Courseiva

CCNA Enterprise Cloud Virtual And Wireless Network Protection Questions

37 questions · Enterprise Cloud Virtual And Wireless Network Protection · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

A.AWS VPC Flow Logs
B.Amazon GuardDuty Kubernetes audit logs
C.AWS Trusted Advisor network optimization checks
D.AWS CloudTrail Management Events
AnswerA

VPC Flow Logs capture IP traffic metadata for elastic network interfaces, including source, destination, ports, and accept or reject decisions. Analysing these records reveals anomalous outbound connections from EC2 instances to unknown external addresses, satisfying the stem's traffic-flow analysis requirement.

Why this answer

AWS VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, action) for network interfaces in a VPC, making them the correct feature to analyze outbound communication from EC2 instances to unknown external IPs. They can be published to CloudWatch Logs or S3 and queried with Athena for anomaly detection.

Exam trap

CND often tests the distinction between network-level telemetry (VPC Flow Logs) and API-level telemetry (CloudTrail), and candidates mistakenly pick CloudTrail thinking it captures all AWS activity including network traffic.

How to eliminate wrong answers

Option B is wrong because GuardDuty Kubernetes audit logs focus on EKS control plane activity (API calls, RBAC events), not VPC-level network flows. Option C is wrong because Trusted Advisor network optimization checks are cost/performance recommendations, not security traffic analysis. Option D is wrong because CloudTrail Management Events record AWS API calls (e.g., RunInstances, CreateUser), not network traffic flows between EC2 instances and external IPs.

Practice this question →
2
MCQmedium

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

A.Google Cloud IAM Bucket-Level Access Control with deny policies
B.Customer-managed encryption keys (CMEK) with scheduled key rotation
C.GCP Storage object versioning with lifecycle rules
D.Cloud Storage Bucket Lock using Object Retention Policies (WORM)
AnswerD

Bucket Lock with Object Retention Policies enforces WORM semantics, making each object immutable for its retention period. Unlike IAM or bucket-level retention alone, it blocks deletion and modification by every principal, including project owners and root administrators, satisfying the mandated five-year compliance hold that no privileged user can override.

Why this answer

Cloud Storage Bucket Lock with Object Retention Policies enforces WORM (Write Once Read Many) semantics, preventing any user—including project owners and root administrators—from modifying or deleting objects until the retention period expires. Once a retention policy is locked, it cannot be shortened or removed, satisfying the 5-year compliance mandate. This is the only GCP feature that provides immutable, tamper-proof retention at the object level.

Exam trap

The trap here is confusing access control (IAM deny policies) with immutability—candidates assume that denying delete permissions is equivalent to WORM, but only Bucket Lock provides non-repudiable, admin-proof retention.

How to eliminate wrong answers

Option A is wrong because IAM deny policies only restrict permissions—they can always be removed or overridden by an organization admin, so they do not provide immutable retention. Option B is wrong because CMEK with key rotation only controls encryption key lifecycle; rotating or destroying a key does not prevent object deletion or modification and is not a retention mechanism. Option C is wrong because object versioning with lifecycle rules allows objects to be overwritten and versions to be deleted by lifecycle policies or users with permissions—it is not WORM and provides no legal hold guarantee.

Practice this question →
3
MCQhard

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

A.Azure Application Gateway Ingress Controller (AGIC)
B.Azure CNI powered by Cilium with data plane encryption enabled
C.Azure Key Vault provider for Secrets Store CSI driver
D.Azure Policy for Kubernetes add-on
AnswerB

Azure CNI powered by Cilium with data plane encryption enabled encrypts pod-to-pod traffic between nodes using IPsec or WireGuard at the network layer, directly satisfying the requirement for encrypted node-to-node communication within the AKS cluster. Enabling it at cluster creation ensures all east-west traffic is protected in transit.

Why this answer

Azure CNI powered by Cilium supports transparent data plane encryption using WireGuard, which encrypts node-to-node and pod-to-pod traffic within the AKS cluster. Enabling data plane encryption during cluster creation (or via configuration) satisfies the requirement for encrypted in-transit communication between nodes. This is the native AKS feature designed for intra-cluster transport encryption.

Exam trap

CND often tests the difference between ingress traffic encryption (AGIC, TLS termination) and intra-cluster data plane encryption (Cilium WireGuard), so candidates who pick an ingress or secrets-management feature for a node-to-node encryption requirement get trapped.

How to eliminate wrong answers

Option A is wrong because AGIC is an ingress controller that manages inbound HTTP/HTTPS traffic from outside the cluster to services — it does not encrypt node-to-node traffic inside the cluster. Option C is wrong because the Key Vault provider for Secrets Store CSI driver mounts secrets from Azure Key Vault into pods; it handles secret management, not transport encryption. Option D is wrong because Azure Policy for Kubernetes enforces governance and compliance rules on cluster resources; it does not provide data plane encryption.

Practice this question →
4
MCQeasy

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

A.AWS Direct Connect combined with VPC Flow Logs
B.AWS Config rules combined with Amazon Inspector
C.AWS WAF combined with Amazon Route 53 DNS logging
D.AWS CloudTrail combined with Amazon EventBridge and SNS alerts
AnswerD

CloudTrail records every AWS API call, including IAM policy and security group modifications, capturing the identity of the caller. EventBridge filters these management events against rules matching unauthorised principals, then routes matches to SNS for immediate alerting. This satisfies the requirement to detect and notify on attempted changes to critical IAM policies and security group rules.

Why this answer

AWS CloudTrail records all API activity in the account, including IAM and EC2 security group modifications. Amazon EventBridge can match specific CloudTrail events (e.g., unauthorized ModifyPolicy or AuthorizeSecurityGroupIngress calls) and route them to Amazon SNS for alerting. This combination provides the required monitoring and notification pipeline.

Exam trap

CND often tests service-to-purpose mapping, catching candidates who confuse monitoring services (CloudTrail for API activity) with configuration/vulnerability services (Config, Inspector) or network inspection tools (WAF, Flow Logs).

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection and VPC Flow Logs capture IP-level traffic metadata, neither of which monitors API calls or IAM/security group changes. Option B is wrong because AWS Config evaluates resource configuration compliance and Amazon Inspector scans for vulnerabilities; neither generates real-time alerts on unauthorized API calls. Option C is wrong because AWS WAF filters HTTP(S) web traffic at the application layer and Route 53 DNS logging records DNS queries, neither of which detects IAM policy or security group API modifications.

Practice this question →
5
MCQmedium

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

A.First match based on rule priority number in ascending order
B.Last match evaluated across all security rules
C.Explicit allow rules override all deny rules regardless of priority
D.Deny rules always take precedence regardless of priority number
AnswerA

Azure evaluates NSG rules by priority number, processing the lowest value first and stopping at the first match. This satisfies the stem's requirement to identify the evaluation principle: traffic is permitted or denied by whichever rule has the smallest priority number that matches, so a deny rule at priority 100 overrides an allow rule at 200.

Why this answer

Azure NSGs evaluate rules in ascending order of priority number (100–4096), and the first rule whose source, destination, port, and protocol match the traffic is applied — no further rules are evaluated. This 'first match wins' model means a lower number equals higher precedence. If no rule matches, the default rules (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, etc.) apply.

Exam trap

The trap is assuming deny always beats allow (as in some firewall models) or that all rules are evaluated — Azure's first-match-by-ascending-priority model is the opposite of 'last match wins' and does not give deny any inherent precedence.

How to eliminate wrong answers

Option B is wrong because Azure does not evaluate all rules and take the last match — it stops at the first match, so later rules are never consulted once a match occurs. Option C is wrong because there is no concept of explicit allow overriding deny in Azure NSGs; precedence is determined solely by priority number, and a deny rule with a lower number will block traffic even if an allow rule exists with a higher number. Option D is wrong because deny rules do not inherently take precedence — a deny rule only wins if its priority number is lower than any matching allow rule.

Practice this question →
6
MCQeasy

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

A.AWS Shield Advanced
B.AWS Organizations with all features enabled
C.AWS CloudTrail
D.AWS Transit Gateway
AnswerB

AWS Organizations with all features enabled creates the organizational management structure Security Hub requires for centralised findings aggregation. All-features mode, rather than consolidated billing only, permits service-managed policies and delegated administrator designation, enabling automatic ingestion across every member account. Without this prerequisite, cross-account centralisation cannot be configured.

Why this answer

AWS Organizations with all features enabled is required to create the organizational structure and enable centralized management of Security Hub across all accounts. Security Hub integrates with Organizations to automatically add new accounts and aggregate findings. All features must be enabled to use service control policies and delegated administration, which are necessary for Security Hub's multi-account setup.

Exam trap

CND often tests the prerequisite services for centralized security management, and candidates may confuse AWS Organizations with other services like CloudTrail or Shield, not realizing that Organizations is the foundational structure.

How to eliminate wrong answers

Option A is wrong because AWS Shield Advanced is a DDoS protection service, not an organizational management tool. Option C is wrong because AWS CloudTrail is for logging API activity, not for creating organizational structures. Option D is wrong because AWS Transit Gateway is a network transit hub, not related to organizational management.

Practice this question →
7
MCQhard

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

A.Hub-and-Spoke Virtual Network architecture with User Defined Routes (UDR) pointing to Azure Firewall
B.Full mesh VPC peering between all individual application virtual networks
C.Azure ExpressRoute Local circuits with direct peering
D.Default Azure Virtual Network peering without route tables
AnswerA

A hub-and-spoke topology centralises inspection by routing all spoke-to-spoke East-West traffic through Azure Firewall in the hub, enforced via User Defined Routes. This satisfies the requirement to inspect inter-subnet traffic between virtual networks with centralised next-generation firewalls.

Why this answer

Hub-and-Spoke with User Defined Routes (UDR) pointing to Azure Firewall is correct because it centralizes East-West traffic inspection. In this topology, spoke VNets peer with a hub VNet that hosts Azure Firewall, and UDRs on the spoke subnets force all inter-spoke traffic through the firewall's private IP as the next hop. This satisfies the requirement to inspect all inter-subnet traffic between different virtual networks using a centralized NGFW.

Exam trap

The trap here is confusing AWS terminology (VPC peering, full mesh) with Azure VNet peering, and assuming that peering alone provides inspection — peering is direct and bypasses firewalls unless UDRs force traffic through a virtual appliance.

How to eliminate wrong answers

Option B is wrong because full mesh VPC peering (a term borrowed from AWS; Azure uses VNet peering) creates direct spoke-to-spoke paths that bypass any centralized firewall, defeating the inspection requirement. Option C is wrong because ExpressRoute Local circuits provide private connectivity from on-premises to an Azure region and have nothing to do with inspecting East-West traffic between Azure VNets. Option D is wrong because default VNet peering without route tables allows direct spoke-to-spoke communication that never traverses a firewall, so no inspection occurs.

Practice this question →
8
MCQeasy

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

A.Azure Information Protection (AIP)
B.Azure Active Directory (Microsoft Entra ID) Identity Protection
C.Azure Key Vault (Managed HSM or Standard Vault)
D.Azure Sentinel (Microsoft Sentinel)
AnswerC

Azure Key Vault stores and controls customer-managed keys, with Managed HSM providing FIPS 140-2 Level 3 validated hardware protection. Integrating it with Storage Accounts enables envelope encryption where the key-encryption key never leaves the HSM, satisfying the auditor's hardware-module requirement.

Why this answer

Azure Key Vault (either a Standard vault or a Managed HSM pool) is the Azure service that stores and manages customer-managed keys (CMK) used for Storage Account encryption at rest. Storage Accounts integrate natively with Key Vault via a system-assigned or user-assigned managed identity, allowing the storage service to unwrap the CMK for encryption/decryption without exposing the key. Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules when the auditor requires keys stored in dedicated HSM hardware.

Exam trap

The trap is confusing data classification/labeling services (AIP/Purview) or identity risk services (Identity Protection) with key management — only Key Vault (or Managed HSM) stores and controls the CMK used for storage encryption.

How to eliminate wrong answers

Option A is wrong because Azure Information Protection (now part of Microsoft Purview Information Protection) is a data classification and labeling service for documents and emails — it does not store encryption keys for Storage Account at-rest encryption. Option B is wrong because Entra ID Identity Protection is a risk-detection and conditional access service for user identities; it has no role in managing storage encryption keys. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for security analytics and incident response — it does not provide key management or HSM-backed key storage.

Practice this question →
9
Multi-Selecthard

A GCP cloud security team is auditing a Kubernetes cluster running in Google Kubernetes Engine (GKE). Which THREE security hardening steps should be verified to ensure robust cluster security? (Choose THREE)

Select 3 answers
A.Enable Workload Identity for secure pod-to-GCP-service authentication
B.Expose the Kubernetes master control plane endpoint with public IP accessible from 0.0.0.0/0
C.Configure GKE Private Cluster with master authorized networks enabled
D.Implement Binary Authorization to ensure only cryptographically signed container images are deployed
E.Disable Kubernetes Role-Based Access Control (RBAC) to simplify pod management
AnswersA, C, D

Workload Identity binds Kubernetes service accounts to Google Cloud IAM service accounts, issuing short-lived federated tokens instead of static JSON keys stored in Secrets. This satisfies the stem's pod-to-GCP-service authentication requirement, eliminating long-lived credentials that attackers could exfiltrate from the cluster.

Why this answer

Option A is correct because Workload Identity binds a Kubernetes service account to a Google Cloud IAM service account, letting pods authenticate to GCP APIs via short-lived OAuth 2.0 tokens instead of static, long-lived service account keys. Option C is correct because a GKE Private Cluster gives nodes internal-only IPs and keeps the control plane reachable only through authorized networks, drastically shrinking the external attack surface. Option D is correct because Binary Authorization enforces a deploy-time policy that admits only container images signed by trusted attestors, preventing unsigned or tampered images from running.

Option B is wrong because exposing the master endpoint to 0.0.0.0/0 removes network isolation and invites brute-force and exploitation attempts against the API server. Option E is wrong because disabling RBAC eliminates least-privilege authorization and lets any authenticated principal perform unrestricted actions, weakening rather than hardening the cluster.

Exam trap

CND often tests the misconception that exposing the control plane publicly is acceptable if strong authentication is used — candidates pick option B thinking 'we have RBAC and strong passwords,' but the exam expects recognition that public control plane exposure is a hardening failure regardless of auth strength.

Practice this question →
10
MCQmedium

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

A.Azure Firewall with Application Rules
B.Azure Application Gateway with Web Application Firewall
C.Network Security Group (NSG) with custom service tags
D.User Defined Routes (UDR) pointing to a load balancer
AnswerA

Azure Firewall with Application Rules filters outbound traffic using FQDNs, satisfying the requirement for domain-based filtering rather than IP addresses. Application Rules operate at layer 7, inspecting HTTP/HTTPS and TLS SNI, which Network Rules (layer 3–4, IP-based) cannot do. This makes it the only listed resource that enforces FQDN egress control from the subnet.

Why this answer

Azure Firewall Application Rules operate at Layer 7 and support fully qualified domain names (FQDNs) as target criteria, allowing outbound HTTP/HTTPS/SQL traffic to be filtered by domain name rather than IP. This is the only native Azure resource that natively supports FQDN-based outbound filtering at the network level. Azure Firewall resolves FQDNs via its own DNS proxy and applies allow/deny rules per domain, which is essential when destinations use dynamic IPs (e.g., Microsoft 365, SaaS endpoints).

Exam trap

The trap is confusing inbound Layer 7 inspection (Application Gateway/WAF) with outbound Layer 7 filtering (Azure Firewall Application Rules) — candidates often pick the WAF because it also operates at Layer 7, but it does not filter egress by FQDN.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway with WAF is an inbound Layer 7 load balancer and reverse proxy for web applications — it does not provide outbound FQDN filtering for arbitrary subnet traffic. Option C is wrong because Network Security Groups are Layer 3/4 stateful packet filters that operate on IP addresses, ports, and service tags — they cannot match on FQDN. Option D is wrong because User Defined Routes control the next-hop path of traffic (e.g., forcing traffic through a firewall or NVA) but do not themselves perform FQDN-based filtering; a UDR alone cannot inspect domain names.

Practice this question →
11
Multi-Selectmedium

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

Select 2 answers
A.Allowing anonymous public read access on all blob containers by default
B.Removing all Azure Key Vault cryptographic keys
C.Configuring Azure Storage Firewall rules to restrict access to specific Virtual Networks and IP ranges
D.Enabling Microsoft Defender for Storage for threat detection
E.Disabling HTTPS traffic so clients communicate exclusively over unencrypted HTTP
AnswersC, D

Storage firewall rules restrict the data plane to approved virtual networks and public IP ranges, blocking access from arbitrary internet addresses. This satisfies the stem's requirement by shrinking the reachable attack surface, complementing identity controls against unauthorised access and exfiltration.

Why this answer

Option C is correct because configuring Azure Storage Firewall rules (network rules on the storage account) restricts access to specified virtual networks, subnets, and public IP ranges, blocking unauthorized clients and reducing data exfiltration paths. Option D is correct because Microsoft Defender for Storage provides threat detection for anomalous access, suspicious exfiltration attempts, and malicious activity against blobs, files, and other storage services. Option A is wrong because allowing anonymous public read access by default exposes blob data to anyone and directly increases exfiltration risk.

Option B is wrong because removing Azure Key Vault cryptographic keys would break encryption and key management rather than improve protection. Option E is wrong because disabling HTTPS forces unencrypted HTTP traffic, weakening security and violating secure transport requirements.

Exam trap

The trap is that candidates see 'encryption' or 'Key Vault' options and assume they address exfiltration; the exam expects you to recognize that network restriction plus threat detection are the controls that actually prevent and detect unauthorized access.

Practice this question →
12
Multi-Selectmedium

A GCP cloud administrator is setting up Cloud VPN to connect an on-premises datacenter to a GCP VPC. Which TWO components must be configured to establish a functional High Availability (HA) VPN gateway? (Choose TWO)

Select 2 answers
A.A GCP HA VPN gateway providing two public IP addresses automatically
B.A dedicated physical fiber interconnect cable
C.A GCP Cloud Router running Border Gateway Protocol (BGP)
D.A Google Cloud Armor security policy attached to the VPN gateway
E.A standalone legacy target VPN gateway with static routes
AnswersA, C

HA VPN requires a gateway with two interfaces, each holding a distinct public IP, so GCP automatically allocates two external addresses. This dual-interface design provides the redundancy needed for 99.99% SLA availability, satisfying the high-availability constraint in the scenario.

Why this answer

Option A is correct because a GCP HA VPN gateway is the required GCP-side resource for an HA VPN, and it automatically provisions two public IP addresses (one per interface) to provide 99.99% availability when both tunnels are configured. Option C is correct because HA VPN requires dynamic routing via a Cloud Router running BGP to exchange routes between the VPC and the on-premises network, and BGP sessions must be established on each tunnel interface. Option B is incorrect because a dedicated physical fiber interconnect cable is associated with Cloud Interconnect (Dedicated Interconnect), not Cloud VPN, which runs IPsec over the public internet.

Option D is incorrect because Cloud Armor is an edge security service for HTTP(S) load balancers and does not attach to VPN gateways. Option E is incorrect because a legacy target VPN gateway with static routes is the older, non-HA VPN construct and does not satisfy the HA VPN requirement.

Exam trap

CND often tests whether candidates confuse Cloud VPN (IPsec over internet, requires Cloud Router + BGP for HA) with Cloud Interconnect (dedicated/physical link), leading them to select the fiber interconnect option.

Practice this question →
13
Multi-Selecthard

An enterprise security team is hardening an Azure environment. Which THREE actions should be implemented to secure Azure Virtual Machines and management planes? (Choose THREE)

Select 3 answers
A.Disabling Azure Disk Encryption across all operating system disks
B.Enabling Microsoft Defender for Cloud for continuous posture management and threat detection
C.Opening TCP ports 22 and 3389 publicly on all NSGs for easy administrative troubleshooting
D.Implementing Just-In-Time (JIT) VM access to restrict standing administrative port access
E.Deploying Azure Bastion to handle secure browser-based RDP and SSH sessions without public IPs on VMs
AnswersB, D, E

Microsoft Defender for Cloud provides continuous secure score assessment and workload protection across VMs and control planes, satisfying the hardening requirement for posture management plus runtime threat detection spanning both the data and management planes.

Why this answer

Option B is correct because Microsoft Defender for Cloud provides continuous security posture management (secure score, regulatory compliance) and threat detection across Azure VMs and management planes, which is a core hardening control. Option D is correct because Just-In-Time (JIT) VM access in Defender for Cloud removes standing open management ports (22/3389) and grants time-bound, IP-restricted, request-approved access, directly reducing the attack surface. Option E is correct because Azure Bastion delivers browser-based RDP/SSH over TLS through the Azure portal, so VMs need no public IP addresses and management ports need not be exposed to the internet.

Option A is incorrect because disabling Azure Disk Encryption removes OS and data disk encryption at rest, weakening rather than hardening the VM. Option C is incorrect because publicly opening TCP 22 and 3389 on NSGs exposes SSH and RDP to internet scanning and brute-force attacks, the opposite of a hardening action.

Exam trap

CND often tests whether candidates recognize that 'ease of administration' justifications (opening 22/3389 publicly) are anti-patterns, and that disabling encryption is never a hardening action—catching those who prioritize convenience over security.

Practice this question →
14
MCQmedium

A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?

A.Event Source: s3.amazonaws.com, Event Name: PutBucketPolicy
B.Event Source: organizations.amazonaws.com, Event Name: AcceptHandshake
C.Event Source: iam.amazonaws.com, Event Name: CreateUser
D.Event Source: sts.amazonaws.com, Event Name: AssumeRole
AnswerD

Temporary credential acquisition via AWS Security Token Service is recorded as AssumeRole with event source sts.amazonaws.com. Searching CloudTrail for this pair reveals exactly which IAM users or roles obtained administrative sessions across accounts, satisfying the cross-account privilege audit requirement.

Why this answer

AWS STS AssumeRole events are logged in CloudTrail with eventSource sts.amazonaws.com and eventName AssumeRole, capturing when an IAM user or role assumes another role, including cross-account role assumption. Searching for this event identifies principals that have obtained administrative privileges via role assumption.

Exam trap

CND often tests the confusion between IAM management events (CreateUser, AttachPolicy) and STS role assumption events, causing candidates to search iam.amazonaws.com instead of sts.amazonaws.com for privilege assumption.

How to eliminate wrong answers

Option A is wrong because s3.amazonaws.com PutBucketPolicy logs changes to S3 bucket policies, not role assumption or privilege acquisition. Option B is wrong because organizations.amazonaws.com AcceptHandshake logs acceptance of AWS Organizations invitations, unrelated to assuming administrative roles. Option C is wrong because iam.amazonaws.com CreateUser logs creation of IAM users, which is a user management action, not the assumption of existing administrative privileges.

Practice this question →
15
MCQhard

A cloud security engineer is configuring a Google Cloud VPC firewall rule to allow traffic from an on-premises network to a specific subnet. The engineer wants to restrict access to only a set of known IP addresses. Which Google Cloud firewall rule component should the engineer use to define these IP addresses?

A.Source IPv4 ranges
B.Source tags
C.Source service accounts
D.Source service account and source tags combined
AnswerA

Source IPv4 ranges allow the engineer to specify one or more CIDR blocks that identify the source IP addresses of incoming traffic. This is the correct component to restrict access to known on-premises IP addresses because on-premises hosts communicate using IP addresses that can be represented as CIDR ranges. The firewall rule will then only allow traffic from those specified ranges.

Why this answer

Google Cloud VPC firewall rules use source IPv4 ranges to filter traffic based on source IP addresses. When traffic originates from an on-premises network, the source is an IP address or range, not a service account or tag. Therefore, specifying the known IP addresses as source IPv4 ranges is the correct way to restrict access.

The other options are used for internal Google Cloud resource identification and cannot match on-premises sources.

Exam trap

The trap here is confusing source tags or service accounts with source IP ranges; tags and service accounts only apply to Google Cloud resources, not on-premises hosts.

Practice this question →
16
MCQhard

An enterprise administrator is setting up an AWS Site-to-Site VPN connection between an on-premises data center and an AWS VPC. To ensure maximum data confidentiality and integrity across the public internet, which IPsec cryptographic parameters should be enforced in the VPN tunnel configuration?

A.RC4 encryption, SHA-1 integrity, and no PFS
B.AES-128 encryption, MD5 integrity, and DH Group 2
C.AES-256 encryption, SHA-2 (SHA-384) integrity, and DH Group 14 or higher
D.DES encryption, MD5 integrity, and DH Group 1
AnswerC

AES-256, SHA-384 and DH Group 14 or higher enforce strong IPsec phase 1 and phase 2 parameters, delivering the confidentiality and integrity the stem demands for traffic crossing the public internet between the data centre and VPC.

Why this answer

For maximum confidentiality and integrity over an IPsec tunnel, AES-256 provides strong symmetric encryption, SHA-2 (e.g., SHA-384) provides robust integrity/authentication, and DH Group 14 (2048-bit MODP) or higher ensures strong Perfect Forward Secrecy. These parameters align with modern cryptographic best practices and AWS VPN recommendations. Weaker ciphers like DES, RC4, MD5, and low DH groups are deprecated and vulnerable.

Exam trap

CND often tests whether candidates recognize deprecated cryptographic algorithms (DES, RC4, MD5, SHA-1, low DH groups) as insecure, catching those who pick 'AES-128' as sufficient without scrutinizing the accompanying weak integrity and key-exchange parameters.

How to eliminate wrong answers

Option A is wrong because RC4 is a deprecated stream cipher with known biases, SHA-1 is collision-prone and no longer considered secure for integrity, and disabling PFS means a compromised long-term key can decrypt past sessions. Option B is wrong because MD5 is cryptographically broken for integrity, and DH Group 2 (1024-bit) is too weak against modern factoring attacks, even though AES-128 is acceptable. Option D is wrong because DES has a 56-bit key that is trivially brute-forced, MD5 is broken, and DH Group 1 (768-bit) is critically weak and deprecated.

Practice this question →
17
Multi-Selectmedium

An enterprise security engineer is investigating potential AWS IAM privilege escalation paths and misconfigurations. Which TWO AWS IAM actions or conditions represent known high-risk misconfigurations that can lead to privilege escalation? (Choose TWO)

Select 2 answers
A.Enforcing Multi-Factor Authentication (MFA) on all IAM user sign-ins
B.Allowing unrestricted iam:PassRole combined with permission to launch EC2 instances with administrative IAM roles
C.Attaching AWS managed policies for read-only access to auditing users
D.Requiring IAM password complexity policies
E.Granting wildcard permissions (*:*) on iam:CreatePolicyVersion
AnswersB, E

iam:PassRole lets a principal hand an administrative role to an AWS service. Combined with ec2:RunInstances, the attacker launches an EC2 instance carrying that role, then retrieves its temporary credentials via the instance metadata service, escalating to full administrative privileges.

Why this answer

Option B is correct because iam:PassRole by itself only lets a principal hand a role to an AWS service, but when combined with permissions such as ec2:RunInstances, the user can launch an EC2 instance that assumes an administrative role and then use that instance's credentials to escalate privileges. Option E is correct because granting *:* on iam:CreatePolicyVersion allows a user to create a new version of an existing policy with arbitrary permissions and set it as the default, effectively escalating to any privilege the policy can grant. Option A is not a privilege escalation risk; enforcing MFA on IAM user sign-ins is a security best practice that strengthens authentication.

Option C is not a risk because read-only AWS managed policies for auditing users grant only visibility, not the ability to modify permissions or resources. Option D is not a risk because IAM password complexity policies improve credential strength and do not grant additional privileges.

Exam trap

CND often tests whether candidates confuse general IAM hardening controls (MFA, password policy, read-only managed policies) with actual privilege escalation primitives like iam:PassRole and iam:CreatePolicyVersion.

Practice this question →
18
MCQmedium

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

A.Google Cloud Armor perimeter security
B.VPC Firewall rules blocking port 22 inbound from 0.0.0.0/0, combined with Identity-Aware Proxy (IAP)
C.Google Cloud DNS DNSSEC configuration
D.Shared VPC host project firewall restriction
AnswerB

Firewall rules denying inbound TCP 22 from 0.0.0.0/0 remove public SSH exposure, while Identity-Aware Proxy tunnels authorised administrative access through Google's infrastructure. This satisfies the constraint that instances remain unreachable directly from the public internet despite having external IP addresses.

Why this answer

To block direct SSH from the internet while still allowing authorized access, you create a VPC firewall rule that denies ingress on TCP/22 from 0.0.0.0/0, and then use Identity-Aware Proxy (IAP) TCP forwarding to grant access based on IAM identity and context. IAP tunnels SSH through Google's infrastructure, so the instance never needs to accept public SSH connections. This is Google's recommended 'zero trust' pattern for administrative access.

Exam trap

The trap is picking IAP alone without the firewall rule, or picking Cloud Armor because it sounds like a network security control — Cloud Armor only protects HTTP(S) load balancers, not SSH.

How to eliminate wrong answers

Option A is wrong because Google Cloud Armor is a WAF/DDoS protection service for external HTTP(S) load balancers, not for controlling SSH access to compute instances. Option C is wrong because Cloud DNS DNSSEC provides cryptographic authentication of DNS responses, which is unrelated to SSH access control. Option D is wrong because Shared VPC host project firewall restrictions control which projects can use shared networks, but do not by themselves prevent public SSH — you still need a firewall rule and an access mechanism like IAP.

Practice this question →
19
MCQhard

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

A.Azure Backup Vault with geo-redundant storage (GRS)
B.Azure ExpressRoute Global Reach
C.Azure Site Recovery (ASR)
D.Azure Traffic Manager with priority routing
AnswerC

Azure Site Recovery continuously replicates VM disks asynchronously to a secondary region, storing replicas in a low-cost state without running secondary compute. This directly satisfies the stem's constraint of cross-region disaster recovery without permanently provisioned standby VMs, enabling failover only when required.

Why this answer

Azure Site Recovery (ASR) is the Azure service designed for disaster recovery of VMs, replicating VM disks asynchronously to a secondary region without requiring secondary VMs to run continuously. It continuously replicates changes to a target region, and on failover it provisions the secondary VMs from the replicated disks, enabling recovery with minimal downtime. This matches the requirement of asynchronous cross-region disk replication with no always-on secondary VMs.

Exam trap

The trap is confusing backup (point-in-time restore with high RTO) or traffic routing (Traffic Manager) with true disaster recovery replication — only Azure Site Recovery provides asynchronous disk replication with on-demand secondary VM provisioning.

How to eliminate wrong answers

Option A is wrong because Azure Backup with GRS stores backup copies for restore, not continuous asynchronous disk replication — recovery from backup has a much higher RPO/RTO and does not provide near-real-time failover. Option B is wrong because ExpressRoute Global Reach is a networking feature that connects on-premises networks via Microsoft's backbone; it has nothing to do with VM disk replication or disaster recovery. Option D is wrong because Traffic Manager with priority routing is a DNS-based traffic routing service that directs users to endpoints — it does not replicate VM disks or provision secondary VMs.

Practice this question →
20
MCQhard

A security team is deploying a Microsoft Azure environment with a hub-and-spoke virtual network topology. They need to inspect all traffic between spoke virtual networks and the on-premises datacenter for intrusion detection. Traffic must be forced through a third-party network virtual appliance (NVA) hosted in the hub VNet. Which Azure feature should they configure on the spoke subnets to ensure this traffic redirection occurs?

A.Network security groups (NSGs)
B.Azure DDoS Protection Standard
C.Azure Firewall
D.User-defined routes (UDRs)
AnswerD

User-defined routes allow you to override Azure's default system routes and direct traffic to a specific next hop, such as a virtual appliance. By creating a UDR on the spoke subnets with the address prefix of the on-premises network and the NVA's private IP as the next hop, all traffic from the spokes to on-premises is forced through the NVA for inspection. This is the standard method for traffic redirection in hub-and-spoke topologies.

Why this answer

To force traffic from spoke subnets through a network virtual appliance in the hub, you must configure user-defined routes on the spoke subnets. UDRs override Azure's default system routes and let you specify the NVA's private IP as the next hop for traffic destined to on-premises or other spokes. This ensures all relevant flows are inspected by the NVA, satisfying the requirement for intrusion detection without altering the NVA itself.

Exam trap

The trap here is confusing traffic filtering (NSGs) or DDoS protection with traffic redirection (UDRs); only UDRs can change the next hop to an NVA.

Practice this question →
21
MCQmedium

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

A.GCP Cloud NAT gateway attached to the subnet
B.External HTTP(S) Load Balancer
C.Dedicated Interconnect with partner peering
D.Private Google Access enabled on the subnet
AnswerD

Private Google Access lets instances lacking external IP addresses reach Google APIs and services through internal routing, satisfying the stem's no-external-IP constraint. Enabling it on the subnet routes traffic to restricted.googleapis.com or private.googleapis.com VIPs, keeping traffic off the public internet while permitting Cloud Storage and BigQuery access.

Why this answer

Private Google Access is a subnet-level setting that allows VM instances with only internal (RFC 1918) IP addresses to reach Google APIs and services (Cloud Storage, BigQuery, Pub/Sub, etc.) using their internal IPs, without requiring a Cloud NAT or external IP. Traffic is routed over Google's internal network to the private.googleapis.com or restricted.googleapis.com VIPs (199.36.153.8/30 or 199.36.153.4/30). This is the canonical GCP control for secure, private API access from internal-only instances.

Exam trap

CND often tests whether candidates confuse Cloud NAT (general internet egress) with Private Google Access (private path to Google APIs) — the trap is picking Cloud NAT because it also enables outbound connectivity for internal-only instances.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet access for instances without external IPs, but it is not required for Google API access — Private Google Access handles that natively, and Cloud NAT is for general internet egress. Option B is wrong because an External HTTP(S) Load Balancer distributes inbound traffic to backends; it does not enable outbound API access from internal instances. Option C is wrong because Dedicated Interconnect provides private connectivity between on-premises and GCP, not between a GCP VM and Google APIs within the same VPC.

Practice this question →
22
Multi-Selectmedium

An enterprise cloud security architect is hardening an AWS environment to protect against unauthorized data exfiltration from S3 buckets. Which TWO preventative security measures should be implemented? (Choose TWO)

Select 2 answers
A.Disable all IAM roles across the AWS account
B.Enable S3 Block Public Access at both the account and bucket levels
C.Rely solely on default S3 bucket Access Control Lists (ACLs)
D.Enable public read access on all log buckets for transparency
E.Configure S3 bucket policies that enforce access exclusively from specific authorized VPC Endpoints
AnswersB, E

S3 Block Public Access applied at account and bucket levels overrides bucket policies and ACLs that would otherwise grant anonymous or public read access, preventing the misconfiguration-driven exposure that enables unauthorised data exfiltration from S3 buckets.

Why this answer

Option B is correct because enabling S3 Block Public Access at both the account and bucket levels is a preventative control that overrides bucket policies and ACLs to block any public access, directly preventing unauthorized public exposure and exfiltration of S3 data. Option E is correct because S3 bucket policies that restrict access exclusively to specific authorized VPC Endpoints (using conditions like aws:sourceVpce) ensure that only traffic originating from approved private network paths can reach the buckets, blocking access from the public internet or unapproved sources. Option A is wrong because disabling all IAM roles would break legitimate workloads and services that require role-based access, and it is not a targeted preventative measure for S3 exfiltration.

Option C is wrong because default S3 ACLs are permissive legacy controls that do not provide robust preventative protection and can inadvertently allow broad access. Option D is wrong because enabling public read access on log buckets directly exposes data to the internet, increasing the risk of unauthorized exfiltration rather than preventing it.

Exam trap

CND often tests whether candidates confuse preventive controls (Block Public Access, restrictive bucket policies) with detective or disruptive controls (Security Hub, GuardDuty), so picking monitoring tools instead of enforcement mechanisms is the common mistake.

Practice this question →
23
MCQeasy

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

A.AWS Shield Standard DDoS mitigation
B.AWS Trusted Advisor security checks
C.Amazon S3 Block Public Access (Account-level setting)
D.AWS IAM Permissions Boundary
AnswerC

Account-level S3 Block Public Access applies the BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy and RestrictPublicBuckets settings to every bucket in the account, including newly created ones. This satisfies the stem's requirement for automatic enforcement across all accounts without per-bucket configuration.

Why this answer

Amazon S3 Block Public Access at the account level is a centralized control that applies to all buckets in the account, including newly created ones, and overrides bucket-level or object-level public access settings. Enabling it at the account level ensures that any future bucket automatically inherits the block, preventing accidental public exposure. This is the only option that directly addresses S3 public access at the account scope.

Exam trap

The trap here is confusing network-level DDoS protection (Shield) or advisory tools (Trusted Advisor) with direct S3 access control, or assuming IAM Permissions Boundaries can block public S3 access.

How to eliminate wrong answers

Option A is wrong because AWS Shield Standard provides DDoS protection for network and transport layers, not S3 bucket access control. Option B is wrong because Trusted Advisor is an advisory service that identifies best-practice violations but does not enforce or automatically block public access. Option D is wrong because IAM Permissions Boundaries limit the maximum permissions an IAM entity can have, but they do not directly control S3 bucket public access settings and are not applied at the account level for this purpose.

Practice this question →
24
Multi-Selectmedium

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

Select 2 answers
A.Standard unencrypted public IP bindings on Azure VMs
B.Azure ExpressRoute with MACsec or configured IPsec tunnels
C.Standard Azure Load Balancer without TLS offloading
D.Unencrypted Azure Virtual Network Peering
E.Azure Site-to-Site VPN Gateway using IPsec encryption
AnswersB, E

ExpressRoute provides private, dedicated transit that bypasses the public internet, and MACsec encrypts the link at layer 2 between edge routers, while IPsec over ExpressRoute encrypts traffic end-to-end. This satisfies the stem's requirement for encrypted, secure transit over a private connection.

Why this answer

Option B is correct because Azure ExpressRoute can provide private, dedicated connectivity from on-premises datacenters to Azure Virtual Networks, and it can be secured with MACsec at the ExpressRoute Direct link layer or with IPsec tunnels over the ExpressRoute private peering for end-to-end encryption. Option E is correct because an Azure Site-to-Site VPN Gateway establishes an IPsec/IKE-encrypted tunnel over the public internet between on-premises VPN devices and the Azure VPN gateway, ensuring secure transit for cross-premises traffic. Option A is not appropriate because standard unencrypted public IP bindings expose VM traffic without providing an encrypted transit channel.

Option C is not appropriate because a standard Azure Load Balancer without TLS offloading does not encrypt traffic between on-premises datacenters and Azure Virtual Networks. Option D is not appropriate because Azure Virtual Network Peering connects virtual networks but does not by itself provide encrypted transit from on-premises datacenters to Azure.

Exam trap

CND often tests the assumption that ExpressRoute is encrypted by default, when it requires MACsec or IPsec configuration, and that VNet Peering provides encryption, which it does not.

Practice this question →
25
MCQmedium

A network security engineer is tasked with securing corporate Wi-Fi clients against Evil Twin attacks where an attacker sets up a fake access point with identical SSID parameters. Which enterprise wireless security practice effectively mitigates client association to fake APs?

A.Using MAC address cloning on the enterprise wireless controllers
B.Enabling 802.1X authentication with strict server certificate validation on clients
C.Deploying WPA2-Personal with a rotating pre-shared key
D.Disabling client roaming capabilities on enterprise controllers
AnswerB

802.1X with strict server certificate validation forces the client to verify the RADIUS server's certificate against a trusted CA before completing authentication. A rogue AP cannot present a valid certificate, so the supplicant aborts association, defeating the Evil Twin's identical SSID parameters.

Why this answer

802.1X with strict server certificate validation forces the client to verify the RADIUS server's certificate against a trusted CA before completing authentication. An Evil Twin AP cannot present a valid certificate for the legitimate authentication server, so the client refuses to associate, effectively neutralizing the attack.

Exam trap

CND often tests the misconception that WPA2-Personal with a strong or rotating PSK stops Evil Twin attacks — candidates must recognize that only mutual certificate-based authentication (802.1X with server validation) defeats a rogue AP.

How to eliminate wrong answers

Option A is wrong because MAC address cloning on controllers does not authenticate the AP to the client and is easily spoofed. Option C is wrong because WPA2-Personal with a rotating PSK still allows an attacker who captures the handshake or knows the PSK to stand up a rogue AP with the same SSID and PSK. Option D is wrong because disabling roaming does not prevent a client from associating to a nearby fake AP with matching SSID; it only affects handoff behavior between legitimate APs.

Practice this question →
26
Multi-Selectmedium

A network administrator is configuring a wireless intrusion prevention system (WIPS) to detect and mitigate rogue access points in an enterprise. The administrator needs to ensure that the WIPS can identify and classify access points that are not authorized. Which TWO techniques should the administrator enable? (Choose two.)

Select 2 answers
A.MAC address filtering
B.RF signature analysis
C.Rogue AP detection using authorized AP lists
D.Band steering
E.Client isolation
AnswersB, C

RF signature analysis involves monitoring the radio frequency characteristics of wireless devices to identify and classify access points. It can distinguish between authorized and unauthorized APs based on their RF fingerprints. This technique helps the WIPS detect rogue APs by comparing observed signatures against a baseline of known devices, making it a correct choice.

Why this answer

RF signature analysis and rogue AP detection using authorized AP lists are both techniques that enable a WIPS to identify unauthorized access points. RF signature analysis classifies devices based on radio frequency characteristics, while authorized AP lists provide a baseline for comparison. Together, they allow the WIPS to detect and mitigate rogue APs effectively.

The other options are client access control or performance features, not detection techniques.

Exam trap

The trap here is assuming that any wireless security feature helps with rogue AP detection, but MAC filtering, client isolation, and band steering are unrelated to identifying unauthorized APs.

Practice this question →
27
MCQmedium

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

A.Running regular traceroute commands from endpoints
B.Deploying a Wireless Intrusion Prevention System (WIPS) with triangulation
C.Enabling port security on enterprise access layer switches
D.Configuring static ARP entries on enterprise switches
AnswerB

A WIPS with triangulation continuously monitors the RF spectrum, flags unauthorised BSSIDs spoofing the corporate SSID, and uses signal-strength readings from multiple sensors to calculate the rogue AP's physical location. This directly satisfies the stem's requirement to both detect the rogue device and locate its physical source.

Why this answer

A WIPS with triangulation uses multiple sensors to measure signal strength (RSSI) from a detected rogue AP and calculates its physical location by comparing readings across sensors. This is the only listed technique that both detects the rogue AP and locates its physical source, which is required to remove it. WIPS also correlates BSSIDs, SSIDs, and behavior to distinguish true rogues from neighboring APs.

Exam trap

The trap is picking a wired-side control (port security, static ARP) for a wireless problem — CND tests whether candidates match the layer and medium of the control to the threat.

How to eliminate wrong answers

Option A is wrong because traceroute operates at Layer 3 and cannot identify or locate a wireless AP, which is a Layer 2 device. Option C is wrong because port security on wired switches blocks unauthorized MAC addresses on wired ports and has no visibility into wireless rogue APs. Option D is wrong because static ARP entries mitigate ARP spoofing on the wired LAN but do nothing to detect or locate a rogue wireless AP.

Practice this question →
28
MCQeasy

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

A.Identity-Aware Proxy (IAP)
B.Kubernetes Network Policies
C.Google Cloud Armor security policies
D.VPC Firewall Rules using subnet tags
AnswerB

Kubernetes Network Policies select pods by label and define ingress and egress rules between them, so traffic filtering works on identity rather than IP addresses. GKE enforces these policies through its network plugin, satisfying the label-based pod restriction requirement.

Why this answer

Kubernetes Network Policies are the native GKE feature that allows pod-level traffic control based on labels, namespaces, and ports. They operate at Layer 3/4 and are enforced by the CNI plugin (e.g., Calico on GKE), enabling fine-grained segmentation without relying on IP addresses. This directly meets the requirement to restrict traffic between pods using labels.

Exam trap

The trap here is confusing network-level security services (Cloud Armor, VPC firewall) with pod-level segmentation, and overlooking that Kubernetes Network Policies are the only native label-based mechanism for pod traffic control.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) is an application-level access control for HTTP(S) services, not for pod-to-pod network traffic. Option C is wrong because Google Cloud Armor provides DDoS protection and WAF at the edge for external HTTP(S) load balancers, not for internal pod communication. Option D is wrong because VPC Firewall Rules apply to VM instances and use network tags, not Kubernetes labels, and they operate at the subnet level, not pod level.

Practice this question →
29
Multi-Selecthard

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

Select 3 answers
A.Amazon VPC Security Groups acting as stateful virtual firewall instances
B.Amazon Route 53 Resolver DNS firewall for intra-subnet packet filtering
C.AWS Network Firewall for managed stateful inspection and intrusion prevention
D.Amazon VPC Network ACLs (NACLs) acting as stateless subnet-level firewalls
E.AWS Shield Standard for intra-VPC subnet routing
AnswersA, C, D

Amazon VPC Security Groups operate at the instance and ENI level, permitting or denying traffic through stateful rule evaluation — return traffic is automatically allowed regardless of inbound rules. This satisfies the stem's requirement for traffic filtering within the VPC, providing the stateful virtual firewall capability needed to enforce network isolation across multi-tier applications.

Why this answer

Option A is correct because Amazon VPC Security Groups are stateful virtual firewalls attached to ENIs/instances that enforce allow-only rules for inbound and outbound traffic, providing instance-level network isolation. Option C is correct because AWS Network Firewall is a managed, stateful network firewall and IPS service deployed in a VPC that filters traffic at the subnet/VPC perimeter with Suricata-compatible rules. Option D is correct because VPC Network ACLs are stateless subnet-level firewalls that evaluate allow/deny rules in order for both ingress and egress, adding a layer of traffic filtering around subnets.

Option B is incorrect because Route 53 Resolver DNS Firewall filters DNS queries (domain-name based) and does not perform intra-subnet packet filtering. Option E is incorrect because AWS Shield Standard is a DDoS protection service, not a mechanism for intra-VPC subnet routing or traffic filtering.

Exam trap

CND often tests the specific roles of AWS network security services, and candidates may confuse DNS firewall or Shield with packet filtering services.

Practice this question →
30
Multi-Selecthard

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

Select 3 answers
A.Relying on legacy WEP shared keys for guest network isolation
B.Configuring hidden SSIDs as the primary security defense
C.Implementing IEEE 802.11w (Protected Management Frames)
D.Deploying a Wireless Intrusion Prevention System (WIPS) sensor network
E.Enabling 802.1X authentication backed by a secure RADIUS / Enterprise PKI infrastructure
AnswersC, D, E

802.11w encrypts and integrity-protects management frames such as deauthentication and disassociation, preventing attackers from forging them to force client disconnections or capture handshakes. This satisfies the stem's requirement to counter wireless sniffing and rogue-device interference at the frame level.

Why this answer

Option C is correct because IEEE 802.11w Protected Management Frames cryptographically protects management frames such as deauthentication and disassociation, preventing wireless sniffing-based denial-of-service and spoofing attacks against the WLAN. Option D is correct because a WIPS sensor network continuously monitors the RF spectrum to detect and automatically contain rogue APs, evil twins, and unauthorized client devices, directly addressing the unauthorized-device requirement. Option E is correct because 802.1X with a secure RADIUS server and Enterprise PKI enforces certificate-based mutual authentication, ensuring only authorized devices and users can associate and preventing credential theft or rogue supplicant access.

Option A is not appropriate because WEP is cryptographically broken and provides no meaningful isolation or protection, and Option B is not appropriate because hidden SSIDs are trivially discovered by sniffers and offer no real security, so neither belongs in a hardened enterprise design.

Exam trap

CND often tests whether candidates treat hidden SSIDs and WEP as legitimate security controls, when both are ineffective — hidden SSIDs offer no protection and WEP is trivially broken.

Practice this question →
31
Multi-Selecthard

A network security engineer is designing a secure enterprise wireless network architecture to mitigate modern wireless attacks. Which THREE security configurations and protocols should be mandated? (Choose THREE)

Select 3 answers
A.Open authentication with MAC address filtering
B.WPA3-Enterprise with 192-bit cryptographic strength
C.Protected Management Frames (PMF / 802.11w)
D.WEP shared key authentication for legacy device compatibility
E.Wireless Intrusion Prevention System (WIPS) for rogue AP mitigation
AnswersB, C, E

WPA3-Enterprise with 192-bit mode enforces CNSA-grade cryptography, using GCMP-256 and SHA-384 to resist offline dictionary and downgrade attacks. This satisfies the scenario's mandate against modern wireless attacks, unlike WPA2-Enterprise, whose weaker ciphers and handshake remain exploitable.

Why this answer

Option B is correct because WPA3-Enterprise with 192-bit cryptographic strength (Suite-B, using GCMP-256, HMAC-SHA-384, and ECDHE) provides the strongest standardized wireless encryption and is mandated for high-security environments to defeat offline dictionary and downgrade attacks. Option C is correct because Protected Management Frames (PMF, defined in 802.11w) cryptographically protects deauthentication, disassociation, and action frames, preventing spoofing and deauth/disassoc denial-of-service attacks that plague WPA2 networks. Option E is correct because a Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, detects and automatically contains rogue APs, evil twins, and misconfigured clients, which is essential for mitigating modern wireless threats.

Option A is not appropriate because open authentication with MAC address filtering offers no real confidentiality or integrity, and MAC addresses are trivially spoofed. Option D is not appropriate because WEP shared key authentication is cryptographically broken (RC4 with weak IVs) and enables trivial key recovery, so it must never be mandated even for legacy compatibility.

Exam trap

CND often tests whether candidates still recommend WEP or MAC filtering as 'legacy compatibility' options — any answer that mandates deprecated crypto is wrong regardless of the compatibility justification.

Practice this question →
32
Multi-Selectmedium

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

Select 2 answers
A.Disabling Google Cloud Audit Logs to reduce storage overhead
B.Prohibiting the creation and download of user-managed service account keys where possible
C.Enforcing the principle of least privilege using predefined or custom IAM roles
D.Assigning broad primitive roles (Owner, Editor) to all project contributors
E.Sharing service account JSON keys publicly in public GitHub repositories for collaboration
AnswersB, C

Prohibiting user-managed service account keys removes long-lived credentials that, once downloaded, cannot be revoked centrally and are easily exfiltrated. This directly satisfies the stem's credential-theft constraint: short-lived tokens issued via workload identity federation or attached service accounts eliminate the static secrets attackers harvest for privilege escalation.

Why this answer

Option B is correct because user-managed service account keys are long-lived credentials that, once downloaded, can be exfiltrated and used to impersonate the service account; prohibiting their creation and download (and instead using short-lived credentials via Workload Identity Federation, service account impersonation, or attached service accounts) directly reduces credential theft risk. Option C is correct because enforcing least privilege with predefined or custom IAM roles limits each principal to only the permissions required, which prevents privilege escalation paths that arise when identities hold excessive permissions. Option A is wrong because disabling Cloud Audit Logs removes the audit trail needed to detect and investigate unauthorized privilege escalation or credential misuse, and it does not improve IAM hygiene.

Option D is wrong because assigning primitive roles like Owner or Editor grants broad, excessive permissions that violate least privilege and enable privilege escalation. Option E is wrong because publishing service account JSON keys publicly exposes credentials to anyone, directly enabling credential theft and unauthorized access.

Exam trap

CND often tests whether candidates recognize that primitive roles and downloadable service account keys are anti-patterns — the trap is choosing convenience-oriented options that actually expand the attack surface.

Practice this question →
33
MCQhard

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

A.Classic RADIUS authentication server on an Azure VM
B.Azure Network Security Groups with IP source restrictions
C.Azure Application Gateway with cookie-based affinity
D.Microsoft Entra Conditional Access policies combined with Azure VPN Gateway
AnswerD

Microsoft Entra Conditional Access evaluates user identity, device compliance state and sign-in location risk before granting access, and Azure VPN Gateway enforces that decision at the network tunnel. This satisfies the stem's requirement that all three signals be assessed prior to session establishment.

Why this answer

Microsoft Entra Conditional Access evaluates user identity, device compliance (via Intune), and sign-in risk (location, behavior) before granting access, which is the core of Zero Trust. Combined with Azure VPN Gateway, it enforces these policies for remote workers connecting to Azure-hosted virtual desktops. This integration provides the identity- and context-aware gate that ZTNA requires.

Exam trap

The trap is selecting network-layer controls (NSGs, RADIUS, load balancers) that cannot evaluate identity, device compliance, and location risk, which are the essence of Zero Trust.

How to eliminate wrong answers

Option A is wrong because a classic RADIUS server only performs authentication/authorization based on credentials and does not evaluate device compliance or location risk. Option B is wrong because NSGs are Layer 3/4 IP and port filters and cannot assess user identity or device posture. Option C is wrong because Application Gateway with cookie-based affinity is a load-balancing feature, not an identity or compliance evaluation mechanism.

Practice this question →
34
MCQeasy

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

A.Azure Bastion
B.Azure VPN Gateway with point-to-site configuration
C.Azure Load Balancer with TCP reset enabled
D.Azure Front Door with Web Application Firewall
AnswerA

Azure Bastion provides RDP and SSH connectivity through the Azure portal over TLS, so no public IP or inbound management port is exposed on the virtual machines. This directly satisfies the requirement to eliminate open RDP 3389 and SSH 22 ports from the public internet, unlike NSG rules or just-in-time access which still leave listening ports reachable.

Why this answer

Azure Bastion is a fully managed PaaS jump-host service that provides RDP and SSH access to VMs directly through the Azure portal over TLS (port 443), so RDP 3389 and SSH 22 never need to be exposed to the public internet. It is deployed into a dedicated subnet named AzureBastionSubnet inside the VM's VNet, and it brokers the session without requiring a public IP on the target VM. This directly satisfies the requirement of eliminating open management ports while still allowing administrative access.

Exam trap

The trap is assuming any secure connectivity option (VPN, WAF, Load Balancer) removes exposed management ports — only a purpose-built jump-host service like Azure Bastion actually eliminates the need for public RDP/SSH exposure.

How to eliminate wrong answers

Option B is wrong because a point-to-site VPN Gateway still requires the VM to have a reachable private IP and typically still leaves management ports listening — it solves network path security but not the elimination of exposed management ports on the VM itself, and it is not the purpose-built jump-host solution. Option C is wrong because a Load Balancer with TCP reset only affects connection handling for load-balanced traffic; it does not provide secure administrative access nor remove open RDP/SSH ports. Option D is wrong because Azure Front Door with WAF is an HTTP/HTTPS Layer 7 reverse proxy for web applications — it cannot broker RDP or SSH sessions and is irrelevant to VM management access.

Practice this question →
35
MCQhard

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

A.AWS Client VPN with split tunneling disabled
B.AWS PrivateLink with Interface VPC Endpoints
C.AWS Direct Connect Gateway with transit VIF
D.Inter-Region VPC Peering with restrictive Network Security Groups
AnswerB

Interface VPC Endpoints backed by PrivateLink expose only a specific service to consumer VPCs over private IP addresses, avoiding public internet exposure and full subnet access that VPC peering would grant. This satisfies the zero-trust least-privilege connectivity constraint.

Why this answer

AWS PrivateLink with Interface VPC Endpoints enables private connectivity between VPCs and AWS services without exposing traffic to the public internet or requiring VPC peering. It provides unidirectional, service-specific access, avoiding the full subnet exposure that peering entails. This aligns with zero-trust principles by limiting access to only the required service.

Exam trap

The trap is choosing VPC peering with restrictive security groups, but peering still exposes the full subnet range at the routing level—PrivateLink is the only option that provides service-level, private connectivity without full network exposure.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN is for remote user access, not service-to-service communication across VPCs, and split tunneling is unrelated to the requirement. Option C is wrong because Direct Connect Gateway with transit VIF provides dedicated network connectivity from on-premises to AWS, not inter-VPC service communication, and it does not inherently restrict subnet access. Option D is wrong because VPC peering opens full subnet-level access (though security groups can restrict), which violates the requirement to avoid full subnet exposure and does not provide the granular service-level isolation of PrivateLink.

Practice this question →
36
MCQeasy

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

A.Terminate the EC2 instance and restore from the latest snapshot
B.Modify the instance state to 'stopped' via AWS CLI
C.Delete the attached Elastic Network Interface (ENI)
D.Remove all current security groups and attach an isolation security group with deny-all rules
AnswerD

Replacing all security groups with a deny-all isolation group severs network connectivity while the instance keeps running, preserving volatile memory and disk state. Terminating or stopping the instance would destroy the forensic evidence needed for investigation.

Why this answer

To isolate a compromised EC2 instance for forensics without terminating it or losing volatile memory, the administrator should remove all existing security groups and attach an isolation security group with deny-all inbound and outbound rules. This cuts all network communication to and from the instance while keeping it running, preserving RAM contents, running processes, and network connection state for forensic analysis. The instance remains accessible only through out-of-band mechanisms like AWS Systems Manager Session Manager or by temporarily allowing a forensic workstation.

Exam trap

The trap is choosing stop or terminate as 'isolation' — both destroy volatile memory, which is the primary forensic evidence; only network-level isolation with a deny-all security group preserves the running state.

How to eliminate wrong answers

Option A is wrong because terminating the instance destroys volatile memory (RAM), running processes, and the instance's ephemeral state — the exact evidence needed for forensics is lost, and restoring from a snapshot only recovers disk data. Option B is wrong because stopping the instance also destroys volatile memory and resets the instance state; a stopped instance loses RAM contents and any in-memory malware artifacts. Option C is wrong because deleting the attached ENI detaches the network interface and can disrupt the instance's identity and networking in ways that complicate forensics; it does not cleanly isolate while preserving state, and it may prevent reattachment of the original interface.

Practice this question →
37
MCQhard

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?

A.WPA2-Enterprise with AES-CCMP and TKIP fallback
B.Enhanced Open (OWE) with opportunistic encryption
C.WPA3-Enterprise 192-bit mode (Suite B compliance)
D.WPA3-Personal with SAE and transition mode enabled
AnswerC

WPA3-Enterprise 192-bit mode enforces Suite B cryptographic suites, mandating 384-bit elliptic curve key derivation and GCMP-256, which blocks downgrade attacks that weaker transitional modes permit. This satisfies the stem's requirement for maximum cryptographic strength and downgrade resistance.

Why this answer

WPA3-Enterprise 192-bit mode (Suite B compliance) enforces AES-256-GCM, SHA-384, and ECDHE/ECDSA with 384-bit curves, providing the strongest cryptographic suite and resistance to downgrade attacks. It is the mode required for government and high-security enterprise deployments.

Exam trap

CND often tests the difference between WPA3-Personal (SAE) and WPA3-Enterprise (192-bit Suite B), and candidates mistakenly pick WPA3-Personal with transition mode thinking it provides enterprise-grade strength.

How to eliminate wrong answers

Option A is wrong because WPA2-Enterprise with TKIP fallback is deprecated and vulnerable — TKIP has known weaknesses, and allowing fallback enables downgrade attacks. Option B is wrong because Enhanced Open (OWE) is for open/public networks and provides opportunistic encryption without authentication, not enterprise-grade cryptographic strength. Option D is wrong because WPA3-Personal with SAE and transition mode is for personal (pre-shared key) networks, and transition mode actually enables WPA2 fallback, which reintroduces downgrade risk.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Enterprise Cloud Virtual And Wireless Network Protection questions.

Start 20-question session