A network defender is reviewing firewall logs and notices a series of failed SSH login attempts from a single external IP address, followed by a successful login from the same IP. What should the defender do first?

Immediately block the external IP address at the firewall

Ignore the event because it is a common brute-force pattern

Investigate the successful login session for signs of unauthorized activity

A network defender notices an unusual pattern of outbound DNS queries from a single internal host to a domain that has never been resolved before. The queries occur at regular intervals and the domain name appears to be a random string. Which classification best describes this activity?

Passive reconnaissance via traffic sniffing

Active reconnaissance via DNS enumeration

Denial of service via DNS amplification

Malware command-and-control beaconing

A network defender is reviewing logs and notices that a server has been sending outbound traffic to a known malicious IP address at regular intervals. The traffic is encrypted and appears to be command-and-control communication. What should the defender do first?

Ignore the traffic because it is encrypted

Isolate the server from the network

Disconnect the server and reimage it

Block the malicious IP at the firewall

What is the primary goal of a cross-site scripting (XSS) attack?

To overload a web server with requests

To redirect users to a phishing site

To execute malicious scripts in a victim's browser

A security analyst is investigating a potential man-in-the-middle (MITM) attack on the corporate network. The analyst notices that the ARP cache on several workstations contains entries mapping the gateway IP address to an unknown MAC address. The analyst also sees that the switch's MAC address table has multiple entries for the same port. What is the most likely attack, and what is the best immediate response?

MAC flooding; disable the switch port and change the gateway IP address.

Session hijacking; implement SSL/TLS on all internal communications.

DNS spoofing; configure the workstations to use a different DNS server.

ARP spoofing; enable Dynamic ARP Inspection (DAI) on the switch and configure port security.

EC-CouncilCertified Network Defender

Domain 1Objective 1

Network Attacks and Defense Strategies CND Practice Questions (Page 3)

Part of the Network Security Fundamentals and Defense Strategy domain, which makes up ~16% of our current practice bank.

53questions here

11free pages

12concepts

Questions 11–15

11application · medium
A network defender is reviewing firewall logs and notices a series of failed SSH login attempts from a single external IP address, followed by a successful login from the same IP. What should the defender do first?
Select an answer first
12application · medium
A network defender notices an unusual pattern of outbound DNS queries from a single internal host to a domain that has never been resolved before. The queries occur at regular intervals and the domain name appears to be a random string. Which classification best describes this activity?
Select an answer first
13expert · medium
A network defender is reviewing logs and notices that a server has been sending outbound traffic to a known malicious IP address at regular intervals. The traffic is encrypted and appears to be command-and-control communication. What should the defender do first?
Select an answer first
14foundation · easy
What is the primary goal of a cross-site scripting (XSS) attack?
Select an answer first
15expert · hard
A security analyst is investigating a potential man-in-the-middle (MITM) attack on the corporate network. The analyst notices that the ARP cache on several workstations contains entries mapping the gateway IP address to an unknown MAC address. The analyst also sees that the switch's MAC address table has multiple entries for the same port. What is the most likely attack, and what is the best immediate response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.