Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
The application is showing a TLS error message as a result of a website administrator failing to timely renew the TLS certificate. But upon deeper analysis, it appears that the problem is brought on by the expiration of the TLS certificate. Which of the following statements is correct?
TLS (Transport Layer Security) secures communication (e.g., HTTPS) using certificates, per RFC 8446. A certificate includes:
Validity Period: Start and end dates (e.g., 'Not After: March 8, 2025').
Purpose: Authenticates the server and encrypts the session.
Scenario: An expired TLS certificate (e.g., past 'Not After' date). Modern browsers (e.g., Chrome, Firefox) validate certificates during the handshake:
ClientHello: Browser initiates TLS.
ServerHello: Server sends its certificate.
Validation: Browser checks expiration, CA trust, etc.
If expired, browsers reject the handshake, displaying errors (e.g., 'NET::ERR_CERT_DATE_INVALID'). No session key is negotiated, and communication doesn't proceed over TLS. Users may bypass warnings (e.g., 'Advanced > Proceed'), but this is unencrypted or uses a fallback (not standard TLS), breaking security guarantees.
Security Implications: Expired certificates expose sites to MITM attacks, as trust is lost. CNSP likely emphasizes certificate management (e.g., automation with Let's Encrypt) to avoid this.
Why other options are incorrect:
B . The communication is still over TLS: False; an expired certificate halts the TLS handshake in compliant browsers. Legacy systems might negotiate insecurely, but this isn't 'TLS' per standards.
Real-World Context: The 2019 Equifax breach partially stemmed from expired certificates missing vulnerabilities.
What RID is given to an Administrator account on a Microsoft Windows machine?
In Windows, security principals (users, groups) are identified by a Security Identifier (SID), formatted as S-1-
RID 500: Assigned to the built-in Administrator account on every Windows machine (e.g., S-1-5-21-<machine>-500).
Created during OS install, with full system privileges.
Disabled by default in newer Windows versions (e.g., 10/11) unless explicitly enabled.
RID 501: Guest account (e.g., S-1-5-21-<machine>-501), limited access.
Technical Details:
Stored in SAM (C:\Windows\System32\config\SAM).
Enumeration: Tools like wmic useraccount or net user reveal RIDs.
Domain Context: Domain Admins use RID 512, but the question specifies a local machine.
Security Implications: RID 500 is a prime target for brute-forcing or pass-the-hash attacks (e.g., Mimikatz). CNSP likely advises renaming/disabling it (e.g., via GPO).
Why other options are incorrect:
A . 0: Reserved (e.g., Null SID, S-1-0-0), not a user RID.
C . 501: Guest, not Administrator.
D . 100: Invalid; local user RIDs start at 1000 (e.g., custom accounts).
Real-World Context: Post-compromise, attackers query RID 500 (e.g., net user Administrator) for privilege escalation.
Which of the following services do not encrypt its traffic by default?
Encryption ensures confidentiality and integrity of network traffic. Analyzing defaults:
A . DNS (Domain Name System):
Default: Unencrypted (UDP/TCP 53), per RFC 1035. Queries/responses (e.g., ''google.com 142.250.190.14'') are plaintext.
Modern Options: DNS over HTTPS (DoH, TCP 443) or DNS over TLS (DoT, TCP 853) encrypt, but aren't default in most systems (e.g., pre-2020 Windows).
B . SSH (Secure Shell):
Default: Encrypted (TCP 22), per RFC 4251. Uses asymmetric (e.g., RSA) and symmetric (e.g., AES) crypto for all sessions.
C . FTPS (FTP Secure):
Default: Encrypted (TCP 21 control, dynamic data ports). Extends FTP with SSL/TLS (e.g., RFC 4217), securing file transfers.
Technical Details:
DNS: Plaintext exposes queries to eavesdropping (e.g., ISP snooping) or spoofing (e.g., cache poisoning).
SSH/FTPS: Encryption is baked into their standards; disabling it requires explicit misconfiguration.
Security Implications: Unencrypted DNS risks privacy and integrity (e.g., Kaminsky attack). CNSP likely pushes DoH/DoT adoption.
Why other options are incorrect:
B, C: Encrypt by default.
D: False, as only DNS lacks default encryption.
Real-World Context: The 2013 Snowden leaks exposed DNS monitoring; DoH uptake (e.g., Cloudflare 1.1.1.1) counters this.
Which of the following services use TCP protocol?
TCP (Transmission Control Protocol) ensures reliable, ordered data delivery via a connection-oriented handshake, contrasting with UDP's lightweight, connectionless approach. Analyzing each service:
C . HTTP (Hypertext Transfer Protocol): Uses TCP (port 80) for web traffic. TCP's reliability ensures HTML, images, etc., arrive intact. HTTPS (TCP 443) extends this with TLS. RFC 2616 mandates TCP.
A . SNMP (Simple Network Management Protocol): Defaults to UDP (port 161) for monitoring devices. UDP's speed suits its lightweight queries, though TCP variants exist (rarely used).
B . NTP (Network Time Protocol): Uses UDP (port 123) per RFC 5905. UDP minimizes latency for time sync, tolerating occasional packet loss.
D . IKE (Internet Key Exchange): Part of IPsec, uses UDP (port 500) per RFC 7296. UDP suits its negotiation phase; TCP isn't standard.
Security Implications: TCP services like HTTP are more prone to state-based attacks (e.g., SYN floods) than UDP counterparts. CNSP likely contrasts TCP vs. UDP in protocol analysis.
Why other options are incorrect:
A, B, D: All default to UDP for efficiency, not TCP's reliability.
Real-World Context: Firewalls prioritize TCP 80/443 rules for HTTP/HTTPS, while UDP 123 is opened for NTP servers.
What types of attacks are phishing, spear phishing, vishing, scareware, and watering hole?
Social engineering exploits human psychology to manipulate individuals into divulging sensitive information, granting access, or performing actions that compromise security. Unlike technical exploits, it targets the 'human factor,' often bypassing technical defenses. The listed attacks fit this category:
Phishing: Mass, untargeted emails (e.g., fake bank alerts) trick users into entering credentials on spoofed sites. Uses tactics like urgency or trust (e.g., typosquatting domains).
Spear Phishing: Targeted phishing against specific individuals/organizations (e.g., CEO fraud), leveraging reconnaissance (e.g., LinkedIn data) for credibility.
Vishing (Voice Phishing): Phone-based attacks (e.g., fake tech support calls) extract info via verbal manipulation. Often spoofs caller ID.
Scareware: Fake alerts (e.g., ''Your PC is infected!'' pop-ups) scare users into installing malware or paying for bogus fixes. Exploits fear and urgency.
Watering Hole: Compromises trusted websites frequented by a target group (e.g., industry forums), infecting visitors via drive-by downloads. Relies on habitual trust.
Technical Details:
Delivery: Email (phishing), VoIP (vishing), web (watering hole/scareware).
Payloads: Credential theft, malware (e.g., trojans), or financial fraud.
Mitigation: User training, email filters (e.g., DMARC), endpoint protection.
Security Implications: Social engineering accounts for ~90% of breaches (e.g., Verizon DBIR 2023), as it exploits unpatchable human error. CNSP likely emphasizes awareness (e.g., phishing simulations) and layered defenses (e.g., MFA).
Why other options are incorrect:
A . Probes: Reconnaissance techniques (e.g., port scanning) to identify vulnerabilities, not manipulation-based like these attacks.
B . Insider threats: Malicious actions by authorized users (e.g., data theft by employees), not external human-targeting tactics.
D . Ransomware: A malware type (e.g., WannaCry) that encrypts data for ransom, not a manipulation method---though phishing often delivers it.
Real-World Context: The 2016 DNC hack used spear phishing to steal credentials, showing social engineering's potency.
What ports does an MSSQL server typically use?
Microsoft SQL Server (MSSQL) relies on specific ports for its core services, as defined by Microsoft and registered with IANA:
1433/TCP: The default port for the SQL Server Database Engine. Clients connect here for querying databases (e.g., via ODBC or JDBC). It's a well-known port, making it a frequent target for attacks if exposed.
1434/UDP: Used by the SQL Server Browser Service, which listens for incoming requests and redirects clients to the correct port/instance (especially for named instances). It's critical for discovering dynamic ports when 1433 isn't used.
1434/TCP: Less commonly highlighted but used in some configurations, such as dedicated admin connections (DAC) or when the Browser Service responds over TCP for specific instances. While 1433/TCP is the primary engine port, 1434/TCP can be involved in multi-instance setups.
Technical Details:
Ports can be customized (e.g., via SQL Server Configuration Manager), but these are defaults.
Named instances often use dynamic ports (allocated from the ephemeral range), with the Browser Service (1434/UDP) guiding clients to them.
Firewalls must allow these ports for MSSQL to function externally, posing risks if not secured (e.g., brute-force attacks on 1433/TCP).
Security Implications: CNSP likely covers MSSQL port security, as vulnerabilities like SQL Slammer (2003) exploited 1434/UDP misconfigurations. Hardening includes restricting access, changing defaults, and monitoring traffic.
Why other options are incorrect:
A . 1433/TCP, 2433/UDP, 3433/TCP: 2433/UDP and 3433/TCP are not MSSQL standards; they're likely typos or unrelated ports.
C . 1433/TCP, 2433/UDP, 1434/TCP: 2433/UDP is incorrect; 1434/UDP is the Browser Service port.
D . 1533/TCP, 1434/UDP, 2434/TCP: 1533/TCP and 2434/TCP aren't associated with MSSQL; they deviate from documented defaults.
Real-World Context: Tools like netstat -an | find '1433' on Windows confirm MSSQL's port usage during audits.
Where are the password hashes stored in a Microsoft Windows 64-bit system?
Windows stores password hashes in the SAM (Security Account Manager) file, with a consistent location across 32-bit and 64-bit systems.
Why B is correct: The SAM file resides at C:\Windows\System32\config\SAM, locked during system operation for security. CNSP notes this for credential extraction risks.
Why other options are incorrect:
A: System64 does not exist; System32 is used even on 64-bit systems.
C: C:\System64 is invalid; the path starts with Windows.
D: config\System32 reverses the correct directory structure.
Exam domains verified against: Official The SecOps Group CNSP exam guide, last checked October 2026.
Covers OSI layer model, IPv4 and IPv6 addressing, and basic networking hardware such as routers, switches and hubs. Understanding TCP/IP fundamentals is essential for recognizing how protocols behave on the wire and identifying security issues in real-world network traffic.
This section examines protocols and techniques used to discover devices and services on a network. Practical experience with tools like Nmap will help you understand how network reconnaissance works and why certain discovery methods are more effective than others.
Focuses on how networks are structured and how to identify targets within them. You should understand common architectural patterns in enterprise environments and how to map network topology to support security assessments.
Sample question from this domain above: Q2
Covers active and passive techniques for scanning networks and identifying systems and services. Practice using Nmap flags and output interpretation to develop intuition for what the exam questions are really asking about service discovery and version detection.
Examines how to assess the security posture of network services. Focus on understanding why services fail and what common misconfigurations introduce risk, rather than memorizing definitions.
Sample question from this domain above: Q7
Covers foundational cryptographic concepts and their application to network security. This includes understanding cipher suites, protocol versions and which choices introduce vulnerabilities.
Focuses on core security concepts within Active Directory environments. Practical knowledge of common AD misconfigurations and attack vectors is important for real-world security roles.
Sample question from this domain above: Q1
Covers fundamental security configuration and hardening for both Linux and Windows operating systems. Understand common security misconfigurations and best practices for both platforms.
Examines vulnerabilities specific to Windows services and common misconfigurations that create security risks. Understand why these issues matter and how they can be exploited in real-world scenarios.
Covers security assessment techniques for web servers and application frameworks. Includes identifying common misconfigurations and vulnerabilities in web service deployments.
Introduces fundamental techniques for analyzing malware and understanding its behaviour. This covers static and dynamic analysis approaches at an introductory level.
Focuses on understanding how social engineering is used to compromise security. Covers common tactics and how they relate to network security defences.
This topic relates to network security tools and frameworks.
Examines techniques for gathering information from public sources about targets. Understanding OSINT is important for the reconnaissance phase of security assessments.
Covers fundamental security concepts for database systems. Includes common misconfigurations and best practices for database hardening.
Focuses on TLS handshake steps, certificate validation and protocol security. Exam questions often present scenarios where you must identify the safest configuration or protocol version. Hands-on experience with tools like OpenSSL to inspect server configurations is valuable.
Covers secure password storage mechanisms including hashing, salting and modern password storage practices. Understanding why certain approaches are more secure than others is important for application and system security.
Common questions about the exam itself
