CNSP Questions Prepare with Learning Information! 2026 Regularly updated
Get CNSP Products Practice Material for CNSP Exam Question Preparation
NEW QUESTION # 32
Which of the following is an example of a SUID program?
- A. None of the above
- B. /usr/bin/passwd
- C. /bin/ls
- D. /usr/bin/curl
Answer: B
Explanation:
In Linux/Unix, the SUID (Set User ID) bit allows a program to execute with the owner's permissions, typically root, rather than the caller's. It's denoted by an s in the user execute field (e.g., -rwsr-xr-x). Common SUID programs perform privileged tasks requiring temporary elevation.
Analysis:
C . /usr/bin/passwd:
Purpose: Updates user passwords in /etc/shadow (root-owned, 0600 perms).
Permissions: Typically -rwsr-xr-x, owned by root. The SUID bit lets non-root users modify shadow securely.
Command: ls -l /usr/bin/passwd confirms SUID (s in user execute).
A . /bin/ls:
Purpose: Lists directory contents, no privileged access needed.
Permissions: -rwxr-xr-x (no SUID). Runs as the calling user.
B . /usr/bin/curl:
Purpose: Transfers data over HTTP/FTP, no root privileges required by default.
Permissions: -rwxr-xr-x (no SUID).
Technical Details:
SUID Bit: Set via chmod u+s <file> or chmod 4755.
Security: SUID binaries are audited (e.g., find / -perm -u=s) due to escalation risks if writable or poorly coded (e.g., buffer overflows).
Security Implications: CNSP likely highlights SUID as an attack vector (e.g., CVE-1996-0095 exploited passwd flaws). Hardening removes unnecessary SUID bits.
Why other options are incorrect:
A, B: Lack SUID; no privileged operations.
D: Incorrect, as /usr/bin/passwd is a SUID example.
Real-World Context: SUID on /bin/su or /usr/bin/sudo similarly enables privilege escalation, often targeted in exploits.
NEW QUESTION # 33
How would you establish a null session to a Windows host from a Windows command prompt?
- A. net use \hostname\c$ "" /u:NULL
- B. net use \hostname\ipc$ "" /u:""
- C. net use \hostname\c$ "" /u:""
- D. net use \hostname\ipc$ "" /u:NULL
Answer: B
Explanation:
A null session in Windows is an unauthenticated connection to certain administrative shares, historically used for system enumeration. The net use command connects to a share, and the IPC$ (Inter-Process Communication) share is the standard target for null sessions, allowing access without credentials when configured to permit it.
Why C is correct: The command net use \\hostname\ipc$ "" /u:"" specifies the IPC$ share and uses empty strings for the password (first "") and username (/u:""), establishing a null session. This syntax is correct for older Windows systems (e.g., XP or 2003) where null sessions were more permissive, a topic covered in CNSP for legacy system vulnerabilities.
Why other options are incorrect:
A: Targets the c$ share (not typically used for null sessions) and uses /u:NULL, which is invalid syntax; the username must be an empty string ("").
B: Targets c$ instead of ipc$, making it incorrect for null session establishment.
D: Uses ipc$ correctly but specifies /u:NULL, which is not the proper way to denote an empty username.
NEW QUESTION # 34
What is the response from an open TCP port which is not behind a firewall?
- A. A FIN and an ACK packet
- B. A SYN packet
- C. A SYN and an ACK packet
- D. A RST and an ACK packet
Answer: C
Explanation:
TCP's three-way handshake, per RFC 793, establishes a connection:
Client → Server: SYN (Synchronize) packet (e.g., port 80).
Server → Client: SYN-ACK (Synchronize-Acknowledge) packet if the port is open and listening.
Client → Server: ACK (Acknowledge) completes the connection.
Scenario: An open TCP port (e.g., 80 for HTTP) with no firewall. When a client sends a SYN to an open port (e.g., via telnet 192.168.1.1 80), the server responds with a SYN-ACK packet, indicating willingness to connect. No firewall means no filtering alters this standard response.
Packet Details:
SYN-ACK: Sets SYN and ACK flags in the TCP header, with a sequence number and acknowledgment number.
Example: Client SYN (Seq=100), Server SYN-ACK (Seq=200, Ack=101).
Security Implications: Open ports responding with SYN-ACK are easily detected (e.g., Nmap "open" state), inviting exploits if unneeded (e.g., Telnet on 23). CNSP likely stresses port minimization and monitoring.
Why other options are incorrect:
A . A FIN and an ACK packet: FIN-ACK closes an established connection, not a response to a new SYN.
B . A SYN packet: SYN initiates a connection from the client, not a server response.
D . A RST and an ACK packet: RST-ACK rejects a connection (e.g., closed port), not an open one.
Real-World Context: SYN-ACK from SSH (22/TCP) confirms a server's presence during reconnaissance.
NEW QUESTION # 35
If a hash begins with $2a$, what hashing algorithm has been used?
- A. MD5
- B. SHA256
- C. SHA512
- D. Blowfish
Answer: D
Explanation:
The prefix $2a$ identifies the bcrypt hashing algorithm, which is based on the Blowfish symmetric encryption cipher (developed by Bruce Schneier). Bcrypt is purpose-built for password hashing, incorporating:
Salt: A random string (e.g., 22 Base64 characters) to thwart rainbow table attacks.
Work Factor: A cost parameter (e.g., $2a$10$ means 2^10 iterations), making it computationally expensive to brute-force.
Format: $2a$[cost]$[salt][hash]
Example: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
$2a$: Bcrypt variant (original is $2$; $2a$ fixes a minor bug).
$10$: 1024 iterations.
Next 22 characters: Salt.
Remaining: Hashed password.
Used in /etc/shadow on Linux, bcrypt's adaptive nature ensures it remains secure as hardware improves. CNSP likely includes it in cryptography modules for its strength over older algorithms like MD5.
Why other options are incorrect:
B . SHA256: Part of the SHA-2 family, outputs a 64-character hexadecimal string (e.g., e3b0c442...), no $ prefix. It's faster, less suited for passwords.
C . MD5: Produces a 32-character hex string (e.g., d41d8cd9...), no prefix. It's cryptographically broken (collisions found).
D . SHA512: SHA-2 variant, 128-character hex (e.g., cf83e135...), no $ prefix, not salted by default.
Real-World Context: Bcrypt protects SSH keys and web app passwords (e.g., in PHP's password_hash()).
NEW QUESTION # 36
WannaCry, an attack, spread throughout the world in May 2017 using machines running on outdated Microsoft operating systems. What is WannaCry?
- A. Malware
- B. Ransomware
Answer: B
Explanation:
WannaCry is a ransomware attack that erupted in May 2017, infecting over 200,000 systems across 150 countries. It exploited the EternalBlue vulnerability (MS17-010) in Microsoft Windows SMBv1, targeting unpatched systems (e.g., Windows XP, Server 2003). Developed by the NSA and leaked by the Shadow Brokers, EternalBlue allowed remote code execution.
Ransomware Mechanics:
Encryption: WannaCry used RSA-2048 and AES-128 to encrypt files, appending extensions like .wcry.
Ransom Demand: Displayed a message demanding $300-$600 in Bitcoin, leveraging a hardcoded wallet.
Worm Propagation: Self-replicated via SMB, scanning internal and external networks, unlike typical ransomware requiring user interaction (e.g., phishing).
Malware Context: While WannaCry is malware (malicious software), "ransomware" is the precise subcategory, distinguishing it from viruses, trojans, or spyware. Malware is a broad term encompassing any harmful code; ransomware specifically encrypts data for extortion. CNSP likely classifies WannaCry as ransomware to focus on its payload and mitigation (e.g., patching, backups).
Why other options are incorrect:
B . Malware: Correct but overly generic. WannaCry's defining trait is ransomware behavior, not just maliciousness. Specificity matters in security taxonomy for threat response (e.g., NIST IR 8019).
Real-World Context: WannaCry crippled NHS hospitals, highlighting patch management's criticality. A kill switch (a domain sinkhole) halted it, but variants persist.
NEW QUESTION # 37
What user account is required to create a Golden Ticket in Active Directory?
- A. Local User account
- B. KRBTGT account
- C. Service account
- D. Domain User account
Answer: B
Explanation:
A Golden Ticket is a forged Kerberos Ticket-Granting Ticket (TGT) in Active Directory (AD), granting an attacker unrestricted access to domain resources by impersonating any user (e.g., with Domain Admin privileges). Kerberos, per RFC 4120, relies on the KRBTGT account-a built-in service account on every domain controller-to encrypt and sign TGTs. To forge a Golden Ticket, an attacker needs:
The KRBTGT password hash (NTLM or Kerberos key), typically extracted from a domain controller's memory using tools like Mimikatz.
Additional domain details (e.g., SID, domain name).
Process:
Compromise a domain controller (e.g., via privilege escalation).
Extract the KRBTGT hash (e.g., lsadump::dcsync /user:krbtgt).
Forge a TGT with arbitrary privileges using the hash (e.g., Mimikatz's kerberos::golden command).
The KRBTGT account itself isn't "used" to create the ticket; its hash is the key ingredient. Unlike legitimate TGTs issued by the KDC, a Golden Ticket bypasses authentication checks, persisting until the KRBTGT password is reset (a rare event in most environments). CNSP likely highlights this as a high-severity AD attack vector.
Why other options are incorrect:
A . Local User account: Local accounts are machine-specific, lack domain privileges, and can't access the KRBTGT hash stored on domain controllers.
B . Domain User account: A standard user has no inherent access to domain controller credentials or the KRBTGT hash without escalation.
C . Service account: While service accounts may have elevated privileges, they don't automatically provide the KRBTGT hash unless compromised to domain admin level-still insufficient without targeting KRBTGT specifically.
Real-World Context: The 2014 Sony Pictures hack leveraged Golden Tickets, emphasizing the need for KRBTGT hash rotation post-breach (a complex remediation step).
NEW QUESTION # 38
What RID is given to an Administrator account on a Microsoft Windows machine?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
In Windows, security principals (users, groups) are identified by a Security Identifier (SID), formatted as S-1-<authority>-<domain>-<RID>. The RID (Relative Identifier) is the final component, unique within a domain or machine. For local accounts:
RID 500: Assigned to the built-in Administrator account on every Windows machine (e.g., S-1-5-21-<machine>-500).
Created during OS install, with full system privileges.
Disabled by default in newer Windows versions (e.g., 10/11) unless explicitly enabled.
RID 501: Guest account (e.g., S-1-5-21-<machine>-501), limited access.
Technical Details:
Stored in SAM (C:\Windows\System32\config\SAM).
Enumeration: Tools like wmic useraccount or net user reveal RIDs.
Domain Context: Domain Admins use RID 512, but the question specifies a local machine.
Security Implications: RID 500 is a prime target for brute-forcing or pass-the-hash attacks (e.g., Mimikatz). CNSP likely advises renaming/disabling it (e.g., via GPO).
Why other options are incorrect:
A . 0: Reserved (e.g., Null SID, S-1-0-0), not a user RID.
C . 501: Guest, not Administrator.
D . 100: Invalid; local user RIDs start at 1000 (e.g., custom accounts).
Real-World Context: Post-compromise, attackers query RID 500 (e.g., net user Administrator) for privilege escalation.
NEW QUESTION # 39
Which of the following attacks are associated with an ICMP protocol?
- A. All of the following
- B. Smurf attack
- C. ICMP flooding
- D. Ping of death
Answer: A
Explanation:
ICMP (Internet Control Message Protocol), per RFC 792, handles diagnostics (e.g., ping) and errors in IP networks. It's exploitable in:
A . Ping of Death:
Method: Sends oversized ICMP Echo Request packets (>65,535 bytes) via fragmentation. Reassembly overflows buffers, crashing older systems (e.g., Windows 95).
Fix: Modern OSes cap packet size (e.g., ping -s 65500).
B . Smurf Attack:
Method: Spoofs ICMP Echo Requests to a network's broadcast address (e.g., 192.168.255.255). All hosts reply, flooding the victim.
Amplification: 100 hosts = 100x traffic.
C . ICMP Flooding:
Method: Overwhelms a target with ICMP Echo Requests (e.g., ping -f), consuming bandwidth/CPU.
Variant: BlackNurse attack targets firewalls.
Technical Details:
ICMP Type 8 (Echo Request), Type 0 (Echo Reply) are key.
Mitigation: Rate-limit ICMP, disable broadcasts (e.g., no ip directed-broadcast).
Security Implications: ICMP attacks are DoS vectors. CNSP likely teaches filtering (e.g., iptables -p icmp -j DROP) balanced with diagnostics need.
Why other options are incorrect:
A, B, C individually: All are ICMP-based; D is comprehensive.
Real-World Context: Smurf attacks peaked in the 1990s; modern routers block them by default.
NEW QUESTION # 40
Which of the following represents a valid Windows Registry key?
- A. HKEY_LOCAL_USER
- B. HKEY_ROOT_CLASSES
- C. HKEY_LOCAL_MACHINE
- D. HKEY_INTERNAL_CONFIG
Answer: C
Explanation:
The Windows Registry is a hierarchical database storing system and application settings, organized into predefined root keys (hives). Only specific names are valid as top-level keys.
Why A is correct: HKEY_LOCAL_MACHINE (HKLM) is a standard root key containing hardware and system-wide configuration data. CNSP references it for security settings analysis (e.g., auditing policies).
Why other options are incorrect:
B: HKEY_INTERNAL_CONFIG is not a valid key; no such hive exists.
C: HKEY_ROOT_CLASSES is a misspelling; the correct key is HKEY_CLASSES_ROOT (HKCR).
D: HKEY_LOCAL_USER is incorrect; the valid key is HKEY_CURRENT_USER (HKCU).
NEW QUESTION # 41
Which of the following statements regarding Authorization and Authentication is true?
- A. Authentication includes the execution rules that determine what functionality and data the user can access. Authentication and Authorization are both the same thing.
- B. Authorization is the process where requests to access a particular resource are granted or denied. Authentication is providing and validating the identity.
- C. Authentication is the process where requests to access a particular resource are granted or denied. Authorization is providing and validating identity.
- D. Authentication controls which processes a person can use and which files they can access, read, or modify. Authentication and authorization typically do not operate together, thus making it impossible to determine who is accessing the information.
Answer: B
Explanation:
Authentication and Authorization (often abbreviated as AuthN and AuthZ) are foundational pillars of access control in network security:
Authentication (AuthN): Verifies "who you are" by validating credentials against a trusted source. Examples include passwords, MFA (multi-factor authentication), certificates, or biometrics. It ensures the entity (user, device) is legitimate, typically via protocols like Kerberos or LDAP.
Authorization (AuthZ): Determines "what you can do" after authentication, enforcing policies on resource access (e.g., read/write permissions, API calls). It relies on mechanisms like Access Control Lists (ACLs), Role-Based Access Control (RBAC), or Attribute-Based Access Control (ABAC).
Option A correctly separates these roles:
Authorization governs access decisions (e.g., "Can user X read file Y?").
Authentication establishes identity (e.g., "Is this user X?").
In practice, these processes are sequential: AuthN precedes AuthZ. For example, logging into a VPN authenticates your identity (e.g., via username/password), then authorizes your access to specific subnets based on your role. CNSP likely stresses this distinction for designing secure systems, as conflating them risks privilege escalation or identity spoofing vulnerabilities.
Why other options are incorrect:
B: Reverses the definitions-Authentication doesn't grant/deny access (that's AuthZ), and Authorization doesn't validate identity (that's AuthN). This mix-up could lead to flawed security models.
C: Falsely equates AuthN and AuthZ and attributes access rules to AuthN. They're distinct processes; treating them as identical undermines granular control (e.g., NIST SP 800-53 separates IA-2 for AuthN and AC-3 for AuthZ).
D: Misassigns access control to AuthN and claims they don't interoperate, which is false-they work together in every modern system (e.g., SSO with RBAC). This would render auditing impossible, contradicting security best practices.
Real-World Context: A web server (e.g., Apache) authenticates via HTTP Basic Auth, then authorizes via .htaccess rules-two separate steps.
NEW QUESTION # 42
What kind of files are "Dotfiles" in a Linux-based architecture?
- A. System files
- B. Library files
- C. Driver files
- D. Hidden files
Answer: D
Explanation:
In Linux, file visibility is determined by naming conventions, impacting how files are listed or accessed in the file system.
Why D is correct: "Dotfiles" are files or directories with names starting with a dot (e.g., .bashrc), making them hidden by default in directory listings (e.g., ls requires -a to show them). They are commonly used for user configuration, as per CNSP's Linux security overview.
Why other options are incorrect:
A: Library files (e.g., in /lib) aren't inherently hidden.
B: Driver files (e.g., kernel modules in /lib/modules) aren't dotfiles by convention.
C: System files may or may not be hidden; "dotfiles" specifically denotes hidden status.
NEW QUESTION # 43
Which of the following services do not encrypt its traffic by default?
- A. SSH
- B. All of these
- C. FTPS
- D. DNS
Answer: D
Explanation:
Encryption ensures confidentiality and integrity of network traffic. Analyzing defaults:
A . DNS (Domain Name System):
Default: Unencrypted (UDP/TCP 53), per RFC 1035. Queries/responses (e.g., "google.com → 142.250.190.14") are plaintext.
Modern Options: DNS over HTTPS (DoH, TCP 443) or DNS over TLS (DoT, TCP 853) encrypt, but aren't default in most systems (e.g., pre-2020 Windows).
B . SSH (Secure Shell):
Default: Encrypted (TCP 22), per RFC 4251. Uses asymmetric (e.g., RSA) and symmetric (e.g., AES) crypto for all sessions.
C . FTPS (FTP Secure):
Default: Encrypted (TCP 21 control, dynamic data ports). Extends FTP with SSL/TLS (e.g., RFC 4217), securing file transfers.
Technical Details:
DNS: Plaintext exposes queries to eavesdropping (e.g., ISP snooping) or spoofing (e.g., cache poisoning).
SSH/FTPS: Encryption is baked into their standards; disabling it requires explicit misconfiguration.
Security Implications: Unencrypted DNS risks privacy and integrity (e.g., Kaminsky attack). CNSP likely pushes DoH/DoT adoption.
Why other options are incorrect:
B, C: Encrypt by default.
D: False, as only DNS lacks default encryption.
Real-World Context: The 2013 Snowden leaks exposed DNS monitoring; DoH uptake (e.g., Cloudflare 1.1.1.1) counters this.
NEW QUESTION # 44
Which of the following techniques can be used to bypass network segmentation during infrastructure penetration testing?
- A. DNS tunneling
- B. VLAN hopping
- C. Covert channels
- D. All of the above
Answer: D
Explanation:
Network segmentation isolates network zones for security, but certain techniques can circumvent these controls, a focus of CNSP penetration testing.
Why D is correct:
A: DNS tunneling encodes data in DNS queries, bypassing segmentation via legitimate DNS traffic.
B: VLAN hopping exploits switch misconfigurations (e.g., double tagging) to access other VLANs.
C: Covert channels use hidden communication paths (e.g., timing channels) to evade segmentation.
All are valid techniques per CNSP for testing segmentation controls.
Why other options are incomplete: A, B, or C alone exclude other viable methods, making D the comprehensive answer.
NEW QUESTION # 45
What is the response from a closed TCP port which is behind a firewall?
- A. RST and an ACK packet
- B. A FIN and an ACK packet
- C. No response
- D. A SYN and an ACK packet
Answer: C
NEW QUESTION # 46
The Management Information Base (MIB) is a collection of object groups that is managed by which service?
- A. SMTP
- B. TACACS
- C. SNMP
- D. NTP
Answer: C
Explanation:
The Management Information Base (MIB) is a structured database defining manageable objects (e.g., CPU usage, interface status) in a network device. It's part of the SNMP (Simple Network Management Protocol) framework, per RFC 1157, used for monitoring and managing network devices (e.g., routers, switches).
SNMP Mechanics:
MIB Structure: Hierarchical, with Object Identifiers (OIDs) like 1.3.6.1.2.1.1.1.0 (sysDescr).
Ports: UDP 161 (agent), 162 (traps).
Operation: Agents expose MIB data; managers (e.g., Nagios) query it via GET/SET commands.
MIB files (e.g., IF-MIB, HOST-RESOURCES-MIB) are vendor-specific or standardized, parsed by SNMP tools (e.g., snmpwalk). CNSP likely covers SNMP for network monitoring and securing it against enumeration (e.g., weak community strings like "public").
Why other options are incorrect:
A . SMTP (Simple Mail Transfer Protocol): Email delivery (TCP 25), unrelated to MIB or device management.
C . NTP (Network Time Protocol): Time synchronization (UDP 123), not MIB-related.
D . TACACS (Terminal Access Controller Access-Control System): Authentication/authorization (TCP 49), not MIB management.
Real-World Context: SNMP misconfiguration led to the 2018 Cisco switch exploits via exposed MIB data.
NEW QUESTION # 47
......
The SecOps Group CNSP Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
Most Reliable The SecOps Group CNSP Training Materials: https://actual4test.practicetorrent.com/CNSP-practice-exam-torrent.html