EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 1–75

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

An organization is updating its incident response policy based on NIST SP 800-61. Which TWO phases are part of the post-incident activity stage? (Choose TWO)

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

An enterprise is hardening its enterprise wireless network and migrating legacy authentication protocols. To protect against offline dictionary attacks and provide forward secrecy during the 4-way handshake, which Wi-Fi standard must be deployed?

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)

A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?