Courseiva

CND · topic practice

Network Attacks And Defense Strategies practice questions

This domain covers how attackers exploit networks and how defenders counter them, spanning web application attacks, credential theft, cloud misconfiguration, and lateral movement. Questions present a scenario and ask you to select the correct defensive control, mitigation, or configuration, so you must map each attack technique to a specific defensive technology or hardening step.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Network Attacks And Defense Strategies
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Network Attacks And Defense Strategies

You must be able to read an attack scenario and choose the precise defensive control that stops it, such as HttpOnly cookies for XSS, a WAF for SQLi, CSPM for public buckets, and Credential Guard for pass-the-hash. Matching the control to the exact attack is the key skill.

Selecting WAF, CSPM, or host hardening controls that match a described attack technique

Applying cookie attributes Secure, HttpOnly, and SameSite to defeat XSS session theft

Understanding NTLM pass-the-hash mitigations such as Credential Guard and disabling NTLM

Using parameterized queries and input validation to block union-based SQL injection

Watch out for

Common Network Attacks And Defense Strategies exam traps

  • ▸Confusing preventive controls with detective controls, such as picking an IDS when the scenario asks for something that blocks the attack
  • ▸Assuming TLS or HTTPS alone stops XSS cookie theft, when HttpOnly and Secure attributes are the actual fix
  • ▸Treating cloud storage exposure as a network firewall issue instead of a bucket policy and CSPM misconfiguration problem

Practice set

Network Attacks And Defense Strategies questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Study the full AAA explanation →

An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?

Question 2easymultiple choice
Read the full Network Attacks And Defense Strategies explanation →

A network administrator observes continuous SYN flooding targeting a primary public-facing web server on a Cisco ASA 5500-X firewall. To mitigate this attack without disrupting legitimate traffic, which specific feature should the administrator enable globally via the command-line interface?

Question 3hardmultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?

Question 4mediummultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?

Question 5easymultiple choice
Read the full wireless explanation →

An enterprise wireless network uses WPA2-Enterprise for authentication. A security administrator wants to upgrade the security posture to protect against offline dictionary attacks on handshakes and provide enhanced cryptographic cipher suites. Which standard should be implemented?

Question 6hardmultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An internal security assessment reveals that an attacker with access to a low-privilege domain user account can enumerate Active Directory group memberships and trust relationships using LDAP. To secure Active Directory against anonymous and excessive unauthenticated enumeration, which specific Active Directory feature and setting should be configured?

Question 7hardmulti select
Read the full Network Attacks And Defense Strategies explanation →

An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)

Question 8mediummultiple choice
Read the full Network Attacks And Defense Strategies explanation →

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

Question 9easymultiple choice
Read the full wireless explanation →

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

Question 10mediummultiple choice
Read the full DNS explanation →

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Question 11hardmultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

Question 12easymultiple choice
Review the full subnetting walkthrough →

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

Question 13mediummultiple choice
Read the full DNS explanation →

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

Question 14easymultiple choice
Read the full Network Attacks And Defense Strategies explanation →

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

Question 15mediummultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

Question 16hardmultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

Question 17hardmultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

Question 18easymultiple choice
Read the full Network Attacks And Defense Strategies explanation →

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

Question 19easymultiple choice
Read the full Network Attacks And Defense Strategies explanation →

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

Question 20mediummultiple choice
Read the full Network Attacks And Defense Strategies explanation →

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Network Attacks And Defense Strategies sessions

Start a Network Attacks And Defense Strategies only practice session

Every question in these sessions is drawn from the Network Attacks And Defense Strategies domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Network Attacks And Defense Strategies questions →Mixed CND session

Related practice questions

Related CND topic practice pages

Move into related areas when this topic feels solid.

Enterprise Cloud Virtual And Wireless Network Protection practice questions

Sharpen your CND knowledge of Enterprise Cloud Virtual And Wireless Network Protection.

Network Security Controls Protocols And Devices practice questions

Sharpen your CND knowledge of Network Security Controls Protocols And Devices.

Network Defense Management practice questions

Network Defense Management practice questions for CND.

Incident Detection Response And Threat Prediction practice questions

Sharpen your CND knowledge of Incident Detection Response And Threat Prediction.

Network Attacks And Defense Strategies practice questions

Network Attacks And Defense Strategies practice questions for CND.

Application And Data Protection practice questions

Practise CND questions linked to Application And Data Protection.

Endpoint Protection practice questions

Targeted CND practice covering Endpoint Protection.

Network Perimeter Protection practice questions

Work through CND questions on Network Perimeter Protection.

CND fundamentals practice questions

CND fundamentals practice questions for CND.

CND scenario practice questions

Work through CND questions on CND scenario.

CND troubleshooting practice questions

Targeted CND practice covering CND troubleshooting.

Frequently asked questions

What does the CND exam test about Network Attacks And Defense Strategies?
You must be able to read an attack scenario and choose the precise defensive control that stops it, such as HttpOnly cookies for XSS, a WAF for SQLi, CSPM for public buckets, and Credential Guard for pass-the-hash. Matching the control to the exact attack is the key skill.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Network Attacks And Defense Strategies questions in a focused session?
Yes — the session launcher on this page draws every question from the Network Attacks And Defense Strategies domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CND topics?
Use the topic links above to move to related areas, or go back to the CND question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the CND exam covers. They are not copied from any real exam or dump site.