How many Troubleshooting Scenario Questions questions are on this page?

This page has 5 Troubleshooting Scenario Questions scenario questions for the CND exam, each with detailed explanations and wrong-answer analysis.

How should I approach CND scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CND

exam code

EC-Council

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

A
aa-complain /usr/sbin/daemon
aa-complain places the specified program's AppArmor profile into complain mode immediately.
B
aa-enforce -r /etc/apparmor.d/usr.sbin.daemon
Why wrong: aa-enforce is used to set profiles to enforcing mode, not complain mode.
C
systemctl set-mode apparmor=complain
Why wrong: systemctl does not take an apparmor mode argument; AppArmor is managed via its own utilities.
D
apparmor_parser -C /etc/apparmor.d/usr.sbin.daemon
Why wrong: The apparmor_parser command with -C checks policy syntax rather than dynamically changing the running profile mode for a single application.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

A
SSL/TLS Decryption (Inspection)
Decryption allows the firewall to analyze encrypted payloads for malware and policy violations.
B
Layer 2 Bridging
Why wrong: Bridging operates at the data link layer without decrypting application payloads.
C
Port Forwarding
Why wrong: Port forwarding maps external ports to internal ports but does not decrypt payloads.
D
Static NAT
Why wrong: Static NAT translates IP addresses.

Full breakdown with real-world context →

Question 3hardmulti select

Full question →

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

A
Traceroute / ping utilities to test end-to-end path connectivity and TTL expiration
Traceroute identifies routing path failures and hop responses.
B
Network packet analyzers (e.g., tcpdump or Wireshark) capturing traffic on firewall interfaces
Capturing traffic verifies whether packets are arriving and what responses are sent.
C
Firewall packet flow tracing / debug packet tools (e.g., Cisco ASA packet-tracer or Palo Alto global packet diagnostic)
Built-in packet flow debuggers simulate packet paths and show exactly which rule dropped the packet.
D
Reformatting the firewall hard drive and reinstalling the BIOS firmware
Why wrong: Reformatting is a drastic, unnecessary troubleshooting step.
E
Disconnecting all internal switch uplinks permanently
Why wrong: Disconnecting uplinks isolates the network rather than diagnosing drops.

Full breakdown with real-world context →

Question 4hardmulti select

Full question →

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

A
Memory regions containing executable code that do not back to any file on disk (unbacked memory)
Injected code often resides in memory without a corresponding file path on disk.
B
Standard file creation timestamps in the $MFT
Why wrong: Standard file timestamps reflect static disk presence rather than runtime memory injection behavior.
C
Default Windows system wallpaper configuration settings
Why wrong: Wallpaper settings are unrelated to process execution or memory injection.
D
Thread start addresses pointing outside of the expected module image bounds
Remote thread injection often causes thread start addresses to point to foreign memory allocations.
E
Memory regions with PAGE_EXECUTE_READWRITE (RWX) permissions allocated in non-system processes
RWX memory regions are frequently used by injected code to write and execute payloads.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full VPN explanation →

A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?

A
Security Association Database (SAD)
Why wrong: The SAD stores the parameters of security associations, but it is a database of states rather than the transport protocol component itself.
B
Authentication Header (AH)
Why wrong: AH provides integrity and authentication for IP packets, but it does not provide encryption, which matches the decryption failure symptom.
C
Internet Key Exchange (IKE)
Why wrong: IKE is used for setting up a security association (SA) between two parties; it is not the protocol that handles data packet decryption during ongoing transmission.
D
Encapsulating Security Payload (ESP)
ESP provides integrity, authentication, and encryption services for IPsec, and its cryptographic parameters must match on both peers to avoid decryption failures.

Full breakdown with real-world context →

These CND practice questions are part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style CND questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related CND topic practice pages

Endpoint Protection practice questions

Enterprise Cloud Virtual And Wireless Network Protection practice questions

Network Security Controls Protocols And Devices practice questions

Incident Detection Response And Threat Prediction practice questions

Network Attacks And Defense Strategies practice questions

Network Defense Management practice questions

Application And Data Protection practice questions

Network Perimeter Protection practice questions

CND fundamentals practice questions

CND scenario practice questions

CND troubleshooting practice questions

Practice scenarios

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)