I85PREP
⌘ K
CNSP Certification study materials
CNSP Certification study resources

CNSP Certification practice questions

One question at a time. Build your CNSP Certification understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Security

A web application reflects the value of a query parameter directly into the HTML body without encoding it. Which vulnerability class is most directly introduced?

  1. Reflected cross-site scripting Correct answer.
  2. Server-side request forgery
  3. Stored cross-site scripting
  4. SQL injection

Explanation

Reflected XSS occurs when user-supplied input from the current request is echoed into the response without output encoding, so a crafted link executes script in the victim's browser. Stored XSS requires the payload to be persisted server-side first. SQL injection and SSRF involve different sinks (database queries and server-side outbound requests).

Question 2Web Application Security

Which HTTP response header instructs browsers to restrict a page from loading scripts, styles, and frames from origins other than those explicitly allowed?

  1. Content-Security-Policy Correct answer.
  2. Strict-Transport-Security
  3. X-Content-Type-Options
  4. Referrer-Policy

Explanation

Content-Security-Policy defines an allowlist of sources for scripts, styles, frames, and other resources, and is the primary browser-enforced mitigation against many XSS payloads. Strict-Transport-Security enforces HTTPS, X-Content-Type-Options stops MIME sniffing, and Referrer-Policy controls referrer leakage.

Question 3Web Application Security

An application sets a session cookie with the HttpOnly attribute. What does this attribute accomplish?

  1. It prevents client-side JavaScript from reading the cookie Correct answer.
  2. It ensures the cookie is only sent over HTTPS
  3. It causes the cookie to expire when the browser closes
  4. It restricts the cookie to the same site as the origin

Explanation

HttpOnly blocks access to the cookie through the Document.cookie API, reducing the impact of XSS by preventing script from stealing the session identifier. Transport protection is provided by the Secure attribute, cross-site behavior by SameSite, and lifetime by Expires or Max-Age.

Question 4Web Application Security

A login form submits credentials over plain HTTP to an origin that also serves HTTPS. Which weakness most directly exposes the credentials to a network attacker?

  1. Verbose error messages revealing stack traces
  2. Missing anti-CSRF token on the login form
  3. Overly permissive CORS policy on the API
  4. Credentials transmitted without transport encryption Correct answer.

Explanation

Sending credentials over HTTP means they cross the network in cleartext and can be captured by anyone with access to the path. CSRF, CORS, and error verbosity are real weaknesses but do not directly expose the password on the wire in the same way.

Question 5Web Application Security

Which practice best mitigates SQL injection in a Java application that builds queries from user input?

  1. Restricting the application database account to SELECT only
  2. Escaping single quotes with a custom replace function
  3. Using parameterized queries with bound placeholders Correct answer.
  4. Hiding detailed SQL errors from end users

Explanation

Parameterized queries separate code from data so user input is never parsed as SQL syntax, which is the definitive fix for injection. Input escaping is fragile and error-prone, least privilege limits damage but does not stop injection, and error hiding only reduces information disclosure.

Question 6Web Application Security

What is the primary purpose of the SameSite=Lax cookie attribute?

  1. To prevent the cookie from being cached by proxies
  2. To bind the cookie to a specific client IP address
  3. To encrypt the cookie value before storage
  4. To limit the cookie from being sent on most cross-site requests Correct answer.

Explanation

SameSite=Lax restricts cookies from accompanying cross-site subrequests while still allowing top-level navigations, which mitigates cross-site request forgery. It does not encrypt values, bind to IP addresses, or control proxy caching.

Question 7Web Application Security

Which encoding should be applied when inserting untrusted data into an HTML element's text content?

  1. HTML entity encoding Correct answer.
  2. URL percent-encoding
  3. JavaScript string escaping
  4. Base64 encoding

Explanation

HTML entity encoding converts characters such as < and & into entities so the browser renders them as text rather than markup. URL encoding is for query strings, JavaScript escaping is for script contexts, and Base64 is a reversible transfer encoding that does not neutralize markup.

Question 8Web Application Security

An application accepts a file upload and stores it under a user-supplied filename in a web-accessible directory. Which risk is most directly created?

  1. DNS rebinding against the storage server
  2. Path traversal enabling writes outside the intended directory Correct answer.
  3. Session fixation through the uploaded file
  4. Cross-site request forgery against the upload endpoint

Explanation

Using a user-controlled filename allows sequences like ../ to escape the target directory, potentially overwriting files or placing executable content elsewhere. CSRF, session fixation, and DNS rebinding are distinct issues not caused by filename handling.

Question 9Web Application Security

A REST API returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. What is the practical effect in browsers?

  1. Only HTTPS origins can read authenticated responses
  2. Any origin can read authenticated responses from the API
  3. The combination is rejected; credentialed requests require a specific origin Correct answer.
  4. The API responses become cacheable across origins

Explanation

The CORS specification forbids the wildcard origin when credentials are allowed, so browsers refuse to expose the response to credentialed cross-origin requests. Developers often mistakenly believe the wildcard grants universal authenticated access, but the browser enforces the restriction.

Question 10Web Application Security

An application uses a predictable sequential integer as the identifier in a URL that returns invoice data, and it checks only that the user is logged in. Which vulnerability is present?

  1. HTTP request smuggling
  2. Insecure direct object reference Correct answer.
  3. Cross-site scripting
  4. Open redirect

Explanation

When access control is based only on authentication and not on object ownership, changing the identifier exposes other users' records, which is IDOR. XSS, request smuggling, and open redirect involve script injection, parsing discrepancies, and redirect targets respectively.

Question 11Web Application Security

Which control most effectively prevents cross-site request forgery on state-changing endpoints?

  1. Requiring a per-session unpredictable anti-CSRF token validated server-side Correct answer.
  2. Setting the session cookie with the Secure attribute
  3. Using POST instead of GET for state changes
  4. Validating the Content-Type header of the request

Explanation

A per-session token that the attacker cannot predict or read prevents forged requests because the cross-site request lacks a valid token. Secure only protects cookie transport, Content-Type checks are insufficient alone, and using POST raises the bar but does not stop form-based forgery.

Question 12Web Application Security

A server-side template renders user-supplied input as part of the template source rather than as a variable value. Which vulnerability results?

  1. LDAP injection
  2. XML external entity injection
  3. Server-side template injection Correct answer.
  4. HTTP response splitting

Explanation

When user input is concatenated into template source, template expressions execute on the server, which can lead to remote code execution depending on the engine. XXE, LDAP injection, and response splitting involve XML parsers, directory queries, and header injection respectively.

Question 13Web Application Security

Which of the following best describes a stored XSS attack chain?

  1. The payload is reflected from a search parameter in the same immediate response
  2. The payload is placed in a URL fragment and executed only in the attacker's browser
  3. The payload is injected into a response header to split the HTTP response
  4. The payload is persisted server-side and served to other users who view the affected content Correct answer.

Explanation

Stored XSS persists the malicious script in a database, comment, profile, or similar store and executes it in victims' browsers when they load the affected page. Reflected XSS is returned in the immediate response, response splitting is a header injection issue, and fragment-only execution affects only the attacker.

Question 14Web Application Security

An application validates that an uploaded image has a .jpg extension but does not inspect its contents, and the upload directory executes scripts. Which defense most directly addresses the risk?

  1. Limiting upload size to a few kilobytes
  2. Renaming uploaded files with a random UUID only
  3. Requiring authentication before the upload endpoint
  4. Validating file content type and storing uploads outside the web root Correct answer.

Explanation

Content validation combined with storing files outside the document root prevents a disguised script from being served and executed. Random names alone do not stop execution if the file is web-accessible, authentication does not fix the storage flaw, and size limits are unrelated.

Question 15Web Application Security

Which statement accurately describes the relationship between authentication and authorization in web applications?

  1. Authentication determines permissions; authorization verifies credentials
  2. Both terms describe the same credential-verification step
  3. Authentication establishes identity; authorization determines which actions that identity may perform Correct answer.
  4. Authorization must occur before authentication in every request flow

Explanation

Authentication verifies who the user is, while authorization decides what that authenticated principal is allowed to do. Confusing the two leads to broken access control, which is why authorization checks must be enforced server-side on every sensitive action.

Question 16Web Application Security

A web application permits users to supply a URL that the server fetches to generate a preview. Which risk is introduced?

  1. Server-side request forgery reaching internal services Correct answer.
  2. Session fixation via the preview endpoint
  3. Cross-site scripting in the preview image
  4. SQL injection in the URL parameter

Explanation

Server-side fetching of user-supplied URLs allows an attacker to target internal addresses such as metadata endpoints or admin interfaces, which is SSRF. The other options describe different sinks and attack mechanics.

Question 17Web Application Security

What does the Secure attribute on a cookie enforce?

  1. The cookie is deleted when the tab closes
  2. The cookie is only transmitted over HTTPS connections Correct answer.
  3. The cookie is scoped to a single path
  4. The cookie cannot be read by JavaScript

Explanation

Secure instructs the browser to send the cookie only over encrypted HTTPS connections, protecting it from cleartext interception. HttpOnly controls script access, Path controls scope, and lifetime is controlled by expiry attributes.

Question 18Web Application Security

An application includes a hidden form field containing the user's role, and the server trusts it when authorizing actions. What is the most accurate description of the flaw?

  1. Client-side state is trusted for authorization decisions Correct answer.
  2. The form lacks sufficient input length validation
  3. The session cookie lacks the SameSite attribute
  4. The application is vulnerable to XML external entity injection

Explanation

Hidden fields are client-controlled and can be modified with a proxy or browser tool, so trusting them for authorization lets users escalate privileges. The fix is to derive roles from server-side session state or a trusted store on every request.

Question 19Web Application Security

Which measure best reduces the risk of session fixation after a successful login?

  1. Increasing the session timeout duration
  2. Encrypting the session identifier in the cookie
  3. Issuing a new session identifier upon authentication Correct answer.
  4. Storing the session identifier in localStorage

Explanation

Rotating the session identifier at login invalidates any identifier the attacker may have pre-set, defeating fixation. Longer timeouts worsen exposure, localStorage is script-readable, and encrypting the cookie value does not address pre-set identifiers.

Question 20Web Application Security

Which HTTP header helps prevent MIME-type confusion attacks by stopping browsers from sniffing content types?

  1. X-Frame-Options: DENY
  2. X-Content-Type-Options: nosniff Correct answer.
  3. Strict-Transport-Security: max-age=31536000
  4. Content-Security-Policy: default-src 'self'

Explanation

The nosniff directive stops browsers from guessing a response's content type, which prevents attacks where a script is disguised as another type. CSP, HSTS, and X-Frame-Options address resource loading, transport security, and framing respectively.

Question 21Web Application Security

An application uses a JSON Web Token signed with the HS256 algorithm and accepts the alg header from the token. Which attack is enabled by this design?

  1. Directory traversal in the token validation path
  2. Reflected XSS through the token payload
  3. Cross-site request forgery against the token issuance endpoint
  4. Algorithm confusion allowing the attacker to substitute a weaker or none algorithm Correct answer.

Explanation

Trusting the alg header lets an attacker attempt algorithm confusion, such as switching to none or forcing verification with a public key as an HMAC secret, bypassing signature checks. The server must pin the expected algorithm and reject unexpected values.

Question 22Web Application Security

A front-end and back-end server disagree on how to parse the Content-Length and Transfer-Encoding headers. Which attack does this discrepancy enable?

  1. HTTP request smuggling Correct answer.
  2. Clickjacking through frame embedding
  3. Cross-site scripting via stored payloads
  4. Open redirect through the Location header

Explanation

When intermediaries and origin servers interpret message boundaries differently, an attacker can smuggle a second request that is processed out of context, poisoning responses or bypassing controls. XSS, open redirect, and clickjacking involve different mechanisms.

Question 23Web Application Security

A web application renders user-supplied Markdown and allows inline HTML, then sanitizes the output with a library configured to allow the <script> tag. What is the primary risk?

  1. The Markdown parser introduces SQL injection in the database
  2. The sanitizer causes session fixation on login
  3. The sanitizer allowlist permits script execution, enabling stored XSS Correct answer.
  4. The application becomes vulnerable to server-side request forgery

Explanation

Allowing script tags in the sanitizer configuration defeats its purpose, so persisted Markdown containing script executes in other users' browsers. Sanitizer allowlists must exclude script, event handlers, and dangerous URL schemes.

Question 24Web Application Security

An application stores passwords using SHA-256 with a per-user random salt. Which weakness remains the most significant?

  1. The salt makes the hash reversible to the original password
  2. The salt must be encrypted before storage
  3. The fast hash function permits efficient offline brute-force attacks Correct answer.
  4. The hash is vulnerable to cross-site scripting in the login page

Explanation

Salting prevents precomputed rainbow tables but SHA-256 is designed to be fast, so GPU-based guessing remains cheap. Password storage should use a memory-hard or deliberately slow algorithm such as Argon2id, scrypt, or bcrypt.

Question 25Web Application Security

A security review finds that an application accepts cross-origin WebSocket connections and authorizes them solely by the presence of the session cookie. Why is this dangerous?

  1. WebSocket connections bypass the same-origin policy entirely and cannot be restricted
  2. Browsers attach cookies to cross-origin WebSocket handshakes, so the Origin header must be validated Correct answer.
  3. WebSocket handshakes cannot include authentication headers
  4. WebSocket frames are always unencrypted even over TLS

Explanation

WebSocket handshakes are HTTP requests that include ambient cookies, and the same-origin policy does not restrict who can initiate them, so servers must validate the Origin header and use anti-CSRF tokens. Framing encryption and header support are not the core issue.

Question 26Web Application Security

Which HTTP response header instructs the browser to only load resources over HTTPS for a defined period and can be used to prevent protocol-downgrade attacks?

  1. Referrer-Policy
  2. X-Content-Type-Options
  3. Content-Security-Policy
  4. Strict-Transport-Security Correct answer.

Explanation

Strict-Transport-Security (HSTS) tells the browser to treat the host as HTTPS-only for max-age seconds, so future navigations and subresource loads are upgraded before any plaintext request leaves the client. This closes the window in which an attacker could strip TLS via a downgrade. It is enforced by the browser after the first valid HTTPS response carrying the header.

Question 27Web Application Security

A developer wants to prevent reflected cross-site scripting in HTML body context. Which practice is correct?

  1. HTML-entity-encode untrusted data before placing it between tags Correct answer.
  2. Strip all angle brackets from input and store the stripped value
  3. Rely on a Web Application Firewall to block script payloads
  4. Encode input on receipt and decode it when rendering

Explanation

Context-aware output encoding is the core defense: when untrusted data lands in HTML body context, converting &, <, >, " and ' to entities prevents it from being parsed as markup. Encoding must happen at the point of output, in the correct context for that sink. Input filtering and WAFs are defense-in-depth at best because they cannot know every sink.

Question 28Web Application Security

Which description best matches a cross-site scripting vulnerability in a single-page application that writes server data into the DOM via innerHTML?

  1. DOM-based XSS where the sink is innerHTML and the source is attacker-influenced data Correct answer.
  2. Mutation XSS where a sanitizer changes the markup after parsing
  3. Reflected XSS where the payload is echoed in the server response
  4. Stored XSS where the payload is persisted in a database

Explanation

When client-side JavaScript reads a tainted source and assigns it to a dangerous sink such as innerHTML without sanitization, the vulnerability is DOM-based XSS because the flaw lives entirely in client code and may never involve a server response. The defining pair is source plus sink. Reflected and stored variants require the payload to travel through the server response or persistence layer.

Question 29Web Application Security

An application sets a session cookie and wants to reduce exposure if a user shares a link to a page. Which cookie attribute limits the cookie from being sent on cross-site navigations while still allowing it on top-level GET navigations?

  1. Secure
  2. Path=/
  3. HttpOnly
  4. SameSite=Lax Correct answer.

Explanation

SameSite=Lax allows the cookie to be attached to same-site requests and to top-level cross-site GET navigations, but withholds it from cross-site subrequests and cross-site POSTs, which reduces exposure when users follow external links. HttpOnly and Secure address script access and transport respectively, not cross-site sending. The Path attribute only scopes the URL path.

Question 30Web Application Security

A penetration tester finds a parameter that is reflected inside a JavaScript string literal in an inline script block. Which encoding is most appropriate for that context?

  1. HTML entity encoding of the value
  2. Base64 encoding of the value
  3. JavaScript string escaping, including escaping the closing quote and the </script sequence Correct answer.
  4. URL percent-encoding of the value

Explanation

Data placed inside a JavaScript string literal must be escaped for that exact context: quotes, backslashes, newlines, and characters that could terminate the script element such as the </script sequence. HTML entity encoding does not apply inside script blocks because entities are not decoded there. URL encoding is for URL components, and Base64 alone does not remove the risk if the value is concatenated into executable code.

Question 31Web Application Security

An application enforces authorization by checking the role claim in a JWT, but the signature verification step is skipped on some endpoints to improve performance. Which vulnerability does this create?

  1. Attackers can forge tokens with arbitrary claims because the signature is not validated Correct answer.
  2. Attackers can replay tokens indefinitely because no expiry is checked
  3. Attackers can downgrade TLS because the token is not bound to the transport
  4. Attackers can enumerate valid usernames because the token leaks claims

Explanation

If the signature is not verified, the token contents are just attacker-controlled data, so a forged role claim will be trusted by the authorization check. JWT security depends on cryptographic verification of the signature before any claim is used. Skipping verification on some endpoints creates an authentication bypass on those routes.

Question 32Web Application Security

Which control most directly mitigates server-side request forgery in a feature that fetches user-supplied URLs?

  1. Resolving the hostname and blocking requests to private, loopback, and link-local address ranges Correct answer.
  2. Limiting response size and timeout for fetched content
  3. Logging all fetched URLs for later review
  4. Requiring the user to authenticate before submitting a URL

Explanation

SSRF is mitigated by restricting where the server can connect: resolve the hostname, validate the resulting IP, and deny internal ranges such as RFC1918, loopback, and link-local metadata addresses, re-checking after redirects. Authentication, size limits, and logging reduce impact or aid detection but do not stop the server from reaching internal services. Allowlisting destinations is even stronger.

Question 33Web Application Security

An application reflects a user-supplied value into an HTML attribute that is later read by client-side JavaScript and passed to eval. Which statement best characterizes the risk?

  1. The eval call acts as a dangerous sink, so tainted data reaching it can execute script in the origin Correct answer.
  2. The risk is limited to reflected content in the server response body
  3. The risk only exists if the value is stored in the database
  4. The attribute context prevents execution because attributes are not script

Explanation

DOM-based XSS is defined by tainted data flowing from a source into a sink that interprets it as code; eval is a classic sink. The HTML attribute is only a transport mechanism for the value, and once JavaScript reads it and evaluates it, the payload executes with the page's origin privileges. Storage is irrelevant to whether the flow is dangerous.

Question 34Web Application Security

A team wants to deploy Content-Security-Policy to reduce XSS impact. Which directive value provides the strongest reduction against inline script execution?

  1. script-src * to allow all origins
  2. script-src 'self' with no 'unsafe-inline' and a per-response nonce for legitimate inline scripts Correct answer.
  3. default-src 'unsafe-inline'
  4. script-src 'self' 'unsafe-inline'

Explanation

A policy that restricts script sources to the application's own origin and uses a fresh nonce for each legitimate inline script blocks attacker-injected inline scripts while permitting intended ones. The critical element is the absence of 'unsafe-inline', which would otherwise allow any inline script. Nonces must be unpredictable per response and matched by the nonce attribute.

Question 35Web Application Security

Which vulnerability arises when an application accepts a serialized object from an untrusted cookie and deserializes it on the server?

  1. Insecure deserialization that can lead to remote code execution via gadget chains Correct answer.
  2. HTTP response splitting because the cookie is reflected in a header
  3. Cross-site request forgery because cookies are automatically sent
  4. Open redirect because the cookie controls navigation

Explanation

Deserializing attacker-controlled data lets the attacker control object state and, with available gadget chains, trigger code execution or other impact during object construction. Cookies are a common transport for such payloads because clients can modify them. Integrity protection and avoiding native deserialization of untrusted data are the mitigations.

Question 36Web Application Security

An API uses an unvalidated redirect parameter to send users to a URL after login. Which risk does this present and how is it best mitigated?

  1. Clickjacking, mitigated by X-Frame-Options
  2. Open redirect, mitigated by allowing only relative paths or an allowlist of destinations Correct answer.
  3. SQL injection, mitigated by parameterized queries
  4. Session fixation, mitigated by rotating the session identifier

Explanation

Reflecting a user-supplied destination into a redirect enables phishing and token leakage because the trusted domain forwards users to an attacker site. The robust fix is to accept only same-origin relative paths or to validate against an explicit allowlist. Redirects should never trust arbitrary external URLs.

Question 37Web Application Security

A web application stores user passwords with bcrypt at a low cost factor and no pepper. Which change most improves resistance to offline cracking if the database is stolen?

  1. Increase the bcrypt cost factor to the highest tolerable value Correct answer.
  2. Encrypt the password column with a static key stored in the same database
  3. Shorten the maximum password length to reduce hashing time
  4. Switch to a single round of SHA-256 with a salt

Explanation

bcrypt is deliberately slow, and the cost factor controls how much work each guess requires; raising it to the maximum the application can tolerate directly increases attacker cost for offline cracking. Salting already prevents precomputation, so the remaining lever is work per guess. Fast hashes and keys stored alongside the data do not provide that resistance.

Question 38Web Application Security

An application uses a third-party JavaScript library loaded from a public CDN without integrity verification. Which control best reduces the risk of a compromised CDN serving malicious code?

  1. Enable HTTP Strict Transport Security
  2. Add a Subresource Integrity hash to the script tag Correct answer.
  3. Set the cookie attribute SameSite=Strict
  4. Add rel=noopener to outbound links

Explanation

Subresource Integrity lets the browser verify that the fetched script matches a known cryptographic hash, so a tampered file from the CDN is rejected. This directly addresses supply-chain compromise of the script source. The other controls address cookie scope, transport enforcement, and window handle leakage, none of which validate script content.

Question 39Web Application Security

A security engineer reviews a login flow and finds the session identifier is created before authentication and is not changed afterward. Which attack does this most directly enable?

  1. Session fixation, where an attacker sets a known identifier and hijacks the authenticated session Correct answer.
  2. Directory traversal, where the attacker reads files outside the web root
  3. SQL injection, where the attacker manipulates the authentication query
  4. Cross-site scripting, where the attacker injects script into the login page

Explanation

If the pre-authentication identifier remains valid after login, an attacker who can plant a known identifier in the victim's browser will share the authenticated session. The standard remedy is to issue a fresh session identifier on privilege change and invalidate the old one. The other listed attacks are unrelated to session identifier lifecycle.

Question 40Web Application Security

An application validates input using a client-side JavaScript regex and performs no server-side validation. Which conclusion is most accurate?

  1. The validation is sufficient if the regex is complex enough
  2. The validation prevents injection because regexes cannot be bypassed
  3. The validation is bypassable because clients control requests, so server-side validation is required Correct answer.
  4. The validation is sufficient because browsers enforce JavaScript before submission

Explanation

Any control implemented only in the browser can be removed or bypassed by an attacker using an intercepting proxy or direct API calls, so security decisions must be enforced on the server. Client-side validation is a usability aid, not a security boundary. Server-side validation and context-aware encoding must back it up.

Question 41Internal Network Security

In a Windows Active Directory environment, which built-in group should be audited most closely because its members can log on to domain controllers interactively and potentially extract credential material from LSASS?

  1. Enterprise Admins
  2. Backup Operators
  3. Domain Admins Correct answer.
  4. Account Operators

Explanation

Domain Admins is the group whose members hold full administrative control over the domain and routinely log on to domain controllers, making their credentials high-value targets for credential dumping. Membership must be tightly controlled and audited because compromise of a single member often yields domain-wide control.

Question 42Internal Network Security

An analyst sees repeated Kerberos authentication failures with error code KRB_AP_ERR_SKEW (clock skew too great). Which internal control most directly resolves this class of failure?

  1. Increase the maximum ticket lifetime in domain policy
  2. Disable Kerberos pre-authentication on affected accounts
  3. Rotate the krbtgt account password twice
  4. Enforce consistent NTP time synchronization across domain members Correct answer.

Explanation

Kerberos requires that client and KDC clocks stay within the configured tolerance, typically five minutes, so drift beyond that produces KRB_AP_ERR_SKEW. Reliable NTP synchronization of domain controllers and members restores authentication without weakening security controls.

Question 43Internal Network Security

Which internal segmentation approach best limits lateral movement between workstation VLANs while still allowing centralized management?

  1. Flat Layer 2 network with port security enabled
  2. Private VLANs with a firewall enforcing inter-zone policy Correct answer.
  3. Inter-VLAN routing restricted by host-based firewalls only
  4. Spanning Tree Protocol root guard on access switches

Explanation

Private VLANs isolate hosts at Layer 2, and routing traffic through a firewall lets you enforce explicit allow rules between zones instead of permitting unrestricted east-west traffic. This combination blocks direct workstation-to-workstation reachability while preserving controlled management paths.

Question 44Internal Network Security

A SOC wants to detect pass-the-hash attacks against internal servers. Which log source and event pattern provides the most direct evidence?

  1. Sysmon Event ID 1 showing parent process explorer.exe
  2. Windows Security Event 4688 process creation with command-line logging
  3. DNS query logs showing repeated AAAA lookups
  4. Windows Security Event 4624 with Logon Type 3 and NTLM authentication Correct answer.

Explanation

Pass-the-hash reuses an NTLM hash to authenticate over the network, which appears as a network logon (Type 3) using NTLM in Event 4624. Correlating that with anomalous source hosts is the canonical detection signal.

Question 45Internal Network Security

Which SMB configuration change most effectively mitigates relay attacks on an internal network?

  1. Enable SMB1 for legacy device compatibility
  2. Require SMB signing and disable NTLMv1 authentication Correct answer.
  3. Allow anonymous share enumeration for asset discovery
  4. Disable SMB signing on file servers to improve throughput

Explanation

SMB signing binds authentication to the session, preventing an attacker from relaying captured credentials to another SMB server. Eliminating NTLMv1 removes a weak challenge-response scheme that is trivially relayed and cracked.

Question 46Internal Network Security

What is the primary security purpose of implementing 802.1X port-based network access control on internal switch ports?

  1. Rate-limiting broadcast traffic per port
  2. Preventing MAC address spoofing on trunk links
  3. Authenticating devices before granting VLAN access Correct answer.
  4. Encrypting all traffic between access switches

Explanation

802.1X requires a supplicant to authenticate to an authenticator before the port is authorized, and the result can place the device into a specific VLAN. This stops unauthorized devices from obtaining normal internal network access.

Question 47Internal Network Security

Which internal DNS control most reduces the risk of DNS cache poisoning against a corporate resolver?

  1. Disable bailiwick checking to speed resolution
  2. Use a single upstream forwarder without DNSSEC
  3. Enable DNSSEC validation and restrict recursion to authorized clients Correct answer.
  4. Permit recursive queries from any internal subnet

Explanation

DNSSEC validation lets the resolver cryptographically verify that answers are authentic, and restricting recursion prevents off-path attackers from abusing the resolver. Together these controls sharply reduce cache-poisoning exposure.

Question 48Internal Network Security

Why is enforcing the principle of least privilege on service accounts an important internal control?

  1. It removes the requirement for password rotation
  2. It reduces the blast radius if a service account is compromised Correct answer.
  3. It eliminates the need for logging service activity
  4. It guarantees service accounts cannot be used interactively

Explanation

Service accounts often run continuously with stored credentials, so excessive rights magnify the damage an attacker can cause after compromise. Limiting each account to the permissions its service actually needs confines that damage and simplifies detection.

Question 49Internal Network Security

An administrator must restrict a contractor's workstation so it can reach only a specific internal application server on TCP 443 and nothing else on the corporate LAN. Which control enforces this most precisely?

  1. An ACL on the internal router permitting only that destination and port Correct answer.
  2. A DNS sinkhole for all other internal domains
  3. A host-based firewall rule on the application server
  4. A network intrusion prevention system signature

Explanation

A router ACL filters traffic at the network layer based on source, destination, and port, which is exactly the granularity needed to permit a single approved flow and deny the rest. The rule is enforced in the path regardless of the endpoint's configuration.

Question 50Internal Network Security

During an internal assessment, an analyst observes LDAP queries returning large volumes of directory data from a single workstation. Which mitigation best reduces the impact of directory enumeration?

  1. Move the directory database to a faster storage tier
  2. Enable LDAP signing and channel binding, and restrict anonymous and broad read access Correct answer.
  3. Enable LDAP over UDP for performance
  4. Increase the LDAP query timeout on domain controllers

Explanation

LDAP signing and channel binding prevent relay and tampering attacks, while limiting anonymous and overly broad read permissions reduces the data an attacker can harvest through enumeration. Restricting read scope directly shrinks the reconnaissance value of directory queries.