Scenario practice questions

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

Trap 1: Passive monitoring connected exclusively to a network switch SPAN…

A SPAN port or TAP delivers copies of traffic passively, so the device can only detect and alert; it cannot drop or block packets inline. Passive monitoring fits an IDS deployment, whereas a NIPS must sit inline in the traffic path to prevent intrusions.

Trap 2: Operating purely as a Layer 2 bridge without inspecting any…

A pure Layer 2 bridge that inspects no network-layer or transport-layer headers cannot match signatures or enforce policy, so it cannot detect or block attacks. Bridging without inspection describes a transparent forwarding device, not a NIPS, which must parse headers to identify and prevent intrusions.

Trap 3: Generating syslog alerts for administrative review without…

Syslog alerting without affecting packet delivery describes passive, out-of-band detection, which is IDS behaviour; a NIPS must sit inline and actively drop or reset malicious traffic. Alert-only monitoring suits environments where blocking risks availability, not prevention.

A
Inline placement directly in the path of network traffic flow to allow active packet dropping.
Inline placement lets the NIPS inspect every packet in real time and drop malicious traffic before it reaches the target, satisfying the requirement for active prevention rather than passive detection. Out-of-band, SPAN-based tools can only alert or reset after the fact, so they cannot block packets directly.
B
Passive monitoring connected exclusively to a network switch SPAN port or test access point (TAP).
Why it fails: A SPAN port or TAP delivers copies of traffic passively, so the device can only detect and alert; it cannot drop or block packets inline. Passive monitoring fits an IDS deployment, whereas a NIPS must sit inline in the traffic path to prevent intrusions.
C
Operating purely as a Layer 2 bridge without inspecting any network-layer or transport-layer headers.
Why it fails: A pure Layer 2 bridge that inspects no network-layer or transport-layer headers cannot match signatures or enforce policy, so it cannot detect or block attacks. Bridging without inspection describes a transparent forwarding device, not a NIPS, which must parse headers to identify and prevent intrusions.
D
Generating syslog alerts for administrative review without affecting the delivery of network traffic packets.
Why it fails: Syslog alerting without affecting packet delivery describes passive, out-of-band detection, which is IDS behaviour; a NIPS must sit inline and actively drop or reset malicious traffic. Alert-only monitoring suits environments where blocking risks availability, not prevention.
E
The ability to reset active TCP connections using TCP reset (RST) injections when malicious payloads are detected.
TCP reset injection lets a NIPS terminate an in-progress session by forging RST packets to both endpoints once a malicious payload signature fires, satisfying the requirement for active, inline prevention rather than passive detection. This enforcement capability distinguishes NIPS from IDS, which can only alert on observed traffic.

Question 2easymultiple choice

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

Trap 1: Heuristic detection

Snort matched a literal signature string, which is signature or pattern-based detection, not heuristic analysis of behavioural anomalies. Heuristic detection is tempting because it also identifies attacks, but it flags deviations from normal behaviour rather than known payload patterns.

Trap 2: Behavioral analytics detection

The alert came from a static rule matching a known SQL injection string, which is signature-based detection; behavioural analytics instead models user or entity activity over time to flag deviations. Behavioural analytics would be the right choice for spotting compromised credentials or unusual data access patterns, not literal payload matching.

Trap 3: Anomaly-based detection

Snort matched a literal byte pattern from its rule set, which is signature-based detection; anomaly-based detection instead baselines normal traffic and flags statistical deviations. Anomaly-based engines would suit detecting novel SQL injection variants with no known signature, but they cannot explain a specific 'SELECT * FROM users WHERE' string match.

A
Heuristic detection
Why it fails: Snort matched a literal signature string, which is signature or pattern-based detection, not heuristic analysis of behavioural anomalies. Heuristic detection is tempting because it also identifies attacks, but it flags deviations from normal behaviour rather than known payload patterns.
B
Behavioral analytics detection
Why it fails: The alert came from a static rule matching a known SQL injection string, which is signature-based detection; behavioural analytics instead models user or entity activity over time to flag deviations. Behavioural analytics would be the right choice for spotting compromised credentials or unusual data access patterns, not literal payload matching.
C
Signature-based detection
Snort compares packet payloads against a database of known attack patterns. The alert fired because the traffic matched a stored signature for the 'SELECT * FROM users WHERE' SQL injection string, so detection relies on predefined signatures rather than anomaly or behaviour baselines.
D
Anomaly-based detection
Why it fails: Snort matched a literal byte pattern from its rule set, which is signature-based detection; anomaly-based detection instead baselines normal traffic and flags statistical deviations. Anomaly-based engines would suit detecting novel SQL injection variants with no known signature, but they cannot explain a specific 'SELECT * FROM users WHERE' string match.

Question 3easymultiple choice

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

Trap 1: Contain the compromised host to prevent lateral movement

Containment limits spread and preserves evidence, but it follows detection and analysis in NIST SP 800-61. The first phase is preparation, then detection and analysis; the failed logins and root login must be analysed first. Containment suits confirmed, scoped incidents, not initial triage.

Trap 2: Perform post-incident lessons learned activities

Post-incident lessons learned closes the lifecycle, capturing improvements after recovery. NIST SP 800-61 sequences it last, after detection and analysis, containment, eradication and recovery. It fits mature incidents already resolved, not the first action on a suspected SSH compromise.

Trap 3: Eradicate the malware from the impacted SSH server

Eradication removes malware and closes the attack vector, which occurs after detection and containment. NIST SP 800-61 orders preparation, detection and analysis, containment, eradication, recovery, then post-incident activity. Eradication fits once the intrusion is scoped and isolated, not as the opening phase.

A
Analyze the log files to verify if an unauthorized breach has occurred
NIST SP 800-61 begins with preparation, but once an event is detected the first active phase is analysis and validation. Examining the SSH logs confirms whether the failed attempts and root login constitute a genuine breach before containment.
B
Contain the compromised host to prevent lateral movement
Why it fails: Containment limits spread and preserves evidence, but it follows detection and analysis in NIST SP 800-61. The first phase is preparation, then detection and analysis; the failed logins and root login must be analysed first. Containment suits confirmed, scoped incidents, not initial triage.
C
Perform post-incident lessons learned activities
Why it fails: Post-incident lessons learned closes the lifecycle, capturing improvements after recovery. NIST SP 800-61 sequences it last, after detection and analysis, containment, eradication and recovery. It fits mature incidents already resolved, not the first action on a suspected SSH compromise.
D
Eradicate the malware from the impacted SSH server
Why it fails: Eradication removes malware and closes the attack vector, which occurs after detection and containment. NIST SP 800-61 orders preparation, detection and analysis, containment, eradication, recovery, then post-incident activity. Eradication fits once the intrusion is scoped and isolated, not as the opening phase.

Question 4hardmultiple choice

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

Trap 1: Configuration Management Baseline Drift

Baseline drift means a system's settings have diverged from an approved hardened configuration, which may include log settings, but the finding is a retention duration shortfall, not a configuration deviation. Baseline management would be correct when comparing deployed settings against a defined standard.

Trap 2: Network Redundancy Fault Tolerance Failure

Redundancy and fault tolerance address availability of systems and data during component failure, not the retention period of audit records. It is tempting because disk exhaustion caused the purge, but the failed control is log retention, not resilience engineering.

Trap 3: Access Control Discretionary Discrepancy

Discretionary access control concerns who may read or modify resources based on owner-assigned permissions, not how long logs persist. It is tempting because logs are data subject to access rules, yet the audit found a retention shortfall, so permissions are irrelevant here.

A
Configuration Management Baseline Drift
Why it fails: Baseline drift means a system's settings have diverged from an approved hardened configuration, which may include log settings, but the finding is a retention duration shortfall, not a configuration deviation. Baseline management would be correct when comparing deployed settings against a defined standard.
B
Audit and Accountability Retention Policy Violation
Purging logs after 7 days breaches the retention control within the audit and accountability family, which mandates preserving security audit records for defined periods. The 365-day compliance requirement is unmet, so the failure is specifically a retention policy violation.
C
Network Redundancy Fault Tolerance Failure
Why it fails: Redundancy and fault tolerance address availability of systems and data during component failure, not the retention period of audit records. It is tempting because disk exhaustion caused the purge, but the failed control is log retention, not resilience engineering.
D
Access Control Discretionary Discrepancy
Why it fails: Discretionary access control concerns who may read or modify resources based on owner-assigned permissions, not how long logs persist. It is tempting because logs are data subject to access rules, yet the audit found a retention shortfall, so permissions are irrelevant here.

Question 5mediummultiple choice

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

Trap 1: Operational threat intelligence

Operational intelligence concerns specific impending campaigns and their timing, not the broader histories and motivations described. It tempts because it sits between tactical and strategic levels and does address adversary activity, but the stem's emphasis on long-term intent and TTPs aligns with strategic intelligence instead.

Trap 2: Tactical threat intelligence

Tactical intelligence describes specific adversary methodologies and tools used in attacks, not campaign histories or motivations. It tempts because TTPs appear in the stem and tactical feeds do document them, yet the accompanying strategic context of intent and campaign narrative exceeds tactical scope.

Trap 3: Technical threat intelligence

Technical intelligence covers indicators such as IP addresses, hashes and domains, not campaign histories or adversary motivations. It tempts because TTPs are often loosely grouped with technical feeds, but the stem's strategic context of intent and campaigns sits above indicator-level data, so technical feeds cannot supply it.

A
Strategic threat intelligence
Strategic threat intelligence addresses adversary motivations, campaign histories and long-term intent at a high level for executive decision-making. This matches the stem's provision of detailed campaign histories and adversary motivations, distinguishing it from tactical or operational intelligence.
B
Operational threat intelligence
Why it fails: Operational intelligence concerns specific impending campaigns and their timing, not the broader histories and motivations described. It tempts because it sits between tactical and strategic levels and does address adversary activity, but the stem's emphasis on long-term intent and TTPs aligns with strategic intelligence instead.
C
Tactical threat intelligence
Why it fails: Tactical intelligence describes specific adversary methodologies and tools used in attacks, not campaign histories or motivations. It tempts because TTPs appear in the stem and tactical feeds do document them, yet the accompanying strategic context of intent and campaign narrative exceeds tactical scope.
D
Technical threat intelligence
Why it fails: Technical intelligence covers indicators such as IP addresses, hashes and domains, not campaign histories or adversary motivations. It tempts because TTPs are often loosely grouped with technical feeds, but the stem's strategic context of intent and campaigns sits above indicator-level data, so technical feeds cannot supply it.

Read the full wireless explanation →

Question 6easymultiple choice

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

Trap 1: Migrate the enterprise wireless network from WPA2-Personal to…

WPA3-Enterprise strengthens authentication and encryption for clients joining legitimate APs; it does nothing to detect or contain a rogue AP already broadcasting the corporate SSID. It is the right upgrade when hardening credential protection against offline dictionary attacks, not for locating and mitigating an evil twin.

Trap 2: Disable SSID broadcasting (hidden SSID) across all corporate…

Hiding the SSID removes it from beacon frames but the evil twin still broadcasts it, and clients that probe for it remain exposed. Hidden SSIDs are a weak obscurity measure for reducing casual discovery, not containment. Rogue detection and containment on the WLC is what actually locates and disables the unauthorised radio.

Trap 3: Configure MAC filtering to allow only corporate-approved wireless…

MAC filtering only governs which client hardware addresses may associate; it cannot detect or contain a rogue AP broadcasting the corporate SSID. It is used to restrict client admission on trusted networks, not to locate and mitigate unauthorised radios, which requires rogue AP detection and containment on the WLC.

A
Enable Rogue AP Detection and Automated Containment on the Wireless LAN Controller (WLC).
Rogue AP Detection with Automated Containment lets the WLC classify access points by comparing their wired MAC addresses against the known authorised list, then issue 802.11 deauthentication frames to clients associated with the offending BSSID. This directly satisfies the stem's requirement to automatically detect and contain the evil twin without manual intervention.
B
Migrate the enterprise wireless network from WPA2-Personal to WPA3-Enterprise (SAE).
Why it fails: WPA3-Enterprise strengthens authentication and encryption for clients joining legitimate APs; it does nothing to detect or contain a rogue AP already broadcasting the corporate SSID. It is the right upgrade when hardening credential protection against offline dictionary attacks, not for locating and mitigating an evil twin.
C
Disable SSID broadcasting (hidden SSID) across all corporate wireless access points.
Why it fails: Hiding the SSID removes it from beacon frames but the evil twin still broadcasts it, and clients that probe for it remain exposed. Hidden SSIDs are a weak obscurity measure for reducing casual discovery, not containment. Rogue detection and containment on the WLC is what actually locates and disables the unauthorised radio.
D
Configure MAC filtering to allow only corporate-approved wireless client hardware addresses.
Why it fails: MAC filtering only governs which client hardware addresses may associate; it cannot detect or contain a rogue AP broadcasting the corporate SSID. It is used to restrict client admission on trusted networks, not to locate and mitigate unauthorised radios, which requires rogue AP detection and containment on the WLC.

Question 7hardmulti select

A CND engineer is implementing continuous network defense monitoring for a demilitarized zone that hosts public web servers. The team wants to detect both network-level and host-level anomalies in near real time. Which TWO technologies should be deployed to meet this requirement? (Choose two.)

Trap 1: A vulnerability scanner scheduled to run weekly against the DMZ

A weekly vulnerability scan identifies known weaknesses in configuration and patching, but it is periodic and cannot detect active intrusions or anomalous behavior in near real time. It complements continuous monitoring by tracking exposure, yet it does not satisfy the detection requirement described in the scenario.

Trap 2: A syslog server that only stores device logs for later review

Centralized log storage supports forensics and compliance, but passive collection without correlation or alerting does not provide near real time detection of network or host anomalies. It is a supporting component for investigation, not a detection technology that meets the stated monitoring objective by itself.

Trap 3: A firewall rule set that blocks all inbound traffic except TCP 443

Restricting inbound traffic to HTTPS is a sound hardening measure, but a firewall policy is a preventive control, not a detection technology. It does not generate alerts about anomalous network or host behavior, and it cannot identify an attacker operating over the permitted port, so it fails to meet the monitoring requirement.

A
A vulnerability scanner scheduled to run weekly against the DMZ
Why it fails: A weekly vulnerability scan identifies known weaknesses in configuration and patching, but it is periodic and cannot detect active intrusions or anomalous behavior in near real time. It complements continuous monitoring by tracking exposure, yet it does not satisfy the detection requirement described in the scenario.
B
Host-based intrusion detection system agents installed on each web server
Host-based agents monitor file integrity, process behavior, and system logs on the servers themselves, catching activity that never crosses the network in a detectable form, such as local privilege escalation or web shell execution. This supplies the host-level anomaly detection the scenario explicitly requires alongside network visibility.
C
Network-based intrusion detection system sensors placed on a SPAN port
A network-based intrusion detection system on a SPAN port inspects copies of traffic crossing the DMZ segment and can alert on exploits, scanning, and command-and-control patterns in near real time. It provides the network-level visibility the scenario requires without inline disruption, making it a correct choice for detecting anomalies targeting the public web servers.
D
A syslog server that only stores device logs for later review
Why it fails: Centralized log storage supports forensics and compliance, but passive collection without correlation or alerting does not provide near real time detection of network or host anomalies. It is a supporting component for investigation, not a detection technology that meets the stated monitoring objective by itself.
E
A firewall rule set that blocks all inbound traffic except TCP 443
Why it fails: Restricting inbound traffic to HTTPS is a sound hardening measure, but a firewall policy is a preventive control, not a detection technology. It does not generate alerts about anomalous network or host behavior, and it cannot identify an attacker operating over the permitted port, so it fails to meet the monitoring requirement.

Read the full DNS explanation →

Question 8mediummultiple choice

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

Trap 1: DNS queries using TCP instead of UDP for large responses

While DNS tunneling may use TCP for large data transfers, TCP usage alone is not a strong indicator because legitimate DNS can use TCP for large responses or DNSSEC. The scenario focuses on anomalous patterns in queries, and TCP usage is not specific enough to detect tunneling effectively. It could be part of a broader analysis but is not the most effective standalone indicator.

Trap 2: Frequent DNS zone transfers (AXFR) from internal to external servers

Zone transfers are typically used for replicating DNS databases between authoritative servers and are not a common exfiltration method. They would be blocked or monitored, but the scenario describes data exfiltration via queries, not zone transfers. This indicator is less relevant and would likely generate false positives for legitimate zone transfers.

Trap 3: Repeated DNS queries for the same domain with identical transaction…

Transaction IDs are randomized and not typically repeated; identical IDs might indicate spoofing or cache poisoning, not tunneling. DNS tunneling often involves many unique queries with varying IDs. This indicator is not characteristic of tunneling and would not reliably detect the described exfiltration method.

A
DNS queries using TCP instead of UDP for large responses
Why it fails: While DNS tunneling may use TCP for large data transfers, TCP usage alone is not a strong indicator because legitimate DNS can use TCP for large responses or DNSSEC. The scenario focuses on anomalous patterns in queries, and TCP usage is not specific enough to detect tunneling effectively. It could be part of a broader analysis but is not the most effective standalone indicator.
B
Frequent DNS zone transfers (AXFR) from internal to external servers
Why it fails: Zone transfers are typically used for replicating DNS databases between authoritative servers and are not a common exfiltration method. They would be blocked or monitored, but the scenario describes data exfiltration via queries, not zone transfers. This indicator is less relevant and would likely generate false positives for legitimate zone transfers.
C
Repeated DNS queries for the same domain with identical transaction IDs
Why it fails: Transaction IDs are randomized and not typically repeated; identical IDs might indicate spoofing or cache poisoning, not tunneling. DNS tunneling often involves many unique queries with varying IDs. This indicator is not characteristic of tunneling and would not reliably detect the described exfiltration method.
D
High volume of DNS queries with long subdomain labels and high entropy
DNS tunneling encodes data in subdomains, producing queries with unusually long labels (often exceeding 50 characters) and high entropy due to base64 or hex encoding. Monitoring for these patterns, along with query volume to a single domain, is a reliable detection method. This directly addresses the scenario where data is exfiltrated via DNS.