Certified Network Defender (CND) v2 Exam (312-38) — Questions and Answers

Question 1: A network defender reviews scan results and must decide which vulnerabilities to fix first. Which framework helps prioritize based on whether a vulnerability is actively being exploited in the wild?

OWASP Top 10
EPSS (Exploit Prediction Scoring System) (Correct answer)
CIS Benchmarks
CVSS Base Score alone

Correct answer: EPSS (Exploit Prediction Scoring System)

EPSS predicts the likelihood that a vulnerability will be exploited in the wild within 30 days, helping prioritize remediation beyond static CVSS scores alone.

Question 2: Which framework uses a five-function structure — Identify, Protect, Detect, Respond, Recover — for managing cybersecurity risk?

CIS Controls
COBIT 5
NIST Cybersecurity Framework (CSF) (Correct answer)
ISO/IEC 27001

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 3: What is the main advantage of an out-of-band (OOB) management network for network device administration?

It automatically patches firmware on network devices
It increases bandwidth for production traffic
It keeps management traffic separate so devices remain accessible during attacks or outages (Correct answer)
It provides real-time encryption for management sessions

Correct answer: It keeps management traffic separate so devices remain accessible during attacks or outages

An out-of-band management network uses separate physical interfaces or dedicated networks, ensuring administrators can access and control devices even when the production network is compromised or down.

Question 4: Which log source is most critical for detecting brute force login attempts against Windows Active Directory?

Windows Security Event Logs (Event ID 4625) (Correct answer)
DHCP lease logs
DNS query logs
Application event logs

Correct answer: Windows Security Event Logs (Event ID 4625)

Windows Security Event ID 4625 records failed logon attempts, and repeated failures from a single source against AD accounts are the primary indicator of a brute force attack.

Question 5: A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Perform ARP poisoning to redirect traffic through the attacker machine
Replay the handshake packets to force re-authentication
Run a dictionary or brute-force attack against the captured handshake offline (Correct answer)
Inject deauthentication frames to obtain the session key directly

Correct answer: Run a dictionary or brute-force attack against the captured handshake offline

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

Question 6: An organization's vulnerability management program uses credentialed scanning. What is the primary advantage over non-credentialed scanning?

It is faster because it skips authentication overhead
It avoids triggering IDS/IPS alerts during the scan
It identifies more vulnerabilities by authenticating to systems and inspecting internal configurations (Correct answer)
It requires no network access to the target system

Correct answer: It identifies more vulnerabilities by authenticating to systems and inspecting internal configurations

Credentialed (authenticated) scanning logs into target systems to check patch levels, configurations, and installed software, discovering vulnerabilities that unauthenticated scans miss.

Question 7: When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?

dd or dcfldd (Correct answer)
Nmap
Wireshark
Netstat

Correct answer: dd or dcfldd

Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.

Question 8: Which VPN protocol operates at Layer 2 and is commonly used to extend VLANs across WAN connections?

L2TP (Correct answer)
OpenVPN
MPLS
IPsec

Correct answer: L2TP

L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 and is often paired with IPsec for security to create secure tunnels.

Question 9: What is the function of a Host-Based Intrusion Prevention System (HIPS)?

Scan email attachments for malware
Manage network firewall rules centrally
Encrypt files on the host's hard drive
Monitor and block suspicious activities on an individual endpoint in real time (Correct answer)

Correct answer: Monitor and block suspicious activities on an individual endpoint in real time

HIPS monitors system calls, file access, registry changes, and network connections on the host, blocking actions that match malicious behavior patterns.

Question 10: A CND analyst wants to ensure DNS responses are cryptographically validated. Which technology should be deployed?

DNS over HTTPS (DoH)
DNSSEC (Correct answer)
DANE
DNS Sinkholes

Correct answer: DNSSEC

DNSSEC uses digital signatures to allow resolvers to verify that DNS responses have not been tampered with.

Question 11: A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?

Hiding the network name to reduce casual discovery (SSID cloaking) (Correct answer)
Enabling band steering to push clients to 5 GHz
Enabling WPA3 protection on the access point
Implementing 802.1X port-based authentication

Correct answer: Hiding the network name to reduce casual discovery (SSID cloaking)

SSID cloaking (hiding) sets the SSID field to null in beacon frames, making the network invisible to casual scanners; however, passive sniffers can still capture the SSID from probe requests and responses.

Question 12: How does a risk assessment help with vulnerability management?

By focusing only on external threats
By ignoring vulnerabilities and focusing on network traffic
By reducing the number of users accessing the network
By helping prioritize vulnerabilities based on their risk to the organization (Correct answer)

Correct answer: By helping prioritize vulnerabilities based on their risk to the organization

A risk assessment evaluates the potential impact and likelihood of identified vulnerabilities being exploited. This process allows organizations to prioritize which vulnerabilities to address first, focusing resources on those that pose the greatest risk to critical assets or business operations. It ensures that vulnerability management efforts are aligned with the organization's overall risk tolerance and strategic goals.

Question 13: What is the purpose of log normalization in a SIEM system?

Deleting old logs to free storage space
Forwarding alerts to the incident response team
Encrypting logs to prevent tampering
Converting logs from different sources into a common format for correlation (Correct answer)

Correct answer: Converting logs from different sources into a common format for correlation

Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.

Question 14: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway
Discard the results and start over completely
Delay reporting until results are favorable

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 15: What is the key difference between IDS and IPS deployment in a network?

IPS is placed inline and can block traffic; IDS passively monitors (Correct answer)
IDS requires agent installation; IPS is agentless
IDS encrypts traffic; IPS does not
IPS only detects known signatures; IDS uses anomaly detection

Correct answer: IPS is placed inline and can block traffic; IDS passively monitors

IPS is deployed inline in the traffic path and can drop or modify packets, while IDS monitors a copy of traffic and only alerts.

Question 16: When conducting a wireless site survey for security planning, what is the primary purpose of measuring RF signal coverage patterns?

To determine the number of user licenses needed for the WLAN controller
To identify the DHCP scope needed for wireless clients
To configure the correct 802.11 amendment on each access point
To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited (Correct answer)

Correct answer: To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited

RF site surveys help defenders understand where the wireless signal extends, ensuring coverage gaps do not create blind spots and that signal does not bleed significantly outside the building where attackers could intercept it.

Question 17: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Allocate all resources equally regardless of need
Keep significant reserves without deployment
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 18: How does the CND body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is relevant only for academic research
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 19: Why is threat intelligence crucial for vulnerability management?

To track and exploit security weaknesses
To provide insights into new and evolving threats for proactive defense (Correct answer)
To prevent the implementation of security measures
To limit threat monitoring to specific regions

Correct answer: To provide insights into new and evolving threats for proactive defense

Threat intelligence is crucial for vulnerability management because it provides organizations with up-to-date information about current and emerging cyber threats, attack methodologies, and threat actors. This intelligence allows security teams to proactively identify and prioritize vulnerabilities that are most likely to be exploited by real-world threats. It enables a more informed and strategic approach to defense.

Question 20: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To guarantee employment in the field
To satisfy a personal achievement goal
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 21: Which statement BEST describes the relationship between Certified Network Defender certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Requirements become less stringent over time
Changes only occur when government mandates new requirements
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 22: How does the CND body of knowledge relate to daily professional practice?

It only applies during certification exams
It is theoretical and has limited practical application
It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 23: A threat agent exploits a software vulnerability to gain unauthorized access. In risk terminology, what is the 'threat agent'?

The weakness in the software
The entity that takes advantage of the vulnerability (Correct answer)
The impact of the successful attack
The control designed to prevent exploitation

Correct answer: The entity that takes advantage of the vulnerability

A threat agent (or threat actor) is the person, group, or entity that initiates and carries out an attack by exploiting a vulnerability.

Question 24: A quantitative risk analysis assigns monetary values to risk. What does the term 'Annual Loss Expectancy (ALE)' represent?

The maximum possible loss from a single incident
The product of SLE and ARO (Correct answer)
The percentage chance a threat will occur in a year
The cost of implementing security controls

Correct answer: The product of SLE and ARO

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), giving the expected yearly financial loss.

Question 25: An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Risk transference
Risk acceptance (Correct answer)
Risk avoidance
Risk mitigation

Correct answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 26: What is the MOST effective way for new CND professionals to build competency in their field?

Learning entirely through trial and error
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics
Studying certification materials exclusively

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 27: Which document provides pre-approved procedures for responding to common incident types, reducing decision fatigue during an active incident?

Security awareness policy
Risk assessment report
Business impact analysis
Playbook (runbook) (Correct answer)

Correct answer: Playbook (runbook)

Playbooks are pre-defined, step-by-step response procedures for specific incident scenarios that allow responders to act quickly and consistently without improvising under pressure.

Question 28: Which CND control specifically addresses preventing unauthorized software execution on endpoints through policy-based restrictions?

Software Restriction Policies (SRP) or AppLocker (Correct answer)
Network Access Control (NAC)
Dynamic Host Configuration Protocol (DHCP)
Intrusion Detection System (IDS)

Correct answer: Software Restriction Policies (SRP) or AppLocker

Windows Software Restriction Policies and AppLocker enforce rules that allow or deny execution of applications based on path, publisher certificate, or file hash.

Question 29: What is the primary forensic use of NetFlow data collected from routers?

Identify communication patterns and detect anomalies without capturing full payloads (Correct answer)
Distribute DHCP leases
Decrypt SSL traffic
Authenticate remote users

Correct answer: Identify communication patterns and detect anomalies without capturing full payloads

NetFlow records metadata (IPs, ports, bytes, duration) about network conversations, enabling anomaly detection without storing full packet payloads.

Question 30: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Keep significant reserves without deployment
Allocate all resources equally regardless of need
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Question 31: What is the primary function of a Demilitarized Zone (DMZ) in a network?

To protect the network from internal attacks
To store backup data securely
To provide a secure zone for public-facing services while protecting internal networks (Correct answer)
To prevent all external network traffic

Correct answer: To provide a secure zone for public-facing services while protecting internal networks

A Demilitarized Zone (DMZ) is a perimeter network that separates an organization's internal local area network (LAN) from an untrusted external network, like the internet. It hosts public-facing services such as web servers, email servers, and DNS servers. This design allows external users to access these services without directly exposing the internal network, adding an extra layer of security.

Question 32: What does a next-generation firewall (NGFW) provide that a traditional stateful firewall does not?

Basic packet filtering
Physical port-based filtering
Deep packet inspection and application awareness (Correct answer)
Static routing capabilities

Correct answer: Deep packet inspection and application awareness

NGFWs add deep packet inspection, application identification, user-identity awareness, and integrated threat intelligence beyond the port/protocol filtering of traditional stateful firewalls.

Question 33: Which document formally authorizes an information system to operate and accepts the residual risk?

System Security Plan (SSP)
Business Impact Analysis (BIA)
Authority to Operate (ATO) (Correct answer)
Risk Register

Correct answer: Authority to Operate (ATO)

An Authority to Operate (ATO) is issued by an authorizing official, formally accepting residual risk and permitting system operation.

Question 34: Which foundational principle is MOST important for success in the Certified Network Defender profession?

Maintaining the minimum requirements for certification
Specializing in only one narrow area of practice
Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 35: During a risk assessment, an analyst finds that a web server is exposed to SQL injection. The vulnerability is the weakness, and the threat is malicious input. What is the 'risk' in this scenario?

The database administrator's lack of awareness
The web server hardware itself
The probability that the SQL injection succeeds combined with the resulting impact (Correct answer)
The firewall protecting the server

Correct answer: The probability that the SQL injection succeeds combined with the resulting impact

Risk is the combination of the likelihood that a threat exploits a vulnerability and the potential impact of that exploitation.

Question 36: In network traffic analysis, what does a sudden spike in ICMP traffic from a single internal host typically indicate?

Normal DNS resolution activity
A potential ping flood or network reconnaissance sweep (Correct answer)
Routine certificate renewal traffic
Standard operating system update downloads

Correct answer: A potential ping flood or network reconnaissance sweep

An unusual spike in ICMP traffic from one host often signals a ping sweep for network reconnaissance, a ping flood DoS attack, or malware attempting to map the network.

Question 37: Under HIPAA, which rule specifically requires covered entities to implement administrative, physical, and technical safeguards for electronic PHI?

Breach Notification Rule
Security Rule (Correct answer)
Privacy Rule
Enforcement Rule

Correct answer: Security Rule

The HIPAA Security Rule requires covered entities to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Question 38: How do regulatory frameworks like GDPR impact an organization’s risk management practices?

They allow organizations to ignore data protection standards
They reduce the cost of implementing security controls
They focus solely on the technical aspects of cybersecurity
They require organizations to implement strict data protection measures to avoid legal consequences (Correct answer)

Correct answer: They require organizations to implement strict data protection measures to avoid legal consequences

Regulatory frameworks like GDPR significantly impact an organization's risk management by imposing strict requirements for data protection, privacy, and security. Organizations must implement robust controls, conduct data protection impact assessments, and ensure data subject rights are upheld to avoid severe legal penalties. These regulations elevate data privacy to a critical risk management concern, requiring comprehensive compliance efforts.

Question 39: Which IEEE 802.11 amendment introduced MU-MIMO and operates in the 6 GHz band in addition to 2.4 GHz and 5 GHz?

802.11ac (Wi-Fi 5)
802.11g
802.11ax (Wi-Fi 6/6E) (Correct answer)
802.11n (Wi-Fi 4)

Correct answer: 802.11ax (Wi-Fi 6/6E)

802.11ax (Wi-Fi 6/6E) supports MU-MIMO, OFDMA, and in its 6E variant operates in the 6 GHz band, offering greater capacity and reduced interference compared to earlier standards.

Question 40: What is the primary security weakness of Wired Equivalent Privacy (WEP)?

It requires 802.1X which is difficult to implement
It lacks mutual authentication but provides strong encryption
It uses 128-bit keys which are too long to be practical
It relies on RC4 with static, reused initialization vectors making it trivially crackable (Correct answer)

Correct answer: It relies on RC4 with static, reused initialization vectors making it trivially crackable

WEP reuses 24-bit IVs and uses a flawed implementation of RC4, allowing attackers to collect enough packets to statistically recover the key in minutes using tools like Aircrack-ng.

Question 41: What distinguishes a Certified Network Defender certified professional from a non-certified practitioner?

Certification validates competency through standardized assessment against established benchmarks (Correct answer)
Certified professionals exclusively work in larger organizations
There is no meaningful difference in competency
Certified professionals always have more years of experience

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 42: What is the primary objective of an incident response plan in cybersecurity?

To increase the number of users affected by the incident
To quickly detect, respond, and recover from a security incident to minimize damage (Correct answer)
To ignore incidents and continue with normal operations
To delay the response until further analysis is completed

Correct answer: To quickly detect, respond, and recover from a security incident to minimize damage

An incident response plan provides a structured approach for an organization to handle cybersecurity incidents. Its primary objective is to enable a rapid and effective response to security breaches, limiting their impact, restoring normal operations as quickly as possible, and learning from the incident to prevent future occurrences. This minimizes financial, reputational, and operational damage.

Question 43: What is 'patch management' and why is it critical for endpoint security?

Regularly applying security updates to fix known vulnerabilities before attackers exploit them (Correct answer)
Installing new features to improve productivity
Replacing hardware components on schedule
Backing up endpoint configurations

Correct answer: Regularly applying security updates to fix known vulnerabilities before attackers exploit them

Patch management ensures that known software vulnerabilities are remediated promptly, closing the window of exploitation before attackers can leverage public exploit code.

Question 44: How does risk mitigation differ from risk acceptance?

Risk mitigation and risk acceptance are the same
Risk mitigation ignores risks, and risk acceptance prevents all potential threats
Risk mitigation reduces or eliminates risks, while risk acceptance acknowledges risks without action (Correct answer)
Risk mitigation involves ignoring risks, while risk acceptance reduces them

Correct answer: Risk mitigation reduces or eliminates risks, while risk acceptance acknowledges risks without action

Risk mitigation involves actively implementing controls and strategies to reduce the likelihood or impact of identified risks, such as deploying firewalls or encrypting data. In contrast, risk acceptance is a conscious decision to acknowledge a risk and its potential consequences without taking specific action to reduce it, often because the cost of mitigation outweighs the potential impact. These are distinct strategies for managing identified risks.

Question 45: Which of the following best describes 'volatile evidence' in digital forensics?

Log files on a NAS device
Archived email stored on a mail server
Data that is lost when the system is powered off, such as RAM contents (Correct answer)
Evidence stored on encrypted hard drives

Correct answer: Data that is lost when the system is powered off, such as RAM contents

Volatile evidence such as RAM contents, running processes, and network connections exists only while the system is powered on and is lost upon shutdown.

Question 46: A security analyst uses open-source intelligence (OSINT) gathering as part of threat assessment. Which of the following is an OSINT technique?

Scanning internal network hosts with Nessus
Running authenticated scans against production servers
Analyzing core memory dumps from compromised endpoints
Reviewing publicly available social media profiles to identify potential insider threats (Correct answer)

Correct answer: Reviewing publicly available social media profiles to identify potential insider threats

OSINT involves collecting information from publicly available sources such as social media, websites, and public records to assess threats without direct system access.

Question 47: What is the role of a network access control (NAC) system?

To block all network traffic
To encrypt all data packets on the network
To enforce security policies and control access based on device compliance (Correct answer)
To monitor network traffic for breaches

Correct answer: To enforce security policies and control access based on device compliance

Network Access Control (NAC) systems manage and enforce security policies for devices attempting to connect to a network. NAC checks devices for compliance with security policies, such as having up-to-date antivirus software or specific operating system patches, before granting or denying network access. This ensures that only healthy and authorized devices can connect, reducing the risk of malware spreading.

Question 48: What does encryption do in the context of network security?

It allows unrestricted access to sensitive data
It encodes data to prevent unauthorized access (Correct answer)
It makes data readable by all users
It simplifies the security protocols used by the network

Correct answer: It encodes data to prevent unauthorized access

Encryption is the process of converting information or data into a code to prevent unauthorized access. It transforms plaintext into ciphertext using an algorithm and a key, making the data unreadable to anyone without the correct decryption key. This ensures confidentiality and protects sensitive information during storage and transmission.

Question 49: Which document formally authorizes a penetration testing team to conduct tests against an organization's systems?

Statement of Work (SoW)
Rules of Engagement (RoE) (Correct answer)
Vulnerability assessment report
Non-Disclosure Agreement (NDA)

Correct answer: Rules of Engagement (RoE)

The Rules of Engagement define the scope, timing, methods, and boundaries of a penetration test, providing legal authorization for the testing activities.

Question 50: Which threat modeling methodology focuses on identifying threats by categorizing them as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

OCTAVE
PASTA
VAST
STRIDE (Correct answer)

Correct answer: STRIDE

STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six types to help identify security weaknesses in systems.

Question 51: Which access control model assigns permissions based on job functions defined by an organization, rather than individual identity?

ABAC (Attribute-Based Access Control)
DAC (Discretionary Access Control)
MAC (Mandatory Access Control)
RBAC (Role-Based Access Control) (Correct answer)

Correct answer: RBAC (Role-Based Access Control)

RBAC grants permissions to roles (e.g., admin, auditor) and then assigns users to those roles, simplifying access management.

Question 52: What is the MOST effective way for new CND professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics
Studying certification materials exclusively
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Question 53: What distinguishes a Certified Network Defender certified professional from a non-certified practitioner?

Certification validates competency through standardized assessment against established benchmarks (Correct answer)
There is no meaningful difference in competency
Certified professionals always have more years of experience
Certified professionals exclusively work in larger organizations

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Question 54: Which log type is most useful for reconstructing a timeline of network intrusion events?

Print spooler logs
Network flow (NetFlow/IPFIX) logs (Correct answer)
Font cache logs
Application event logs

Correct answer: Network flow (NetFlow/IPFIX) logs

Network flow logs capture source/destination IP, ports, timestamps, and byte counts, making them ideal for reconstructing intrusion timelines.

Question 55: In an 802.1X wireless deployment, what role does the RADIUS server fulfill?

It acts as the wireless access point providing RF signals
It functions as the authenticator that enforces port access
It serves as the Authentication Server (AS) that validates supplicant credentials (Correct answer)
It manages IP address assignment for wireless clients

Correct answer: It serves as the Authentication Server (AS) that validates supplicant credentials

In 802.1X, the RADIUS server acts as the Authentication Server (AS), receiving forwarded credentials from the authenticator (AP) and making accept/reject decisions based on identity validation.

Question 56: What is a 'honeypot' used for in network forensics and threat analysis?

Caching web content
Storing encrypted credentials
Luring attackers to study their techniques (Correct answer)
Distributing software patches

Correct answer: Luring attackers to study their techniques

A honeypot is a deliberately vulnerable decoy system designed to attract attackers so their methods and tools can be observed and analyzed.

Question 57: How frequently should ongoing assessments be conducted in Certified Network Defender practice?

Only when required by external auditors
Once annually regardless of circumstances
At regular intervals based on established protocols and as conditions change (Correct answer)
Only when problems are reported

Correct answer: At regular intervals based on established protocols and as conditions change

Ongoing assessments should follow established protocols for regular intervals and also be conducted when conditions change. This balanced approach ensures continuous monitoring while remaining responsive to new developments.

Question 58: What is 'data exfiltration' in the context of a security incident?

Unauthorized copying or transfer of data from an organization to an external destination (Correct answer)
Moving data between internal network segments
Encrypting sensitive data before it is backed up
The process of deleting logs to cover attacker tracks

Correct answer: Unauthorized copying or transfer of data from an organization to an external destination

Data exfiltration refers to the unauthorized transfer of data from within an organization to an outside location controlled by an attacker.

Question 59: Which countermeasure directly protects against evil twin attacks by cryptographically binding the network identity to the authentication exchange?

Setting maximum transmit power to overpower the rogue AP
Enabling MAC address filtering on the legitimate AP
Using certificate-based mutual authentication (EAP-TLS) with 802.1X (Correct answer)
Hiding the SSID in beacon frames

Correct answer: Using certificate-based mutual authentication (EAP-TLS) with 802.1X

EAP-TLS requires the authentication server to present a certificate the client validates, so a rogue AP cannot complete the mutual auth exchange — the client detects the missing or invalid server certificate and refuses to connect.

Question 60: What network segmentation technique uses logical partitioning within a single physical network to separate traffic by function or department?

Proxy
VLAN (Correct answer)
Load balancing
NAT

Correct answer: VLAN

VLANs (Virtual Local Area Networks) allow a single physical switch infrastructure to be logically divided into multiple isolated broadcast domains, limiting lateral movement of threats.

Question 61: Which vulnerability management metric measures the average time between when a vulnerability is discovered and when it is fully remediated?

Mean Time to Remediate (MTTR) (Correct answer)
Mean Time to Detect (MTTD)
Vulnerability Density Score
Patch Compliance Rate

Correct answer: Mean Time to Remediate (MTTR)

Mean Time to Remediate (MTTR) tracks how long it takes on average to fix vulnerabilities after discovery, and is a key KPI for vulnerability management program effectiveness.

Question 62: What is the MOST important factor to consider when selecting assessment tools for CND certification work?

Validity, reliability, and appropriateness for the specific context (Correct answer)
How quickly the tool can be administered
Personal familiarity with the tool
The cost of the assessment tool

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 63: Which stakeholder engagement strategy is MOST effective for CND professionals leading initiatives?

Limit engagement to senior leadership only
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Inform stakeholders only after decisions are made
Engage stakeholders only when their approval is needed

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 64: Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation?

Wireshark (Correct answer)
Metasploit
Aircrack-ng
Nessus

Correct answer: Wireshark

Wireshark is the industry-standard open-source packet analyzer used to capture and inspect raw network traffic during forensic investigations.

Question 65: Which stakeholder engagement strategy is MOST effective for CND professionals leading initiatives?

Limit engagement to senior leadership only
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Engage stakeholders only when their approval is needed
Inform stakeholders only after decisions are made

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Question 66: In the context of threat assessment, what does 'threat likelihood' measure?

The potential damage a threat could cause if it occurs
The time required to remediate a discovered vulnerability
The number of known exploits for a vulnerability
The probability that a specific threat will exploit a given vulnerability (Correct answer)

Correct answer: The probability that a specific threat will exploit a given vulnerability

Threat likelihood (or probability) estimates how likely it is that a particular threat will successfully exploit a vulnerability within a given timeframe.

Question 67: When planning a project in Certified Network Defender, which element should be established FIRST?

The project timeline
The budget allocation
The team member assignments
Clear objectives, scope, and success criteria (Correct answer)

Correct answer: Clear objectives, scope, and success criteria

Clear objectives, scope, and success criteria must be established first because they form the foundation for all other planning decisions. Without knowing what success looks like, it is impossible to properly allocate budget, assign personnel, or set timelines.

Question 68: What is the MOST effective way for new CND professionals to build competency in their field?

Learning entirely through trial and error
Studying certification materials exclusively
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Question 69: What does the term 'attack surface' refer to in threat assessment?

The geographic area from which attacks originate
The time window during which a system is vulnerable
The number of active exploits targeting a system
The total set of different points where an attacker could enter or extract data from an environment (Correct answer)

Correct answer: The total set of different points where an attacker could enter or extract data from an environment

The attack surface encompasses all the different points (network interfaces, APIs, user inputs, etc.) where an unauthorized user could attempt to enter or extract data.

Question 70: What is the primary purpose of a Security Information and Event Management (SIEM) system in network forensics?

Encrypt network traffic
Generate SSL certificates
Correlate and aggregate log data for real-time analysis (Correct answer)
Replace firewall rules

Correct answer: Correlate and aggregate log data for real-time analysis

A SIEM centralizes log collection from multiple sources and applies correlation rules to detect suspicious patterns in real time.

Question 71: Which statement BEST describes the relationship between Certified Network Defender certification requirements and industry evolution?

Changes only occur when government mandates new requirements
Certification requirements never change once established
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Question 72: What is the function of a web application firewall (WAF) in network defense?

To filter network traffic based on IP addresses and ports
To inspect and filter HTTP/HTTPS traffic to protect web applications from attacks like SQLi and XSS (Correct answer)
To provide encrypted tunnels for remote users
To monitor and log DNS requests

Correct answer: To inspect and filter HTTP/HTTPS traffic to protect web applications from attacks like SQLi and XSS

A WAF operates at Layer 7, analyzing HTTP/HTTPS traffic to detect and block web-specific attacks including SQL injection, cross-site scripting, and OWASP Top 10 threats.

Question 73: A security engineer needs to ensure data integrity without confidentiality for routing protocol updates. Which IPsec mode is most appropriate?

ESP in Tunnel mode
ESP in Transport mode
IKEv1 Aggressive mode
AH in Transport mode (Correct answer)

Correct answer: AH in Transport mode

AH in Transport mode authenticates the packet payload and IP header without encrypting data, providing integrity only.

Question 74: The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?

The PIN is transmitted in plaintext over the air
The 8-digit PIN is validated in two halves independently, reducing the keyspace (Correct answer)
WPS uses RC4 encryption instead of AES
The PIN is derived from the MAC address of the AP

Correct answer: The 8-digit PIN is validated in two halves independently, reducing the keyspace

WPS validates the first 4 digits of the PIN separately from the last 4 (minus a checksum digit), reducing the brute-force space from 10^8 to roughly 10^4 + 10^3 = ~11,000 guesses.

Question 75: Why is it important to establish cybersecurity policies for an organization?

To increase the complexity of security measures
To reduce the number of employees working on security tasks
To provide clear rules for securing data and complying with regulations (Correct answer)
To make systems easier to hack

Correct answer: To provide clear rules for securing data and complying with regulations

Establishing cybersecurity policies provides clear, documented guidelines for employees on how to handle and protect organizational data and systems. These policies ensure consistent security practices across the organization, define responsibilities, and help ensure compliance with legal and regulatory requirements. They are essential for creating a strong security culture and framework.

Question 76: Under the NIST Cybersecurity Framework, which function covers activities to restore services impaired by a cybersecurity incident?

Protect
Respond
Identify
Recover (Correct answer)

Correct answer: Recover

The 'Recover' function encompasses activities to restore capabilities or services that were impaired during an incident, including communications and improvement plans.

Question 77: Which concept describes a vulnerability that is being actively exploited by attackers before the vendor is aware of it or has issued a patch?

Residual risk
Zero-day vulnerability (Correct answer)
Legacy vulnerability
Known vulnerability

Correct answer: Zero-day vulnerability

A zero-day vulnerability is one that is unknown to the software vendor and is actively exploited before a patch or mitigation is available.

Question 78: Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?

Nmap + Metasploit
Kismet + GPS receiver (Correct answer)
Airsnort + John the Ripper
Wireshark + Burp Suite

Correct answer: Kismet + GPS receiver

Kismet is a passive wireless network detector and sniffer, and when combined with a GPS receiver it can map discovered networks geographically, which is the core capability used in wardriving.

Question 79: Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?

Registry hive backups
Prefetch files from the filesystem
Event log files from disk
Contents of RAM (memory dump) (Correct answer)

Correct answer: Contents of RAM (memory dump)

RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.

Question 80: What is threat hunting in a security operations context?

Automated scanning of systems for known vulnerabilities
Running penetration tests against production systems
Responding to active security incidents as they are reported
Proactive searching through networks and endpoints to detect threats that evade automated detection (Correct answer)

Correct answer: Proactive searching through networks and endpoints to detect threats that evade automated detection

Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.

Question 81: Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?

Differential backup
Mirror backup
Full backup
Incremental backup (Correct answer)

Correct answer: Incremental backup

Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.

Question 82: When documenting assessment findings in CND practice, which approach is MOST appropriate?

Use technical jargon that only experts can understand
Record objective findings, measurements, and professional observations factually (Correct answer)
Summarize findings verbally without written documentation
Include only positive findings to maintain optimism

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 83: Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?

Mean Time to Recover (MTTR)
Mean Time to Detect (MTTD) (Correct answer)
Recovery Time Objective (RTO)
Mean Time Between Failures (MTBF)

Correct answer: Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) measures the average duration between the start of a security incident and its detection by the SOC, with lower values indicating better monitoring effectiveness.

Question 84: An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?

A facility with hardware and connectivity pre-installed but requiring data restoration before use (Correct answer)
A fully operational duplicate data center that can take over in minutes
A cloud-only recovery environment with no physical infrastructure
An empty building where equipment can be shipped after a disaster

Correct answer: A facility with hardware and connectivity pre-installed but requiring data restoration before use

A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.

Question 85: In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

The cost to restore operations after a disaster
The maximum acceptable downtime before business impact becomes critical (Correct answer)
The point in time to which data must be recovered
The maximum tolerable data loss measured in time

Correct answer: The maximum acceptable downtime before business impact becomes critical

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Question 86: What is the role of risk assessment in risk management?

To identify, assess, and prioritize risks based on their potential impact and likelihood (Correct answer)
To minimize the cost of cybersecurity programs
To ignore risks and focus only on recovery
To reduce the number of users accessing sensitive data

Correct answer: To identify, assess, and prioritize risks based on their potential impact and likelihood

Risk assessment is a foundational component of risk management, involving the systematic identification of potential threats and vulnerabilities. It then assesses the likelihood of these risks occurring and their potential impact on the organization. This process allows organizations to prioritize risks, focusing resources on the most critical areas to develop effective mitigation strategies.

Question 87: An organization implements a proxy that intercepts all outbound HTTP/HTTPS connections and scans content. What type of control is this?

Forward Proxy with SSL inspection (Correct answer)
Unified Threat Management
Intrusion Detection System
Reverse Proxy

Correct answer: Forward Proxy with SSL inspection

A forward proxy with SSL inspection decrypts, inspects, and re-encrypts outbound traffic to enforce content policies and detect threats.

Question 88: Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?

Living off the Land (LotL) attacks using LOLBins (Correct answer)
ARP spoofing
SQL injection
Cross-site scripting

Correct answer: Living off the Land (LotL) attacks using LOLBins

Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.

Question 89: During the recovery phase of incident response, which action verifies that eradication was successful before returning systems to production?

Changing all user passwords
Updating firewall rules to block the attacker's IP
Running a full antivirus scan only
Reinstalling the OS and verifying system integrity against a known-good baseline (Correct answer)

Correct answer: Reinstalling the OS and verifying system integrity against a known-good baseline

Rebuilding from a known-good baseline and verifying integrity ensures no persistent backdoors or malware remnants remain before the system rejoins production.

Question 90: Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?

Bluejacking
Bluesnarfing (Correct answer)
BlueSmack
BIAS (Bluetooth Impersonation Attack)

Correct answer: Bluesnarfing

Bluesnarfing exploits vulnerabilities in OBEX Push Profile or OBEX File Transfer Profile to access sensitive data on a Bluetooth device without user authorization or authentication.

Question 91: What is the significance of incident response testing?

To focus solely on monitoring systems without action
To test the plan’s effectiveness and make necessary improvements (Correct answer)
To delay incident response processes
To prevent any incidents from happening

Correct answer: To test the plan’s effectiveness and make necessary improvements

Incident response testing is essential for validating the effectiveness of an organization's incident response plan. By simulating real-world scenarios, testing helps identify weaknesses, gaps, and areas where the plan might fail under pressure. This allows for necessary adjustments and improvements, ensuring that the organization is well-prepared to handle actual security incidents efficiently.

Question 92: Which wireless intrusion detection/prevention capability detects rogue access points by comparing detected BSSIDs against an authorized AP list and alerts on unauthorized devices?

Network Access Control (NAC) enforcement
Wireless IDS (WIDS) with AP monitoring (Correct answer)
ARP inspection on the distribution layer
DHCP snooping on the wired switch

Correct answer: Wireless IDS (WIDS) with AP monitoring

A Wireless IDS (WIDS) continuously monitors the RF environment, catalogs all detected APs, and compares them against the authorized AP database to alert defenders when unknown or rogue APs appear.

Question 93: What does the concept of containment refer to during an incident response?

To limit the spread of the incident, minimizing further damage (Correct answer)
To speed up the attack on the network
To allow the breach to spread and infect more systems
To stop responding to the incident

Correct answer: To limit the spread of the incident, minimizing further damage

Containment is a critical phase in incident response where the primary goal is to stop the spread of a security incident and prevent further damage to systems and data. This might involve isolating affected systems, disconnecting networks, or blocking malicious traffic. Effective containment is essential to prevent a localized incident from becoming a widespread disaster.

Question 94: When documenting assessment findings in CND practice, which approach is MOST appropriate?

Record objective findings, measurements, and professional observations factually (Correct answer)
Include only positive findings to maintain optimism
Summarize findings verbally without written documentation
Use technical jargon that only experts can understand

Correct answer: Record objective findings, measurements, and professional observations factually

Question 95: In network forensics, what is the purpose of 'packet carving'?

Encrypting captured packets for storage
Reconstructing files and data from raw packet streams (Correct answer)
Splitting large PCAP files into smaller segments
Filtering packets by protocol type

Correct answer: Reconstructing files and data from raw packet streams

Packet carving reconstructs files, images, or documents from reassembled packet payloads captured in a PCAP file.

Question 96: Which business continuity concept identifies which business processes are most critical and must be restored first after a disaster?

Vulnerability Assessment
Risk Register
Business Impact Analysis (BIA) (Correct answer)
Gap Analysis

Correct answer: Business Impact Analysis (BIA)

A Business Impact Analysis (BIA) identifies critical business functions, quantifies the impact of disruptions, and prioritizes recovery order based on operational and financial consequences.

Question 97: In security monitoring, what does the term 'false positive' refer to?

A security control that failed to detect an attack
An alert triggered by legitimate activity that is incorrectly flagged as malicious (Correct answer)
A vulnerability that has no available patch
A real attack that was successfully blocked

Correct answer: An alert triggered by legitimate activity that is incorrectly flagged as malicious

A false positive occurs when a security tool generates an alert for benign activity, incorrectly classifying it as a threat, which wastes analyst time and contributes to alert fatigue.

Question 98: What is the primary goal of OS hardening in a network defender's role?

Enable remote desktop on all workstations
Increase system performance
Install the latest productivity software
Reduce the attack surface by disabling unnecessary services and features (Correct answer)

Correct answer: Reduce the attack surface by disabling unnecessary services and features

OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.

Question 99: What is 'log tampering' and why is it a concern in forensic investigations?

Compressing logs to save disk space
Backing up logs to a remote server
Converting logs to a binary format
An attacker deleting or modifying logs to cover their tracks (Correct answer)

Correct answer: An attacker deleting or modifying logs to cover their tracks

Log tampering involves an attacker deleting, modifying, or disabling logs to erase evidence of their unauthorized activities.

Question 100: A network defender wants to prevent wireless clients from communicating directly with each other on the same AP while still allowing internet access. Which AP feature accomplishes this?

Beamforming to direct signals toward the router
Client isolation (AP isolation / PSPF) (Correct answer)
WMM (Wi-Fi Multimedia) QoS profiles
Band steering to separate client types

Correct answer: Client isolation (AP isolation / PSPF)

Client isolation (sometimes called AP isolation or Publicly Secure Packet Forwarding) blocks Layer 2 traffic between wireless clients on the same SSID, preventing peer-to-peer attacks like ARP poisoning while allowing uplink access.

Certified Network Defender (CND) v2 Exam (312-38)

The CND certification validates the skills of network administrators to protect, detect, and respond to network attacks, ensuring network security.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds