EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) (CND) — Questions 151–225

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

An internal security assessment reveals that an attacker with access to a low-privilege domain user account can enumerate Active Directory group memberships and trust relationships using LDAP. To secure Active Directory against anonymous and excessive unauthenticated enumeration, which specific Active Directory feature and setting should be configured?

A security engineer is performing threat hunting on Linux servers to detect hidden rootkits modifying system call tables. Which tool is specifically designed to check for Linux kernel module tampering and hidden processes by comparing user-space output with kernel-space data structures?

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

An administrator is deploying a Snort 3 Intrusion Detection System on an enterprise gateway segment. To detect a specific exploit payload containing the exact ASCII string \x41\x41\x41\x41 without relying on preprocessors, which rule option should be implemented?

An enterprise cloud architect is configuring Google Cloud VPC Network Service Tiers to optimize cost and security for sensitive internal database traffic. Which service tier should be selected to ensure traffic stays entirely within Google's private global backbone network without touching the public internet?

A security engineer is configuring mobile device management (MDM) for corporate-owned iOS devices. To prevent users from installing unauthorized apps while still allowing access to enterprise applications, which feature should be deployed?

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

An organization is hardening its wireless network infrastructure to prevent unauthorized client association and eavesdropping. Which TWO wireless security mechanisms should be enforced according to modern enterprise standards? (Choose two)

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

An organization experiences a data breach involving personal identifiable information (PII). Regulatory compliance mandates notifying authorities within 72 hours. Which phase of the incident response process includes fulfilling external reporting and stakeholder communication requirements?

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?

During a network security audit, the auditor requests evidence that the principle of least privilege is enforced for administrative access to core network infrastructure routers. Which artifact should the network administrator provide to demonstrate compliance?

An enterprise cloud security architect is hardening an AWS environment to protect against unauthorized data exfiltration from S3 buckets. Which TWO preventative security measures should be implemented? (Choose TWO)

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

An organization is drafting a password policy. To balance security with user usability, which requirement represents modern industry best practices aligned with NIST SP 800-63B guidelines?

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

An enterprise threat intelligence team is consuming a new threat feed formatted in STIX 2.1 to ingest indicators of compromise (IoCs) into their TIP (Threat Intelligence Platform). Which core STIX 2.1 domain object is specifically designed to encapsulate observable data such as file hashes, IP addresses, and domain names?

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?

An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

A network engineer is configuring IPsec site-to-site VPN policies. During Phase 2 negotiations, which TWO parameters must match identically on both VPN peers for the security association (SA) to establish successfully? (Choose two)

A security analyst is investigating a compromised network segment and discovers that an attacker bypassed network perimeter access controls by tunneling malicious command-and-control traffic through allowed protocols. Which THREE protocols are most commonly abused for covert data exfiltration and tunneling through corporate firewalls? (Choose three)

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

A network security engineer is tasked with securing corporate Wi-Fi clients against Evil Twin attacks where an attacker sets up a fake access point with identical SSID parameters. Which enterprise wireless security practice effectively mitigates client association to fake APs?

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

A security architect is designing a Zero Trust Network Access (ZTNA) solution to replace a legacy remote access VPN. Unlike traditional VPNs that grant network-level access upon initial authentication, how does a true service-initiated ZTNA architecture handle application access for a remote user?

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

An administrator is troubleshooting a Linux endpoint running Ubuntu where AppArmor is operating in enforcing mode, but a critical daemon keeps failing to write to its log file. Which command should the administrator run to temporarily switch the profile for this specific daemon to complain mode without affecting the rest of the system?

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?