Free Certified Network Defender Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Network Defender practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which malware type replicates by inserting copies of itself into existing programs or data files?

   1. A. A Trojan horse
   2. B. A virus
   3. C. A rootkit
   4. D. A keystroke logger

   Answer: B

   Explanation: NIST states, "A virus self-replicates by inserting copies of itself into host programs or data files." Replication within a host file distinguishes a virus from the other listed tools.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops — Section 2.1, p. 2

2. 2A technician needs read access to diagnostic logs but no ability to change system settings. Which authorization implements least privilege?

   1. A. Grant read access to the logs
   2. B. Grant administrator access to the host
   3. C. Grant modification access to all logs
   4. D. Grant the permissions of the technician's manager

   Answer: A

   Explanation: NIST describes least privilege as "granting users only those accesses required to perform their duties." Read-only log access meets the stated task without adding modification rights.

   Reference: An Introduction to Information Security — Section 10.7, p. 62

3. 3With UAC enabled and an administrator using Admin Approval Mode, which token normally starts applications that do not perform administrative tasks?

   1. A. The full administrator token without an elevation prompt
   2. B. The full administrator token after an elevation prompt
   3. C. The standard user access token without an elevation prompt
   4. D. The standard user access token after a mandatory elevation prompt

   Answer: C

   Explanation: Microsoft states that in the standard user access token, "the administrative Windows privileges and SIDs are removed". This reduced token starts ordinary applications; use of the full administrator token requires elevation.

   Reference: How User Account Control works — Sign in process, standard user access token bullets

4. 4How does strict application allowlisting handle a program that has not been approved?

   1. A. It permits execution unless the filename is suspicious
   2. B. It permits execution until a malware alert occurs
   3. C. It blocks execution because the program is not on the allowlist
   4. D. It allows execution if the program uses a standard file extension

   Answer: C

   Explanation: NIST states, "Whitelist enforcement permits only whitelist items to be executed and blocks execution of all others". Approval, rather than absence from a blocklist, determines execution.

   Reference: Guide to Application Whitelisting — Section 2.3, p. 5

5. 5In full virtualization, which component partitions physical resources and isolates guest operating systems?

   1. A. The guest operating system
   2. B. The host operating system
   3. C. The hypervisor
   4. D. The virtual network switch

   Answer: C

   Explanation: NIST states, "The hypervisor can partition the system’s resources and isolate the guest OSs". The hypervisor mediates guest use of physical hardware.

   Reference: Guide to Security for Full Virtualization Technologies — Section 2, p. 2-1

6. 6An analyst applies a Wireshark display filter to a saved capture. What happens to packets that do not match?

   1. A. They are removed from the capture file
   2. B. They remain in the file but are hidden from view
   3. C. They are rewritten with empty payloads
   4. D. They are moved into a separate capture file

   Answer: B

   Explanation: The guide explains, "Display filters allow you to concentrate on the packets you are interested in while hiding the currently uninteresting ones." The same section states that all packets remain in the capture file. Display filtering hides nonmatching packets rather than removing, rewriting, or moving them.

   Reference: Wireshark User’s Guide: Filtering Packets While Viewing — Section 6.3, Filtering Packets While Viewing, introductory explanation of hidden packets

7. 7Two incidents compete for limited response staff. Which basis should guide their response priority under NIST's current recommendations?

   1. A. The chronological order in which reports arrived
   2. B. The alert count alone, regardless of the affected assets
   3. C. The familiarity of available staff with the affected systems
   4. D. Risk factors such as impact and asset criticality

   Answer: D

   Explanation: NIST bases prioritization on "risk evaluation factors" and lists asset criticality and functional and data impacts. Arrival order, alert volume alone, or staff familiarity does not establish the incident’s overall risk.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile — Table 3, Incident Management (RS.MA), pp.26-27

8. 8A server's access-control configuration contains a weakness that an attacker could exploit. Which risk concept describes that weakness?

   1. A. Threat source
   2. B. Vulnerability
   3. C. Business impact
   4. D. Risk tolerance

   Answer: B

   Explanation: NIST defines a vulnerability as "a weakness in an information system". The exploitable configuration is a weakness, while the attacker is a threat source, impact is harm, and tolerance concerns acceptable risk.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, p.9, Vulnerabilities and Predisposing Conditions

9. 9A malicious, self-contained program propagates between hosts by exploiting a network service vulnerability without user action. Which classification fits this behavior?

   1. A. A macro virus
   2. B. A Trojan horse
   3. C. A network service worm
   4. D. A mass mailing worm

   Answer: C

   Explanation: NIST explains, "A network service worm takes advantage of a vulnerability in a network service to propagate itself and infect other hosts." This matches autonomous propagation through the vulnerable service.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops — Section 2.1, p. 2

10. 10A sensitive configuration change requires one employee to request it and another to approve it. Which control principle does this implement?

    1. A. Least privilege
    2. B. Role-based access control
    3. C. Separation of duties
    4. D. Need-to-know access

    Answer: C

    Explanation: NIST describes "separation of duties" as reducing "the risk of malevolent activity without collusion". Dividing request and approval reduces unilateral abuse.

    Reference: An Introduction to Information Security — Section 5.4.3, p.32