EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) CND Questions 301–311 | Page 5/5

301

MCQeasy

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

A.Network tap / SPAN port capturing database protocol traffic or host-based driver interceptors

B.On the perimeter firewall inspecting ICMP echo requests

C.At the corporate DNS resolver cache

D.As an SMTP email gateway relay filter

AnswerA

A network tap or SPAN port captures the database protocol traffic on the wire, plus host-based driver interceptors, giving query visibility independent of SQL Server's own logs. This satisfies the requirement to capture all queries accurately without relying solely on database logs.

Why this answer

A DAM sensor captures database activity most accurately by sitting inline or out-of-band on the network path where database protocol traffic flows — typically via a network TAP or SPAN port mirroring the database VLAN — or by using host-based driver interceptors that hook the database client/server libraries. This captures the actual SQL statements on the wire (TDS for SQL Server, TNS for Oracle) independent of what the database chooses to log, which is critical because native audit logs can be tampered with or disabled by a compromised DBA.

Exam trap

The trap is that candidates pick 'database logs' or a generic network device because they sound plausible, but the question explicitly says 'without relying solely on database logs' — the exam tests whether you know DAM sensors must see the database wire protocol or hook the DB driver, not just any network vantage point.

How to eliminate wrong answers

Option B is wrong because a perimeter firewall inspecting ICMP echo requests only sees ping traffic, not the TDS/SQL statements that constitute database activity — ICMP has no relevance to SQL query monitoring. Option C is wrong because a DNS resolver cache only holds name-to-IP mappings; it never sees the SQL payloads inside database sessions. Option D is wrong because an SMTP email gateway relay filter processes email messages, not database wire protocols, so it cannot observe queries.

Full explanation →

302

Multi-Selecthard

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

Select 3 answers

A.Implement a 'three-legged' firewall configuration or a dual-firewall DMZ architecture to separate zones.

B.Store primary enterprise Active Directory domain controllers directly inside the DMZ zone for faster authentication.

C.Deploy strict firewall access control lists (ACLs) blocking all unnecessary inbound and outbound ports on the DMZ perimeter.

D.Allow DMZ servers to establish unrestricted initiating connections directly into the internal corporate database servers.

E.Disable all non-essential services, accounts, and management daemons on servers deployed within the DMZ.

AnswersA, C, E

A three-legged firewall uses separate interfaces for internet, DMZ, and internal segments, while a dual-firewall design places the DMZ between two devices. Both satisfy the stem's isolation requirement by forcing traffic between zones through distinct policy enforcement points rather than a single flat path.

Why this answer

Option A is correct because a three-legged firewall (one firewall with separate interfaces for internet, DMZ, and internal LAN) or a dual-firewall DMZ (two firewalls with the DMZ sandwiched between them) enforces zone separation and prevents a compromised DMZ host from directly reaching the internal network. Option C is correct because strict ACLs on the DMZ perimeter that deny all traffic except explicitly required ports and protocols implement least-privilege filtering, limiting both inbound attack surface and outbound exfiltration or lateral movement. Option E is correct because hardening DMZ servers by disabling non-essential services, accounts, and management daemons (e.g., Telnet, unused RPC endpoints, default accounts) reduces the exploitable attack surface exposed to untrusted networks.

Option B is wrong because placing primary Active Directory domain controllers in the DMZ exposes the internal identity infrastructure to internet-facing compromise; authentication for DMZ hosts should use read-only domain controllers or separate identity stores. Option D is wrong because allowing DMZ servers to initiate unrestricted connections into internal database servers violates segmentation and would let an attacker who compromises a DMZ host pivot directly into the corporate network.

Exam trap

CND often tests the misconception that placing domain controllers in the DMZ is acceptable for authentication, or that DMZ servers should have unrestricted access to internal resources, leading candidates to select insecure options.

Full explanation →

303

MCQhard

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?

A.Setting an expiration time (exp claim) of 15 minutes

B.Failing to strictly validate the JWT algorithm header, allowing 'none' or asymmetric-to-symmetric key confusion (RS256 to HS256)

C.Storing the JWT inside an HTTP-only Secure cookie instead of localStorage

D.Including the user's role claim inside the public payload section

AnswerB

Trusting the JWT header's alg field lets an attacker submit 'none' or swap RS256 for HS256, signing with the public key as an HMAC secret. Strictly pinning the expected algorithm server-side prevents this signature forgery and the resulting privilege escalation.

Why this answer

The JWT algorithm header (alg) is attacker-controlled and must be strictly validated server-side against an allowlist. If the application accepts 'none' or trusts the alg field to select the verification key, an attacker can forge tokens — the classic RS256-to-HS256 confusion attack lets the attacker sign with the public RSA key as an HMAC secret, which the server then accepts. This directly enables signature forgery and privilege escalation.

Exam trap

CND often tests the misconception that JWT payload contents (like role claims) are the primary risk, when the real high-severity flaw is trusting the attacker-controlled alg header — candidates must recognize that signature verification logic, not payload visibility, drives forgery risk.

How to eliminate wrong answers

Option A is wrong because a 15-minute exp claim is a security best practice that limits token replay windows, not a forgery risk. Option C is wrong because storing JWTs in HTTP-only Secure cookies is actually the recommended mitigation against XSS token theft, not a flaw. Option D is wrong because role claims in the payload are not a vulnerability per se — the payload is only base64-encoded, not encrypted, but the signature still protects integrity, so including role claims is standard practice as long as the server validates the signature.

Full explanation →

304

MCQeasy

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

A.Terminate the EC2 instance and restore from the latest snapshot

B.Modify the instance state to 'stopped' via AWS CLI

C.Delete the attached Elastic Network Interface (ENI)

D.Remove all current security groups and attach an isolation security group with deny-all rules

AnswerD

Replacing all security groups with a deny-all isolation group severs network connectivity while the instance keeps running, preserving volatile memory and disk state. Terminating or stopping the instance would destroy the forensic evidence needed for investigation.

Why this answer

To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Exam trap

The trap is choosing stop or terminate as 'isolation' — both destroy volatile memory, which is the primary forensic evidence; only network-level isolation with a deny-all security group preserves the running state.

How to eliminate wrong answers

Option A is wrong because terminating the instance destroys volatile memory (RAM), running processes, and the instance's ephemeral state — the exact evidence needed for forensics is lost, and restoring from a snapshot only recovers disk data. Option B is wrong because stopping the instance also destroys volatile memory and resets the instance state; a stopped instance loses RAM contents and any in-memory malware artifacts. Option C is wrong because deleting the attached ENI detaches the network interface and can disrupt the instance's identity and networking in ways that complicate forensics; it does not cleanly isolate while preserving state, and it may prevent reattachment of the original interface.

Full explanation →

305

MCQeasy

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

A.Exposing the legacy host directly to the public internet for easier monitoring

B.Disabling the system logging service to prevent disk space exhaustion

C.Implementing strict network segmentation and firewall micro-perimeter isolation around the legacy host

D.Granting full local administrator privileges to all domain users

AnswerC

Micro-segmentation and firewall isolation restrict lateral movement from the unpatched host, containing any compromise. This satisfies the stem's constraint that immediate replacement is impossible, since compensating controls reduce exposure while the end-of-life system remains in service.

Why this answer

When immediate replacement of an end-of-life OS is impossible, best practice is to isolate the legacy host using strict network segmentation and firewall micro-perimeter controls. This limits the attack surface and prevents lateral movement, even if the host is compromised. Segmentation buys time until a replacement can be deployed.

Exam trap

The trap is selecting an option that seems to improve monitoring or access but actually increases exposure, such as exposing the host to the internet or disabling logging.

How to eliminate wrong answers

Option A is wrong because exposing a legacy host to the public internet drastically increases risk and is never a mitigation. Option B is wrong because disabling logging reduces visibility and hinders incident detection, worsening security. Option D is wrong because granting full admin privileges to all users violates least privilege and increases the risk of compromise.

Full explanation →

306

MCQmedium

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

A.Running processes, hard disk storage, system memory (RAM), CPU registers

B.CPU registers and cache, routing tables and network connections, system memory (RAM), hard disk storage

C.Hard disk image, system memory (RAM), network connections, running processes

D.System memory (RAM), hard disk storage, running processes, CPU registers

AnswerB

Volatility order runs from most to least transient: CPU registers and cache first, then routing tables and network connections, then system memory, and finally hard disk storage. Capturing RAM before disk preserves evidence that vanishes on power-down, maintaining forensic integrity and chain of custody.

Why this answer

The order of volatility, from most volatile to least volatile, is: CPU registers and cache, routing tables and network connections, system memory (RAM), and then hard disk storage. This sequence ensures that the most perishable evidence is captured first before it is lost due to power-down or ongoing system activity. Option B correctly lists this order.

Exam trap

CND often tests the order of volatility by presenting plausible but reversed sequences, so candidates who memorize only 'RAM first' without knowing the full order (registers > network > RAM > disk) pick the wrong option.

How to eliminate wrong answers

Option A is wrong because it places running processes before CPU registers and omits cache, and it lists hard disk storage before system memory, which violates the order of volatility (disk is less volatile than RAM). Option C is wrong because it starts with hard disk image, which is the least volatile, and places network connections after RAM, reversing the correct order. Option D is wrong because it starts with RAM but then lists hard disk storage before running processes and CPU registers, which is incorrect since processes and registers are more volatile than disk.

Full explanation →

307

MCQhard

A CND analyst is conducting post-incident threat prediction after a recent breach. The analyst needs to identify which internal host initiated the most outbound connections to known malicious IP addresses over the past 72 hours to prioritize containment and predict future attack paths. Which data source and analysis technique should the analyst use?

A.Windows Security event logs aggregated in a SIEM, analyzed using a failed logon correlation rule.

B.Full packet capture (PCAP) from the DMZ interface, analyzed with Wireshark's Conversations view.

C.NetFlow records exported from core routers, analyzed with a top-talkers report filtered by destination IP reputation.

D.Endpoint Detection and Response (EDR) process telemetry, analyzed for suspicious parent-child process relationships.

AnswerC

NetFlow provides flow-level metadata including source IP, destination IP, ports, and byte counts, which is ideal for identifying internal hosts communicating with malicious external IPs. By correlating NetFlow with a threat intelligence feed of known malicious IPs, the analyst can rank internal hosts by outbound connection volume and frequency, directly supporting containment prioritization and threat prediction.

Why this answer

NetFlow provides scalable, flow-level visibility across the network without full packet capture overhead, making it the most efficient source for identifying internal hosts with high volumes of outbound connections to known malicious IPs. Correlating flow records with threat intelligence enables the analyst to prioritize containment and predict which hosts are most likely compromised or serving as pivot points.

Exam trap

The trap here is assuming that full packet capture or endpoint telemetry alone can provide the broad, retrospective network-wide view needed to rank internal hosts by malicious outbound connections.

Full explanation →

308

Multi-Selecteasy

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

Select 3 answers

A.DomainKeys Identified Mail (DKIM) to cryptographically sign outbound emails and verify integrity.

B.Dynamic Host Configuration Protocol (DHCP) snooping for IP-to-MAC address allocation tracking.

C.Domain-based Message Authentication, Reporting, and Conformance (DMARC) to specify handling policies for failed SPF/DKIM checks.

D.Unicast Reverse Path Forwarding (uRPF) for IP routing packet verification on routers.

E.Sender Policy Framework (SPF) to define authorized sending mail servers for the domain.

AnswersA, C, E

DKIM adds a cryptographic signature to outbound mail headers, letting receivers verify the message was authorised by the sending domain and was not altered in transit. This directly counters spoofing and tampering, satisfying the requirement to enforce authentication records against phishing and credential harvesting.

Why this answer

Option A (DKIM) is correct because it adds a cryptographic signature to outbound messages using a private key, with the public key published in a DNS TXT record, allowing receivers to verify message integrity and detect tampering or spoofing. Option C (DMARC) is correct because it builds on SPF and DKIM by publishing a DNS TXT record at _dmarc that tells receivers how to handle messages failing alignment checks (none, quarantine, or reject) and provides aggregate/forensic reporting, directly countering spoofing and credential-harvesting phishing. Option E (SPF) is correct because it publishes a DNS TXT record listing authorized sending hosts (e.g., ip4, ip6, include, -all) so receivers can reject mail from unauthorized servers forging the domain.

Option B (DHCP snooping) is incorrect because it is a Layer 2 switch feature that filters rogue DHCP servers and builds IP-to-MAC bindings, unrelated to email authentication. Option D (uRPF) is incorrect because it is a router anti-spoofing technique for validating source IP addresses against the routing table, not an email or DNS control.

Exam trap

CND often tests the confusion between network-layer anti-spoofing (uRPF, DHCP snooping) and email-layer authentication (SPF, DKIM, DMARC) — candidates must select only the email-specific protocols for email security questions.

Full explanation →

309

Multi-Selectmedium

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

Select 2 answers

A.Disabling SELinux or AppArmor enforcement

B.Setting a restrictive default umask (such as 027) in shell profiles

C.Configuring PermitRootLogin no in /etc/ssh/sshd_config

D.Enabling password authentication with zero minimum length in PAM

E.Mounting all filesystems with read-write and suid privileges

AnswersB, C

A restrictive umask such as 027 strips group-write and all other permissions from newly created files and directories, preventing world-readable or world-writable artefacts that enable local privilege escalation and unauthorised access on hardened Linux servers.

Why this answer

Option B is correct because setting a restrictive default umask such as 027 in shell profiles (e.g., /etc/profile or /etc/bashrc) ensures newly created files are not world-readable or group-writable, reducing exposure of sensitive data and limiting opportunities for local attackers to tamper with files. Option C is correct because configuring PermitRootLogin no in /etc/ssh/sshd_config prevents direct SSH logins as root, forcing administrators to authenticate as unprivileged users and then escalate via sudo or su, which strengthens accountability and blocks a common brute-force path to full system compromise. The unmarked options do not belong: disabling SELinux or AppArmor (A) removes mandatory access control enforcement and weakens containment of compromised processes, enabling password authentication with zero minimum length in PAM (D) permits weak or empty passwords that are trivially guessed or brute-forced, and mounting all filesystems read-write with suid privileges (E) increases the attack surface by allowing setuid binaries to execute and by permitting modification of system files.

Exam trap

The trap is selecting options that sound like 'flexibility' (password auth, read-write SUID mounts) — candidates must recognize that hardening means restricting, not enabling, these features.

Full explanation →

310

MCQeasy

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

A.Preparation

B.Detection and Analysis

C.Post-Incident Activity

D.Threat Hunting

AnswerC

NIST SP 800-61 Rev. 2 defines four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity. The final phase follows recovery directly, covering lessons learned, evidence retention and report finalisation for the investigated C2 incident.

Why this answer

The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The question asks which phase immediately follows Containment, Eradication, and Recovery. According to the standard, Post-Incident Activity is the final phase, where lessons learned are captured and improvements are made to prevent future incidents.

Exam trap

CND often tests the exact sequence of the NIST SP 800-61 Rev. 2 incident response lifecycle, and candidates frequently confuse Post-Incident Activity with Threat Hunting or mistakenly think Detection and Analysis follows Containment.

How to eliminate wrong answers

Option A is wrong because Preparation is the first phase, occurring before an incident happens. Option B is wrong because Detection and Analysis is the second phase, which precedes Containment, Eradication, and Recovery. Option D is wrong because Threat Hunting is not one of the four phases in the NIST SP 800-61 Rev. 2 lifecycle; it is a proactive security activity that may occur during Preparation or Detection, but it is not the phase that follows Containment, Eradication, and Recovery.

Full explanation →

311

MCQhard

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

A.WPA2-Enterprise with AES-CCMP and TKIP fallback

B.Enhanced Open (OWE) with opportunistic encryption

C.WPA3-Enterprise 192-bit mode (Suite B compliance)

D.WPA3-Personal with SAE and transition mode enabled

AnswerC

WPA3-Enterprise 192-bit mode enforces Suite B cryptographic suites, mandating 384-bit elliptic curve key derivation and GCMP-256, which blocks downgrade attacks that weaker transitional modes permit. This satisfies the stem's requirement for maximum cryptographic strength and downgrade resistance.

Why this answer

WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Exam trap

CND often tests the difference between WPA3-Personal (SAE) and WPA3-Enterprise (192-bit Suite B), and candidates mistakenly pick WPA3-Personal with transition mode thinking it provides enterprise-grade strength.

How to eliminate wrong answers

Option A is wrong because WPA2-Enterprise with TKIP fallback is deprecated and vulnerable — TKIP has known weaknesses, and allowing fallback enables downgrade attacks. Option B is wrong because Enhanced Open (OWE) is for open/public networks and provides opportunistic encryption without authentication, not enterprise-grade cryptographic strength. Option D is wrong because WPA3-Personal with SAE and transition mode is for personal (pre-shared key) networks, and transition mode actually enables WPA2 fallback, which reintroduces downgrade risk.

Full explanation →

EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 301–311