CND

A sudden flood of TCP SYN packets is exhausting a public web server's connection table. Which attack is MOST likely occurring?

• ASYN flood
• BDNS cache poisoning
• CARP spoofing
• DSQL injection

Which statement BEST describes defense in depth?

• AUsing one perimeter firewall as the primary security control
• BApplying multiple layered controls so that one failure does not expose the entire environ…
• CEncrypting every packet on the network with the same shared key
• DBlocking all outbound traffic from user workstations

An attacker sends a targeted email to a finance employee with a fake invoice link that leads to a credential-harvesting site. Which attack category BEST fits this scenario?

• ASpear phishing
• BWardriving
• CBluejacking
• DDNS tunneling

A workstation becomes infected after a user opens a malicious attachment, and the malware encrypts local files before attempting lateral movement. How should this attack be classified MOST accurately?

• APhysical attack
• BHost-level attack
• CWireless-only attack
• DRouting attack

A customer portal is vulnerable because user input is inserted directly into a backend query without proper validation. Which attack type is MOST likely?

• APass-the-hash
• BSQL injection
• CMAC flooding
• DSmurf attack

A company discovers that an internet-facing object storage bucket was left public and contains sensitive files. Which category BEST describes the exposure?

• ACloud-specific attack surface
• BOn-premises switch attack
• CBluetooth exploit
• DHost BIOS compromise

Employees are connecting to a rogue wireless network that impersonates the company SSID in the parking lot. Which attack is this?

• AEvil twin attack
• BWatering-hole attack
• CRogue DHCP failover
• DSMB relay

A trusted vendor's signed software update is compromised upstream and delivers malware to customers. Which type of attack does this BEST illustrate?

• AMan-in-the-browser attack
• BSupply chain attack
• CSmishing attack
• DTeardrop attack

Which action BEST reflects an adaptive security strategy rather than a static annual review model?

• AKeeping firewall rules unchanged until the next budget cycle
• BUpdating detections and controls continuously based on telemetry, incidents, and threat c…
• CRetiring all legacy systems before implementing monitoring
• DRequiring every user to have local administrator rights for flexibility

Why do defenders commonly map observed activity to frameworks such as MITRE ATT&CK?

• ATo replace incident response documentation entirely
• BTo identify coverage gaps across attacker tactics and techniques and improve detections
• CTo encrypt endpoint logs before storage
• DTo eliminate the need for vulnerability scanning

What is the PRIMARY purpose of a formal network security policy?

• ATo define management-approved security expectations and governance requirements
• BTo replace all technical configurations on firewalls and switches
• CTo provide packet captures for every incident
• DTo act as a hardware inventory serial-number list

Why is maintaining an accurate IT asset inventory essential for network defense?

• AIt guarantees that no system will ever be compromised
• BIt helps teams know what must be protected, patched, monitored, and retired
• CIt removes the need for vulnerability scanning
• DIt eliminates false positives in IDS alerts

After several employees click simulated phishing messages, what is the BEST immediate administrative control to strengthen?

• ASecurity awareness training
• BDisk defragmentation scheduling
• CScreen brightness policy
• DPrinter toner rotation

A retailer must protect cardholder data and validate technical and administrative safeguards. Which regulatory framework is MOST directly associated with this requirement?

• APCI DSS
• BNTP
• CBGP
• DSTP

Which document should specify that all domain administrator accounts must use phishing-resistant MFA and may not be used for routine email or web browsing?

• ASecurity standard
• BFirewall syslog export
• CIncident ticket note
• DPacket capture retention log

A new privacy law changes how long the company may retain certain logs containing personal data. What should the security team do FIRST?

• AUpdate the relevant policy and retention standard, then align operational procedures
• BDelete every existing log immediately without review
• CDisable all centralized logging to avoid compliance risk
• DIgnore the change until the next annual audit

What is the BEST asset-management response when a perimeter firewall model reaches end of support and no longer receives security patches?

• AMove it to a more trusted network segment
• BDocument the risk and plan replacement or compensating controls immediately
• CTreat it as lower risk because attackers target only newer devices
• DDisable log collection so performance improves

Which source is MOST useful for staying current on newly disclosed vulnerabilities affecting a deployed network security product?

• AVendor security advisories and trusted vulnerability alert feeds
• BOnly the purchase invoice for the product
• CThe product box artwork
• DA local workstation's recycle bin

A business-critical legacy application cannot yet support MFA and runs on an isolated server. Which administrative action is MOST defensible if replacement cannot happen immediately?

• AIgnore the weakness because downtime would be inconvenient
• BIssue a documented risk acceptance with compensating controls and an expiration date
• CGrant permanent local admin to all support staff
• DRemove all logging to reduce exposure

A network engineer wants to bypass the standard exception process and receive verbal approval to keep unsupported VPN software in production. What is the BEST response?

• AAllow it because network availability always overrides policy
• BRequire formal exception approval, risk documentation, ownership, and review timing
• CApprove it permanently if the engineer is senior enough
• DDisable user awareness training instead

Which access control model is BEST described as permissions assigned to a job function rather than to each individual separately?

• ARBAC
• BDAC
• CMAC
• DPAP

What technology is commonly used to enforce port-based network access control on wired switches?

• A802.1X
• BSMTP
• CTFTP
• DRIP

Which cryptographic approach is MOST efficient for encrypting large volumes of session data after a secure connection is established?

• ASymmetric encryption
• BAsymmetric encryption only
• CPlaintext hashing
• DSteganography

A company needs to protect traffic between two branch offices across the public internet. Which solution is MOST appropriate?

• AIPsec site-to-site VPN
• BOpen relay SMTP server
• CAnonymous FTP
• DUnencrypted Telnet tunnel

What is the PRIMARY security benefit of network segmentation?

• AIt guarantees zero false positives in IDS alerts
• BIt limits east-west movement and reduces blast radius after compromise
• CIt replaces the need for endpoint hardening
• DIt permanently eliminates insider risk

A company grants access to an internal application only if the user is in Finance, is on a managed device, and is connecting from an approved country. Which access model BEST fits this design?

• AABAC
• BMandatory access control only
• CNo access control model is being used
• DSingle sign-on without authorization

Which combination is BEST for securely managing network devices over the network?

• ATelnet and SNMPv1
• BSSH and SNMPv3
• CHTTP and TFTP
• DFTP and POP3

Which statement correctly distinguishes hashing from encryption?

• AHashing is reversible with the right private key
• BEncryption is one-way, while hashing is used for confidentiality
• CHashing is used mainly for integrity, while encryption is used to protect confidentiality
• DThey are identical except for key length

A security team separates departments with VLANs but allows unrestricted traffic between those VLANs through the core. Which statement is MOST accurate?

• AThe design still needs policy enforcement because VLANs alone do not provide strong secur…
• BThe design is equivalent to a zero trust architecture
• CThe design eliminates the need for ACLs or internal firewalls
• DThe design prevents all lateral movement automatically

What is the PRIMARY purpose of a digital certificate presented by an internal management portal during a TLS session?

• ATo permanently store user passwords
• BTo prove the server's identity and help establish trusted encryption
• CTo replace network segmentation
• DTo perform switch stacking

Which type of firewall tracks the state of established connections and allows return traffic accordingly?

• AStateful inspection firewall
• BHub
• CReverse proxy cache only
• DWireless repeater

A company hosts a public web server that must be reachable from the internet but should not sit on the same internal segment as finance systems. Where should the server be placed?

• AIn a DMZ
• BOn the domain controller
• CInside the finance VLAN
• DOn an unmanaged switch under a desk

What is the key operational difference between an IDS and an IPS?

• AAn IDS is usually passive, while an IPS is inline and can block traffic
• BAn IDS encrypts packets, while an IPS cannot
• CAn IDS works only on Linux, while an IPS works only on Windows
• DAn IDS is wireless-only, while an IPS is wired-only

Which IDS outcome is MOST concerning because malicious activity is missed entirely?

• AFalse negative
• BFalse positive
• CTrue positive
• DTrue negative

Where should a network IDS sensor be connected if the goal is to inspect a copy of traffic without becoming a single point of failure?

• ATo a SPAN/mirror port or network tap
• BBetween the server CPU and RAM
• CInside the printer toner cartridge
• DOnly on a user desktop USB port

Which perimeter rule set follows the principle of least privilege MOST closely?

• AAllow any inbound traffic and review monthly
• BDeny by default and explicitly permit only required services
• CAllow all outbound and inbound traffic during business hours
• DMirror the rules from another company without review

What is the BEST practice for unused switch ports in an enterprise office?

• ALeave them active so help desk calls are reduced
• BDisable them or place them in an unused VLAN with protective settings
• CConfigure them as trunk ports by default
• DUse them for unauthorized personal access points

An edge router should block packets arriving from the internet with source addresses that belong to the organization's internal ranges. What control is being applied?

• AAnti-spoofing ingress filtering
• BLoad balancing
• CQoS shaping only
• DPort aggregation

Why would a team choose a next-generation firewall with deep packet inspection over a simple port-based filter for a branch internet edge?

• ATo inspect application-layer traffic and enforce policy beyond just IPs and ports
• BTo eliminate the need for any endpoint controls
• CTo make all encrypted traffic readable without certificates
• DTo replace DNS entirely

What is a defining idea behind a software-defined perimeter (SDP) in a zero trust design?

• AExpose all internal applications and rely on user awareness to prevent misuse
• BHide services until identity and policy checks are satisfied before allowing connectivity
• CReplace MFA with static ACLs
• DAllow any authenticated device unrestricted lateral access

Which Windows feature helps prevent unauthorized changes by prompting for elevation when administrative actions are attempted?

• AUser Account Control (UAC)
• BDisk Cleanup
• CTask Scheduler
• DScreen Saver

Which native Windows control is designed to protect data on a lost laptop by encrypting the drive contents at rest?

• ABitLocker
• BNotepad
• CClipboard history
• DRemote Assistance

An administrator wants all domain-joined Windows workstations to enforce the same password policy and screen-lock timeout. What is the BEST management mechanism?

• AGroup Policy
• BLocal browser bookmarks
• CA shared spreadsheet on a file server
• DManual desktop wallpaper changes

Why is Microsoft LAPS or an equivalent managed local administrator password solution valuable for Windows endpoint security?

• AIt makes all local admin passwords identical for easier support
• BIt randomizes and rotates local admin passwords to reduce credential reuse across endpoin…
• CIt disables all local accounts permanently
• DIt replaces full-disk encryption

A critical internet-facing Windows server receives a patch for an actively exploited remote code execution flaw. What is the MOST appropriate response?

• APrioritize expedited testing and deployment because exposure and exploitability are both…
• BWait for the next quarterly maintenance cycle regardless of risk
• CDisable logging before patching
• DRemove the server from the asset inventory

Which legacy Windows file-sharing protocol is commonly disabled because of major historical security weaknesses and worm abuse?

• ASMBv1
• BNTP
• CLDAPS
• DRDP with NLA