Prepare For Realistic CNSP Dumps PDF - 100% Passing Guarantee [Q20-Q43]

4.5/5 - (20 votes)

Prepare For Realistic CNSP Dumps PDF – 100% Passing Guarantee

Check the Available CNSP Exam Dumps with 62 Q’s

Q20. Which SMB (Server Message Block) network protocol versions are vulnerable to the EternalBlue (MS17-010) Windows exploit?

SMBv1 only

SMBv2 only

SMBv3 only

Both SMBv1 and SMBv2

Q21. Which of the following is an example of a SUID program?

/bin/ls

/usr/bin/curl

/usr/bin/passwd

None of the above

Q22. What RID is given to an Administrator account on a Microsoft Windows machine?

500

501

100

Q23. Where is the system registry file stored in a Microsoft Windows Operating System?

C:Windowsdebug

C:WindowsSystem32Config

C:Windowssecurity

All of the above

The Windows Registry is a hierarchical database storing configuration settings for the operating system, applications, and hardware. It’s physically stored as hive files on disk, located in the directory C:\Windows\System32\Config. These files are loaded into memory at boot time and managed by the Windows kernel. Key hive files include:
SYSTEM: Contains hardware and system configuration (e.g., drivers, services).
SOFTWARE: Stores software settings.
SAM: Security Accounts Manager data (e.g., local user accounts, passwords).
SECURITY: Security policies and permissions.
DEFAULT: Default user profile settings.
USERDIFF and user-specific hives (e.g., NTUSER.DAT in C:\Users<username>) for individual profiles, though these are linked to Config indirectly.
Technical Details:
Path: C:\Windows\System32\Config is the primary location for system-wide hives. Files lack extensions (e.g., “SYSTEM” not “SYSTEM.DAT”) and are backed by transaction logs (e.g., SYSTEM.LOG) for recovery.
Access: Direct file access is restricted while Windows runs, as the kernel locks them. Tools like reg save or offline forensic utilities (e.g., RegRipper) can extract them.
Backup: Copies may exist in C:\Windows\System32\config\RegBack (pre-Windows 10 1803) or repair folders (e.g., C:\Windows\Repair).
Security Implications: The registry is a prime target for attackers (e.g., persistence via Run keys) and malware (e.g., WannaCry modified registry entries). CNSP likely emphasizes securing this directory (e.g., NTFS permissions) and auditing changes (e.g., via Event Viewer, Event ID 4657). Compromising these files offline (e.g., via physical access) can extract password hashes from SAM.
Why other options are incorrect:
A . C:\Windows\debug: Used for debug logs (e.g., memory.dmp) or tools like DebugView, not registry hives. It’s unrelated to core configuration storage.
C . C:\Windows\security: Contains security-related files (e.g., audit logs, policy templates), but not the registry hives themselves.
D . All of the above: Only B is correct; including A and C dilutes accuracy.
Real-World Context: Forensic analysts target C:\Windows\System32\Config during investigations (e.g., parsing SAM with Mimikatz offline).

Q24. You are performing a security audit on a company’s infrastructure and have discovered that the domain name system (DNS) server is vulnerable to a DNS cache poisoning attack. What is the primary security risk?

The primary risk is that an attacker could redirect traffic to a malicious website and steal sensitive information.

The primary risk is that an attacker could manipulate the cache of the web server or proxy server to return incorrect content for a specific URL or web page.

Q25. Which of the following commands will work on a Microsoft operating system to add a new domain admin user?

net group “Domain Admins” John /add /domain

net user John “Domain Admins” /add /domain

net user John /add /domain /admin

net group “Administrator” John /add

Q26. On a Microsoft Windows operating system, what does the following command do?
net localgroup Sales Sales_domain /add

Display the list of the users of a local group Sales

Add a domain group to the local group Sales

Add a new user to the local group Sales

Add a local group Sales to the domain group

Q27. Which of the following files has the SUID permission set?
-rwxr-sr-x 1 root root 4096 Jan 1 00:00 myfile
-rwsr-xr-x 1 root root 4896 Jan 1 08:00 myprogram
-rw-r–r-s 1 root root 4096 Jan 1 00:00 anotherfile

myfile

myprogram

anotherfile

All of the above

Q28. Which of the following services use TCP protocol?

SNMP

NTP

HTTP

IKE

Q29. In the context of a Unix-based system, where does a daemon process execute in the memory?

Kernel space

User space

Q30. What kind of files are “Dotfiles” in a Linux-based architecture?

Library files

Driver files

System files

Hidden files

Q31. How many octets are there in an IPv6 address?

128

Q32. Which of the following files has the SGID permission set?
-rwxr-sr-x 1 root root 4096 Jan 1 08:00 myfile
-rwsr-xr-x 1 root root 4096 Jan 1 00:08 myprogram
-rw-r–r-s 1 root root 4896 Jan 1 00:00 anotherfile

myfile

myprogram

anotherfile

All of the above

Q33. What ports does an MSSQL server typically use?

1433/TCP, 2433/UDP, and 3433/TCP

1433/TCP, 1434/UDP, and 1434/TCP

1433/TCP, 2433/UDP, and 1434/TCP

1533/TCP, 1434/UDP, and 2434/TCP

Q34. How would you establish a null session to a Windows host from a Windows command prompt?

net use hostnamec$ “” /u:NULL

net use hostnamec$ “” /u:””

net use hostnameipc$ “” /u:””

net use hostnameipc$ “” /u:NULL

Q35. On a Microsoft Windows Operating System, what does the following command do?
net localgroup administrators

List domain admin users for the current domain

Displays the local administrators group on the computer

Q36. Which of the following is not a DDoS attack?

SYN Flood

NTP Amplification

UDP Flood

Brute Force

Q37. What is the response from a closed TCP port which is behind a firewall?

RST and an ACK packet

A FIN and an ACK packet

No response

A SYN and an ACK packet

Q38. Which is the correct command to change the MAC address for an Ethernet adapter in a Unix-based system?

ifconfig eth0 hw ether AA:BB:CC:DD:EE:FF

ifconfig eth0 hdw ether AA:BB:CC:DD:EE:FF

ifconfig eth0 hdwr ether AA:BB:CC:DD:EE:FF

ifconfig eth0 hwr ether AA:BB:CC:DD:EE:FF

Q39. What is the response from a closed UDP port which is not behind a firewall?

ICMP message showing Destination Unreachable

A RST packet

No response

None of the above

Q40. Which of the following statements regarding Authorization and Authentication is true?

Authorization is the process where requests to access a particular resource are granted or denied. Authentication is providing and validating the identity.

Authentication is the process where requests to access a particular resource are granted or denied. Authorization is providing and validating identity.

Authentication includes the execution rules that determine what functionality and data the user can access. Authentication and Authorization are both the same thing.

Authentication controls which processes a person can use and which files they can access, read, or modify. Authentication and authorization typically do not operate together, thus making it impossible to determine who is accessing the information.

Authentication and Authorization (often abbreviated as AuthN and AuthZ) are foundational pillars of access control in network security:
Authentication (AuthN): Verifies “who you are” by validating credentials against a trusted source. Examples include passwords, MFA (multi-factor authentication), certificates, or biometrics. It ensures the entity (user, device) is legitimate, typically via protocols like Kerberos or LDAP.
Authorization (AuthZ): Determines “what you can do” after authentication, enforcing policies on resource access (e.g., read/write permissions, API calls). It relies on mechanisms like Access Control Lists (ACLs), Role-Based Access Control (RBAC), or Attribute-Based Access Control (ABAC).
Option A correctly separates these roles:
Authorization governs access decisions (e.g., “Can user X read file Y?”).
Authentication establishes identity (e.g., “Is this user X?”).
In practice, these processes are sequential: AuthN precedes AuthZ. For example, logging into a VPN authenticates your identity (e.g., via username/password), then authorizes your access to specific subnets based on your role. CNSP likely stresses this distinction for designing secure systems, as conflating them risks privilege escalation or identity spoofing vulnerabilities.
Why other options are incorrect:
B: Reverses the definitions-Authentication doesn’t grant/deny access (that’s AuthZ), and Authorization doesn’t validate identity (that’s AuthN). This mix-up could lead to flawed security models.
C: Falsely equates AuthN and AuthZ and attributes access rules to AuthN. They’re distinct processes; treating them as identical undermines granular control (e.g., NIST SP 800-53 separates IA-2 for AuthN and AC-3 for AuthZ).
D: Misassigns access control to AuthN and claims they don’t interoperate, which is false-they work together in every modern system (e.g., SSO with RBAC). This would render auditing impossible, contradicting security best practices.
Real-World Context: A web server (e.g., Apache) authenticates via HTTP Basic Auth, then authorizes via .htaccess rules-two separate steps.

Q41. What is the response from an open UDP port which is not behind a firewall?

ICMP message showing Port Unreachable

No response

A SYN packet

A FIN packet

Q42. The Management Information Base (MIB) is a collection of object groups that is managed by which service?

SMTP

SNMP

NTP

TACACS

Q43. An ‘EICAR’ file can be used to?

Test the response of an antivirus program

Test the encryption algorithms

The SecOps Group CNSP Exam Syllabus Topics:

Topic	Details
Topic 1	Testing Network Services
Topic 2	Linux and Windows Security Basics: This section of the exam measures skills of Security Analysts and compares foundational security practices across these two operating systems. It addresses file permissions, user account controls, and basic hardening techniques to reduce the attack surface.
Topic 3	Active Directory Security Basics: This section of the exam measures the skills of Network Engineers and introduces the fundamental concepts of directory services, highlighting potential security risks and the measures needed to protect identity and access management systems in a Windows environment.
Topic 4	TLS Security Basics: This section of the exam measures the skills of Security Analysts and outlines the process of securing network communication through encryption. It highlights how TLS ensures data integrity and confidentiality, emphasizing certificate management and secure configurations.
Topic 5	Network Security Tools and Frameworks (such as Nmap, Wireshark, etc)
Topic 6	Cryptography: This section of the exam measures the skills of Security Analysts and focuses on basic encryption and decryption methods used to protect data in transit and at rest. It includes an overview of algorithms, key management, and the role of cryptography in maintaining data confidentiality.
Topic 7	Network Scanning & Fingerprinting: This section of the exam measures the skills of Security Analysts and covers techniques for probing and analyzing network hosts to gather details about open ports, operating systems, and potential vulnerabilities. It emphasizes ethical and legal considerations when performing scans.
Topic 8	Database Security Basics: This section of the exam measures the skills of Network Engineers and covers how databases can be targeted for unauthorized access. It explains the importance of strong authentication, encryption, and regular auditing to ensure that sensitive data remains protected.
Topic 9	Network Architectures, Mapping, and Target Identification: This section of the exam measures the skills of Network Engineers and reviews different network designs, illustrating how to diagram and identify potential targets in a security context. It stresses the importance of accurate network mapping for efficient troubleshooting and defense.
Topic 10	This section of the exam measures skills of Network Engineers and explores the utility of widely used software for scanning, monitoring, and troubleshooting networks. It clarifies how these tools help in detecting intrusions and verifying security configurations.
Topic 11	Common vulnerabilities affecting Windows Services: This section of the exam measures the skills of Network Engineers and focuses on frequently encountered weaknesses in core Windows components. It underscores the need to patch, configure, and monitor services to prevent privilege escalation and unauthorized use.
Topic 12	This section of the exam measures the skills of Network Engineers and explains how to verify the security and performance of various services running on a network. It focuses on identifying weaknesses in configurations and protocols that could lead to unauthorized access or data leaks.
Topic 13	Password Storage: This section of the exam measures the skills of Network Engineers and addresses safe handling of user credentials. It explains how hashing, salting, and secure storage methods can mitigate risks associated with password disclosure or theft.
Topic 14	Testing Web Servers and Frameworks: This section of the exam measures skills of Security Analysts and examines how to assess the security of web technologies. It looks at configuration issues, known vulnerabilities, and the impact of unpatched frameworks on the overall security posture.
Topic 15	Basic Malware Analysis: This section of the exam measures the skills of Network Engineers and offers an introduction to identifying malicious software. It covers simple analysis methods for recognizing malware behavior and the importance of containment strategies in preventing widespread infection.
Topic 16	TCP IP (Protocols and Networking Basics): This section of the exam measures the skills of Security Analysts and covers the fundamental principles of TCP IP, explaining how data moves through different layers of the network. It emphasizes the roles of protocols in enabling communication between devices and sets the foundation for understanding more advanced topics.
Topic 17	Network Discovery Protocols: This section of the exam measures the skills of Security Analysts and examines how protocols like ARP, ICMP, and SNMP enable the detection and mapping of network devices. It underlines their importance in security assessments and network monitoring.