The SecOps Group CNSP Practice Test Questions Answers

A DNS zone transfer replicates an entire DNS zone (a collection of DNS records for a domain) from a primary nameserver to a secondary one, typically for redundancy or load balancing. TheAXFR(Authoritative Full Zone Transfer) query type, defined in RFC 1035, facilitates this process. The dig (Domain Information Groper) tool, a staple in Linux/Unix environments, is used to query DNS servers. The correct syntax is:

dig @ axfrHere, dig @10.0.0.1 victim.com axfr instructs dig to request a zone transfer for "victim.com" from the nameserver at 10.0.0.1. The @ symbol specifies the target server, overriding the system’s default resolver.

Technical Details:

The AXFR query is sent over TCP (port 53), not UDP, due to the potentially large size of zone data, which exceeds UDP’s typical 512-byte limit (pre-EDNS0).

Successful execution requires the nameserver to permit zone transfers from the querying IP, often restricted to trusted secondaries via Access Control Lists (ACLs) for security. If restricted, the server responds with a "REFUSED" error.

Security Implications:Zone transfers expose all DNS records (e.g., A, MX, NS), making them a reconnaissance goldmine for attackers if misconfigured. CNSP likely emphasizes securing DNS servers against unauthorized AXFR requests, using tools like dig to test vulnerabilities.

Why other options are incorrect:

A. dig @10.0.0.1 victim.com axrfr:"axrfr" is a typographical error. The correct query type is "axfr." Executing this would result in a syntax error or an unrecognized query type response from dig.

B. dig @10.0.0.1 victim.com afxr:"afxr" is another typo, not a valid DNS query type per RFC 1035. dig would fail to interpret this, likely outputting an error like "unknown query type."

C. dig @10.0.0.1 victim.com arfxr:"arfxr" is also invalid, a jumbled version of "axfr." It holds no meaning in DNS protocol standards and would fail similarly.

Real-World Context:Penetration testers use dig ... axfr to identify misconfigured DNS servers. For example, dig @ns1.example.com example.com axfr might reveal subdomains or internal IPs if not locked down.References:CNSP Official Documentation (DNS Security and Tools); RFC 1035 (Domain Names - Implementation and Specification).

UDP (User Datagram Protocol), per RFC 768, is connectionless, lacking TCP’s handshake or acknowledgment mechanisms. When a UDP packet reaches a port:

Closed Port:The host typically sends an ICMP "Destination Port Unreachable" (Type 3, Code 3) unless suppressed (e.g., by firewall or OS settings).

Open Port:If a service is listening (e.g., DNS on 53/UDP), it processes the packet but doesn’t inherently reply unless the application protocol requires it (e.g., DNS sends a response).

Scenario:Anopen UDP port behind a firewall, with the firewall rule allowing traffic (e.g., permit udp any host 10.0.0.1 eq 123). The packet reaches the service, but UDP itself doesn’t mandate a response. Most services (e.g., NTP, SNMP) only reply if the packet matches an expected request. In this question’s generic context (no specific service),no responseis the default, as the firewall permits the packet, and the open port silently accepts it without feedback.

Security Implications:This silence makes UDP ports harder to scan (e.g., Nmap assumes "open|filtered" for no response), but exposed open ports risk amplification attacks (e.g., DNS reflection). CNSP likely contrasts UDP’s behavior with TCP for firewall rule crafting.

Why other options are incorrect:

A. ICMP message showing Port Unreachable:Occurs for closed ports, not open ones, unless the service explicitly rejects the packet (rare).

C. A SYN Packet:SYN is TCP-specific (handshake initiation), irrelevant to UDP.

D. A FIN Packet:FIN is TCP-specific (connection closure), not UDP.

Real-World Context:Testing UDP 53 (DNS) with dig @8.8.8.8 +udp yields a response, but generic UDP probes (e.g., nc -u) often get silence.References:CNSP Official Documentation (UDP and Firewall Behavior); RFC 768 (UDP).

In Linux/Unix, theSUID (Set User ID)bit allows a program to execute with the owner’s permissions, typically root, rather than the caller’s. It’s denoted by an s in the user execute field (e.g., -rwsr-xr-x). Common SUID programs perform privileged tasks requiring temporary elevation.

Analysis:

C. /usr/bin/passwd:

Purpose: Updates user passwords in /etc/shadow (root-owned, 0600 perms).

Permissions: Typically -rwsr-xr-x, owned by root. The SUID bit lets non-root users modify shadow securely.

Command: ls -l /usr/bin/passwd confirms SUID (s in user execute).

A. /bin/ls:

Purpose: Lists directory contents, no privileged access needed.

Permissions: -rwxr-xr-x (no SUID).Runs as the calling user.

B. /usr/bin/curl:

Purpose: Transfers data over HTTP/FTP, no root privileges required by default.

Permissions: -rwxr-xr-x (no SUID).

Technical Details:

SUID Bit: Set via chmod u+s or chmod 4755.

Security: SUID binaries are audited (e.g., find / -perm -u=s) due to escalation risks if writable or poorly coded (e.g., buffer overflows).

Security Implications:CNSP likely highlights SUID as an attack vector (e.g., CVE-1996-0095 exploited passwd flaws). Hardening removes unnecessary SUID bits.

Why other options are incorrect:

A, B:Lack SUID; no privileged operations.

D:Incorrect, as /usr/bin/passwd is a SUID example.

Real-World Context:SUID on /bin/su or /usr/bin/sudo similarly enables privilege escalation, often targeted in exploits.References:CNSP Official Documentation (Linux Security); Linux File Permissions Guide.

Social engineeringexploits human psychology to manipulate individuals into divulging sensitive information, granting access, or performing actions that compromise security. Unlike technical exploits, it targets the "human factor," often bypassing technical defenses. The listed attacks fit this category:

Phishing:Mass, untargeted emails (e.g., fake bank alerts) trick users into entering credentials on spoofed sites. Uses tactics like urgency or trust (e.g., typosquatting domains).

Spear Phishing:Targeted phishing against specific individuals/organizations (e.g., CEO fraud), leveraging reconnaissance (e.g., LinkedIn data) for credibility.

Vishing (Voice Phishing):Phone-based attacks (e.g., fake tech support calls) extract info via verbal manipulation. Often spoofs caller ID.

Scareware:Fake alerts (e.g., “Your PC is infected!” pop-ups) scare users into installing malware or paying for bogus fixes. Exploits fear and urgency.

Watering Hole:Compromises trusted websites frequented by a target group (e.g., industry forums), infecting visitors via drive-by downloads. Relies on habitual trust.

Technical Details:

Delivery: Email (phishing), VoIP (vishing), web (watering hole/scareware).

Payloads: Credential theft, malware (e.g., trojans), or financial fraud.

Mitigation: User training, email filters (e.g., DMARC), endpoint protection.

Security Implications:Social engineering accounts for ~90% of breaches (e.g., Verizon DBIR 2023), as it exploits unpatchable human error. CNSP likely emphasizes awareness (e.g., phishing simulations) and layered defenses (e.g., MFA).

Why other options are incorrect:

A. Probes:Reconnaissance techniques (e.g., port scanning) to identify vulnerabilities, not manipulation-based like these attacks.

B. Insider threats:Malicious actions by authorized users (e.g., data theft by employees), not external human-targeting tactics.

D. Ransomware:A malware type (e.g., WannaCry) that encrypts data for ransom, not a manipulation method—though phishing often delivers it.

Real-World Context:The 2016 DNC hack used spear phishing to steal credentials, showing social engineering’s potency.References:CNSP Official Study Guide (Social Engineering Threats); NIST SP 800-50 (Security Awareness Training).

UDP’s connectionless nature means it lacks inherent acknowledgment mechanisms, affecting its port response behavior.

Why B is correct:An open UDP port does not respond unless an application explicitly sends a reply. Without a firewall or application response, the sender receives no feedback, per CNSP scanning guidelines.

Why other options are incorrect:

A:ICMP Port Unreachable indicates a closed port, not an open one.

C:SYN packets are TCP-specific, not UDP.

D:FIN packets are also TCP-specific.

References:CNSP "UDP Scanning" (Section on Port Behavior) notes "no response" as the default for open UDP ports.