Certified Network Defender (CND) v2 Exam (312-38) — Questions and Answers

Question 1: Which SOX section holds executives personally accountable for the accuracy of financial reports and the effectiveness of internal controls?

Section 802
Section 404
Section 302 (Correct answer)
Section 409

Correct answer: Section 302

SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

Question 2: Which statement BEST describes the relationship between Certified Network Defender certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Changes only occur when government mandates new requirements
Requirements become less stringent over time
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 3: What is the function of a web application firewall (WAF) in network defense?

To inspect and filter HTTP/HTTPS traffic to protect web applications from attacks like SQLi and XSS (Correct answer)
To monitor and log DNS requests
To provide encrypted tunnels for remote users
To filter network traffic based on IP addresses and ports

Correct answer: To inspect and filter HTTP/HTTPS traffic to protect web applications from attacks like SQLi and XSS

A WAF operates at Layer 7, analyzing HTTP/HTTPS traffic to detect and block web-specific attacks including SQL injection, cross-site scripting, and OWASP Top 10 threats.

Question 4: Which countermeasure directly protects against evil twin attacks by cryptographically binding the network identity to the authentication exchange?

Hiding the SSID in beacon frames
Setting maximum transmit power to overpower the rogue AP
Using certificate-based mutual authentication (EAP-TLS) with 802.1X (Correct answer)
Enabling MAC address filtering on the legitimate AP

Correct answer: Using certificate-based mutual authentication (EAP-TLS) with 802.1X

EAP-TLS requires the authentication server to present a certificate the client validates, so a rogue AP cannot complete the mutual auth exchange — the client detects the missing or invalid server certificate and refuses to connect.

Question 5: In the context of network defense, what is the purpose of a bastion host?

A hardened host providing a single access point between public and private networks (Correct answer)
A system that stores centralized authentication credentials
A device that load balances incoming web traffic
A server used solely for data backup

Correct answer: A hardened host providing a single access point between public and private networks

A bastion host is a specially hardened system exposed to the internet that acts as a gateway into an internal network, minimizing the attack surface through strict configuration.

Question 6: What is the MOST important leadership quality for a CND certified professional managing a team?

Achieving the highest personal performance metrics
Maintaining strict control over all decisions
Avoiding all forms of conflict within the team
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 7: Which foundational principle is MOST important for success in the Certified Network Defender profession?

Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maximizing financial returns on every engagement
Specializing in only one narrow area of practice
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 8: What is 'log tampering' and why is it a concern in forensic investigations?

An attacker deleting or modifying logs to cover their tracks (Correct answer)
Converting logs to a binary format
Backing up logs to a remote server
Compressing logs to save disk space

Correct answer: An attacker deleting or modifying logs to cover their tracks

Log tampering involves an attacker deleting, modifying, or disabling logs to erase evidence of their unauthorized activities.

Question 9: What is the role of penetration testing in threat assessment?

To make systems more vulnerable to attacks
To eliminate all threats from the network
To focus only on reducing the number of network users
To simulate attacks and identify vulnerabilities in a network or system (Correct answer)

Correct answer: To simulate attacks and identify vulnerabilities in a network or system

Penetration testing, often called ethical hacking, involves authorized simulated cyberattacks against a computer system, network, or web application. Its purpose is to identify exploitable vulnerabilities and security weaknesses that an attacker could leverage. This proactive testing helps organizations understand their security posture and improve defenses before real attacks occur.

Question 10: An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Risk avoidance
Risk acceptance (Correct answer)
Risk transference
Risk mitigation

Correct answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 11: Which network security measure is used to authenticate users based on their physical characteristics?

Username and password combinations
Biometric authentication (Correct answer)
Password protection
Smartcards

Correct answer: Biometric authentication

Biometric authentication verifies a user's identity based on unique physical or behavioral characteristics. Examples include fingerprints, facial recognition, iris scans, or voice patterns. This method offers a high level of security because biometric traits are difficult to replicate or steal, making it a robust way to authenticate users.

Question 12: What is the MOST important leadership quality for a CND certified professional managing a team?

Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Maintaining strict control over all decisions
Avoiding all forms of conflict within the team
Achieving the highest personal performance metrics

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Question 13: In NIST SP 800-30, what is the correct order of the risk assessment process?

Identify vulnerabilities, determine impact, identify threats, assess controls
Determine impact, identify threats, assess controls, determine likelihood
Identify threats, identify vulnerabilities, determine likelihood, determine impact (Correct answer)
Assess controls, identify threats, determine impact, identify vulnerabilities

Correct answer: Identify threats, identify vulnerabilities, determine likelihood, determine impact

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Question 14: Why is multi-factor authentication (MFA) important for protecting endpoint access?

It eliminates the need for passwords entirely
It prevents phishing emails from reaching the user
It ensures an attacker with stolen credentials alone cannot log in (Correct answer)
It encrypts the user's home directory automatically

Correct answer: It ensures an attacker with stolen credentials alone cannot log in

MFA requires a second factor beyond a password, so even if credentials are phished or stolen, the attacker cannot authenticate without the additional factor.

Question 15: Why is it important to have a disaster recovery plan in place for network systems?

To monitor and delay incident recovery
To prevent all future disasters from occurring
To prevent network users from accessing the systems during a disaster
To restore systems and data after an incident, ensuring business continuity (Correct answer)

Correct answer: To restore systems and data after an incident, ensuring business continuity

A disaster recovery plan (DRP) outlines the procedures an organization will follow to resume critical business operations after a disruptive event, such as a natural disaster, cyberattack, or system failure. Its importance lies in minimizing downtime and data loss, ensuring that the organization can quickly recover its IT infrastructure and data, thereby maintaining business continuity and resilience.

Question 16: A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?

Hot site with real-time data replication (Correct answer)
Weekly tape backups stored offsite
Manual processing using paper records
Cold site provisioned within 72 hours

Correct answer: Hot site with real-time data replication

A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.

Question 17: A quantitative risk analysis assigns monetary values to risk. What does the term 'Annual Loss Expectancy (ALE)' represent?

The cost of implementing security controls
The maximum possible loss from a single incident
The product of SLE and ARO (Correct answer)
The percentage chance a threat will occur in a year

Correct answer: The product of SLE and ARO

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), giving the expected yearly financial loss.

Question 18: Which concept describes using SIEM correlation rules to detect when a user logs in from two geographically impossible locations within a short time period?

Lateral movement detection
Privilege escalation alerting
Data exfiltration monitoring
Impossible travel detection (Correct answer)

Correct answer: Impossible travel detection

Impossible travel detection is a SIEM use case that flags authentications from geographically distant locations within a timeframe that would be physically impossible, indicating credential compromise.

Question 19: What is the primary purpose of risk management in cybersecurity?

To increase the likelihood of security breaches
To ignore potential threats
To delay response to security incidents
To assess, prioritize, and mitigate risks to protect systems and data (Correct answer)

Correct answer: To assess, prioritize, and mitigate risks to protect systems and data

The primary purpose of risk management in cybersecurity is to proactively identify, analyze, and evaluate potential threats and vulnerabilities to an organization's assets. By assessing the likelihood and impact of these risks, organizations can prioritize and implement appropriate controls and mitigation strategies. This systematic approach aims to protect systems and data from harm while aligning with business objectives.

Question 20: Which statement BEST describes the relationship between Certified Network Defender certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Changes only occur when government mandates new requirements
Requirements become less stringent over time
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Question 21: A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?

Implementing 802.1X port-based authentication
Hiding the network name to reduce casual discovery (SSID cloaking) (Correct answer)
Enabling WPA3 protection on the access point
Enabling band steering to push clients to 5 GHz

Correct answer: Hiding the network name to reduce casual discovery (SSID cloaking)

SSID cloaking (hiding) sets the SSID field to null in beacon frames, making the network invisible to casual scanners; however, passive sniffers can still capture the SSID from probe requests and responses.

Question 22: Which framework uses a five-function structure — Identify, Protect, Detect, Respond, Recover — for managing cybersecurity risk?

COBIT 5
ISO/IEC 27001
CIS Controls
NIST Cybersecurity Framework (CSF) (Correct answer)

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 23: Which wireless security protocol introduced CCMP as its mandatory encryption algorithm?

WPA2 (Correct answer)
WEP
WPA3-Personal
WPA (TKIP)

Correct answer: WPA2

WPA2 mandates CCMP (Counter Mode CBC-MAC Protocol) based on AES, replacing the weaker TKIP used by WPA.

Question 24: In network forensics, what is the purpose of 'packet carving'?

Reconstructing files and data from raw packet streams (Correct answer)
Encrypting captured packets for storage
Splitting large PCAP files into smaller segments
Filtering packets by protocol type

Correct answer: Reconstructing files and data from raw packet streams

Packet carving reconstructs files, images, or documents from reassembled packet payloads captured in a PCAP file.

Question 25: Which TLS handshake message is used by the client to prove possession of a private key during mutual authentication?

Finished
Certificate
CertificateVerify (Correct answer)
ClientHello

Correct answer: CertificateVerify

The CertificateVerify message contains a digital signature over handshake data, proving the client holds the private key.

Question 26: How does the CND body of knowledge relate to daily professional practice?

It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It only applies during certification exams
It is theoretical and has limited practical application

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 27: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Delay reporting until results are favorable
Discard the results and start over completely
Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 28: In network traffic analysis, what does a sudden spike in ICMP traffic from a single internal host typically indicate?

A potential ping flood or network reconnaissance sweep (Correct answer)
Standard operating system update downloads
Normal DNS resolution activity
Routine certificate renewal traffic

Correct answer: A potential ping flood or network reconnaissance sweep

An unusual spike in ICMP traffic from one host often signals a ping sweep for network reconnaissance, a ping flood DoS attack, or malware attempting to map the network.

Question 29: What is the primary objective of an incident response plan in cybersecurity?

To ignore incidents and continue with normal operations
To delay the response until further analysis is completed
To quickly detect, respond, and recover from a security incident to minimize damage (Correct answer)
To increase the number of users affected by the incident

Correct answer: To quickly detect, respond, and recover from a security incident to minimize damage

An incident response plan provides a structured approach for an organization to handle cybersecurity incidents. Its primary objective is to enable a rapid and effective response to security breaches, limiting their impact, restoring normal operations as quickly as possible, and learning from the incident to prevent future occurrences. This minimizes financial, reputational, and operational damage.

Question 30: What is the purpose of Network Address Translation (NAT) from a security perspective?

It encrypts network traffic between hosts
It monitors packets for malicious signatures
It authenticates users before granting network access
It hides internal IP addresses from external networks (Correct answer)

Correct answer: It hides internal IP addresses from external networks

NAT translates private internal IP addresses to a public IP address, effectively hiding the internal network topology from external observers.

Question 31: Which firewall rule processing model checks rules sequentially and stops at the first match?

Round-robin processing
First-match rule base (Correct answer)
Weighted priority processing
Best-match rule base

Correct answer: First-match rule base

Most firewalls use a first-match (first-fit) rule processing model where rules are evaluated top-to-bottom and the first matching rule is applied, making rule ordering critical.

Question 32: Why is employee training important in incident response?

To ensure staff know how to respond to an incident and support recovery efforts (Correct answer)
To prevent users from reporting issues
To delay incident response by creating confusion
To increase the number of people involved in the incident response

Correct answer: To ensure staff know how to respond to an incident and support recovery efforts

Employee training is critical in incident response because human error is often a significant factor in security incidents. Well-trained staff can recognize potential threats, follow established protocols, and contribute effectively to containment and recovery efforts. This proactive approach empowers employees to act as a strong first line of defense, minimizing the impact of incidents.

Question 33: What is the primary goal of OS hardening in a network defender's role?

Enable remote desktop on all workstations
Increase system performance
Reduce the attack surface by disabling unnecessary services and features (Correct answer)
Install the latest productivity software

Correct answer: Reduce the attack surface by disabling unnecessary services and features

OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.

Question 34: Which technique do attackers use to bypass application whitelisting by abusing trusted, pre-approved system tools?

Living off the Land (LotL) attacks using LOLBins (Correct answer)
SQL injection
ARP spoofing
Cross-site scripting

Correct answer: Living off the Land (LotL) attacks using LOLBins

Living off the Land attacks abuse legitimate, pre-approved system binaries (LOLBins) like PowerShell, certutil, or mshta to execute malicious code within whitelisting policies.

Question 35: KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?

The 4-way handshake used to establish session keys (Correct answer)
The DHCP IP address assignment process
The RADIUS authentication exchange
The initial beacon and probe response exchange

Correct answer: The 4-way handshake used to establish session keys

KRACK manipulates retransmissions in the WPA2 4-way handshake to force nonce reuse, allowing decryption and potentially injection of traffic by reinstalling an already-in-use cryptographic key.

Question 36: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To guarantee employment in the field
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 37: Why is compliance important in cybersecurity?

To increase the risk of noncompliance penalties
To simplify network infrastructure
To avoid paying for software licenses
To ensure legal and regulatory standards are met, protecting data and avoiding penalties (Correct answer)

Correct answer: To ensure legal and regulatory standards are met, protecting data and avoiding penalties

Compliance is crucial in cybersecurity because it ensures organizations adhere to legal, regulatory, and industry standards, such as GDPR or HIPAA. Meeting these requirements helps protect sensitive data, maintain customer trust, and avoid significant legal penalties and reputational damage. Compliance frameworks often mandate robust security practices, thereby strengthening an organization's overall security posture.

Question 38: In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

The cost to restore operations after a disaster
The maximum acceptable downtime before business impact becomes critical (Correct answer)
The maximum tolerable data loss measured in time
The point in time to which data must be recovered

Correct answer: The maximum acceptable downtime before business impact becomes critical

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Question 39: Which Windows feature uses virtualization to protect the integrity of the OS kernel from rootkits?

Windows Defender Firewall
Credential Guard
Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI) (Correct answer)
BitLocker

Correct answer: Virtualization-Based Security (VBS) / Hypervisor-Protected Code Integrity (HVCI)

VBS with HVCI uses hardware virtualization to isolate kernel code integrity checks in a protected environment, preventing kernel-level rootkits from tampering with the OS.

Question 40: Which of the following is a best practice for ensuring log integrity in a forensic context?

Rotate logs every hour and delete the previous copy
Forward logs in real time to a remote write-once log server (Correct answer)
Store logs only on the monitored host
Disable logging on high-traffic systems to reduce noise

Correct answer: Forward logs in real time to a remote write-once log server

Forwarding logs in real time to an isolated, write-once remote server prevents attackers who compromise the source system from tampering with log evidence.

Question 41: What is the role of a network access control (NAC) system?

To encrypt all data packets on the network
To block all network traffic
To enforce security policies and control access based on device compliance (Correct answer)
To monitor network traffic for breaches

Correct answer: To enforce security policies and control access based on device compliance

Network Access Control (NAC) systems manage and enforce security policies for devices attempting to connect to a network. NAC checks devices for compliance with security policies, such as having up-to-date antivirus software or specific operating system patches, before granting or denying network access. This ensures that only healthy and authorized devices can connect, reducing the risk of malware spreading.

Question 42: Which wireless security protocol introduced Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key (PSK) handshake and eliminate offline dictionary attacks?

WPA3-Personal (Correct answer)
WPA2-Enterprise
WEP2
WPA2-Personal

Correct answer: WPA3-Personal

WPA3-Personal replaces PSK with SAE (a Dragonfly-based handshake), which is resistant to offline dictionary attacks because an attacker cannot test a captured handshake without interacting with the network each time.

Question 43: The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?

The 8-digit PIN is validated in two halves independently, reducing the keyspace (Correct answer)
The PIN is transmitted in plaintext over the air
WPS uses RC4 encryption instead of AES
The PIN is derived from the MAC address of the AP

Correct answer: The 8-digit PIN is validated in two halves independently, reducing the keyspace

WPS validates the first 4 digits of the PIN separately from the last 4 (minus a checksum digit), reducing the brute-force space from 10^8 to roughly 10^4 + 10^3 = ~11,000 guesses.

Question 44: Which protocol is used by network devices to synchronize clocks, which is critical for accurate log correlation during incident response?

Syslog
NTP (Correct answer)
SNMP
LDAP

Correct answer: NTP

NTP (Network Time Protocol) synchronizes device clocks, ensuring log timestamps are consistent across the network for accurate forensic analysis.

Question 45: What is the MOST effective way for new CND professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Learning entirely through trial and error
Studying certification materials exclusively
Focusing solely on the most advanced topics

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 46: How does continuous monitoring support risk management?

By slowing down network performance to prevent breaches
By providing real-time detection of threats and enabling proactive risk mitigation (Correct answer)
By preventing all network traffic
By blocking all incoming data packets

Correct answer: By providing real-time detection of threats and enabling proactive risk mitigation

Continuous monitoring supports risk management by providing ongoing, real-time visibility into an organization's security posture and potential threats. This constant oversight allows for immediate detection of anomalies, vulnerabilities, and active attacks, enabling proactive risk mitigation before significant damage occurs. It ensures that security controls remain effective and adapt to evolving threat landscapes.

Question 47: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Allocate all resources equally regardless of need
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Focus resources only on the largest tasks
Keep significant reserves without deployment

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 48: Which security benchmark is widely used as a baseline for endpoint hardening configurations?

MITRE ATT&CK
CIS Benchmarks (Correct answer)
OWASP Top 10
CVE Dictionary

Correct answer: CIS Benchmarks

CIS (Center for Internet Security) Benchmarks provide prescriptive, consensus-based hardening guidelines for operating systems, applications, and network devices.

Question 49: What does EDR (Endpoint Detection and Response) provide beyond traditional antivirus?

Patch deployment across endpoints
Only signature-based malware scanning
Firewall rule management
Continuous behavioral monitoring, threat hunting, and incident response capabilities (Correct answer)

Correct answer: Continuous behavioral monitoring, threat hunting, and incident response capabilities

EDR solutions monitor endpoint behavior continuously, detect anomalies indicative of advanced threats, and provide tools for investigation and remediation.

Question 50: Which assessment method provides the MOST reliable data for CND professionals making critical decisions?

Informal verbal feedback alone
Standardized tools combined with professional observation (Correct answer)
Single-source data from one stakeholder
Social media reviews and testimonials

Correct answer: Standardized tools combined with professional observation

Combining standardized assessment tools with professional observation provides the most reliable and comprehensive data. Standardized tools ensure consistency and validity, while professional observation captures nuances that tools might miss.

Question 51: Which foundational principle is MOST important for success in the Certified Network Defender profession?

Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Specializing in only one narrow area of practice
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Question 52: Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?

Static analysis
Dynamic analysis (sandboxing) (Correct answer)
Code review
Signature scanning

Correct answer: Dynamic analysis (sandboxing)

Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.

Question 53: Which stakeholder engagement strategy is MOST effective for CND professionals leading initiatives?

Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Engage stakeholders only when their approval is needed
Limit engagement to senior leadership only
Inform stakeholders only after decisions are made

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 54: A network defender wants to prevent wireless clients from communicating directly with each other on the same AP while still allowing internet access. Which AP feature accomplishes this?

Client isolation (AP isolation / PSPF) (Correct answer)
Beamforming to direct signals toward the router
WMM (Wi-Fi Multimedia) QoS profiles
Band steering to separate client types

Correct answer: Client isolation (AP isolation / PSPF)

Client isolation (sometimes called AP isolation or Publicly Secure Packet Forwarding) blocks Layer 2 traffic between wireless clients on the same SSID, preventing peer-to-peer attacks like ARP poisoning while allowing uplink access.

Question 55: Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation?

Identification
Lessons Learned
Detection
Eradication (Correct answer)

Correct answer: Eradication

Eradication is the phase where root causes are eliminated — malware removed, patches applied, and compromised credentials reset — before systems are returned to production.

Question 56: What role does communication play in disaster recovery?

To confuse users and prevent recovery
To stop the recovery efforts until further analysis is completed
To limit communication to only internal teams
To keep stakeholders informed and coordinated during recovery (Correct answer)

Correct answer: To keep stakeholders informed and coordinated during recovery

Effective communication is vital during disaster recovery to ensure all involved parties, from technical teams to senior management and external stakeholders, are informed and coordinated. This prevents confusion, manages expectations, and facilitates a smooth, synchronized effort to restore operations. Clear communication ensures everyone understands their roles and the current status of recovery efforts.

Question 57: What does the term 'chain of custody' mean in the context of network forensics?

The sequence of firewall rules applied to traffic
Documented handling of evidence from collection to court presentation (Correct answer)
A VPN tunnel encryption sequence
The order in which logs are rotated

Correct answer: Documented handling of evidence from collection to court presentation

Chain of custody documents every person who handled digital evidence and every action taken, ensuring admissibility in legal proceedings.

Question 58: An organization wants to comply with ISO/IEC 27001. Which document serves as the foundation by defining the scope, objectives, and boundaries of the Information Security Management System (ISMS)?

Asset Inventory
Risk Treatment Plan
Information Security Policy
Statement of Applicability (SoA) (Correct answer)

Correct answer: Statement of Applicability (SoA)

The Statement of Applicability (SoA) documents which ISO/IEC 27001 Annex A controls are applicable and justified for the organization's ISMS scope.

Question 59: Which encryption cipher suite is mandatory in WPA2 and provides stronger security than TKIP?

DES
RC4
TKIP
CCMP (AES) (Correct answer)

Correct answer: CCMP (AES)

CCMP, based on AES in Counter Mode with CBC-MAC, is the mandatory cipher suite in WPA2 and provides data confidentiality, integrity, and replay protection superior to TKIP.

Question 60: During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?

Disabling all network interfaces permanently
Immediate shutdown of the host
Reinstalling the operating system
Network segmentation using VLAN or firewall ACL changes (Correct answer)

Correct answer: Network segmentation using VLAN or firewall ACL changes

Network segmentation via VLANs or ACLs isolates the compromised host from the rest of the network while keeping it powered on to preserve volatile memory evidence.

Question 61: A security team uses Aircrack-ng to test their wireless network. After capturing the 4-way handshake, what additional step is required to attempt to recover the WPA2-PSK?

Replay the handshake packets to force re-authentication
Inject deauthentication frames to obtain the session key directly
Perform ARP poisoning to redirect traffic through the attacker machine
Run a dictionary or brute-force attack against the captured handshake offline (Correct answer)

Correct answer: Run a dictionary or brute-force attack against the captured handshake offline

Once the 4-way handshake is captured, Aircrack-ng performs offline dictionary or brute-force attacks by trying candidate passphrases through the PBKDF2-HMAC-SHA1 function to see if the computed MIC matches the captured one.

Question 62: What is the significance of timestamps in log analysis during a forensic investigation?

They compress log data
They establish the sequence and timing of events (Correct answer)
They encrypt log entries
They determine log file size

Correct answer: They establish the sequence and timing of events

Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.

Question 63: Which EAP method provides the strongest security by requiring both the client and the authentication server to present digital certificates?

EAP-TLS (Correct answer)
LEAP
EAP-MD5
EAP-FAST

Correct answer: EAP-TLS

EAP-TLS requires mutual certificate-based authentication — both the supplicant and the RADIUS server present X.509 certificates — making it immune to password-based attacks and the most secure EAP method.

Question 64: Why is regular vulnerability scanning important in network security?

To reduce the network’s capacity
To delay remediation of network vulnerabilities
To make the network more vulnerable
To identify and address vulnerabilities before they are exploited (Correct answer)

Correct answer: To identify and address vulnerabilities before they are exploited

Regular vulnerability scanning is vital because it systematically checks systems and networks for known security weaknesses. By continuously identifying these vulnerabilities, organizations can patch or reconfigure systems before attackers can discover and exploit them. This proactive measure significantly reduces the risk of successful cyberattacks and data breaches.

Question 65: What is the role of a Certificate Revocation List (CRL) in PKI?

List certificates no longer trusted before expiry (Correct answer)
Encrypt private keys
Validate certificate chain length
Store issued certificates

Correct answer: List certificates no longer trusted before expiry

A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.

Question 66: What is the primary function of a Security Information and Event Management (SIEM) system?

To aggregate and correlate security event logs from multiple sources for analysis (Correct answer)
To encrypt communications between endpoints
To manage user access control policies
To automatically patch vulnerabilities across the network

Correct answer: To aggregate and correlate security event logs from multiple sources for analysis

A SIEM collects, normalizes, and correlates log data from diverse sources (firewalls, IDS, servers) to provide real-time security monitoring, alerting, and forensic analysis.

Question 67: Which wireless intrusion detection/prevention capability detects rogue access points by comparing detected BSSIDs against an authorized AP list and alerts on unauthorized devices?

Network Access Control (NAC) enforcement
Wireless IDS (WIDS) with AP monitoring (Correct answer)
DHCP snooping on the wired switch
ARP inspection on the distribution layer

Correct answer: Wireless IDS (WIDS) with AP monitoring

A Wireless IDS (WIDS) continuously monitors the RF environment, catalogs all detected APs, and compares them against the authorized AP database to alert defenders when unknown or rogue APs appear.

Question 68: Which assessment method provides the MOST reliable data for CND professionals making critical decisions?

Standardized tools combined with professional observation (Correct answer)
Informal verbal feedback alone
Single-source data from one stakeholder
Social media reviews and testimonials

Correct answer: Standardized tools combined with professional observation

Question 69: What is the purpose of log normalization in a SIEM system?

Encrypting logs to prevent tampering
Converting logs from different sources into a common format for correlation (Correct answer)
Deleting old logs to free storage space
Forwarding alerts to the incident response team

Correct answer: Converting logs from different sources into a common format for correlation

Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.

Question 70: Which federal law mandates that US government agencies implement information security programs and report to OMB annually?

HIPAA
SOX
FERPA
FISMA (Correct answer)

Correct answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement agency-wide information security programs.

Question 71: What is baseline monitoring in the context of network security operations?

Documenting all installed software versions
Establishing normal network behavior patterns to identify anomalies (Correct answer)
Creating backup copies of network configurations
Running daily vulnerability scans against all systems

Correct answer: Establishing normal network behavior patterns to identify anomalies

Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.

Question 72: How does risk mitigation differ from risk acceptance?

Risk mitigation involves ignoring risks, while risk acceptance reduces them
Risk mitigation and risk acceptance are the same
Risk mitigation reduces or eliminates risks, while risk acceptance acknowledges risks without action (Correct answer)
Risk mitigation ignores risks, and risk acceptance prevents all potential threats

Correct answer: Risk mitigation reduces or eliminates risks, while risk acceptance acknowledges risks without action

Risk mitigation involves actively implementing controls and strategies to reduce the likelihood or impact of identified risks, such as deploying firewalls or encrypting data. In contrast, risk acceptance is a conscious decision to acknowledge a risk and its potential consequences without taking specific action to reduce it, often because the cost of mitigation outweighs the potential impact. These are distinct strategies for managing identified risks.

Question 73: An attacker sets up a wireless access point near a coffee shop that mimics the legitimate free Wi-Fi, hoping users will connect to it. This is known as which attack?

Evil twin attack (Correct answer)
RF jamming
Bluesnarfing
Wardriving

Correct answer: Evil twin attack

An evil twin attack creates a fraudulent AP that mimics a legitimate one, tricking users into connecting so the attacker can intercept traffic, capture credentials, or conduct man-in-the-middle attacks.

Question 74: A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?

Disconnect affected systems from the network to prevent further spread (Correct answer)
Reimage all 200 workstations simultaneously
Notify all employees about the attack via company email
Pay the ransom to restore operations quickly

Correct answer: Disconnect affected systems from the network to prevent further spread

Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.

Question 75: What is the purpose of a playbook (runbook) in a Security Operations Center?

A configuration guide for firewall rule creation
A report template for executive security briefings
A document listing all network IP addresses and device inventories
A documented, step-by-step procedure for responding to specific types of security incidents (Correct answer)

Correct answer: A documented, step-by-step procedure for responding to specific types of security incidents

SOC playbooks provide analysts with standardized, repeatable procedures for responding to specific incident types, ensuring consistent, efficient responses and reducing the chance of missed steps during high-pressure situations.

Question 76: Which protocol replaces Telnet with encrypted remote management and supports public key authentication?

SSH (Correct answer)
HTTPS
RDP
SFTP

Correct answer: SSH

SSH (Secure Shell) encrypts all traffic and supports password or public-key authentication for remote CLI access.

Question 77: What is the significance of incident response testing?

To focus solely on monitoring systems without action
To test the plan’s effectiveness and make necessary improvements (Correct answer)
To prevent any incidents from happening
To delay incident response processes

Correct answer: To test the plan’s effectiveness and make necessary improvements

Incident response testing is essential for validating the effectiveness of an organization's incident response plan. By simulating real-world scenarios, testing helps identify weaknesses, gaps, and areas where the plan might fail under pressure. This allows for necessary adjustments and improvements, ensuring that the organization is well-prepared to handle actual security incidents efficiently.

Question 78: In an 802.1X wireless deployment, what role does the RADIUS server fulfill?

It manages IP address assignment for wireless clients
It serves as the Authentication Server (AS) that validates supplicant credentials (Correct answer)
It functions as the authenticator that enforces port access
It acts as the wireless access point providing RF signals

Correct answer: It serves as the Authentication Server (AS) that validates supplicant credentials

In 802.1X, the RADIUS server acts as the Authentication Server (AS), receiving forwarded credentials from the authenticator (AP) and making accept/reject decisions based on identity validation.

Question 79: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment in the field
To bypass educational requirements
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 80: Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?

RTO (Recovery Time Objective)
MTBF (Mean Time Between Failures)
MTTR (Mean Time to Repair)
RPO (Recovery Point Objective) (Correct answer)

Correct answer: RPO (Recovery Point Objective)

RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.

Question 81: What is the primary benefit of implementing a centralized log management solution (like a SIEM) over reviewing logs on individual systems?

It eliminates the need for endpoint security solutions
It enables cross-system correlation to identify attack patterns spanning multiple devices (Correct answer)
It automatically remediates detected security issues
It reduces the storage space required for logs

Correct answer: It enables cross-system correlation to identify attack patterns spanning multiple devices

Centralized log management allows security analysts to correlate events across multiple systems, making it possible to detect multi-stage attacks that would appear innocuous when viewed in isolation on individual devices.

Question 82: Which of the following protocols is used to secure communications on the internet?

Telnet
FTP
HTTP
TLS (Transport Layer Security) (Correct answer)

Correct answer: TLS (Transport Layer Security)

TLS (Transport Layer Security) is a cryptographic protocol designed to provide communication security over a computer network. It is widely used for securing web browsing (HTTPS), email, and other data transfers, ensuring data privacy and integrity between communicating applications. HTTP, FTP, and Telnet are older protocols that either lack inherent security or are less secure.

Question 83: What is the function of a Security Information and Event Management (SIEM) system?

To store unencrypted sensitive data
To prevent users from accessing sensitive data
To block all external connections to the network
To monitor, detect, and respond to security incidents by analyzing event data (Correct answer)

Correct answer: To monitor, detect, and respond to security incidents by analyzing event data

A Security Information and Event Management (SIEM) system centralizes and analyzes security logs and event data from various sources across an organization's network. Its primary function is to provide real-time monitoring, detect suspicious activities, and alert security teams to potential threats or incidents. This enables rapid response and investigation, enhancing an organization's overall security posture.

Question 84: A threat agent exploits a software vulnerability to gain unauthorized access. In risk terminology, what is the 'threat agent'?

The control designed to prevent exploitation
The impact of the successful attack
The entity that takes advantage of the vulnerability (Correct answer)
The weakness in the software

Correct answer: The entity that takes advantage of the vulnerability

A threat agent (or threat actor) is the person, group, or entity that initiates and carries out an attack by exploiting a vulnerability.

Question 85: When documenting assessment findings in CND practice, which approach is MOST appropriate?

Use technical jargon that only experts can understand
Record objective findings, measurements, and professional observations factually (Correct answer)
Summarize findings verbally without written documentation
Include only positive findings to maintain optimism

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 86: What is the purpose of Windows Defender Credential Guard?

Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft (Correct answer)
Encrypt credentials in transit over the network
Enforce password complexity on domain accounts
Scan credentials stored in browsers for malware

Correct answer: Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft

Credential Guard uses VBS to store NTLM and Kerberos credential material in an isolated hypervisor-protected environment, preventing Pass-the-Hash and Pass-the-Ticket attacks.

Question 87: What is the role of incident response in risk management?

To delay responses until further analysis is completed
To react to incidents, minimize damage, and recover from security breaches (Correct answer)
To prevent any incidents from happening
To create new risks for the organization

Correct answer: To react to incidents, minimize damage, and recover from security breaches

Incident response is a critical component of risk management that focuses on the reactive phase of dealing with security breaches. Its role is to quickly detect, contain, eradicate, and recover from security incidents to minimize damage and restore normal operations. By effectively managing incidents, organizations can reduce financial losses, reputational harm, and operational disruption caused by security events.

Question 88: Port security on a network switch is primarily used to defend against which type of attack?

SQL injection
DNS poisoning
Man-in-the-middle via TLS stripping
MAC flooding attacks (Correct answer)

Correct answer: MAC flooding attacks

Port security limits the number of MAC addresses allowed on a switch port, preventing MAC flooding attacks that attempt to overflow the CAM table and cause the switch to broadcast all traffic.

Question 89: What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?

Events require immediate escalation; incidents do not
Events are always malicious; incidents may be benign
An incident is an adverse event that threatens security; an event is any observable occurrence (Correct answer)
Incidents occur only on endpoints; events occur only on networks

Correct answer: An incident is an adverse event that threatens security; an event is any observable occurrence

NIST SP 800-61 defines an event as any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

Question 90: What is the primary function of a Security Information and Event Management (SIEM) system in incident response?

Performing automated vulnerability scans on all network devices
Encrypting sensitive data at rest across the enterprise
Blocking malware before it executes on endpoints
Aggregating and correlating log data from multiple sources to detect incidents (Correct answer)

Correct answer: Aggregating and correlating log data from multiple sources to detect incidents

A SIEM collects, normalizes, and correlates log and event data from across the environment to detect suspicious patterns and generate alerts for incident responders.

Question 91: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Conduct additional assessment using alternative methods (Correct answer)
Discard the results and start over completely
Delay reporting until results are favorable

Correct answer: Conduct additional assessment using alternative methods

Question 92: Which risk analysis method uses expert opinion and descriptive ratings such as 'High,' 'Medium,' and 'Low' rather than numerical values?

Monte Carlo simulation
Quantitative analysis
Delphi method
Qualitative analysis (Correct answer)

Correct answer: Qualitative analysis

Qualitative risk analysis uses subjective ratings and expert judgment instead of precise monetary or numerical calculations.

Question 93: In network forensics, what does 'log normalization' refer to?

Compressing log archives
Deleting redundant log entries
Converting logs from different sources into a common format (Correct answer)
Encrypting log files at rest

Correct answer: Converting logs from different sources into a common format

Log normalization transforms heterogeneous log formats from various devices and applications into a unified schema for consistent analysis.

Question 94: What is the function of Intrusion Detection Systems (IDS)?

To scan emails for viruses
To prevent attacks by blocking incoming traffic
To monitor and alert on suspicious activities or breaches (Correct answer)
To prevent all network traffic

Correct answer: To monitor and alert on suspicious activities or breaches

Intrusion Detection Systems (IDS) are security tools that continuously monitor network or system activities for malicious activities or policy violations. When suspicious patterns or known attack signatures are detected, an IDS generates alerts to security personnel. Its primary role is to detect and notify, rather than to actively block traffic.

Question 95: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To bypass educational requirements
To guarantee employment in the field
To demonstrate verified competency and adherence to professional standards (Correct answer)
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 96: What role does vulnerability management play in network security?

To remove all software updates
To allow all vulnerabilities to remain unaddressed
To make the network easier to access
To identify, prioritize, and remediate security vulnerabilities to reduce risk (Correct answer)

Correct answer: To identify, prioritize, and remediate security vulnerabilities to reduce risk

Vulnerability management is a continuous process of identifying, assessing, reporting, and remediating security vulnerabilities in systems and software. Its goal is to reduce an organization's attack surface and overall risk by systematically finding and fixing weaknesses before they can be exploited by attackers. This proactive approach is essential for maintaining a strong security posture.

Question 97: Which security monitoring approach uses pre-defined signatures or rules to identify known attack patterns, and what is its primary limitation?

Heuristic detection; requires too much manual tuning
Anomaly-based detection; cannot handle high traffic volumes
Signature-based detection; cannot detect unknown or zero-day attacks (Correct answer)
Behavioral detection; generates too many false positives

Correct answer: Signature-based detection; cannot detect unknown or zero-day attacks

Signature-based detection is effective against known threats but cannot detect novel zero-day exploits or attacks that haven't been cataloged in the signature database, making it reactive rather than proactive.

Question 98: What does encryption do in the context of network security?

It simplifies the security protocols used by the network
It makes data readable by all users
It allows unrestricted access to sensitive data
It encodes data to prevent unauthorized access (Correct answer)

Correct answer: It encodes data to prevent unauthorized access

Encryption is the process of converting information or data into a code to prevent unauthorized access. It transforms plaintext into ciphertext using an algorithm and a key, making the data unreadable to anyone without the correct decryption key. This ensures confidentiality and protects sensitive information during storage and transmission.

Question 99: Which SNMPv3 security level provides both authentication and encryption?

authPriv (Correct answer)
authNoPriv
privNoAuth
noAuthNoPriv

Correct answer: authPriv

authPriv uses HMAC for authentication and DES/AES for encryption, providing the highest SNMPv3 security level.

Question 100: During a risk assessment, an analyst finds that a web server is exposed to SQL injection. The vulnerability is the weakness, and the threat is malicious input. What is the 'risk' in this scenario?

The probability that the SQL injection succeeds combined with the resulting impact (Correct answer)
The web server hardware itself
The database administrator's lack of awareness
The firewall protecting the server

Correct answer: The probability that the SQL injection succeeds combined with the resulting impact

Risk is the combination of the likelihood that a threat exploits a vulnerability and the potential impact of that exploitation.

Certified Network Defender (CND) v2 Exam (312-38)

The CND certification validates the skills of network administrators to protect, detect, and respond to network attacks, ensuring network security.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Eligibility, fees, renewal, score validity, retake fee, exam format, passing score, time limit, exam information · verified Nov 2026
eccouncil.org — Test delivery · verified Oct 2026