Free The SecOps Group Certified Network Security Practitioner CNSP Exam Questions

Online attacks require real-time interaction with a target system (e.g., a login interface), whereas offline attacks occur without direct system interaction, typically after obtaining data like password hashes. A rainbow table attack is an offline method that uses precomputed tables of hash values to reverse-engineer passwords from stolen hash databases, distinguishing it from the other options, which are online.

Why B is correct: Rainbow table attacks are performed offline after an attacker has already acquired a hash (e.g., from a compromised database). The attacker matches the hash against precomputed tables to find the plaintext password, requiring no interaction with the target system during the attack. CNSP classifies this as an offline password recovery technique.

Why other options are incorrect:

A: Brute force attacks involve repeatedly submitting password guesses to a live system (e.g., via SSH or a web login), making it an online attack.

C: Password spraying attacks test a few common passwords across many accounts on a live system, also an online attack aimed at avoiding lockouts.

D: Phishing attacks trick users into submitting credentials through fake interfaces (e.g., emails or websites), requiring real-time interaction and thus classified as online.

Symmetric encryption is a cryptographic technique where the same key is used for both encryption and decryption processes. In the context of network security, when data is encrypted prior to transmission and decrypted at the receiving end using a symmetric encryption algorithm (e.g., AES or Triple-DES), both the sender and receiver must share and utilize an identical secret key. This key is applied by the sender to transform plaintext into ciphertext and by the receiver to reverse the process, recovering the original plaintext. The efficiency of symmetric encryption makes it ideal for securing large volumes of data transmitted over networks, provided the key is securely distributed and managed.

Why A is correct: Option A accurately describes the fundamental property of symmetric encryption---using a single shared key for both encryption and decryption. This aligns with CNSP documentation, which emphasizes symmetric encryption's role in securing data in transit (e.g., via VPNs or secure file transfers).

Why other options are incorrect:

B: This describes asymmetric encryption (e.g., RSA), where different keys (public and private) are used for encryption and decryption, not symmetric encryption.

C: Symmetric encryption inherently relies on keys; the absence of keys contradicts its definition and operational mechanism.

D: Symmetric encryption is not inherently insecure; its security depends on key strength and management practices, not the algorithm itself. CNSP highlights that algorithms like AES are widely regarded as secure when implemented correctly.

Windows stores password hashes in the SAM (Security Account Manager) file, with a consistent location across 32-bit and 64-bit systems.

Why B is correct: The SAM file resides at C:\Windows\System32\config\SAM, locked during system operation for security. CNSP notes this for credential extraction risks.

Why other options are incorrect:

A: System64 does not exist; System32 is used even on 64-bit systems.

C: C:\System64 is invalid; the path starts with Windows.

D: config\System32 reverses the correct directory structure.

Address spoofing fakes a source address (e.g., IP, MAC) to impersonate or amplify attacks. Analyzing protocol resilience:

C . TCP (Transmission Control Protocol):

Mechanism: Three-way handshake (SYN, SYN-ACK, ACK) verifies both endpoints.

Client SYN (Seq=X), Server SYN-ACK (Seq=Y, Ack=X+1), Client ACK (Ack=Y+1).

Spoofing Resistance: Spoofer must predict the server's sequence number (randomized in modern stacks) and receive SYN-ACK, impractical without session hijacking or MITM.

Correct Implementation: RFC 793-compliant, with anti-spoofing (e.g., Linux tcp_syncookies).

A . UDP:

Connectionless (RFC 768), no handshake. Spoofed packets (e.g., source IP 1.2.3.4) are accepted if port is open, enabling reflection attacks (e.g., DNS amplification).

B . ARP (Address Resolution Protocol):

No authentication (RFC 826). Spoofed ARP replies (e.g., fake MAC for gateway IP) poison caches, enabling MITM (e.g., arpspoof).

D . IP:

No inherent validation at Layer 3 (RFC 791). Spoofed source IPs pass unless filtered (e.g., ingress filtering, RFC 2827).

Security Implications: TCP's handshake makes spoofing harder, though not impossible (e.g., blind spoofing with sequence prediction, mitigated since BSD 4.4). CNSP likely contrasts this with UDP/IP's vulnerabilities in DDoS contexts.

Why other options are incorrect:

A, B, D: Lack handshake or authentication, inherently spoofable.

Real-World Context: TCP spoofing was viable pre-1990s (e.g., Mitnick attack); modern randomization thwarts it.

Network segmentation isolates network zones for security, but certain techniques can circumvent these controls, a focus of CNSP penetration testing.

Why D is correct:

A: DNS tunneling encodes data in DNS queries, bypassing segmentation via legitimate DNS traffic.

B: VLAN hopping exploits switch misconfigurations (e.g., double tagging) to access other VLANs.

C: Covert channels use hidden communication paths (e.g., timing channels) to evade segmentation.

All are valid techniques per CNSP for testing segmentation controls.

Why other options are incomplete: A, B, or C alone exclude other viable methods, making D the comprehensive answer.

The Windows Registry is a hierarchical database storing system and application settings, organized into predefined root keys (hives). Only specific names are valid as top-level keys.

Why A is correct: HKEY_LOCAL_MACHINE (HKLM) is a standard root key containing hardware and system-wide configuration data. CNSP references it for security settings analysis (e.g., auditing policies).

Why other options are incorrect:

B: HKEY_INTERNAL_CONFIG is not a valid key; no such hive exists.

C: HKEY_ROOT_CLASSES is a misspelling; the correct key is HKEY_CLASSES_ROOT (HKCR).

D: HKEY_LOCAL_USER is incorrect; the valid key is HKEY_CURRENT_USER (HKCU).

SNMP community strings authenticate access, with defaults posing security risks if unchanged.

Why C is correct:

A: 'public' is the standard read-only default, per SNMP specs and CNSP.

B: 'private' is the standard read-write default, also per SNMP and CNSP.

Both are true, making C the answer.

Why other options are incorrect:

1, 2: Exclude one true statement each.

4: Both statements are true, so 'none' is wrong.

The Linux Filesystem Hierarchy Standard (FHS), per FHS 3.0, defines directory purposes:

/mnt: Designated for temporarily mounted filesystems, typically by system administrators.

Use: Mount points for removable media (e.g., USB drives: mount /dev/sdb1 /mnt/usb) or network shares (e.g., NFS).

Nature: Transient, user-managed, not persistent across reboots (unlike /etc/fstab mounts).

Contrast:

/media: Auto-mounts removable devices (e.g., by desktop environments like GNOME).

/mnt vs. /media: /mnt is manual, /media is system-driven.

Technical Details:

Empty by default; subdirectories (e.g., /mnt/usb) are created as needed.

Permissions: Typically root-owned (0755), requiring sudo for mounts.

Security Implications: Misconfigured /mnt mounts (e.g., world-writable) risk unauthorized access. CNSP likely covers mount security (e.g., nosuid option).

Why other options are incorrect:

B . System config/init scripts: Found in /etc (e.g., /etc/passwd, /etc/init.d).

C . Driver modules: Located in /lib/modules/<kernel-version>.

D . Kernel state: Resides in /proc (e.g., /proc/cpuinfo).

Real-World Context: Admins mount ISOs at /mnt during server provisioning (e.g., mount -o loop image.iso /mnt).

An IP address with a /18 prefix (CIDR notation) indicates 18 network bits in the subnet mask, leaving 14 host bits (32 total bits - 18). For IPv4 (e.g., 192.168.0.1):

Binary Mask: First 18 bits are 1s, rest 0s.

1st octet: 11111111 (255)

2nd octet: 11111111 (255)

3rd octet: 11000000 (192)

4th octet: 00000000 (0)

Decimal: 255.255.192.0

Calculation:

Bits: /18 = 2^14 hosts (16,384), minus 2 (network/broadcast) = 16,382 usable.

Range: 192.168.0.0--192.168.63.255 (3rd octet: 0--63, as 192 = 11000000 covers 6 bits).

Technical Details:

Subnet masks align on octet boundaries or mid-octet (e.g., 192 = 2^7 + 2^6).

Contrast: /24 = 255.255.255.0 (256 hosts), /16 = 255.255.0.0 (65,536 hosts).

Security Implications: Larger subnets (e.g., /18) increase broadcast domains, risking amplification attacks. CNSP likely teaches subnetting for segmentation (e.g., VLANs).

Why other options are incorrect:

A . 255.255.255.0: /24 (8 host bits), not /18.

B . 255.225.225.0: Invalid mask (225 = 11100001, non-contiguous 1s).

D . 255.225.192.0: Invalid (225 breaks binary sequence).

Real-World Context: Subnetting 192.168.0.0/18 isolates departments in enterprise networks.

SNMP (Simple Network Management Protocol) uses community strings as a basic form of authentication. The default read-only community string 'public' is widely known, and if left unchanged, it exposes devices to unauthorized access. The primary risk with 'public' is information disclosure, as it typically grants read-only access, allowing attackers to gather sensitive data (e.g., device configurations, network topology) without altering settings.

Why A is correct: With the 'public' string, an attacker can use tools like snmpwalk to enumerate device details (e.g., system uptime, interfaces, or software versions) via SNMP queries. This aligns with CNSP's focus on reconnaissance risks during security audits, emphasizing the danger of default credentials enabling passive data collection.

Why other options are incorrect:

B: While modifying settings is a risk with SNMP, the default 'public' string is typically read-only. Changing configurations requires a read-write community string (e.g., 'private'), which isn't implied here. Thus, snmpset would not work with 'public' alone.

C: Since B is incorrect in this context, C (both A and B) cannot be the answer.

D: The risk in A is valid, so 'none of the above' is incorrect.