TCP reset enabled

D.Azure Front Door with Web Application Firewall

AnswerA

Azure Bastion provides RDP and SSH connectivity through the Azure portal over TLS, so no public IP or inbound management port is exposed on the virtual machines. This directly satisfies the requirement to eliminate open RDP 3389 and SSH 22 ports from the public internet, unlike NSG rules or just-in-time access which still leave listening ports reachable.

Why this answer

Azure Bastion is a fully managed PaaS jump-host service that provides RDP and SSH access to VMs directly through the Azure portal over TLS (port 443), so RDP 3389 and SSH 22 never need to be exposed to the public internet. It is deployed into a dedicated subnet named AzureBastionSubnet inside the VM's VNet, and it brokers the session without requiring a public IP on the target VM. This directly satisfies the requirement of eliminating open management ports while still allowing administrative access.

Exam trap

The trap is assuming any secure connectivity option (VPN, WAF, Load Balancer) removes exposed management ports — only a purpose-built jump-host service like Azure Bastion actually eliminates the need for public RDP/SSH exposure.

How to eliminate wrong answers

Option B is wrong because a point-to-site VPN Gateway still requires the VM to have a reachable private IP and typically still leaves management ports listening — it solves network path security but not the elimination of exposed management ports on the VM itself, and it is not the purpose-built jump-host solution. Option C is wrong because a Load Balancer with TCP reset only affects connection handling for load-balanced traffic; it does not provide secure administrative access nor remove open RDP/SSH ports. Option D is wrong because Azure Front Door with WAF is an HTTP/HTTPS Layer 7 reverse proxy for web applications — it cannot broker RDP or SSH sessions and is irrelevant to VM management access.

Full explanation →

261

MCQmedium

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

A.To locally compress, encrypt, and forward normalized log telemetry to the central SIEM collector

B.To act as a stateful firewall blocking unauthorized inbound and outbound network packets on the host

C.To perform full disk encryption key escrow and manage endpoint certificate lifecycles

D.To automatically execute remediation scripts and isolate compromised endpoints without human intervention

AnswerA

Forwarders perform local normalisation, compression and encryption before shipping telemetry, so the central SIEM receives consistent, bandwidth-efficient data from every segment. This satisfies the distributed-collection constraint, enabling correlation and proactive hunting across the whole estate rather than per-segment silos.

Why this answer

Forwarders or agents on endpoints are designed to collect, normalize, compress, and encrypt log telemetry locally, then forward it to the central SIEM collector. This enables the SIEM to ingest data from distributed segments without requiring direct network access to each endpoint, supporting proactive threat hunting and rapid detection. The agent handles buffering during network outages and ensures data integrity in transit.

Exam trap

The trap is assuming the SIEM agent performs active security functions like blocking or remediation, when its primary role is telemetry collection and forwarding.

How to eliminate wrong answers

Option B is wrong because a stateful firewall blocking packets is a network security control, not the function of a SIEM forwarder; forwarders do not enforce traffic policy. Option C is wrong because full disk encryption key escrow and certificate lifecycle management are endpoint security management functions, typically handled by MDM or PKI systems, not SIEM agents. Option D is wrong because automated remediation and endpoint isolation are functions of SOAR or EDR platforms, not the log-forwarding role of a SIEM agent.

Full explanation →

262

MCQhard

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

A.Strict TCP handshake validation

B.Unicast RPF (Reverse Path Forwarding)

C.Stateful Session Synchronization (Cluster State Sync)

D.NAT hairpinning

AnswerC

Stateful Session Synchronization replicates connection state tables between cluster members, so Firewall B recognises the SYN-ACK as belonging to an existing session established via Firewall A. This prevents the return packet being dropped as out-of-state under asymmetric routing.

Why this answer

Stateful Session Synchronization (also called Cluster State Sync or HA session replication) continuously replicates the connection state table — including TCP sequence numbers, flags, and timeout values — from Firewall A to Firewall B over a dedicated HA heartbeat link. When asymmetric routing causes SYN and SYN-ACK to traverse different firewalls, both devices must share the same state so the second firewall recognizes the SYN-ACK as part of an established session rather than dropping it as an out-of-state packet. Without this synchronization, each firewall maintains an independent state table and the return packet fails stateful inspection.

Exam trap

CND often tests the misconception that enabling a routing or anti-spoofing feature (like uRPF) fixes asymmetric routing, when the actual requirement is replicating the stateful session table across the HA pair.

How to eliminate wrong answers

Option A is wrong because strict TCP handshake validation actually makes the problem worse — it enforces that every packet matches an existing state entry, so an unsynchronized firewall will drop the SYN-ACK even harder. Option B is wrong because Unicast RPF is an anti-spoofing mechanism that checks the source address against the routing table; it does not share connection state and can itself drop packets in asymmetric routing scenarios. Option D is wrong because NAT hairpinning (NAT loopback) only allows internal hosts to reach an internal server via its public NAT address — it has nothing to do with synchronizing state tables between two firewalls.

Full explanation →

263

MCQeasy

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

A.Annualized Loss Expectancy (ALE)

B.Packet drop rate on enterprise core firewalls

C.Common Vulnerability Scoring System (CVSS) base score

D.Active directory domain controller CPU utilization

AnswerA

Annualized Loss Expectancy multiplies single loss expectancy by annualised rate of occurrence, expressing expected yearly financial loss in monetary terms. This gives the board a quantified exposure figure, unlike qualitative ratings or technical metrics that lack direct financial meaning.

Why this answer

Annualized Loss Expectancy (ALE) is the correct answer because it quantifies financial exposure in monetary terms by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). This allows a CISO to translate technical risk into a dollar figure that a board of directors can directly understand and use for budget and risk-acceptance decisions. It is the standard quantitative risk metric used in executive risk reporting.

Exam trap

CND often tests the confusion between technical severity metrics (CVSS) and business/financial risk metrics (ALE), so candidates must remember that only ALE expresses monetary exposure.

How to eliminate wrong answers

Option B is wrong because packet drop rate is a low-level operational performance metric that indicates network congestion or hardware issues, not financial exposure from breaches. Option C is wrong because CVSS base scores measure the technical severity of a vulnerability (0.0–10.0) but do not express monetary loss or business impact. Option D is wrong because domain controller CPU utilization is a host performance indicator with no direct relationship to breach-related financial risk.

Full explanation →

264

MCQhard

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

A.Audit and restrict the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended access rights on the domain object.

B.Enforce LDAP signing and channel binding on all domain controller NTDS settings.

C.Monitor the 'GenericAll' and 'WriteDacl' permissions on all computer account objects.

D.Disable NT LAN Manager (NTLM) authentication and enforce Kerberos ticket granting settings.

AnswerA

DCSync abuses the directory replication protocol by impersonating a domain controller. Granting 'Replicating Directory Changes' and 'Replicating Directory Changes All' on the domain object lets a principal request password hashes via DRSUAPI. Auditing and restricting these rights removes the non-administrative path to credential material.

Why this answer

DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting password hashes via GetNCChanges. The two extended rights that grant this capability are 'Replicating Directory Changes' (DS-Replication-Get-Changes) and 'Replicating Directory Changes All' (DS-Replication-Get-Changes-All), plus 'Replicating Directory Changes In Filtered Set' in some cases. Auditing and restricting these ACEs on the domain NC head prevents non-DC principals from performing replication.

Exam trap

CND often tests whether candidates confuse DCSync's replication-rights abuse with LDAP-based attacks or delegation attacks, so the trap is picking LDAP signing or GenericAll instead of the two Replicating Directory Changes extended rights.

How to eliminate wrong answers

Option B is wrong because LDAP signing and channel binding protect against LDAP relay and man-in-the-middle attacks, not DRS replication abuse — DCSync uses the DRSUAPI RPC interface, not LDAP. Option C is wrong because GenericAll/WriteDacl on computer objects enables resource-based constrained delegation and RBCD attacks, not DCSync; those rights are unrelated to replication. Option D is wrong because disabling NTLM and enforcing Kerberos does not stop DCSync — DCSync authenticates via Kerberos by default and abuses legitimate replication rights, not NTLM relay.

Full explanation →

265

MCQmedium

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

A.diskpart clean

B.dc3dd

C.chkdsk /f /r

D.sfc /scannow

AnswerB

dc3dd is a patched GNU dd variant that writes a bit-for-bit image while computing a hash in the same pass, satisfying the forensic requirement for verifiable integrity. Its native hashing options avoid the separate hashing step that plain dd would demand.

Why this answer

dc3dd is a forensically enhanced fork of GNU dd that creates bit-for-bit disk images while simultaneously computing cryptographic hashes (MD5, SHA-1, SHA-256) in a single pass, which is exactly what the question requires. It is purpose-built for incident response and forensic imaging, supporting progress reporting, split output, and hash verification without a second read of the source disk.

Exam trap

CND often tests whether candidates confuse destructive disk utilities (diskpart, chkdsk, sfc) with forensic imaging tools, causing them to pick a Windows repair command that would actually alter evidence.

How to eliminate wrong answers

Option A is wrong because diskpart clean wipes partition tables and destroys data — it is a destructive disk preparation command, not an imaging tool. Option C is wrong because chkdsk /f /r repairs file system errors and recovers bad sectors; it does not create images and can modify the disk, violating forensic soundness. Option D is wrong because sfc /scannow verifies and repairs Windows system files, which alters the disk and has nothing to do with imaging or hashing.

Full explanation →

266

MCQmedium

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

A.sdrop

B.reject

C.drop

D.alert

AnswerD

The alert action tells Snort to log and generate an alert when a packet matches the rule, while allowing the packet to continue. This satisfies the requirement to notify without blocking inbound traffic, unlike drop or reject.

Why this answer

The 'alert' rule action keyword in Snort generates an alert and logs the packet when a rule matches, without dropping or blocking the traffic. This is the default and most common action for intrusion detection mode. When Snort runs in IDS mode, 'alert' is the appropriate keyword to detect and notify without interfering with the packet flow.

Exam trap

CND often tests Snort rule actions by asking for detection without blocking — candidates pick 'drop' or 'reject' thinking they are more secure, forgetting that 'alert' is the non-blocking detection action and that drop/reject require inline IPS mode.

How to eliminate wrong answers

Option A is wrong because 'sdrop' silently drops the packet and generates no alert — it blocks traffic without notification, which is the opposite of what the analyst wants. Option B is wrong because 'reject' actively blocks the packet and sends a TCP reset or ICMP unreachable message back to the sender, which both blocks and notifies the source, not just alerts. Option C is wrong because 'drop' blocks the packet and logs it, but it still prevents the traffic from reaching its destination — the scenario requires no blocking.

Full explanation →

267

MCQmedium

An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?

A.Antivirus signature update logs from all workstation endpoints.

B.Software asset inventory spreadsheets listing operating system versions.

C.Architecture diagrams and firewall rulebases demonstrating that out-of-scope networks cannot reach the CDE without strict filtering.

D.HR onboarding records showing background checks for all employees with physical access to the building.

AnswerC

Architecture diagrams plus firewall rulebases prove that out-of-scope networks cannot reach the cardholder data environment without strict filtering. This documented evidence demonstrates segmentation controls to the PCI-DSS auditor, satisfying the requirement for proof rather than assertion.

Why this answer

PCI-DSS segmentation evidence requires demonstrating that out-of-scope networks cannot reach the cardholder data environment (CDE) without passing through a controlled, filtered boundary. Architecture diagrams show the intended segmentation, and firewall rulebases prove the actual enforcement — together they are the standard artifacts auditors request to validate that the CDE is isolated and that all access is explicitly authorized and restricted.

Exam trap

CND often tests the confusion between segmentation evidence (diagrams + firewall rules) and unrelated compliance artifacts (AV logs, asset inventories, HR records) — candidates pick any document that sounds audit-related rather than the one that proves network isolation.

How to eliminate wrong answers

Option A is wrong because antivirus signature logs are endpoint malware protection evidence, unrelated to network segmentation. Option B is wrong because a software asset inventory lists OS versions for patch management, not network isolation. Option D is wrong because HR background check records address personnel screening (PCI-DSS 12.7), not network segmentation controls.

Full explanation →

268

MCQeasy

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

A.The vendor part numbers and firmware release schedules for core network switches.

B.The exact physical coordinates and lock combinations of the server room cages.

C.Explicit notification that network activity is monitored and clear disciplinary actions for violations.

D.Detailed command-line instructions for configuring IPsec VPN tunnels on remote laptops.

AnswerC

Enforceability depends on employees having prior notice that monitoring occurs and on defined, consistent penalties. Without explicit monitoring notification and stated disciplinary consequences, the AUP cannot be applied fairly or defended when violations are actioned.

Why this answer

The essential element for enforceability in an AUP is explicit notification that network activity is monitored and clear disciplinary actions for violations. Without informing employees that their activity is monitored, the policy may be legally unenforceable due to privacy expectations. Clear disciplinary actions provide the necessary consequences to deter violations and ensure consistent enforcement.

This combination establishes both transparency and accountability, which are fundamental to a valid AUP.

Exam trap

CND often tests the misconception that technical details (like part numbers or configurations) are essential in policy documents, when in fact policies must focus on user behavior, monitoring, and consequences to be enforceable.

How to eliminate wrong answers

Option A is wrong because vendor part numbers and firmware schedules are technical inventory details, not policy elements that affect employee behavior or enforceability. Option B is wrong because physical coordinates and lock combinations are security-sensitive operational details that belong in a physical security plan, not an AUP, and their inclusion could compromise security. Option D is wrong because command-line instructions for VPN configuration are technical procedures, not policy statements, and they do not address user responsibilities or consequences.

Full explanation →

269

MCQmedium

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

A.Ensuring kernel crash dumps are enabled and a trusted memory acquisition utility like LiME is pre-staged

B.Configuring automatic disk encryption using BitLocker with a TPM chip

C.Deploying a Host-Based Intrusion Detection System (HIDS) for file integrity monitoring

D.Enabling centralized syslog forwarding over encrypted TLS channels

AnswerA

Pre-staging LiME and enabling kernel crash dumps guarantees volatile RAM can be captured before reboot destroys it, satisfying the live kernel attack constraint. LiME loads as a kernel module, dumping memory directly to disk or network, while crash dumps preserve state on panic — both essential for forensic readiness.

Why this answer

Ensuring kernel crash dumps are enabled and pre-staging a trusted memory acquisition utility like LiME directly supports forensic readiness by allowing volatile RAM contents to be captured during a live kernel attack. This preserves critical evidence that would otherwise be lost on reboot or shutdown. The other options do not address volatile memory acquisition.

Exam trap

The trap is selecting controls that protect data at rest (encryption) or detect file changes (HIDS) instead of focusing on volatile memory acquisition, which is the specific requirement for forensic readiness during a live kernel attack.

How to eliminate wrong answers

Option B is wrong because BitLocker with TPM provides disk encryption at rest, which protects data on disk but does not capture volatile RAM contents. Option C is wrong because HIDS with file integrity monitoring detects changes to files but does not preserve memory contents. Option D is wrong because centralized syslog forwarding captures log data, not the full volatile memory state, and logs may not contain kernel-level attack artifacts.

Full explanation →

270

Multi-Selecthard

A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)

Select 3 answers

A.Disabling ICMP redirect processing on host operating systems and core routers

B.Enabling IPv6 RA Guard on switch access ports to drop rogue router advertisements

C.Enabling Spanning Tree PortFast across all trunk ports

D.Enabling SNMPv1 community strings on all perimeter routing devices

E.Implementing source address validation and uRPF (Unicast Reverse Path Forwarding)

AnswersA, B, E

Disabling ICMP redirect processing stops hosts and routers accepting Redirect messages that instruct them to alter their routing path. This directly defeats the ICMP redirection half of the MitM attempt, preventing an attacker from persuading victims to route traffic through their machine.

Why this answer

Option A is correct because disabling ICMP redirect processing on hosts and routers prevents an attacker from using forged ICMP redirect messages to alter a victim's routing table and insert themselves as a man-in-the-middle. Option B is correct because IPv6 RA Guard on switch access ports filters and drops rogue Router Advertisement messages, blocking the RA spoofing vector used to hijack the default gateway. Option E is correct because source address validation and uRPF (Unicast Reverse Path Forwarding) drop packets whose source addresses do not match the expected inbound path, making it harder for an attacker to spoof addresses needed for these redirection attacks.

Option C is not appropriate because Spanning Tree PortFast is a Layer 2 convergence feature and does not mitigate ICMP redirect or IPv6 RA spoofing, and enabling it on trunk ports can even cause loops. Option D is incorrect because SNMPv1 community strings are weak management credentials and do not provide any protection against local network redirection attacks.

Exam trap

CND often tests the misconception that Spanning Tree features or SNMP hardening mitigate Layer 3 redirection attacks, when the exam expects first-hop security controls like RA Guard, ICMP redirect suppression, and uRPF.

Full explanation →

271

MCQeasy

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

A.Disk Defragmentation

B.Remote Device Wipe

C.Remote Host Isolation / Network Containment

D.Cloud Sandbox Submission

AnswerC

Remote host isolation severs the endpoint's network connections while leaving the machine powered on, preserving volatile memory such as running processes and encryption keys. Shutting down would destroy that evidence, so containment satisfies the stem's forensic requirement.

Why this answer

Remote Host Isolation (network containment) is the EDR capability that severs an endpoint's network connectivity while leaving the machine powered on, preserving volatile memory (RAM) for forensic analysis. This matches the IR team's requirement to disconnect without shutting down, allowing memory capture of ransomware artifacts, encryption keys, and process state. It is the standard containment action in modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Exam trap

The trap is confusing containment (isolate but preserve) with remediation actions like wipe or shutdown, which destroy the volatile evidence the IR team explicitly wants to keep.

How to eliminate wrong answers

Option A is wrong because Disk Defragmentation is a maintenance operation that rearranges files on disk and has no security or containment function — it would also destroy forensic artifacts. Option B is wrong because Remote Device Wipe erases the endpoint, destroying the volatile memory and disk evidence the IR team needs to preserve. Option D is wrong because Cloud Sandbox Submission sends files for detonation analysis in a sandbox; it does not contain the infected host or stop the ransomware from spreading.

Full explanation →

272

MCQeasy

An attacker on the same wireless network as a corporate user sets up a rogue access point that broadcasts the same SSID as the legitimate corporate network and offers a stronger signal. Users connect automatically, and the attacker captures their credentials through a fake captive portal. Which attack has been performed?

A.Evil twin access point attack

B.WPS PIN brute-force against the access point

C.Deauthentication flood to force reconnection

D.WPA2 four-way handshake capture for offline cracking

AnswerA

An evil twin is a rogue access point that clones the SSID and, often, the BSSID of a legitimate network while offering a stronger signal to entice automatic client association. Once users connect, the attacker controls all traffic and can present a counterfeit captive portal to harvest credentials. This matches the scenario exactly, including the stronger signal and the fake portal used for credential capture.

Why this answer

The rogue access point imitating the corporate SSID with a stronger signal, combined with a counterfeit captive portal that captures credentials, is the defining pattern of an evil twin attack. Clients configured to auto-connect to a known SSID will associate with the strongest matching signal, giving the attacker a man-in-the-middle position and a convincing pretext for collecting user logins.

Exam trap

The trap here is conflating any rogue access point with a deauthentication attack, when the credential-harvesting portal makes this specifically an evil twin.

Full explanation →

273

MCQmedium

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

A.Physical Security Controls

B.User Responsibilities and Data Sharing

C.Disaster Recovery Protocols

D.Network Infrastructure Redundancy

AnswerB

The User Responsibilities and Data Sharing section governs how employees handle and disclose data, so revising it lets the policy explicitly regulate sharing on external cloud collaboration platforms. Other sections cover asset use or enforcement, not the specific data-sharing behaviour the manager must address.

Why this answer

The Acceptable Use Policy governs how employees may use corporate IT resources, so regulating employee data sharing on external cloud collaboration platforms falls squarely under the 'User Responsibilities and Data Sharing' section. This section defines permitted and prohibited behaviors, data handling expectations, and consequences for misuse. Revising it is the correct way to address emerging cloud collaboration tools in the AUP.

Exam trap

The trap is being drawn to technical-sounding options (physical security, DR, network redundancy) when the question is about policy scope — candidates must recognize that AUPs address user behavior, not infrastructure.

How to eliminate wrong answers

Option A is wrong because Physical Security Controls address facility access, locks, and environmental protections — not employee data-sharing behavior on cloud platforms. Option C is wrong because Disaster Recovery Protocols define recovery time/point objectives and restoration procedures, which are unrelated to acceptable use of collaboration tools. Option D is wrong because Network Infrastructure Redundancy concerns resilient network design (redundant links, failover), not policy governing employee data sharing.

Full explanation →

274

MCQmedium

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

A.Manually download and install MSI installers via local administrator logon scripts

B.Disable all third-party software on endpoints

C.Rely exclusively on Microsoft Windows Update for Business

D.Integrate third-party software patch catalogs into MECM or a dedicated Patch Management tool

AnswerD

Importing vendor patch catalogues into MECM or a dedicated patch tool lets the organisation detect, approve and deploy third-party updates through one automated pipeline. This directly addresses the stem's constraint: browsers and PDF readers dominating missing patches across the Windows fleet.

Why this answer

Third-party applications (browsers, PDF readers, Java, etc.) are not covered by Microsoft's native update channels, so the scalable solution is to integrate third-party patch catalogs (e.g., Patch My PC, Ivanti, or vendor catalogs) into MECM or a dedicated patch management platform. This automates detection, download, and deployment of third-party updates alongside Microsoft patches.

Exam trap

CND often tests the assumption that Windows Update for Business or WSUS natively patches third-party software — candidates must recognize that only Microsoft products are covered unless a third-party catalog integration is explicitly deployed.

How to eliminate wrong answers

Option A is wrong because manually downloading and installing MSI installers via logon scripts does not scale, lacks version detection, and creates reliability and privilege issues. Option B is wrong because disabling all third-party software is operationally infeasible and does not address the vulnerability management requirement. Option C is wrong because Windows Update for Business only delivers Microsoft product updates — it does not patch third-party applications like Chrome or Adobe Reader.

Full explanation →

275

MCQmedium

A CND engineer is reviewing the organization's incident response plan. The plan states that after containment and eradication, the team must validate that the affected systems are clean before restoring normal operations. Which activity BEST fulfills this validation requirement?

A.Asking the affected user to confirm that the system appears to be working normally

B.Rebuilding affected hosts from a known-good image and confirming endpoint protection reports no detections

C.Reviewing the original alert that triggered the investigation to confirm it is no longer firing

D.Documenting the root cause in the incident report and closing the ticket

AnswerB

Rebuilding from a trusted baseline and confirming no detections validates that the systems are free of the identified compromise before they rejoin production. This directly supports the recovery phase of the incident response lifecycle and prevents reintroducing the threat. It is the most reliable validation because it removes any residual artifacts rather than merely observing that symptoms have stopped.

Why this answer

Validation requires positive technical evidence that the threat has been removed. Rebuilding from a known-good image and confirming clean endpoint protection reports provides that evidence and eliminates residual artifacts. Alert silence, user reassurance, and paperwork closure are all weak proxies that can mask a still-compromised system being returned to production.

Exam trap

The trap here is treating the disappearance of the original alert as proof of remediation rather than requiring positive evidence from a trusted baseline.

Full explanation →

276

MCQhard

A security analyst is examining a memory dump from a compromised Windows 10 host. The analyst suspects that a malicious process injected code into a legitimate process. Which of the following memory analysis techniques is MOST effective for identifying injected code?

A.Listing all running processes and their parent-child relationships

B.Scanning for executable pages that are not backed by a file on disk

C.Analyzing the Windows event log for process creation events

D.Checking the digital signatures of loaded modules

AnswerB

Injected code often resides in memory regions that are executable but not mapped to a file on disk. By scanning for such pages, the analyst can identify anomalous code injections. This technique is highly effective because legitimate executables are typically backed by files, while injected code is often not.

Why this answer

Scanning for executable memory pages not backed by files on disk is the most effective technique because injected code typically resides in such regions. Other methods, such as process listing, signature checks, and event log analysis, may provide context but do not directly reveal in-memory code injection.

Exam trap

The trap here is relying on disk-based or event-based artifacts to detect memory-only threats, which can miss injected code entirely.

Full explanation →

277

MCQeasy

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

A.BGP Routing Table Summaries

B.Active Directory Account Access Logs and Group Memberships

C.Network Switch Port VLAN Assignments

D.DNS Zone File Configurations

AnswerB

Account access logs record individual logon events tied to distinct usernames, revealing whether one account is used concurrently from separate locations or sessions. Group memberships show privilege assignment, not usage, so logs are the artifact proving whether credentials are shared.

Why this answer

To verify that administrative accounts are not sharing credentials and to validate individual accountability, the auditor must inspect Active Directory account access logs and group memberships. These artifacts show which accounts exist, who is a member of privileged groups, and when each account was used to log on. If multiple administrators are using the same account, the logon events will show the same account name from different workstations or at overlapping times, which is the evidence of shared credentials.

Exam trap

CND often tests the difference between network-layer artifacts (routing tables, VLANs, DNS) and identity-layer artifacts (AD logs, group memberships) — candidates who focus on network security may overlook that accountability is an identity and access management concern.

How to eliminate wrong answers

Option A is wrong because BGP routing table summaries are network-layer routing data and have nothing to do with user authentication or accountability. Option C is wrong because switch port VLAN assignments are Layer 2 network segmentation data and do not record user identity or account usage. Option D is wrong because DNS zone file configurations are name-resolution records and contain no authentication or account-usage information.

Full explanation →

278

MCQeasy

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

A.ufw enable 192.168.100.0/24

B.ufw allow from 192.168.100.0/24 to any port 22 proto tcp

C.ufw deny ssh

D.ufw route allow 22

AnswerB

UFW's allow rule with a from source and to any port 22 proto tcp matches the subnet constraint exactly, permitting inbound SSH only from 192.168.100.0/24 while denying other sources. Specifying proto tcp restricts the rule to SSH's transport, and the /24 CIDR covers the whole subnet.

Why this answer

The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Exam trap

CND often tests UFW syntax precision — candidates pick options that look like valid commands but either use wrong keywords (`enable` with a subnet) or confuse routing (`route allow`) with input filtering.

How to eliminate wrong answers

Option A is wrong because `ufw enable 192.168.100.0/24` is invalid syntax — `enable` activates the firewall and does not take a subnet argument. Option C is wrong because `ufw deny ssh` would block SSH entirely, the opposite of the requirement, and it does not scope to the subnet. Option D is wrong because `ufw route allow 22` is for routed traffic (forwarding between interfaces) and does not specify a source subnet or the correct port syntax.

Full explanation →

279

MCQeasy

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

A.To serve as the primary domain controller for the internal enterprise network.

B.To store encrypted backups of internal databases.

C.To bridge wireless clients directly to the wired core.

D.To act as a hardened, single-purpose server exposed to the internet in a DMZ.

AnswerD

A DMZ bastion host is deliberately hardened and limited to a single purpose, sitting in the perimeter network to broker administrative access to internal systems. Exposing it to the internet while stripping unnecessary services reduces the attack surface, satisfying the DMZ containment requirement.

Why this answer

A DMZ bastion host is a hardened, single-purpose system placed in the DMZ to provide controlled access between untrusted networks (like the internet) and internal resources, minimizing the attack surface. It is deliberately exposed but stripped of unnecessary services and tightly monitored.

Exam trap

CND often tests whether candidates understand that a bastion is a hardened jump host, not a general-purpose server — the trap is picking an option that places a domain controller or sensitive data in the DMZ.

How to eliminate wrong answers

Option A is wrong because a domain controller should never sit in a DMZ — exposing AD to the internet-facing segment would be a catastrophic security failure. Option B is wrong because storing encrypted backups of internal databases in a DMZ exposes sensitive data to the least-trusted network segment. Option C is wrong because bridging wireless clients directly to the wired core bypasses segmentation and defeats the purpose of the DMZ.

Full explanation →

280

MCQeasy

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

A.Kubernetes Ingress Controller with basic HTTP routing

B.Istio with Envoy sidecar proxies enforcing automatic mTLS

C.Docker Swarm overlay networking with IPsec tunneling

D.Apache ZooKeeper configuration management service

AnswerB

Envoy sidecar proxies intercept pod traffic and perform automatic mTLS handshakes, so encryption between microservices is enforced without altering application code. This satisfies the in-cluster data-in-transit requirement, since Istio's control plane issues and rotates certificates for each workload identity.

Why this answer

Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Exam trap

CND often tests whether candidates confuse edge TLS termination (Ingress) with east-west mTLS between pods — the key discriminator is that only a service mesh with sidecars provides automatic identity-based encryption without code changes.

How to eliminate wrong answers

Option A is wrong because an Ingress Controller only handles north-south traffic entering the cluster and typically terminates TLS at the edge; it does not encrypt pod-to-pod east-west traffic or provide mTLS identity between services. Option C is wrong because Docker Swarm overlay networking with IPsec encrypts node-to-node transport but does not provide per-service identity-based mTLS, and Docker Swarm is not a Kubernetes service mesh. Option D is wrong because Apache ZooKeeper is a distributed coordination service for configuration and leader election, not a data-plane encryption or service mesh technology.

Full explanation →

281

Multi-Selectmedium

A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)

Select 2 answers

A.Unencrypted Telnet management session over port 23

B.Unauthenticated PPTP remote dial-up connection

C.SSL/TLS-based VPN (e.g., OpenVPN or AnyConnect) integrated with an identity provider for MFA

D.Standard HTTP web browsing to internal unencrypted portals

E.IPsec VPN client software configured with IKEv2 and certificate/MFA authentication

AnswersC, E

SSL/TLS VPNs tunnel traffic over TCP or UDP port 443, encrypting all client traffic, while integration with an identity provider enables MFA enforcement at authentication. This meets the policy's dual requirements of MFA support and full traffic encryption without requiring certificate infrastructure.

Why this answer

Option C is correct because an SSL/TLS-based VPN such as OpenVPN or Cisco AnyConnect encrypts all client traffic through a TLS tunnel and can be integrated with an identity provider (e.g., RADIUS, SAML, or LDAP) to enforce multi-factor authentication before granting access. Option E is correct because an IPsec VPN client using IKEv2 provides strong encryption of all traffic and supports certificate-based authentication combined with MFA (for example, EAP-MSCHAPv2 plus a one-time token), satisfying both the encryption and MFA mandates. Option A is wrong because Telnet on port 23 transmits credentials and session data in cleartext and offers no MFA.

Option B is wrong because PPTP is cryptographically broken and unauthenticated dial-up does not provide MFA or reliable encryption. Option D is wrong because standard HTTP to internal portals is unencrypted and does not itself enforce MFA or encrypt all client traffic.

Exam trap

CND often tests the misconception that any 'VPN' or 'secure' protocol automatically includes MFA and strong encryption, when in fact PPTP and unauthenticated dial-up fail both criteria, and Telnet/HTTP fail encryption entirely.

Full explanation →

282

MCQeasy

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

A.Support for HTTP chunked transfer encoding

B.Support for UTF-8 character encoding

C.Support for JSON serialization and deserialization

D.Support for Document Type Definitions (DTDs) and external entity references

AnswerD

XXE abuses the parser's DTD processing, specifically external entity declarations that fetch local files or remote URLs. Disabling DTD support and external entity resolution removes the attack path entirely, satisfying the requirement to detect and prevent XXE injection in HTTP POST bodies.

Why this answer

XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Exam trap

The trap is assuming XXE relates to encoding or transport (UTF-8, chunked encoding); the exam expects you to know it is specifically about DTD and external entity processing in the XML parser.

How to eliminate wrong answers

Option A is wrong because HTTP chunked transfer encoding is a transport-layer framing mechanism unrelated to XML parsing or entity expansion. Option B is wrong because UTF-8 is a character encoding; it has no bearing on whether external entities are resolved. Option C is wrong because JSON serialization/deserialization is a different data format entirely — XXE is specific to XML parsers and DTD handling, not JSON.

Full explanation →

283

Multi-Selecthard

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Select 3 answers

A.TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data

B.TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters

C.TDE does not protect data in transit across the network between client applications and the database server

D.TDE encrypts database data files, log files, and backups at rest on storage media

E.TDE eliminates the need for database user access controls and role-based permissions

AnswersA, C, D

TDE decrypts data at the storage layer, so pages are plaintext once read into the buffer pool. Any user or administrator holding SELECT privileges views decrypted rows normally, and RAM contents remain unprotected, defining TDE's architectural boundary.

Why this answer

Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL.

Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Exam trap

CND often tests the scope of TDE — candidates may incorrectly assume TDE protects data in use or in transit, or that it prevents injection attacks, when in fact it only protects data at rest and does not replace access controls or network encryption.

Full explanation →

284

MCQhard

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

A.AWS Client VPN with split tunneling disabled

B.AWS PrivateLink with Interface VPC Endpoints

C.AWS Direct Connect Gateway with transit VIF

D.Inter-Region VPC Peering with restrictive Network Security Groups

AnswerB

Interface VPC Endpoints backed by PrivateLink expose only a specific service to consumer VPCs over private IP addresses, avoiding public internet exposure and full subnet access that VPC peering would grant. This satisfies the zero-trust least-privilege connectivity constraint.

Why this answer

AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Exam trap

The trap is choosing VPC peering with restrictive security groups, but peering still exposes the full subnet range at the routing level—PrivateLink is the only option that provides service-level, private connectivity without full network exposure.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is for remote user access, not service-to-service communication across VPCs, and split tunneling is unrelated to the requirement. Option C is wrong because Direct Connect Gateway with transit VIF provides dedicated network connectivity from on-premises to AWS, not inter-VPC service communication, and it does not inherently restrict subnet access. Option D is wrong because VPC peering opens full subnet-level access (though security groups can restrict), which violates the requirement to avoid full subnet exposure and does not provide the granular service-level isolation of PrivateLink.

Full explanation →

285

MCQmedium

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

A.Upgrade the IDS hardware to process higher bandwidth capacity

B.Convert the IDS into an inline IPS

C.Tune the IDS sensor signature policies to exclude the internal vulnerability scanner's source IP addresses

D.Move the IDS from a switch SPAN port to an inline routing position

AnswerC

Suppressing alerts by source IP removes the scanner's noise while leaving every detection signature active for genuine threats, directly cutting false positive fatigue. This satisfies the stem's constraint of reducing alert volume without disabling signatures, since the exclusion targets a known benign origin rather than the detection logic itself.

Why this answer

Tuning the IDS signature policies to exclude the internal vulnerability scanner's source IP addresses suppresses alerts generated by authorized scanning activity while keeping all detection signatures active for real threats. This directly reduces false positive fatigue without weakening the IDS's ability to detect actual attacks.

Exam trap

The trap here is confusing performance tuning (hardware, inline conversion) with alert tuning (signature exclusions), leading candidates to pick options that change deployment mode rather than filter noise.

How to eliminate wrong answers

Option A is wrong because upgrading hardware addresses performance/throughput, not alert relevance or false positives. Option B is wrong because converting to inline IPS changes the deployment mode and could block legitimate traffic, but does not reduce false positives from internal scans. Option D is wrong because moving to an inline routing position changes traffic flow and may introduce latency or blocking, but does not filter out scanner-generated alerts.

Full explanation →

286

Multi-Selectmedium

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

Select 3 answers

A.Dynamic ARP Inspection (DAI) leveraging the DHCP snooping database to drop spoofed ARP packets.

B.Border Gateway Protocol (BGP) Route Flap Damping to stabilize wide-area inter-domain routing.

C.Port Security to limit the number of learned MAC addresses per switch port and specify violation actions.

D.Web Application Firewall (WAF) rule sets for HTTP parameter parsing and inspection.

E.DHCP Snooping to maintain a binding database of legitimate IP-to-MAC addresses and block rogue DHCP servers.

AnswersA, C, E

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping those with mismatched MAC-to-IP mappings. This directly satisfies the stem's Layer 2 hardening requirement by preventing ARP spoofing and man-in-the-middle attacks on access and distribution switches, where untrusted hosts could otherwise poison gateway caches.

Why this answer

Option A is correct because Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets on untrusted ports, dropping ARP spoofing attempts that would otherwise enable man-in-the-middle attacks at Layer 2. Option C is correct because Port Security restricts the number of source MAC addresses learned on an access port and can take violation actions such as shutdown, restrict, or protect, mitigating MAC flooding and unauthorized device attachment. Option E is correct because DHCP Snooping builds the trusted IP-to-MAC binding database that DAI and IP Source Guard rely on, while also rate-limiting and blocking rogue DHCP server offers on untrusted ports.

Option B does not belong because BGP Route Flap Damping is an inter-domain routing stability mechanism applied at the WAN/ISP edge, not a Layer 2 switch hardening feature. Option D does not belong because a Web Application Firewall inspects HTTP application-layer traffic and is irrelevant to protecting a switch's Layer 2 control plane.

Exam trap

The trap is selecting features that are not Layer 2 security mechanisms, such as BGP or WAF, due to familiarity with those terms, rather than focusing on the specific layer and attack types.

Full explanation →

287

MCQmedium

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

A.Clientless SSL VPN

B.Full-tunnel VPN

C.Split-tunnel VPN

D.Transport mode IPsec VPN

AnswerB

Full-tunnel VPN captures every packet from the client, including internet-bound traffic, and forwards it through the VPN gateway to the corporate data centre, where the security stack inspects it. This directly satisfies the policy's requirement that all remote-worker internet traffic traverse the corporate security controls rather than egressing locally.

Why this answer

A full-tunnel VPN routes all client traffic — including internet-bound traffic — through the VPN tunnel to the corporate data center, where it is inspected by the security stack before reaching the internet. This ensures consistent policy enforcement and prevents split-tunnel bypass. Split-tunnel VPN, by contrast, sends only corporate traffic through the tunnel while internet traffic goes directly.

Exam trap

CND often tests the confusion between full-tunnel and split-tunnel VPNs, causing candidates to select split-tunnel when the requirement is to route all traffic through the corporate security stack, or to confuse clientless SSL VPN with full network access.

How to eliminate wrong answers

Option A is wrong because a clientless SSL VPN provides browser-based access to specific web applications without a full network tunnel, and does not route all internet traffic through the corporate stack. Option C is wrong because split-tunnel VPN deliberately sends only corporate traffic through the tunnel, leaving internet traffic to go directly, which violates the requirement. Option D is wrong because Transport mode IPsec VPN encrypts only the payload and is typically used for host-to-host or endpoint-to-endpoint scenarios, not for full-tunnel remote access routing all traffic.

Full explanation →

288

Multi-Selecthard

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

Select 3 answers

A.Microsoft-Windows-WMI-Activity/Operational event log (Event ID 5858 and related operational events)

B.PowerShell script block logging (Event ID 4104) capturing WMI class instantiations (e.g., [wmiclass])

C.The Master Boot Record (MBR) partition table sectors

D.The system HOSTS file in \Windows\System32\drivers\etc\

E.WMI permanent event subscriptions located in the \root\subscription namespace (EventFilters, EventConsumers, FilterToConsumerBindings)

AnswersA, B, E

Microsoft-Windows-WMI-Activity/Operational records WMI operation failures and client activity, including Event ID 5858, which logs failed WMI operations with the originating process, command line and namespace. This directly satisfies the stem's requirement to examine WMI logging mechanisms, exposing the malicious script or process that issued the fileless WMI commands.

Why this answer

Option A is correct because the Microsoft-Windows-WMI-Activity/Operational log records WMI operational activity, including Event ID 5858, which captures failed or suspicious WMI operations and is a primary source for detecting fileless WMI abuse. Option B is correct because PowerShell script block logging (Event ID 4104) records the actual script content, including WMI class instantiations such as [wmiclass], allowing investigators to see malicious WMI calls executed through PowerShell. Option E is correct because WMI persistence in fileless attacks is commonly implemented via permanent event subscriptions in the \root\subscription namespace, where EventFilters, EventConsumers, and FilterToConsumerBindings reveal the trigger, action, and binding used for persistence.

Option C is not relevant because the MBR partition table sectors relate to disk boot structures and are not WMI artifacts or WMI logging mechanisms. Option D is not relevant because the HOSTS file is used for local name resolution and is unrelated to WMI activity or WMI-based fileless malware.

Exam trap

CND often tests the misconception that fileless malware leaves no artifacts, causing candidates to overlook WMI logs and subscriptions, or to incorrectly select disk-based artifacts like MBR or HOSTS file.

Full explanation →

289

MCQeasy

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

A.Installed directly on the core router's uplink interface facing the ISP

B.Configured as a virtual machine inside the cloud data center hypervisor cluster

C.Attached as a tap on the primary corporate database server's storage area network (SAN)

D.Distributed across the physical office space as dedicated RF monitoring sensors or dual-band access points

AnswerD

WIPS sensors must sit within radio range of the monitored airspace to capture rogue frames and unauthorised SSIDs. Distributing dedicated RF sensors or dual-band access points across the office provides the coverage needed to detect and contain rogue devices.

Why this answer

A WIPS sensor must monitor the RF (radio frequency) spectrum to detect rogue APs, evil twins, and unauthorized devices broadcasting corporate SSIDs. Deploying dedicated RF sensors or dual-band APs throughout the physical office space ensures full wireless coverage and accurate detection. Wired or virtual placements cannot see over-the-air threats.

Exam trap

CND often tests the physical-layer requirement of wireless monitoring — candidates pick virtual or wired placements because they sound 'centralized,' forgetting that RF threats can only be detected by sensors with antennas in the coverage area.

How to eliminate wrong answers

Option A is wrong because a sensor on the core router's ISP uplink monitors wired traffic, not wireless RF signals, so it cannot detect rogue APs or SSID spoofing. Option B is wrong because a VM inside a cloud hypervisor has no physical RF interface and cannot monitor wireless spectrum in the office. Option C is wrong because a tap on a SAN monitors storage traffic, which is entirely unrelated to wireless intrusion detection.

Full explanation →

290

Multi-Selectmedium

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

Select 3 answers

A.Storing unencrypted paper backup tapes containing sensitive customer PII in unlocked office hallways

B.Environmental monitoring sensors tracking temperature and humidity thresholds

C.Visitor management logs requiring identification verification and escort protocols

D.Biometric or electronic card-key access control systems logging all entry and exit events

E.Leaving data center exterior emergency exit doors propped open for convenient cooling

AnswersB, C, D

Environmental monitoring sensors satisfy Annex A.11.2.1's requirement for environmental threat protection by detecting temperature and humidity excursions before equipment damage occurs. Unlike reactive fire suppression or access logging, continuous threshold monitoring provides the preventive detection capability the standard expects in a primary data centre housing critical infrastructure.

Why this answer

Option B is correct because ISO/IEC 27001 Annex A (A.11.2.1/A.7.5 in the 2022 revision) requires protection against environmental threats, and temperature/humidity sensors with defined thresholds detect conditions that could damage servers and storage. Option C is correct because Annex A physical entry controls (A.11.1.2/A.7.2) require visitor records, identity verification, and escorting of unauthorized persons to prevent unauthorized physical access. Option D is correct because Annex A requires secure areas to be protected by appropriate entry controls such as biometric or card-key systems, and logging all entry/exit events provides the audit trail needed for accountability and incident investigation.

Option A is not acceptable because storing unencrypted backup tapes with sensitive PII in unlocked hallways violates both physical protection of media (A.11.2.3/A.7.10) and confidentiality requirements. Option E is not acceptable because propping open emergency exits defeats physical perimeter security and violates secure-area access control requirements, even if done for cooling convenience.

Exam trap

CND often tests whether candidates can distinguish actual implemented controls from obvious control violations — the trap is picking a plausible-sounding but non-compliant practice (open doors, unsecured tapes) as if it were a security measure.

Full explanation →

291

MCQhard

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

A.SQL injection vulnerabilities in web application forms

B.LLMNR/NBT-NS poisoning and credential relay attacks

C.BGP prefix hijacking and route table poisoning

D.DNS zone transfer enumeration via nslookup

AnswerB

Disabling LLMNR removes the multicast name-resolution fallback that attackers spoof to harvest NetNTLM hashes and relay credentials. This directly mitigates LLMNR/NBT-NS poisoning and credential relay attacks on domain member servers, as the CIS benchmark intends.

Why this answer

Disabling LLMNR mitigates LLMNR/NBT-NS poisoning and credential relay attacks, where an attacker responds to broadcast name resolution requests to impersonate a legitimate host and capture NTLMv2 hashes for offline cracking or relay. LLMNR is a multicast protocol (224.0.0.252, ff02::1:3) that Windows uses as a fallback when DNS fails, and tools like Responder exploit it. Disabling it forces resolution through DNS, reducing the attack surface.

Exam trap

CND often tests whether candidates associate LLMNR with the correct attack class (credential relay/poisoning) rather than unrelated vulnerabilities like SQL injection or BGP hijacking, causing them to pick a distractor based on superficial keyword matching.

How to eliminate wrong answers

Option A is wrong because SQL injection is a web application vulnerability mitigated by input validation and parameterized queries, not by disabling a name resolution protocol. Option C is wrong because BGP prefix hijacking is a routing-layer attack mitigated by RPKI, BGPsec, and prefix filtering, not by LLMNR configuration. Option D is wrong because DNS zone transfer enumeration is mitigated by restricting AXFR/IXFR to authorized secondary servers, not by disabling LLMNR.

Full explanation →

292

MCQhard

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

A.Configure the port as an 802.1X trunk port with automatic supplicant fallback enabled.

B.Place the port in an open dynamic VLAN using unauthenticated guest access without any RADIUS lookup.

C.Disable spanning-tree protocol (STP) on the port to allow unauthenticated legacy device association.

D.Configure MAC Authentication Bypass (MAB) with a specific device profiling and authorization profile on the RADIUS server.

AnswerD

MAC Authentication Bypass lets the switch authenticate the camera by its MAC address against the RADIUS server without supplicant software. Pairing MAB with device profiling and a specific authorisation profile ensures the camera is identified and placed into an isolated, restricted VLAN rather than granted broad access.

Why this answer

MAC Authentication Bypass (MAB) is the correct solution because it allows the switch to authenticate devices that lack an 802.1X supplicant by using the device's MAC address as the credential against the RADIUS server. Combined with device profiling and an authorization profile, the camera can be placed into a restricted VLAN or given limited ACLs, achieving both authentication and isolation. This is the standard Cisco ISE/switch design pattern for headless devices like cameras, printers, and IoT sensors.

Exam trap

CND often tests whether candidates confuse MAB (MAC-based authentication for headless devices) with guest VLANs or 802.1X fallback, causing them to pick an unauthenticated option that fails the 'securely isolate' requirement.

How to eliminate wrong answers

Option A is wrong because 802.1X does not support 'automatic supplicant fallback' on a trunk port; trunk ports are for switch-to-switch links and would not authenticate an endpoint camera. Option B is wrong because placing the port in an open guest VLAN without RADIUS lookup provides no authentication and no isolation — it is effectively an open port, violating the security requirement. Option C is wrong because disabling STP has nothing to do with authentication and would introduce Layer 2 loop risks; STP is a loop-prevention protocol, not an access control mechanism.

Full explanation →

293

MCQeasy

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

A.Layer 2 unmanaged switch

B.Layer 3 router or multilayer switch

C.Hub

D.Wireless range extender

AnswerB

Traffic between distinct VLANs requires Layer 3 forwarding, since VLANs are separate broadcast domains and Layer 2 switching alone cannot cross them. A Layer 3 router or multilayer switch with inter-VLAN routing configured is therefore strictly required to move packets between the Marketing and Sales VLANs.

Why this answer

VLANs are logically separate Layer 2 broadcast domains, so traffic between the Marketing VLAN and the Sales VLAN cannot be switched at Layer 2 — it must be routed. A Layer 3 router or multilayer switch performs inter-VLAN routing by terminating each VLAN's SVI (or subinterface) and forwarding packets between the two IP subnets. This is the only device class in the options that operates at Layer 3 and can make forwarding decisions based on IP addressing.

Exam trap

The trap here is assuming that because a switch 'connects' devices, a Layer 2 switch can move traffic between VLANs — candidates forget that VLANs are separate broadcast domains requiring Layer 3 routing.

How to eliminate wrong answers

Option A is wrong because a Layer 2 unmanaged switch only forwards frames within a single broadcast domain and has no IP routing capability, so it cannot move traffic between two VLANs. Option C is wrong because a hub is a Layer 1 repeater that floods all frames out every port with no VLAN awareness or routing logic whatsoever. Option D is wrong because a wireless range extender merely rebroadcasts Wi-Fi signals at Layer 1/2 and provides no inter-VLAN routing function.

Full explanation →

294

Multi-Selecteasy

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

Select 2 answers

A.Perimeter firewalls controlling traffic entering and leaving the zone

B.Unprotected hubs connecting all corporate workstations

C.Internal active directory domain controllers serving workstation logins

D.Public-facing web or mail servers

E.Unrestricted direct fiber connections to employee home routers

AnswersA, D

Perimeter firewalls enforce the boundary between the internet, the DMZ and the internal network, filtering traffic entering and leaving the zone. This satisfies the stem's requirement for a standard DMZ element by providing the access control that segments the public-facing subnet from trusted internal resources.

Why this answer

Option A is correct because a DMZ is by definition a segmented perimeter network, and perimeter firewalls (often deployed as an external firewall facing the Internet and an internal firewall facing the trusted LAN) enforce the access-control policy that governs traffic entering and leaving the zone. Option D is correct because the classic purpose of a DMZ is to host public-facing services such as web, mail, DNS, or reverse-proxy servers that must be reachable from untrusted networks while being isolated from the internal corporate network. Option B is incorrect because hubs are legacy, unswitched devices that broadcast all traffic to every port and provide no segmentation or access control, making them unsuitable for any security zone, let alone a DMZ.

Option C is incorrect because internal Active Directory domain controllers authenticate users and hold sensitive directory data, so placing them in a DMZ would expose the core identity infrastructure to Internet-facing threats; DMZ hosts should use separate, isolated identity services if needed. Option E is incorrect because unrestricted direct fiber links to employee home routers would bypass perimeter firewalls and create an unmonitored, unauthenticated path into the enterprise network, violating DMZ segmentation principles.

Exam trap

The trap is assuming that any server can go in a DMZ or that internal identity services (like AD) can be extended into the DMZ; candidates often overlook that DMZ isolation is about preventing lateral movement into the internal network.

Full explanation →

295

MCQmedium

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

A.Enable DHCP Snooping globally and configure untrusted user access ports as untrusted.

B.Activate IP Source Guard with static binding entries on all edge switch ports.

C.Configure Dynamic ARP Inspection (DAI) on all trunk ports connecting to core switches.

D.Enable Port Security with maximum MAC address limits and restrict violation actions.

AnswerA

DHCP snooping filters DHCP messages on untrusted ports, dropping rogue OFFERs and ACKs from unauthorised servers while rate-limiting DISCOVER floods. Marking user access ports untrusted satisfies the constraint of blocking both spoofed servers and starvation attacks at the access layer.

Why this answer

DHCP Snooping is the switch security feature designed to prevent rogue DHCP servers and DHCP starvation attacks. By enabling it globally and configuring user access ports as untrusted, the switch only allows DHCP server responses (OFFER, ACK) from trusted ports (e.g., uplinks to legitimate DHCP servers), blocking unauthorized DHCP servers.

Exam trap

CND often tests the distinction between DHCP Snooping, DAI, and IP Source Guard; candidates may confuse which feature addresses DHCP spoofing versus ARP spoofing.

How to eliminate wrong answers

Option B is wrong because IP Source Guard with static bindings prevents IP spoofing but does not stop rogue DHCP servers; it relies on DHCP Snooping bindings to be effective. Option C is wrong because Dynamic ARP Inspection (DAI) on trunk ports protects against ARP spoofing, not DHCP spoofing, and should be configured on access ports, not just trunks. Option D is wrong because Port Security limits MAC addresses but does not prevent DHCP spoofing or starvation attacks.

Full explanation →

296

MCQeasy

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

A.SNMPv3

B.SNMPv2c

C.SNMPv1

D.SNMPv2u

AnswerA

SNMPv3 adds the User-based Security Model, providing both authentication (MD5 or SHA) and encryption (DES or AES) of management queries and responses. SNMPv1 and v2c transmit community strings in cleartext, so neither meets the encryption and authentication requirement.

Why this answer

SNMPv3 is the only version that provides both encryption (via DES, 3DES, AES) and authentication (via MD5, SHA). It introduces the User-based Security Model (USM) to secure management queries and responses. SNMPv1 and v2c offer only community string authentication, which is sent in cleartext.

Exam trap

CND often tests the misconception that SNMPv2c provides encryption because it has 'v2' in the name, but only SNMPv3 offers both authentication and encryption.

How to eliminate wrong answers

Option B is wrong because SNMPv2c uses community strings for authentication, which are transmitted in plaintext and provide no encryption. Option C is wrong because SNMPv1 also uses plaintext community strings and lacks encryption and strong authentication. Option D is wrong because SNMPv2u is a proposed variant that offers authentication but not encryption, and it was never widely adopted.

Full explanation →

297

Multi-Selecthard

A security engineer is performing a security audit of an enterprise firewall and discovers several misconfigurations. Which THREE of the following practices represent severe security vulnerabilities in firewall deployment? (Choose three)

Select 3 answers

A.Configuring a default 'any-any-allow' rule at the bottom of the security policy rulebase without logging

B.Exposing the firewall management GUI/SSH interface directly to the public internet without a VPN or source IP restriction

C.Enabling stateful inspection on all internal DMZ interfaces

D.Implementing strict reverse path forwarding (RPF) checks on external interfaces

E.Leaving default factory administrator usernames and passwords active on the device

AnswersA, B, E

An unlogged any-any-allow rule at the bottom permits all traffic the preceding rules did not match, silently defeating the default-deny posture. This satisfies the stem's severe-vulnerability criterion because the absence of logging hides that permissive fallthrough from monitoring, audit and incident detection entirely.

Why this answer

Option A is correct because a default 'any-any-allow' rule at the bottom of the rulebase silently permits all traffic that fails to match earlier rules, effectively negating the firewall's deny-by-default posture, and the absence of logging removes any audit trail or detection capability. Option B is correct because exposing the management GUI/SSH directly to the internet without a VPN or source IP restriction gives attackers a reachable authentication surface for brute-force, credential-stuffing, and exploitation of management-plane vulnerabilities, violating the principle of out-of-band, restricted administrative access. Option E is correct because leaving factory default administrator usernames and passwords active allows trivial unauthorized access using publicly documented credentials, leading to full device compromise and policy manipulation.

Option C does not belong because enabling stateful inspection on internal DMZ interfaces is a recommended, security-enhancing practice, not a vulnerability. Option D does not belong because strict reverse path forwarding on external interfaces is a legitimate anti-spoofing control that mitigates IP spoofing and asymmetric routing attacks.

Exam trap

CND often tests whether candidates can distinguish hardening controls (stateful inspection, RPF) from actual vulnerabilities — the trap is picking security best practices as 'misconfigurations' because they sound restrictive.

Full explanation →

298

MCQhard

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

A.Windows Defender Real-time Protection is enabled

B.The Application Identity service (AppIDSvc) is stopped or disabled

C.BitLocker encryption is not enabled on the system drive

D.Fast Startup is enabled in the BIOS

AnswerB

AppLocker enforcement depends on the Application Identity service to evaluate and apply rules. If AppIDSvc is stopped or disabled, rules are not enforced, so unsigned executables from user-writable paths still run despite the publisher rule.

Why this answer

AppLocker relies on the Application Identity service (AppIDSvc) to evaluate and enforce rules. If AppIDSvc is stopped or disabled, AppLocker policies are not applied, allowing all executables to run regardless of configured rules. The administrator's rule to allow signed apps would be ignored, and unsigned tools from user-writable directories would execute freely.

Exam trap

CND often tests the misconception that AppLocker rules are enforced solely by policy configuration, overlooking the dependency on the Application Identity service (AppIDSvc) being running and set to automatic.

How to eliminate wrong answers

Option A is wrong because Windows Defender Real-time Protection is an antivirus feature that scans for malware; it does not enforce AppLocker rules and would not prevent unsigned tools from running if AppLocker is not enforced. Option C is wrong because BitLocker is a disk encryption feature that protects data at rest; it has no role in application control or AppLocker enforcement. Option D is wrong because Fast Startup is a power management feature that affects boot behavior; it does not interfere with AppLocker's rule enforcement.

Full explanation →

299

Multi-Selectmedium

A security operations center (SOC) analyst is investigating a compromised Linux web server. Which TWO log files and forensic artifacts should the analyst examine to determine the initial access vector and persistence mechanisms used by the attacker? (Choose TWO)

Select 2 answers

A.Cron job tables and spool directories (/etc/crontab and /var/spool/cron) to check for unauthorized scheduled tasks.

B.Active Directory SYSVOL replication logs for Group Policy object modifications.

C.Master Boot Record (MBR) partition table geometry and cylinder sector metrics.

D.Windows Registry hives (SAM, SYSTEM, SOFTWARE) for user credential artifacts.

E.Authentication logs (/var/log/auth.log or /var/log/secure) to inspect login attempts and sudo usage.

AnswersA, E

Cron tables and spool directories hold scheduled task definitions per user and system-wide. Attackers persist by inserting entries that re-execute payloads after reboot, so inspecting /etc/crontab and /var/spool/cron reveals unauthorised jobs, directly satisfying the persistence mechanism requirement in the stem.

Why this answer

Option A is correct because on Linux, persistence is frequently achieved through scheduled tasks, and examining /etc/crontab along with the per-user spool directories under /var/spool/cron (and /etc/cron.d, /etc/cron.*) reveals unauthorized cron entries that re-execute attacker payloads. Option E is correct because /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) records authentication events, including SSH logins, failed password attempts, accepted publickey sessions, and sudo/su command usage, which are essential for identifying the initial access vector such as brute force or stolen credentials. Option B is not applicable because SYSVOL replication and Group Policy are Active Directory components on Windows domain controllers, not artifacts found on a Linux web server.

Option C is irrelevant since MBR partition geometry and cylinder/sector metrics are disk-layout metadata and do not reveal attacker access or persistence. Option D is incorrect because SAM, SYSTEM, and SOFTWARE registry hives are Windows artifacts and do not exist on a Linux host.

Exam trap

CND often tests cross-platform artifact confusion — candidates must recognize that Windows-only artifacts (Registry hives, SYSVOL) are distractors when the compromised host is explicitly Linux.

Full explanation →

300

MCQeasy

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

A.Configure Security-Enhanced Linux (SELinux) or AppArmor in enforcing mode.

B.Modify standard Linux file permission bits (chmod and chown) for all application binaries.

C.Enable the Linux audit daemon (auditd) to log all system call activities.

D.Install and configure a host-based firewall using iptables or nftables.

AnswerA

SELinux and AppArmor are Linux Security Modules built into the kernel that enforce mandatory access control, confining each process to a defined policy regardless of user privileges. Running in enforcing mode blocks any access outside that policy, satisfying the requirement to restrict processes to only necessary resources.

Why this answer

SELinux and AppArmor are Linux kernel security modules that implement mandatory access control (MAC), confining processes to only the resources defined by policy regardless of user privileges. Running them in enforcing mode ensures that policy violations are blocked, not just logged, which is the correct way to restrict processes to only necessary resources.

Exam trap

CND often tests the distinction between DAC and MAC, so candidates pick chmod/chown or auditd when the question specifically requires a kernel-level mandatory access control module like SELinux or AppArmor.

How to eliminate wrong answers

Option B is wrong because standard file permission bits (chmod/chown) implement discretionary access control (DAC), where the file owner controls access; DAC does not confine processes and can be bypassed by root or compromised services. Option C is wrong because auditd logs system calls for auditing and forensics but does not enforce access restrictions; it is a monitoring tool, not a MAC mechanism. Option D is wrong because iptables/nftables are host-based firewalls that filter network traffic, not process-level mandatory access control; they do not restrict which files or system resources a process can access.

Full explanation →

EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 226–300