CertArea
All EC-Council exams

Free Certified Network Defender (CND) practice test: 30 questions with answers

30 original questions for Certified Network Defender (CND), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Network Defender (CND) exam guide: topics, cost and format

All 30 Certified Network Defender (CND) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Administrative and Technical Network Security (5 questions)

  1. Question 1

    Which control enforces least privilege for network device administration?

    1. AA shared administrator account, so that the team can share the same access easily
    2. BTelnet access from any internal host, so that administrators can log in quickly
    3. CThe default vendor passwords, which are kept unchanged so that the team never gets locked out
    4. DRole-based access with individual accounts, centrally authenticated through AAA such as TACACS+
    Show answer and explanation
    Correct answer: D

    Individual accounts with role-based permissions, authenticated centrally through AAA, enforce least privilege and provide accountability. Shared accounts, Telnet and default passwords each weaken administration.

  2. Question 2

    Which AAA protocol encrypts the entire payload of administrative login and command authorisation traffic?

    1. ATelnet, which sends the administrator's credentials and commands in clear text across the network
    2. BRADIUS, which encrypts only the password field, leaving the other attributes in clear text
    3. CTACACS+, which encrypts the full packet payload between the device and the server
    4. DHTTP, which transfers the administrative pages without any encryption at all between the parties
    Show answer and explanation
    Correct answer: C

    TACACS+ encrypts the entire payload, while RADIUS encrypts only the password. Telnet and HTTP send administrative data without encryption.

  3. Question 3

    Which practice most reduces the size of broadcast domains on a campus network?

    1. APlacing every port in VLAN 1, so that all devices share one broadcast domain
    2. BSegmenting users, servers and management traffic into separate VLANs with routing between them
    3. CBuilding one large flat network, so that all devices can talk to each other without restriction
    4. DUsing a shared trunk with no pruning, so that every VLAN reaches every switch on the network
    Show answer and explanation
    Correct answer: B

    Separate VLANs for users, servers and management confine broadcasts to smaller domains, with routing controlling traffic between them. A flat network, a single default VLAN and unpruned trunks all enlarge the broadcast domain.

  4. Question 4

    Which control blocks an unauthorised device from gaining access through a wired switch port?

    1. ADisabling switch logging, so that the port does not write unnecessary entries to the log
    2. B802.1X port-based authentication, combined with network access control (NAC) policies
    3. CReplacing the switches with hubs, so that every connected device sees all of the traffic
    4. DLeaving every port open to all devices, so that new equipment can be connected without delay
    Show answer and explanation
    Correct answer: B

    802.1X port-based authentication with NAC policies allows only authenticated devices onto the network. Disabling logs, using hubs and leaving ports open each remove the control.

  5. Question 5

    Which wireless security protocol should be retired because it is broken and offers no meaningful protection?

    1. AWPA3-SAE, which provides strong password authentication for personal wireless networks
    2. BWPA2-Enterprise with AES, which uses centralised authentication and strong encryption
    3. CWEP, which uses weak RC4 keys that can be recovered quickly by an attacker with the right tools
    4. DWPA2 with a strong passphrase and AES, which is the standard choice for personal networks
    Show answer and explanation
    Correct answer: C

    WEP uses weak RC4 keys that can be cracked quickly, so it provides no meaningful protection. WPA3-SAE, WPA2-Enterprise and WPA2 with AES are current protections.

Perimeter and Endpoint Security (5 questions)

  1. Question 6

    Where should a web server that is exposed to the internet typically be placed?

    1. AIn a DMZ, with firewall rules that restrict its access to the internal network
    2. BInside the internal LAN with no firewall between the web server and the internal hosts
    3. COn the same VLAN as the finance servers, so that its management is simpler to coordinate
    4. DOn a staff member's personal laptop, which the staff member keeps running during the working day
    Show answer and explanation
    Correct answer: A

    A DMZ isolates internet-facing servers, and firewall rules restrict what they can reach inside the network. Placing the web server inside the LAN, on the finance VLAN or on a laptop exposes internal systems.

  2. Question 7

    Which device monitors traffic inline and blocks known malicious patterns before they reach their destination?

    1. AAn intrusion detection system (IDS), which only alerts and does not block traffic inline
    2. BA network hub, which repeats traffic to every port and does not inspect the content at all
    3. CAn intrusion prevention system (IPS), which sits inline and blocks known malicious traffic
    4. DA repeater, which regenerates the signal on a cable and does not analyse or block any traffic
    Show answer and explanation
    Correct answer: C

    An IPS sits inline and can block known malicious traffic, while an IDS alerts. Hubs and repeaters do not inspect or block traffic.

  3. Question 8

    Which endpoint control detects and responds to malicious behaviour on a host, using signatures, heuristics and behavioural analysis?

    1. AA printer driver, which controls how documents are sent to the printers on the network
    2. BEndpoint detection and response (EDR), which monitors host behaviour and responds to threats
    3. CA browser cache, which stores the pages a user visits so they can load faster next time
    4. DA monitor setting, which controls the display brightness and refresh rate of the screen
    Show answer and explanation
    Correct answer: B

    EDR monitors host behaviour and responds to threats using signatures, heuristics and behavioural analysis. Printer drivers, browser caches and monitor settings are unrelated to endpoint threat detection.

  4. Question 9

    What is the main purpose of a host-based firewall?

    1. ATo restrict inbound and outbound connections on a single host, as a last layer of defence
    2. BTo log printer usage across the organisation for cost recovery and charge-back reporting
    3. CTo route traffic between VLANs, acting as the core switch for the internal network
    4. DTo replace the network firewall at the perimeter, so that the perimeter device is no longer needed
    Show answer and explanation
    Correct answer: A

    A host-based firewall restricts inbound and outbound connections on an individual host, which adds a defence layer. It does not replace the perimeter firewall, log printing or route between VLANs.

  5. Question 10

    Which technology allows only approved applications to run on an endpoint?

    1. AApplication whitelisting, which allows only the software on an approved list to execute
    2. BDHCP, which assigns IP addresses to devices that connect to the network automatically
    3. CNTP, which synchronises the clocks of the devices on the network with a time source
    4. DSNMP, which collects status information from network devices and reports it to a manager
    Show answer and explanation
    Correct answer: A

    Application whitelisting allows only approved software to execute. DHCP, NTP and SNMP provide network services or monitoring rather than application control.

Data and Application Security (5 questions)

  1. Question 11

    Which control protects data in transit between a client and a web server?

    1. AHashing the user's password, which protects the stored password in the database only
    2. BFull-disk encryption on the client laptop, which protects data that is stored on the device
    3. CTLS, which encrypts the data as it moves between the client and the server
    4. DPrinter settings that restrict which users may print the documents sent from the web server
    Show answer and explanation
    Correct answer: C

    TLS encrypts data in transit between the client and server. Password hashing and disk encryption protect data at rest, and printer settings are unrelated.

  2. Question 12

    What does a cryptographic hash function provide?

    1. AIntegrity verification, which shows whether data has changed, without providing confidentiality
    2. BA secure key exchange between two parties, which allows them to agree on a shared secret
    3. CData compression, which reduces the size of files so that they can be stored more cheaply
    4. DReversible encryption, so that the original data can be recovered with the correct key
    Show answer and explanation
    Correct answer: A

    A cryptographic hash verifies integrity, showing whether data has changed, but it does not provide confidentiality or reversible encryption. Key exchange and compression are different functions.

  3. Question 13

    Which technique prevents SQL injection in application code?

    1. ADisabling password requirements for database logins, so that users can log in more easily
    2. BConcatenating user input directly into the SQL query text, which is quick to write and test
    3. CParameterised queries, which keep user input separate from the SQL command structure
    4. DSending the query parameters in the URL with GET requests, which keeps the input visible
    Show answer and explanation
    Correct answer: C

    Parameterised queries separate user input from the command structure so that input cannot change the SQL. Concatenation, disabled passwords and GET parameters all make injection easier.

  4. Question 14

    Which data loss prevention (DLP) capability addresses sensitive data leaving the organisation by email?

    1. APrinter logs, which record which documents were printed on each device and when they were printed
    2. BNTP, which keeps the clocks of the mail servers synchronised with the time source
    3. CDNS cache, which stores the recent name lookups made by the devices on the network
    4. DContent inspection of outbound email, with a policy action such as block, encrypt or quarantine
    Show answer and explanation
    Correct answer: D

    Content inspection of outbound email with a policy action such as block, encrypt or quarantine addresses sensitive data leaving by email. Printer logs, DNS caches and NTP do not inspect email content.

  5. Question 15

    Which two controls protect data at rest? (Choose two.)

    1. AFull-disk or database encryption, with keys managed under controlled access
    2. BSending the data in plain text, so that it can be inspected easily by the monitoring tools
    3. CSharing the encryption keys by email, so that every administrator has access when needed
    4. DAccess control and encryption applied to backups, so that stored copies stay protected
    5. EDisabling backups, so that copies of sensitive data are never created in the first place
    Show answer and explanation
    Correct answer: A, D

    Encryption with controlled key management and protected backups both protect data while it is stored. Plain-text transmission, emailed keys and disabled backups each weaken protection or resilience.

Network Attacks and Defence Strategy (5 questions)

  1. Question 16

    An attacker sends a flood of TCP SYN packets to a server and never completes the handshakes, so that many connections stay half-open. Which attack is this?

    1. AA SYN flood, a denial-of-service attack that exhausts half-open connection resources
    2. BAn SQL injection that changes the database queries sent by the web application
    3. CA cross-site scripting attack that runs script in the browser of each visitor to the site
    4. DA phishing campaign that sends emails to staff asking them to confirm their credentials
    Show answer and explanation
    Correct answer: A

    A SYN flood sends SYN packets without completing handshakes, which exhausts the server's half-open connection resources. SQL injection, cross-site scripting and phishing are different attack types.

  2. Question 17

    Which defence most directly reduces ARP spoofing on a switched LAN?

    1. ADisabling DHCP on every subnet, so that no client ever receives an address automatically
    2. BEnabling Telnet on each switch port, so that administrators can see the ARP traffic clearly
    3. CDynamic ARP Inspection, which validates ARP packets against trusted DHCP snooping bindings
    4. DUsing WEP on the wired ports, so that ARP packets are encrypted between the switch and host
    Show answer and explanation
    Correct answer: C

    Dynamic ARP Inspection validates ARP packets against DHCP snooping bindings, which blocks forged ARP replies. Disabling DHCP, enabling Telnet and using WEP do not stop ARP spoofing.

  3. Question 18

    Which framework describes adversary tactics and techniques so that defenders can map detections and gaps?

    1. AITIL, which describes IT service management practices for service delivery
    2. BCOBIT, which describes governance and management objectives for enterprise IT
    3. CISO 9001, which describes quality management systems for organisations
    4. DMITRE ATT&CK, a knowledge base of adversary tactics and techniques
    Show answer and explanation
    Correct answer: D

    MITRE ATT&CK catalogues adversary tactics and techniques, which helps defenders map detections and coverage. ITIL, COBIT and ISO 9001 are governance or management frameworks.

  4. Question 19

    Which two controls help mitigate ARP spoofing on a LAN? (Choose two.)

    1. ADynamic ARP Inspection, which validates ARP packets against trusted bindings
    2. BDisabling spanning tree on all switches, so that loops cannot form in the network
    3. CTelnet access enabled on every switch, so that administrators can monitor the ARP table
    4. DStatic ARP entries for critical hosts, which prevent their mappings from being overwritten
    5. EMaking the subnet larger, so that fewer devices share the same ARP table entries
    Show answer and explanation
    Correct answer: A, D

    Dynamic ARP Inspection and static ARP entries for critical hosts both prevent forged mappings from being accepted. Disabling spanning tree, Telnet and larger subnets do not stop ARP spoofing.

  5. Question 20

    An attacker captures traffic on a shared Wi-Fi network and reads login credentials sent over plain HTTP. Which attack is this?

    1. APhishing, which tricks the user into entering the credentials on a fake web page
    2. BRansomware, which encrypts the files on the victim's device and demands a payment
    3. CSniffing or eavesdropping on unencrypted traffic, which exposes the data as it passes
    4. DBuffer overflow, which overwrites memory in the application to run code of the attacker's choice
    Show answer and explanation
    Correct answer: C

    Reading credentials from unencrypted traffic on a shared network is sniffing or eavesdropping. The protection is to encrypt the traffic with HTTPS. Phishing, ransomware and buffer overflows are different attacks.

Enterprise Cloud and Wireless Security (5 questions)

  1. Question 21

    In cloud security, which model defines which security tasks belong to the provider and which belong to the customer?

    1. AShared hosting, which places many customers on one server without defining any separate roles
    2. BThe shared responsibility model, which divides security duties between the provider and the customer
    3. CA public cloud with no responsibilities defined, since the provider handles all of the security
    4. DHosted DNS, which resolves domain names for the services that the customer runs in the cloud
    Show answer and explanation
    Correct answer: B

    The shared responsibility model divides security duties between the cloud provider and the customer. Shared hosting, an undefined public cloud and hosted DNS do not define responsibilities.

  2. Question 22

    Which practice helps detect rogue access points that have been connected to the corporate network?

    1. ABroadcasting the SSID with the vendor's default password, so that users connect easily
    2. BWireless intrusion detection with rogue access point scanning across the building
    3. CUsing WEP for legacy devices, since those devices cannot support newer wireless protocols
    4. DLeaving guest and corporate wireless on the same VLAN, to simplify the network design
    Show answer and explanation
    Correct answer: B

    Wireless intrusion detection with rogue access point scanning finds unauthorised access points on the network. Default passwords, shared VLANs and WEP all make rogue devices easier to hide or exploit.

  3. Question 23

    Which cloud control restricts which identities can create or change cloud resources?

    1. APublic storage buckets, which make the stored objects readable by anyone on the internet
    2. BLeast-privilege IAM policies, which grant each identity only the permissions it needs
    3. CA shared root account used by all administrators, so that access changes are not needed
    4. DDisabling cloud audit logging, so that administrators can change resources without a record
    Show answer and explanation
    Correct answer: B

    Least-privilege IAM policies restrict which identities can create or change resources. Public buckets, a shared root account and disabled audit logging each weaken control.

  4. Question 24

    Which two practices strengthen wireless network security? (Choose two.)

    1. AUsing WEP for legacy devices, so that every device can connect to the wireless network
    2. BUsing WPA3 or WPA2-Enterprise with AES, so that strong authentication and encryption apply
    3. CBroadcasting default SSIDs with the vendor's factory settings, so that users can find the network
    4. DSharing a single wireless password publicly, so that any visitor can connect without a request
    5. ESeparating guest and corporate wireless networks, so that visitors cannot reach internal systems
    Show answer and explanation
    Correct answer: B, E

    WPA3 or WPA2-Enterprise with AES provides strong authentication and encryption, and separating guest from corporate networks limits what visitors can reach. WEP, default SSIDs and public shared passwords each weaken wireless security.

  5. Question 25

    Which cloud service model provides a managed platform on which developers deploy and run their applications?

    1. AIaaS, which provides virtual machines and storage that the customer manages in full
    2. BPaaS, which provides a managed platform for developers to deploy and run applications
    3. CDo-it-yourself hosting, where the team builds its own servers and networks from scratch
    4. DOn-premises hosting, which is run entirely by the organisation in its own data centres
    Show answer and explanation
    Correct answer: B

    Platform as a Service (PaaS) provides a managed platform for developers to run applications. IaaS leaves more management to the customer, and on-premises and do-it-yourself hosting are not cloud models.

Network Monitoring and Incident Response (5 questions)

  1. Question 26

    Which protocol exports flow metadata, such as the source, destination and volume of traffic, for analysis?

    1. ANetFlow or IPFIX, which export flow records describing the traffic between endpoints
    2. BDHCP, which assigns IP addresses to devices on the network automatically
    3. CDNS, which resolves domain names to IP addresses for the clients on the network
    4. DSMTP, which transfers outbound email between the mail servers on the network
    Show answer and explanation
    Correct answer: A

    NetFlow and IPFIX export flow metadata for traffic analysis. DHCP, DNS and SMTP provide other network services.

  2. Question 27

    What is the primary role of a security information and event management (SIEM) system?

    1. APrinting reports on the schedule that the security team sets for each department
    2. BStoring the passwords for the accounts of the users on the network in one place
    3. CRouting packets between the subnets on the network, acting as the core router
    4. DCorrelating logs from many sources and alerting on suspicious patterns for analysts
    Show answer and explanation
    Correct answer: D

    A SIEM collects and correlates logs from many sources and alerts analysts to suspicious patterns. Printing reports, storing passwords and routing packets are not its role.

  3. Question 28

    Which two log sources are most useful for detecting lateral movement inside a network? (Choose two.)

    1. APrinter job logs, which record each document that is sent to the office printers
    2. BCafeteria badge logs, which record the staff who entered the restaurant each day
    3. CAuthentication logs, which record logons across hosts and accounts in the network
    4. DOffice temperature logs, which record the environmental conditions in the server rooms
    5. ENetwork flow logs, which record connections between internal hosts and their volumes
    Show answer and explanation
    Correct answer: C, E

    Authentication logs and internal flow logs show accounts and connections moving between hosts, which is how lateral movement appears. Printer, cafeteria and temperature logs are unrelated to network movement.

  4. Question 29

    Which tool captures and analyses network packets for investigation?

    1. APing, which tests whether a host responds to ICMP echo requests from the network
    2. BTraceroute, which shows the path that packets take across the network to a destination
    3. CWireshark, which captures and decodes packets for detailed analysis by the investigator
    4. DWhois, which looks up the registration details of a domain name in the public registry
    Show answer and explanation
    Correct answer: C

    Wireshark captures and decodes packets for detailed analysis. Ping, traceroute and Whois test reachability, paths and registrations rather than capturing packets for analysis.

  5. Question 30

    Which Windows log records successful and failed logons, and the use of privileges by accounts?

    1. ASecurity event logs, which record logons, account changes and privilege use on the host
    2. BApplication logs only, which record the events generated by individual applications on the host
    3. CDHCP logs, which record the addresses that are leased to the clients connected to the network
    4. DPrinter logs, which record the documents that are sent to each printer on the network
    Show answer and explanation
    Correct answer: A

    Windows security event logs record logons, account changes and privilege use. Printer, application-only and DHCP logs do not record the same account activity.