The SecOps Group CNSP Exam Questions Instant Access

Question 1

Which of the following is a valid DNS record type?

ANAPTR record

BSRV record

CTXT record

DAll of the above

Answer : D

DNS (Domain Name System) records define how domain names are mapped to various types of data, each serving a specific purpose in network operations. The question asks for valid DNS record types, and all listed options are recognized.

Why D is correct:

A . NAPTR record: The Naming Authority Pointer (NAPTR) record is used for service discovery and mapping domain names to services, protocols, and ports (e.g., in SIP or ENUM systems).

B . SRV record: The Service (SRV) record specifies the hostname and port for specific services (e.g., LDAP, XMPP), aiding in service location.

C . TXT record: The Text (TXT) record stores arbitrary text data, often for SPF, DKIM, or domain verification.

All are valid DNS record types per RFC standards and CNSP documentation, making 'All of the above' the correct answer.

Why other options are incomplete: A, B, or C alone exclude other valid types listed, so D is the most comprehensive response.

Question 2

How many usable TCP/UDP ports are there?

A65536

B65535

C63535

D65335

Answer : B

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) port numbers are defined by a 16-bit field in their packet headers, as specified in RFC 793 (TCP) and RFC 768 (UDP). A 16-bit integer ranges from 0 to 65,535, yielding a total of 65,536 possible ports (2^16). However, port 0 is universally reserved across both protocols and is not considered 'usable' for standard network communication. According to the Internet Assigned Numbers Authority (IANA), port 0 is designated for special purposes, such as indicating an invalid or dynamic port assignment in some systems (e.g., when a client requests an ephemeral port). In practice, operating systems and applications avoid binding to port 0 for listening services, and it's often used in error conditions or as a placeholder in protocol implementations (e.g., socket programming).

Thus, the usable port range spans from 1 to 65,535, totaling 65,535 ports. These ports are categorized by IANA into:

Well-Known Ports (0--1023): Reserved for system services (e.g., HTTP on 80/TCP). Note that 0 is still reserved within this range.

Registered Ports (1024--49151): Assigned to user applications.

Dynamic/Ephemeral Ports (49152--65535): Used temporarily by clients.

From a security perspective, understanding the usable port count is critical for firewall configuration, port scanning (e.g., with Nmap), and detecting anomalies (e.g., services binding to unexpected ports). Misconfiguring a system to use port 0 could lead to protocol errors or expose vulnerabilities, though it's rare. The CNSP curriculum likely emphasizes this distinction to ensure practitioners can accurately scope network security assessments.

Why other options are incorrect:

A . 65536: This reflects the total number of possible ports (0--65535), but it includes the reserved port 0, which isn't usable for typical TCP/UDP communication. In security contexts, including port 0 in a count could lead to misconfigured rules or scanning errors.

C . 63535: This is an arbitrary number with no basis in the 16-bit port structure. It might stem from a typo or misunderstanding (e.g., subtracting 2000 from 65535 incorrectly), but it's invalid.

D . 65335: Similarly, this lacks grounding in protocol standards. It could be a miscalculation (e.g., subtracting 200 from 65535), but it doesn't align with TCP/UDP specifications.

Real-World Context: In penetration testing, tools like Nmap scan ports 1--65535 by default, excluding 0 unless explicitly specified (e.g., -p0-65535), reinforcing that 65,535 is the practical usable count.

Question 3

What user account is required to create a Golden Ticket in Active Directory?

ALocal User account

BDomain User account

CService account

DKRBTGT account

Answer : D

A Golden Ticket is a forged Kerberos Ticket-Granting Ticket (TGT) in Active Directory (AD), granting an attacker unrestricted access to domain resources by impersonating any user (e.g., with Domain Admin privileges). Kerberos, per RFC 4120, relies on the KRBTGT account---a built-in service account on every domain controller---to encrypt and sign TGTs. To forge a Golden Ticket, an attacker needs:

The KRBTGT password hash (NTLM or Kerberos key), typically extracted from a domain controller's memory using tools like Mimikatz.

Additional domain details (e.g., SID, domain name).

Process:

Compromise a domain controller (e.g., via privilege escalation).

Extract the KRBTGT hash (e.g., lsadump::dcsync /user:krbtgt).

Forge a TGT with arbitrary privileges using the hash (e.g., Mimikatz's kerberos::golden command).

The KRBTGT account itself isn't 'used' to create the ticket; its hash is the key ingredient. Unlike legitimate TGTs issued by the KDC, a Golden Ticket bypasses authentication checks, persisting until the KRBTGT password is reset (a rare event in most environments). CNSP likely highlights this as a high-severity AD attack vector.

Why other options are incorrect:

A . Local User account: Local accounts are machine-specific, lack domain privileges, and can't access the KRBTGT hash stored on domain controllers.

B . Domain User account: A standard user has no inherent access to domain controller credentials or the KRBTGT hash without escalation.

C . Service account: While service accounts may have elevated privileges, they don't automatically provide the KRBTGT hash unless compromised to domain admin level---still insufficient without targeting KRBTGT specifically.

Real-World Context: The 2014 Sony Pictures hack leveraged Golden Tickets, emphasizing the need for KRBTGT hash rotation post-breach (a complex remediation step).

Question 4

Which is the correct command to change the MAC address for an Ethernet adapter in a Unix-based system?

Aifconfig eth0 hw ether AA:BB:CC:DD:EE:FF

Bifconfig eth0 hdw ether AA:BB:CC:DD:EE:FF

Cifconfig eth0 hdwr ether AA:BB:CC:DD:EE:FF

Difconfig eth0 hwr ether AA:BB:CC:DD:EE:FF

Answer : A

In Unix-based systems (e.g., Linux), the ifconfig command is historically used to configure network interfaces, including changing the Media Access Control (MAC) address of an Ethernet adapter. The correct syntax to set a new MAC address for an interface like eth0 is ifconfig eth0 hw ether AA:BB:CC:DD:EE:FF, where hw specifies the hardware address type (ether for Ethernet), followed by the new MAC address in colon-separated hexadecimal format.

Why A is correct: The hw ether argument is the standard and correct syntax recognized by ifconfig to modify the MAC address. This command temporarily changes the MAC address until the system reboots or the interface is reset, assuming the user has sufficient privileges (e.g., root). CNSP documentation on network configuration and spoofing techniques validates this syntax for testing network security controls.

Why other options are incorrect:

B: hdw is not a valid argument; it's a typographical error and unrecognized by ifconfig.

C: hdwr is similarly invalid; no such shorthand exists in the command structure.

D: hwr is incorrect; the full keyword hw followed by ether is required for proper parsing.

Question 5

You are performing a security audit on a company's infrastructure and have discovered that the domain name system (DNS) server is vulnerable to a DNS cache poisoning attack. What is the primary security risk?

AThe primary risk is that an attacker could redirect traffic to a malicious website and steal sensitive information.

BThe primary risk is that an attacker could manipulate the cache of the web server or proxy server to return incorrect content for a specific URL or web page.

Answer : A

DNS cache poisoning, also known as DNS spoofing, involves an attacker injecting false DNS records into a resolver's cache, altering how domain names resolve.

Why A is correct: The primary risk is that an attacker can redirect users to malicious websites (e.g., phishing or malware sites) by poisoning the DNS cache with fake IP addresses. This can lead to credential theft, data exfiltration, or malware distribution. CNSP identifies this as the core threat of DNS cache poisoning, aligning with real-world attack vectors.

Why other option is incorrect:

B . Manipulate the cache of the web server or proxy server: This describes web cache poisoning, a different attack targeting HTTP caches, not DNS servers. DNS cache poisoning affects DNS resolution, not web or proxy server caches directly.

Question 6

Which one of the following is a phishing email?

AOnly A

BOnly B

CBoth A and B

DNone of the above
Explanation:

The screenshot shows an email labeled 'B' with the subject 'Verify your email address' purportedly from Apple. To determine if this is a phishing email, we need to analyze its content and characteristics against common phishing indicators as outlined in CNSP documentation. Since option A is not provided in the screenshot, we will evaluate email B and infer the context for A.
Analysis of Email B:
Sender and Branding: The email claims to be from 'Apple Support' and includes an Apple logo, which is a common tactic to establish trust. However, phishing emails often impersonate legitimate brands like Apple to deceive users.
Subject and Content: The subject 'Verify your email address' and the body requesting the user to verify their email by clicking a link ('Verify Your Email') are typical of phishing attempts. Legitimate companies like Apple may send verification emails, but the tone and context here raise suspicion.
Link Presence: The email contains a clickable link ('Verify Your Email') that is purportedly for email verification. The screenshot does not show the URL, but phishing emails often include malicious links that lead to fake login pages to steal credentials. CNSP emphasizes that unsolicited requests to click links for verification are a red flag.
Urgency and Vague Instructions: The email includes a statement, 'If you did not make this change or believe an unauthorized person has accessed your account, click here to cancel and secure your account.' This creates a sense of urgency, a common phishing tactic to prompt immediate action without critical thinking.
Generic Greeting: The email starts with 'Dear User,' a generic greeting often used in phishing emails. Legitimate companies like Apple typically personalize emails with the user's name.
Suspicious Elements: The email mentions 'your Apple ID (example@icloud.com),' which is a placeholder rather than a specific email address, further indicating a mass phishing campaign rather than a targeted, legitimate communication.
Phishing Indicators (per CNSP):
CNSP documentation on phishing identification lists several red flags:
Unsolicited requests for verification or account updates.
Generic greetings (e.g., 'Dear User' instead of a personalized name).
Presence of links that may lead to malicious sites (not verifiable in the screenshot but implied).
Urgency or threats (e.g., 'click here to cancel and secure your account').
Impersonation of trusted brands (e.g., Apple).
Email B exhibits multiple indicators: the generic greeting, unsolicited verification request, urgent call to action, and impersonation of Apple.
Option A Context:
Since the screenshot only shows email B, and the correct answer is 'Only B,' we can infer that email A (not shown) does not exhibit phishing characteristics. For example, A might be a legitimate email from Apple with proper personalization, no suspicious links, or a different context (e.g., a purchase confirmation rather than a verification request).
Evaluation of Options:
1. Only A: Incorrect, as email A is not shown, and the correct answer indicates B as the phishing email.
2. Only B: Correct. Email B shows clear phishing characteristics, such as impersonation, a generic greeting, an unsolicited verification link, and urgency, aligning with CNSP's phishing criteria.
3. Both A and B: Incorrect, as A is implied to be non-phishing based on the correct answer.
4. None of the above: Incorrect, as B is a phishing email.
Conclusion: Email B is a phishing email due to its impersonation of Apple, generic greeting, unsolicited verification request with a link, and use of urgency to prompt action. Since A is not shown but implied to be non-phishing, the correct answer is 'Only B.'

Answer : B

Question 7

Which of the following is true for SNMP?

A) The default community string for read-only access is "public."

B) The default community string for read/write access is "private."

AOnly A

BOnly B

CBoth A and B

DNone of the above

Answer : C

SNMP community strings authenticate access, with defaults posing security risks if unchanged.

Why C is correct:

A: 'public' is the standard read-only default, per SNMP specs and CNSP.

B: 'private' is the standard read-write default, also per SNMP and CNSP.

Both are true, making C the answer.

Why other options are incorrect:

1, 2: Exclude one true statement each.

4: Both statements are true, so 'none' is wrong.

The SecOps Group Certified Network Security Practitioner CNSP Exam Questions