Courseiva

CCNA Application And Data Protection Questions

33 questions · Application And Data Protection · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

A.The proxy's custom Root CA certificate installed into the workstations' Trusted Root Certification Authorities store
B.The public keys of every external website visited by users
C.An expired SSLv2 certificate bundle
D.Self-signed SSH host keys generated on the Squid proxy
AnswerA

SSL interception requires the proxy to re-sign traffic with its own certificate, so clients must trust that issuing CA. Installing the proxy's custom Root CA into the Trusted Root Certification Authorities store lets workstations accept the forged certificates without warnings.

Why this answer

For SSL interception, the Squid proxy generates a forged certificate for each HTTPS site on the fly, signed by its own internal Root CA. For clients to trust these forged certificates without warnings, the proxy's Root CA certificate must be installed in each workstation's Trusted Root Certification Authorities store. This establishes a chain of trust so browsers accept the intercepted TLS sessions transparently.

Exam trap

The trap is thinking the proxy's server certificate or the destination site's public key must be installed, when in fact the trust anchor (Root CA) that signs the dynamically generated leaf certificates is what clients must trust.

How to eliminate wrong answers

Option B is wrong because installing every external website's public key is impractical and technically meaningless — public keys are already presented during the TLS handshake and are not what clients need to trust the proxy. Option C is wrong because SSLv2 is deprecated and insecure, and an expired certificate bundle would cause trust failures rather than enable interception. Option D is wrong because SSH host keys are used for SSH server authentication, not for TLS/HTTPS interception, and are unrelated to the X.509 trust model browsers use.

Practice this question →
2
MCQmedium

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

A.HTTP Compression Schema module
B.IIS Request Filtering with rules to deny double-encoding and path traversal sequences ('..')
C.IP Address and Domain Restrictions module
D.Windows Authentication Provider with Kerberos constraints
AnswerB

Request Filtering inspects decoded URL sequences, so it catches '%2e%2e%2f' traversal attempts that IIS would otherwise normalise into '../' and serve. Denying double-encoded and dot-dot sequences blocks these requests before they reach the application, satisfying the requirement to automatically block path traversal.

Why this answer

IIS Request Filtering is the built-in module that inspects incoming requests and can deny URL sequences, double-encoded characters, and path traversal patterns like '..'. Configuring it to reject double-encoded sequences ('%2e%2e%2f') and traversal strings blocks the attack at the web server layer before it reaches the application. This is the native IIS defense for path traversal and encoded URL attacks.

Exam trap

CND often tests the misconception that IP restrictions or authentication modules block path traversal — candidates must know that only Request Filtering inspects and rejects malicious URL sequences.

How to eliminate wrong answers

Option A is wrong because the HTTP Compression Schema module handles response compression (gzip/deflate) and has no request-inspection or blocking capability. Option C is wrong because IP Address and Domain Restrictions only allow/deny based on source IP or hostname — it cannot detect encoded path traversal in the URL. Option D is wrong because Windows Authentication with Kerberos constraints governs identity and authentication, not URL payload inspection, so it would not block traversal attempts.

Practice this question →
3
Multi-Selecteasy

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

Select 2 answers
A.Plaintext Telnet protocol
B.Unencrypted HTTP protocol
C.Transport Layer Security (TLS v1.3)
D.Plaintext File Transfer Protocol (FTP)
E.Internet Protocol Security (IPsec) VPN
AnswersC, E

TLS v1.3 encrypts data in transit using authenticated key exchange and AEAD ciphers, providing confidentiality and integrity across public networks. It satisfies the requirement for a secure communication channel, and version 1.3 removes legacy algorithms such as RSA key transport and CBC modes, hardening the handshake against downgrade attacks.

Why this answer

Option C, Transport Layer Security (TLS v1.3), is correct because TLS provides authenticated, encrypted channels over untrusted networks using modern cipher suites and a handshake that negotiates ephemeral keys, ensuring confidentiality and integrity for protocols such as HTTPS. Option E, Internet Protocol Security (IPsec) VPN, is correct because IPsec operates at the network layer to encrypt and authenticate IP packets, commonly in tunnel mode for site-to-site or remote-access VPNs, protecting data in transit across public networks. The unmarked options do not belong: Telnet (A), HTTP (B), and FTP (D) are all plaintext protocols that transmit credentials and data without encryption, so they cannot provide secure communication channels.

Exam trap

CND often tests whether candidates confuse 'protocol that can be secured' with 'protocol that is secure by default' — Telnet, HTTP, and FTP all have secure variants (SSH, HTTPS, FTPS/SFTP) but the base protocols listed here are plaintext.

Practice this question →
4
Multi-Selectmedium

An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?

Select 2 answers
A.TPM with a Startup PIN
B.TPM only
C.RADIUS server biometric token verification
D.Active Directory Kerberos ticket delegation
E.Hardware token smart card reader authentication
AnswersA, B

BitLocker natively supports TPM-only, TPM with Startup PIN, and TPM with Startup Key for OS volume protection. TPM with Startup PIN satisfies the stem by requiring both hardware-bound measurement validation and a user-entered secret before the volume unlocks.

Why this answer

Option A (TPM with a Startup PIN) is correct because BitLocker natively supports combining the TPM with a user-entered PIN, which provides multi-factor pre-boot authentication for the OS volume. Option B (TPM only) is correct because BitLocker natively supports a TPM-only protector, where the TPM validates boot integrity and releases the volume master key without user interaction. Options C, D, and E are not native BitLocker OS-volume startup protectors: RADIUS biometric token verification, Kerberos ticket delegation, and hardware token smart card reader authentication are not BitLocker startup authentication methods, though smart cards can be used with BitLocker in some contexts via certificate-based protectors rather than as a native startup authentication option in this list.

Exam trap

CND often tests the distinction between native BitLocker authentication methods and external authentication protocols, causing candidates to confuse smart card or biometric options with built-in TPM-based protectors.

Practice this question →
5
Multi-Selecthard

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

Select 3 answers
A.Dynamic Data Masking (DDM) to limit sensitive data exposure to non-privileged users in query results
B.Always Encrypted to protect sensitive column data from database administrators
C.Transparent Data Encryption (TDE) for encrypting database files at rest on disk
D.Disabling the TCP/IP protocol and allowing only NetBIOS frame broadcasts
E.Granting db_owner permissions to all public database roles by default
AnswersA, B, C

DDM applies masking rules at query-result level, hiding sensitive columns from non-privileged users without altering stored data. This satisfies the exposure-limiting constraint, complementing encryption and auditing for defence in depth across Microsoft SQL Server 2019.

Why this answer

Option A (Dynamic Data Masking) is correct because DDM masks sensitive column values in query results for non-privileged users without altering the underlying data, limiting exposure at the application layer. Option B (Always Encrypted) is correct because it encrypts sensitive column data client-side so that even DBAs and sysadmins cannot read plaintext, protecting data from privileged insiders. Option C (Transparent Data Encryption) is correct because TDE encrypts the database files, log files, and backups at rest on disk, protecting against physical media theft.

Option D is incorrect because disabling TCP/IP and relying on NetBIOS frame broadcasts is not a SQL Server security feature and would break normal client connectivity. Option E is incorrect because granting db_owner to all public roles violates least privilege and would massively expand the attack surface.

Exam trap

CND often tests the misconception that DDM actually encrypts data — it only masks query output, so candidates who pick DDM as a substitute for Always Encrypted or TDE fall into the trap.

Practice this question →
6
MCQmedium

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

A.Freeze global object prototypes using Object.freeze() and validate incoming JSON keys to disallow __proto__ assignments
B.Sanitize all input parameters using DOMPurify before rendering them
C.Configure CORS headers with Access-Control-Allow-Origin set to specific domains
D.Implement parameterized SQL queries for all database interactions
AnswerA

Object.freeze() on Object.prototype prevents modification of the prototype chain, blocking injected __proto__ properties from altering inherited behaviour, while key validation rejects malicious JSON payloads. Together they neutralise prototype pollution at the parsing and object-model layers.

Why this answer

Prototype pollution occurs when attacker-controlled JSON keys like __proto__ or constructor.prototype are merged into objects, altering Object.prototype and affecting all objects in the Node.js process. The correct remediation is to freeze the global prototypes with Object.freeze(Object.prototype) and to validate/reject incoming JSON keys that contain __proto__, constructor, or prototype before any merge or assignment. This directly blocks the pollution vector at the source rather than trying to sanitize output.

Exam trap

The trap here is that candidates see 'input sanitization' and pick DOMPurify or parameterized queries, conflating prototype pollution with XSS or SQL injection — the exam tests whether you know prototype pollution is a JavaScript object-model flaw, not an injection-into-HTML or SQL issue.

How to eliminate wrong answers

Option B is wrong because DOMPurify is an HTML sanitizer for XSS — it has no effect on JavaScript object prototype chains and does nothing to stop __proto__ injection during object merges. Option C is wrong because CORS headers control which browser origins can read responses; they do not prevent server-side prototype pollution from malicious JSON payloads. Option D is wrong because parameterized SQL queries prevent SQL injection, not prototype pollution — the vulnerability is in JavaScript object handling, not database query construction.

Practice this question →
7
Multi-Selecteasy

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

Select 2 answers
A.Data routed through internal Bluetooth beacon devices
B.Data processed inside physical server CPU cache registers only
C.Data in transit across network gateways (Network DLP)
D.Data transmitted over analog telephone modem lines
E.Data at rest on endpoint hard drives and file shares (Storage/Discovery DLP)
AnswersC, E

Network DLP inspects traffic crossing perimeter gateways, catching intellectual property as it leaves via email, web uploads or file transfers. This satisfies the requirement to monitor data in transit, complementing endpoint and cloud coverage so exfiltration attempts are detected before reaching external destinations.

Why this answer

Option C is correct because Network DLP monitors data in transit as it crosses network gateways, inspecting protocols such as HTTP/S, SMTP, and FTP to detect and block sensitive intellectual property leaving the perimeter. Option E is correct because Storage/Discovery DLP scans data at rest on endpoint hard drives and file shares, using content fingerprinting and regex rules to locate and remediate stored sensitive files. Together, these cover the two fundamental data states—in motion and at rest—that a comprehensive DLP architecture must address.

Option A is not a standard DLP monitoring location, as Bluetooth beacon devices are proximity/telemetry hardware, not data transport channels for DLP inspection. Option B is incorrect because CPU cache registers are transient internal processor state and are not a monitored DLP data state. Option D is incorrect because analog modem lines are legacy dial-up channels, not a recognized DLP monitoring location in modern architectures.

Exam trap

CND often tests the three data states — candidates may pick obscure options like Bluetooth or CPU cache, but DLP focuses on at rest, in motion, and in use.

Practice this question →
8
Multi-Selecthard

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

Select 3 answers
A.Configure pg_hba.conf to enforce scram-sha-256 password authentication and restrict remote host connection ranges
B.Load the pgcrypto extension and configure encryption for sensitive columns
C.Set superuser password to null and allow trust authentication for all interfaces
D.Enable SSL/TLS in postgresql.conf by setting ssl = on along with valid server certificate file paths
E.Disable all logging in postgresql.conf to maximize query execution performance
AnswersA, B, D

Editing pg_hba.conf to require scram-sha-256 replaces weaker md5 or trust authentication, while host-range restrictions limit which remote addresses may connect. Together these satisfy the stem's access-control constraint, blocking unauthorised hosts and preventing password-cracking against stored credentials.

Why this answer

Option A is correct because pg_hba.conf is the host-based access control file that determines which clients may connect and how they authenticate; enforcing scram-sha-256 (the strongest built-in password method, replacing md5) and narrowing remote CIDR ranges blocks unauthorized hosts and prevents password-hash replay attacks. Option B is correct because loading the pgcrypto extension enables column-level encryption functions (e.g., pgp_sym_encrypt) so sensitive data is encrypted at rest within the database, protecting it even if table files or backups are exposed. Option D is correct because setting ssl = on in postgresql.conf together with ssl_cert_file and ssl_key_file (valid server certificate paths) encrypts client-server traffic in transit, preventing credential and data interception.

Option C is wrong because null superuser passwords with trust authentication allow anyone to connect as superuser without credentials, a critical vulnerability. Option E is wrong because disabling logging removes the audit trail needed to detect and investigate unauthorized access, and it does nothing to secure access or data at rest.

Exam trap

CND often tests whether candidates confuse 'hardening' with 'performance tuning' — options that disable logging or weaken authentication are distractors that sound like optimizations but destroy security posture.

Practice this question →
9
MCQeasy

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

A.Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> BitLocker Settings
B.Computer Configuration -> Administrative Templates -> System -> Trusted Platform Module Services
C.User Configuration -> Administrative Templates -> Windows Components -> Encryption -> BitLocker
D.Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives
AnswerD

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives contains the "Require additional authentication at startup" setting, where the TPM startup PIN is enforced. This path satisfies the stem's requirement to mandate a startup PIN on TPM-equipped systems through Group Policy.

Why this answer

To enforce a startup PIN with TPM in BitLocker via Group Policy, the administrator must navigate to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives and enable 'Require additional authentication at startup'.

Practice this question →
10
MCQeasy

A small business wants to secure its web application against SQL injection without modifying application code. The application uses a MySQL database and receives user input through web forms. Which defensive measure should be implemented at the database layer to reduce the impact of SQL injection attacks?

A.Create a dedicated database account for the application with only the minimum required privileges.
B.Enable the MySQL general query log to record all SQL statements.
C.Change the MySQL default port from 3306 to a non-standard port.
D.Enable MySQL binary logging and perform daily backups.
AnswerA

Applying least privilege to the application's database account limits what an injected statement can do. If the account cannot drop tables, read other schemas, or use FILE privileges, the blast radius of a successful injection is greatly reduced. This is a database-layer control that works without changing application code and directly mitigates impact.

Why this answer

Least privilege on the application's database account constrains what injected SQL can accomplish, reducing impact even if input validation fails. Logging, port changes, and backups do not block or contain injection. This database-layer hardening is a practical compensating control when code cannot be modified.

Exam trap

The trap here is choosing logging or backups as a security control; they aid detection and recovery but do not reduce the impact of a SQL injection at execution time.

Practice this question →
11
MCQhard

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

A.pg_encrypt_cluster utility
B.PostgreSQL Enterprise TDE Daemon
C.Filesystem-level encryption using dm-crypt/LUKS combined with the pgcrypto extension for column-specific cryptographic functions
D.pg_tde core extension module
AnswerC

PostgreSQL lacks native TDE, so dm-crypt/LUKS encrypts the entire data directory at the block device layer, satisfying data-at-rest protection without schema changes. pgcrypto adds column-level cryptographic functions for granular protection of sensitive fields. Together they deliver encryption at rest using native PostgreSQL tooling rather than unavailable built-in TDE.

Why this answer

PostgreSQL has no native Transparent Data Encryption (TDE) engine in core, so the practical way to encrypt data at rest is at the filesystem/volume layer using dm-crypt/LUKS, which transparently encrypts the disk blocks PostgreSQL writes to. For column-level or field-level cryptographic operations inside the database, the pgcrypto extension provides functions like pgp_sym_encrypt and digest. Combining these two layers gives both at-rest protection and application-visible encryption of specific sensitive columns.

Exam trap

CND often tests whether candidates assume PostgreSQL has native TDE like SQL Server or Oracle — it does not, so the correct answer combines OS-level encryption with the pgcrypto extension rather than a fictional built-in feature.

How to eliminate wrong answers

Option A is wrong because there is no 'pg_encrypt_cluster' utility in PostgreSQL — this is a fabricated command name. Option B is wrong because no 'PostgreSQL Enterprise TDE Daemon' exists; PostgreSQL does not ship an enterprise TDE daemon, and this is an invented product. Option D is wrong because pg_tde is not a core PostgreSQL extension module — while third-party TDE projects exist (e.g., Percona's pg_tde), it is not a core native mechanism, so it cannot be the correct answer for 'core native PostgreSQL mechanism or extension.'

Practice this question →
12
MCQeasy

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

A.sudo fdisk /dev/sdb1 --encrypt
B.sudo mkfs.ext4 -e encrypted /dev/sdb1
C.sudo cryptsetup luksFormat /dev/sdb1
D.sudo mount -o encrypt /dev/sdb1 /mnt/secure
AnswerC

`cryptsetup luksFormat` initialises the LUKS header on /dev/sdb1, writing the encryption metadata and master key slot that all subsequent operations depend on. It satisfies the stem's requirement to initialise the encrypted partition first; `luksOpen`, `mkfs` and mounting only work once this header exists.

Why this answer

The cryptsetup luksFormat command initializes a partition with LUKS encryption headers and master keys.

Practice this question →
13
MCQhard

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

A.Digital Guardian Discovery Server
B.Digital Guardian Network Sensor
C.Digital Guardian Cloud Analytics Engine (CAE)
D.Digital Guardian Endpoint Agent with Web Inspection / Browser Control module
AnswerD

Digital Guardian's Endpoint Agent hooks browser processes via its Web Inspection module, inspecting HTTPS traffic before encryption leaves the endpoint. This satisfies the stem's browser-level interception constraint: the agent, not a network appliance, identifies the source-code upload to a personal cloud provider and blocks it in real time.

Why this answer

Digital Guardian provides an endpoint agent with deep hooks into browser communications and application APIs to inspect and block HTTPS uploads and web-based file transfers.

Practice this question →
14
MCQhard

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

A.SHA-256 without a salt
B.AES-256-CBC symmetric encryption with a shared database key
C.bcrypt via the pgcrypto extension using the crypt(password, gen_salt('bf', 12)) function
D.MD5 with a hardcoded static salt
AnswerC

bcrypt with a cost factor of 12 is deliberately slow and salted, making offline brute-force attacks computationally expensive. Unlike unsalted MD5 or SHA-256, its adaptive work factor satisfies the modern cryptographic standard the stem demands.

Why this answer

bcrypt is a purpose-built password hashing function that incorporates a per-password random salt and a tunable cost factor. The pgcrypto call crypt(password, gen_salt('bf', 12)) uses the Blowfish-based bcrypt variant with a cost of 12, meaning 2^12 key-expansion iterations, which makes offline brute-force attacks computationally expensive while remaining fast enough for interactive logins.

Exam trap

The trap is confusing fast general-purpose hashes (SHA-256) or reversible encryption (AES) with slow, salted password-hashing functions; the exam tests whether you know that password storage requires a deliberately slow, salted, one-way algorithm like bcrypt.

How to eliminate wrong answers

Option A is wrong because SHA-256 without a salt is a fast general-purpose hash — attackers can precompute rainbow tables and test billions of guesses per second on GPUs, so it is unsuitable for password storage. Option B is wrong because AES-256-CBC is reversible symmetric encryption, not hashing; if the shared database key leaks, every password is immediately recoverable, and encryption does not provide the one-way property password storage requires. Option D is wrong because MD5 is cryptographically broken (collision attacks are trivial) and a hardcoded static salt means every password shares the same salt, so a single rainbow table defeats the entire database.

Practice this question →
15
MCQmedium

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

A.Configuring an IIS URL Rewrite rule to block GET requests
B.Disabling Outlook Web Access (OWA) entirely for all users
C.Enabling Basic Authentication across all virtual directories
D.Applying the latest Microsoft Exchange Cumulative Updates (CUs) and security patches
AnswerD

Exchange Cumulative Updates include architectural fixes and hardening that remove the vulnerable web component behaviours exploited for SSRF and insecure deserialisation. Staying current closes those attack paths, satisfying the requirement to prevent both attack types.

Why this answer

Microsoft Exchange SSRF and insecure deserialization vulnerabilities (notably ProxyLogon CVE-2021-26855 and ProxyShell/ProxyOracle chains) are patched through Cumulative Updates and security updates. Applying the latest CU and patches is the single most critical control because these flaws live in Exchange's own web components (e.g., Autodiscover, ECP, OWA) and cannot be reliably mitigated by generic IIS rules or authentication changes.

Exam trap

CND often tests whether candidates reach for generic web hardening (URL Rewrite, disabling OWA, Basic Auth) instead of the specific vendor patch — the trap is treating Exchange SSRF/deserialization as a generic IIS problem rather than a product-specific vulnerability requiring CUs.

How to eliminate wrong answers

Option A is wrong because blocking GET requests via URL Rewrite breaks legitimate Exchange functionality and does not address the POST-based SSRF and deserialization vectors used in ProxyLogon/ProxyShell. Option B is wrong because disabling OWA entirely is a drastic availability trade-off that still leaves ECP, Autodiscover, and other vulnerable virtual directories exposed. Option C is wrong because enabling Basic Authentication weakens security, exposes credentials, and does nothing to remediate SSRF or deserialization flaws in Exchange code.

Practice this question →
16
MCQeasy

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

A.TCP handshake stateful inspection
B.Behavioral anomaly machine learning baseline profiling
C.Data Loss Prevention (DLP) pattern matching
D.Signature-based detection rules
AnswerD

Signature-based rules match known attack patterns, such as SQL injection syntax, within HTTP requests and drop matching traffic before it reaches the web server. This satisfies the requirement to detect and block typical SQL injection payloads.

Why this answer

Signature-based detection rules match HTTP request payloads against known attack patterns — regex or token sequences characteristic of SQL injection, such as ' OR 1=1--, UNION SELECT, or encoded variants. A WAF in front of an online banking portal uses these signatures (e.g., ModSecurity CRS rules 942100, 942110) to inspect parameters, headers, and bodies, then drop matching requests before they reach the origin server. This is the classic negative-security model that blocks known-bad inputs.

Exam trap

The trap is conflating 'detecting SQLi patterns' with anomaly/ML detection — candidates overthink and pick behavioral profiling when the question explicitly describes matching known attack patterns.

How to eliminate wrong answers

Option A is wrong because TCP handshake stateful inspection only validates the three-way handshake and connection state — it has no visibility into application-layer SQL syntax. Option B is wrong because behavioral anomaly ML profiling learns normal traffic baselines and flags deviations; it is not pattern-matching for known SQLi signatures and typically produces probabilistic, not deterministic, blocks. Option C is wrong because DLP pattern matching targets sensitive data exfiltration (credit cards, PII), not injection attack syntax.

Practice this question →
17
MCQeasy

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

A.McAfee DLP Endpoint Client
B.McAfee DLP Prevent
C.McAfee ePolicy Orchestrator (ePO) Relay Server
D.McAfee DLP Discover
AnswerA

The McAfee DLP Endpoint Client runs on each workstation and enforces device-control policies locally, inspecting file operations to USB mass storage and blocking them without server round-trips. This satisfies the stem's requirement for on-endpoint inspection and blocking, unlike network-based or ePO-managed components that cannot intercept local bus traffic.

Why this answer

The McAfee DLP Endpoint Client is the agent installed on each workstation that performs local inspection and enforcement, including blocking writes to USB mass storage devices. It enforces policy at the endpoint without requiring a round trip to a network appliance. This is the component that actually intercepts the file-copy operation on the host.

Exam trap

The trap is conflating network DLP (Prevent) with endpoint DLP (Endpoint Client); USB blocking is always a local endpoint function, not a gateway function.

How to eliminate wrong answers

Option B is wrong because McAfee DLP Prevent is the network-side appliance that inspects traffic at the gateway, not the local endpoint agent that controls USB devices. Option C is wrong because the ePO Relay Server distributes policies and signatures from ePolicy Orchestrator; it does not inspect or block data movement. Option D is wrong because McAfee DLP Discover scans data at rest on servers and repositories to find sensitive content, not to block USB writes in real time.

Practice this question →
18
MCQhard

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

A.Run sp_configure 'enforce network encryption', 1; on the master instance
B.Set the database compatibility level to 150 and enable Always Encrypted with secure enclaves
C.Enable Transparent Data Encryption (TDE) on the primary replica database
D.Configure the Availability Group Endpoint with ALTER ENDPOINT hadr_endpoint FOR DATABASE_MIRRORING (ENCRYPTION = REQUIRED)
AnswerD

Encrypting the database mirroring endpoint is the only mechanism that protects Always On Availability Group replica traffic, since that endpoint carries the log transport between replicas. Specifying ENCRYPTION = REQUIRED on the HADR endpoint enforces encryption for all traffic, satisfying the stem's requirement that inter-replica database traffic be encrypted.

Why this answer

Availability group endpoints must be configured with ENCRYPTION = REQUIRED or SUPPORTED using ALTER ENDPOINT to secure replication traffic across nodes.

Practice this question →
19
MCQmedium

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

A.nocase
B.uricontent
C.depth
D.offset
AnswerA

The `nocase` modifier performs case-insensitive pattern matching on the preceding content match, so `admin_login.php` triggers regardless of capitalisation. This satisfies the stem's requirement to detect the exact string in the HTTP URI whatever its case, whereas default Snort matching is case-sensitive and would miss variants such as `Admin_Login.php`.

Why this answer

The nocase modifier in Snort tells the detection engine to perform a case-insensitive match on the preceding content or uricontent pattern. Since the requirement is to match 'admin_login.php' regardless of case (e.g., 'Admin_Login.PHP'), appending nocase to the content/uricontent rule option is the correct approach. Without it, Snort performs a byte-exact case-sensitive comparison and would miss mixed-case variants attackers commonly use to evade signature matching.

Exam trap

CND often tests whether candidates confuse positional modifiers (depth, offset, distance, within) with case-modifier keywords (nocase), so the trap is picking depth or offset thinking they broaden the match.

How to eliminate wrong answers

Option B is wrong because uricontent is a payload inspection keyword that searches the normalized HTTP URI buffer, but it does not by itself make the match case-insensitive — it only selects which buffer to inspect. Option C is wrong because depth limits how far into the payload the content match may begin from the start of the packet, restricting the search window rather than altering case sensitivity. Option D is wrong because offset specifies where in the payload the content match should begin, again a positional constraint, not a case-folding modifier.

Practice this question →
20
MCQhard

A financial services company stores customer records in a Microsoft SQL Server 2019 database. A security administrator must ensure that sensitive columns such as credit card numbers are encrypted at rest and that even a database administrator with full server access cannot read the plaintext values without an additional secret. Which SQL Server feature should be implemented to meet this requirement?

A.Dynamic Data Masking (DDM)
B.Row-Level Security (RLS)
C.Always Encrypted with column encryption keys stored outside the database
D.Transparent Data Encryption (TDE)
AnswerC

Always Encrypted keeps column encryption keys in a trusted key store such as Windows Certificate Store or Azure Key Vault, outside the database engine. The client driver encrypts and decrypts data, so the server never sees plaintext or the column key. Even a sysadmin querying the table sees only ciphertext, satisfying the requirement that full server access is insufficient to read sensitive values.

Why this answer

Always Encrypted separates the keys from the data by keeping column encryption keys in an external key store, so the database engine only handles ciphertext. This ensures that a database administrator with sysadmin rights cannot decrypt sensitive columns. TDE, DDM, and RLS all leave plaintext accessible to privileged database users, so they do not satisfy the stated threat model.

Exam trap

The trap here is equating encryption at rest with protection from a privileged database administrator; TDE encrypts files but the engine still decrypts data for authorized queries.

Practice this question →
21
Multi-Selectmedium

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

Select 2 answers
A.KeepAlive On and KeepAliveTimeout 5
B.DirectoryIndex index.php index.html
C.Listen 80 without SSLVirtualHost configuration
D.mod_security (Web Application Firewall engine)
E.mod_headers configured to enforce HTTP Strict Transport Security (HSTS)
AnswersD, E

mod_security acts as an inline web application firewall, inspecting HTTP requests against rule sets to block SQL injection, cross-site scripting and similar payloads before Apache processes them. It satisfies the hardening requirement by adding request-level filtering that core Apache directives alone cannot provide.

Why this answer

Option D is correct because mod_security is a Web Application Firewall (WAF) engine for Apache that inspects HTTP requests and responses against rule sets such as the OWASP Core Rule Set, blocking SQL injection, cross-site scripting (XSS), and other common web attacks. Option E is correct because mod_headers allows Apache to inject response headers, and configuring it to send Strict-Transport-Security (HSTS) forces browsers to use HTTPS for future connections, mitigating protocol downgrade and cookie-hijacking attacks. Option A is not correct because KeepAlive and KeepAliveTimeout only tune TCP connection reuse and have no direct security effect.

Option B is not correct because DirectoryIndex merely defines default index files and does not mitigate web threats. Option C is not correct because listening on port 80 without an SSL virtual host leaves traffic unencrypted and does not enhance application security.

Practice this question →
22
MCQeasy

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

A.Exact Data Matching (EDM)
B.Described Content Matching (DCM) with a Data Identifier utilizing Luhn algorithm validation
C.Indexed Document Matching (IDM)
D.Vector Machine Learning (VML)
AnswerB

DCM inspects payload content against predefined Data Identifiers, and the credit card identifier applies Luhn checksum validation to candidate digit strings. This validates the check digit, so random 16-digit numbers are rejected, matching the stem's requirement for standard card formats.

Why this answer

Described Content Matching (DCM) uses data identifiers — regex patterns combined with validators like the Luhn algorithm — to detect structured data such as credit card numbers in motion. The Luhn checksum (mod-10) confirms the number is mathematically valid, dramatically reducing false positives from random 16-digit strings. This is exactly the mechanism Symantec DLP uses for PCI/credit card detection in Network Monitor policies inspecting HTTP traffic.

Exam trap

CND often tests the distinction between pattern-based detection (DCM with validators like Luhn) and dataset-based detection (EDM/IDM), tricking candidates who assume any 'matching' technology handles credit cards.

How to eliminate wrong answers

Option A is wrong because Exact Data Matching (EDM) matches against a specific indexed dataset of known records (e.g., a CSV of actual customer SSNs), not generic patterns like credit card formats. Option C is wrong because Indexed Document Matching (IDM) fingerprints entire documents and detects when those specific files are exfiltrated — it does not validate numeric formats. Option D is wrong because Vector Machine Learning (VML) trains a statistical model on sample documents to classify content by similarity, not to validate structured patterns with checksum algorithms.

Practice this question →
23
Multi-Selectmedium

A healthcare organization is implementing a data loss prevention (DLP) program for endpoints running Windows 10. The security team wants to prevent protected health information (PHI) from leaving the organization through email and removable media. Which TWO controls should be enabled in a Microsoft Defender for Endpoint DLP policy to directly block these exfiltration channels? (Choose two.)

Select 2 answers
A.Enable Windows Firewall outbound rules to block SMTP traffic on port 25.
B.Deploy a Group Policy setting that disables the use of cloud storage sync clients.
C.Create a DLP rule that blocks sending email containing sensitive information types to external recipients.
D.Configure a DLP rule that restricts copying sensitive files to USB removable drives.
E.Enable BitLocker Drive Encryption on all endpoint system drives.
AnswersC, D

An email DLP rule evaluates messages for sensitive information types such as health records and can block delivery to external recipients. This directly stops PHI from leaving via email, which is the second required exfiltration channel, so it is a correct control for the endpoint DLP policy.

Why this answer

Endpoint DLP policies work by inspecting content and applying rules to specific channels. A rule restricting sensitive files to USB removable drives blocks one exfiltration path, and a rule blocking email with sensitive information types to external recipients blocks the other. Encryption, firewall port blocking, and disabling cloud clients do not provide content-aware blocking for the required channels.

Exam trap

The trap here is treating encryption or broad network blocks as DLP; only content-aware rules scoped to email and removable media directly stop PHI from leaving through those channels.

Practice this question →
24
MCQmedium

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

A.Invoke the java.net.URLEncoder.encode() method on all parameters
B.Wrap all input strings inside single quotes and strip out semicolon characters
C.Use parameterized queries and PreparedStatement objects with placeholder parameters
D.Sanitize all input characters using HTML entity encoding before passing them to the database driver
AnswerC

Parameterised queries with PreparedStatement placeholders separate SQL code from user-supplied data, so input is bound as a literal value rather than parsed as SQL syntax. This neutralises injection in the flagged JDBC template query, satisfying the requirement to secure the database interaction.

Why this answer

Parameterized queries using PreparedStatement with placeholder parameters (?) ensure that user input is treated strictly as data, never as executable SQL. The JDBC driver sends the query structure and parameters separately to the database, so injection payloads cannot alter the SQL grammar. This is the definitive remediation for SQL injection in Java applications and is recommended by OWASP.

Exam trap

The trap is choosing input-sanitization or encoding approaches (URL encoding, HTML entities, quote-stripping) that address the wrong context, instead of the structural fix of parameterized queries.

How to eliminate wrong answers

Option A is wrong because URLEncoder.encode() is designed for URL query-string encoding, not SQL context — it does not escape SQL metacharacters like single quotes, and the database driver would still interpret injected syntax. Option B is wrong because wrapping inputs in quotes and stripping semicolons is a blacklist approach that fails against comment sequences (--), UNION-based injection, and encoded payloads. Option D is wrong because HTML entity encoding is for preventing XSS in HTML output contexts, not for SQL — the database does not decode HTML entities, so the input would either break queries or still allow injection via SQL-specific characters.

Practice this question →
25
MCQmedium

A security analyst is reviewing an application that stores user passwords in a database. The analyst finds that passwords are hashed with SHA-256 and a unique salt per user. The organization wants to increase resistance to offline brute-force attacks using GPUs. Which change should the analyst recommend?

A.Switch to SHA-512 with a longer salt.
B.Encrypt the password hashes with AES-256 before storing them.
C.Replace SHA-256 with bcrypt using an appropriate work factor.
D.Store passwords using Base64 encoding instead of hashing.
AnswerC

bcrypt is a password-hashing function designed to be slow and tunable via a cost factor, making GPU-based brute-force attacks much more expensive. It also handles salting internally. Replacing fast SHA-256 with bcrypt directly addresses the need to increase resistance to offline cracking, so it is the appropriate recommendation.

Why this answer

Fast hashes like SHA-256, even with salts, are vulnerable to high-speed GPU cracking. bcrypt is intentionally slow and tunable, so increasing its work factor raises the cost of offline attacks. SHA-512, AES encryption of hashes, and Base64 encoding either remain fast or weaken protection, so bcrypt is the correct recommendation.

Exam trap

The trap here is assuming a stronger or longer fast hash improves password security; speed is the weakness, and only a deliberately slow algorithm such as bcrypt addresses GPU cracking.

Practice this question →
26
MCQhard

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

A.xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true in elasticsearch.yml
B.http.cors.enabled: true and http.cors.allow-origin: "*"
C.cluster.routing.allocation.enable: all and network.host: 0.0.0.0
D.discovery.type: single-node without password configuration
AnswerA

Enabling `xpack.security.enabled: true` activates Elasticsearch's native authentication and role-based access control, blocking anonymous index access, while `xpack.security.transport.ssl.enabled: true` encrypts node-to-node transport, preventing interception of PII and financial records in transit. Together they satisfy the stem's requirement to enforce both authentication and transport layer security.

Why this answer

To secure an Elasticsearch cluster, you must enable the security features via xpack.security.enabled: true, which turns on authentication, authorization, and role-based access control, and xpack.security.transport.ssl.enabled: true, which encrypts node-to-node transport traffic. Together these enforce credential-based access to indices and protect inter-node communication from eavesdropping, satisfying the auditor's requirement for PII and financial data protection.

Exam trap

The trap here is that candidates see a security-sounding setting like http.cors or network.host and assume it hardens the cluster, when in fact CORS wildcards and 0.0.0.0 binding are common misconfigurations that expose Elasticsearch — the exam tests whether you know the actual xpack.security flags that enable auth and TLS.

How to eliminate wrong answers

Option B is wrong because http.cors.enabled with a wildcard origin actually weakens security by allowing any web origin to make cross-origin requests to the cluster, and it does nothing for authentication or transport encryption. Option C is wrong because cluster.routing.allocation.enable: all is a shard allocation setting and network.host: 0.0.0.0 binds Elasticsearch to all interfaces, exposing it broadly rather than securing it. Option D is wrong because discovery.type: single-node without password configuration leaves the cluster unauthenticated and unencrypted, which is the opposite of the required hardening.

Practice this question →
27
MCQmedium

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

A.Pass the uploaded file directly to the operating system's eval() function
B.Validate the file's magic bytes (header signature), enforce an extension whitelist, and store files outside the web root
C.Compress the uploaded file using ZIP format before saving
D.Check only the filename extension provided in the client's HTTP multipart header
AnswerB

Magic-byte validation confirms the file's true type regardless of its name, the extension whitelist blocks executable formats, and storing files outside the web root prevents direct execution. Together these controls stop uploaded scripts from being interpreted and executed by the server.

Why this answer

Preventing arbitrary file upload RCE requires validating the file's actual content (magic bytes/header signature), enforcing a strict extension whitelist, and storing uploaded files outside the web root so they cannot be executed. This triple control defeats both extension-spoofing (e.g., 'shell.php.jpg') and direct execution of uploaded payloads. Magic-byte validation ensures the file truly is the claimed type, not a renamed script.

Exam trap

CND often tests the misconception that checking the file extension or Content-Type header is sufficient — candidates must recognize that only magic-byte validation plus storage outside the web root prevents RCE.

How to eliminate wrong answers

Option A is wrong because passing user-uploaded content to eval() is a direct remote code execution vulnerability — it executes arbitrary attacker-supplied code, the exact opposite of a mitigation. Option C is wrong because compressing a file with ZIP does not sanitize it; the archive can still contain a malicious payload, and if extracted server-side, the payload executes. Option D is wrong because checking only the client-supplied filename extension is trivially bypassed — attackers can rename 'shell.php' to 'shell.jpg' or use double extensions, and the Content-Type header is also client-controlled.

Practice this question →
28
Multi-Selecthard

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

Select 3 answers
A.Executing automated remediation tasks such as quarantining, encrypting, or deleting discovered sensitive files
B.Scanning file shares and NAS devices for unencrypted sensitive files (e.g., PII, financial records)
C.Inspecting live bidirectional SIP VoIP voice call streams for rogue credit card dictation
D.Querying relational databases (e.g., Oracle, SQL Server) for columns containing unprotected credit card numbers
E.Intercepting local USB thumb drive file copy operations inline on endpoints
AnswersA, B, D

Storage discovery DLP tools can act directly on data at rest, quarantining, encrypting or deleting files once sensitive content is identified. This satisfies the stem's requirement for a standard storage-vector capability, distinguishing it from endpoint or network DLP, which intercept data in motion rather than remediating stored files.

Why this answer

Storage discovery DLP tools are designed to find data at rest across repositories, and option B is correct because scanning SMB/CIFS file shares and NAS devices for unencrypted PII or financial records is a core storage-discovery function. Option D is correct because these tools commonly connect to relational databases such as Oracle and SQL Server and query schemas/tables for unprotected credit card numbers or other regulated data. Option A is also correct because once sensitive files are discovered, storage DLP can trigger automated remediation such as quarantining, encrypting, or deleting the files according to policy.

Option C is not a storage discovery capability; inspecting live bidirectional SIP VoIP streams is network/voice content inspection, not data-at-rest discovery. Option E is also not storage discovery; intercepting USB file copies inline is an endpoint DLP enforcement function, not scanning stored repositories.

Practice this question →
29
MCQeasy

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

A.Kubernetes Ingress Controller with basic HTTP routing
B.Istio with Envoy sidecar proxies enforcing automatic mTLS
C.Docker Swarm overlay networking with IPsec tunneling
D.Apache ZooKeeper configuration management service
AnswerB

Envoy sidecar proxies intercept pod traffic and perform automatic mTLS handshakes, so encryption between microservices is enforced without altering application code. This satisfies the in-cluster data-in-transit requirement, since Istio's control plane issues and rotates certificates for each workload identity.

Why this answer

Istio deploys Envoy sidecar proxies alongside each service pod and uses its control plane (istiod) to distribute certificates and enforce mutual TLS automatically. Because the sidecars intercept all pod-to-pod traffic, mTLS is applied transparently without any application code changes. This is the canonical service mesh pattern for zero-trust east-west encryption in Kubernetes.

Exam trap

CND often tests whether candidates confuse edge TLS termination (Ingress) with east-west mTLS between pods — the key discriminator is that only a service mesh with sidecars provides automatic identity-based encryption without code changes.

How to eliminate wrong answers

Option A is wrong because an Ingress Controller only handles north-south traffic entering the cluster and typically terminates TLS at the edge; it does not encrypt pod-to-pod east-west traffic or provide mTLS identity between services. Option C is wrong because Docker Swarm overlay networking with IPsec encrypts node-to-node transport but does not provide per-service identity-based mTLS, and Docker Swarm is not a Kubernetes service mesh. Option D is wrong because Apache ZooKeeper is a distributed coordination service for configuration and leader election, not a data-plane encryption or service mesh technology.

Practice this question →
30
MCQeasy

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

A.Support for HTTP chunked transfer encoding
B.Support for UTF-8 character encoding
C.Support for JSON serialization and deserialization
D.Support for Document Type Definitions (DTDs) and external entity references
AnswerD

XXE abuses the parser's DTD processing, specifically external entity declarations that fetch local files or remote URLs. Disabling DTD support and external entity resolution removes the attack path entirely, satisfying the requirement to detect and prevent XXE injection in HTTP POST bodies.

Why this answer

XXE injection abuses the XML parser's support for Document Type Definitions (DTDs) and external entity references, allowing an attacker to define an entity that reads local files or makes outbound requests. Disabling DTD processing (e.g., setFeature('http://apache.org/xml/features/disallow-doctype-decl', true)) prevents the attack. The core feature to disable is DTD/external entity support.

Exam trap

The trap is assuming XXE relates to encoding or transport (UTF-8, chunked encoding); the exam expects you to know it is specifically about DTD and external entity processing in the XML parser.

How to eliminate wrong answers

Option A is wrong because HTTP chunked transfer encoding is a transport-layer framing mechanism unrelated to XML parsing or entity expansion. Option B is wrong because UTF-8 is a character encoding; it has no bearing on whether external entities are resolved. Option C is wrong because JSON serialization/deserialization is a different data format entirely — XXE is specific to XML parsers and DTD handling, not JSON.

Practice this question →
31
Multi-Selecthard

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

Select 3 answers
A.TDE does not protect data in memory (RAM) or prevent authorized database users/administrators with SELECT privileges from viewing decrypted data
B.TDE prevents SQL injection attacks by automatically sanitizing all incoming query parameters
C.TDE does not protect data in transit across the network between client applications and the database server
D.TDE encrypts database data files, log files, and backups at rest on storage media
E.TDE eliminates the need for database user access controls and role-based permissions
AnswersA, C, D

TDE decrypts data at the storage layer, so pages are plaintext once read into the buffer pool. Any user or administrator holding SELECT privileges views decrypted rows normally, and RAM contents remain unprotected, defining TDE's architectural boundary.

Why this answer

Option D is correct because TDE's core function is at-rest encryption: it encrypts the database data files, transaction log files, and backups on storage media, protecting them if physical media or backup files are stolen. Option A is correct because TDE decrypts data as it is read into memory, so it offers no protection against in-memory attacks (RAM scraping, cold-boot) and does not stop authorized users or DBAs with SELECT privileges from viewing plaintext data through normal queries. Option C is correct because TDE only covers data at rest; data moving over the network between clients and the database server is not encrypted by TDE and requires transport encryption such as TLS/SSL.

Option B is wrong because TDE is an encryption-at-rest feature and does nothing to sanitize query parameters or prevent SQL injection, which requires parameterized queries and input validation. Option E is wrong because TDE is not an access-control mechanism; authentication, authorization, and role-based permissions remain essential and are unaffected by enabling TDE.

Exam trap

CND often tests the scope of TDE — candidates may incorrectly assume TDE protects data in use or in transit, or that it prevents injection attacks, when in fact it only protects data at rest and does not replace access controls or network encryption.

Practice this question →
32
MCQeasy

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

A.Network tap / SPAN port capturing database protocol traffic or host-based driver interceptors
B.On the perimeter firewall inspecting ICMP echo requests
C.At the corporate DNS resolver cache
D.As an SMTP email gateway relay filter
AnswerA

A network tap or SPAN port captures the database protocol traffic on the wire, plus host-based driver interceptors, giving query visibility independent of SQL Server's own logs. This satisfies the requirement to capture all queries accurately without relying solely on database logs.

Why this answer

A DAM sensor captures database activity most accurately by sitting inline or out-of-band on the network path where database protocol traffic flows — typically via a network TAP or SPAN port mirroring the database VLAN — or by using host-based driver interceptors that hook the database client/server libraries. This captures the actual SQL statements on the wire (TDS for SQL Server, TNS for Oracle) independent of what the database chooses to log, which is critical because native audit logs can be tampered with or disabled by a compromised DBA.

Exam trap

The trap is that candidates pick 'database logs' or a generic network device because they sound plausible, but the question explicitly says 'without relying solely on database logs' — the exam tests whether you know DAM sensors must see the database wire protocol or hook the DB driver, not just any network vantage point.

How to eliminate wrong answers

Option B is wrong because a perimeter firewall inspecting ICMP echo requests only sees ping traffic, not the TDS/SQL statements that constitute database activity — ICMP has no relevance to SQL query monitoring. Option C is wrong because a DNS resolver cache only holds name-to-IP mappings; it never sees the SQL payloads inside database sessions. Option D is wrong because an SMTP email gateway relay filter processes email messages, not database wire protocols, so it cannot observe queries.

Practice this question →
33
MCQhard

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?

A.Setting an expiration time (exp claim) of 15 minutes
B.Failing to strictly validate the JWT algorithm header, allowing 'none' or asymmetric-to-symmetric key confusion (RS256 to HS256)
C.Storing the JWT inside an HTTP-only Secure cookie instead of localStorage
D.Including the user's role claim inside the public payload section
AnswerB

Trusting the JWT header's alg field lets an attacker submit 'none' or swap RS256 for HS256, signing with the public key as an HMAC secret. Strictly pinning the expected algorithm server-side prevents this signature forgery and the resulting privilege escalation.

Why this answer

The JWT algorithm header (alg) is attacker-controlled and must be strictly validated server-side against an allowlist. If the application accepts 'none' or trusts the alg field to select the verification key, an attacker can forge tokens — the classic RS256-to-HS256 confusion attack lets the attacker sign with the public RSA key as an HMAC secret, which the server then accepts. This directly enables signature forgery and privilege escalation.

Exam trap

CND often tests the misconception that JWT payload contents (like role claims) are the primary risk, when the real high-severity flaw is trusting the attacker-controlled alg header — candidates must recognize that signature verification logic, not payload visibility, drives forgery risk.

How to eliminate wrong answers

Option A is wrong because a 15-minute exp claim is a security best practice that limits token replay windows, not a forgery risk. Option C is wrong because storing JWTs in HTTP-only Secure cookies is actually the recommended mitigation against XSS token theft, not a flaw. Option D is wrong because role claims in the payload are not a vulnerability per se — the payload is only base64-encoded, not encrypted, but the signature still protects integrity, so including role claims is standard practice as long as the server validates the signature.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Application And Data Protection questions.

Start 20-question session