Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which of the following represents a valid Windows Registry key?
The Windows Registry is a hierarchical database storing system and application settings, organized into predefined root keys (hives). Only specific names are valid as top-level keys.
Why A is correct: HKEY_LOCAL_MACHINE (HKLM) is a standard root key containing hardware and system-wide configuration data. CNSP references it for security settings analysis (e.g., auditing policies).
Why other options are incorrect:
B: HKEY_INTERNAL_CONFIG is not a valid key; no such hive exists.
C: HKEY_ROOT_CLASSES is a misspelling; the correct key is HKEY_CLASSES_ROOT (HKCR).
D: HKEY_LOCAL_USER is incorrect; the valid key is HKEY_CURRENT_USER (HKCU).
What kind of files are "Dotfiles" in a Linux-based architecture?
In Linux, file visibility is determined by naming conventions, impacting how files are listed or accessed in the file system.
Why D is correct: 'Dotfiles' are files or directories with names starting with a dot (e.g., .bashrc), making them hidden by default in directory listings (e.g., ls requires -a to show them). They are commonly used for user configuration, as per CNSP's Linux security overview.
Why other options are incorrect:
A: Library files (e.g., in /lib) aren't inherently hidden.
B: Driver files (e.g., kernel modules in /lib/modules) aren't dotfiles by convention.
C: System files may or may not be hidden; 'dotfiles' specifically denotes hidden status.
Which of the following attacks are associated with an ICMP protocol?
ICMP (Internet Control Message Protocol), per RFC 792, handles diagnostics (e.g., ping) and errors in IP networks. It's exploitable in:
A . Ping of Death:
Method: Sends oversized ICMP Echo Request packets (>65,535 bytes) via fragmentation. Reassembly overflows buffers, crashing older systems (e.g., Windows 95).
Fix: Modern OSes cap packet size (e.g., ping -s 65500).
B . Smurf Attack:
Method: Spoofs ICMP Echo Requests to a network's broadcast address (e.g., 192.168.255.255). All hosts reply, flooding the victim.
Amplification: 100 hosts = 100x traffic.
C . ICMP Flooding:
Method: Overwhelms a target with ICMP Echo Requests (e.g., ping -f), consuming bandwidth/CPU.
Variant: BlackNurse attack targets firewalls.
Technical Details:
ICMP Type 8 (Echo Request), Type 0 (Echo Reply) are key.
Mitigation: Rate-limit ICMP, disable broadcasts (e.g., no ip directed-broadcast).
Security Implications: ICMP attacks are DoS vectors. CNSP likely teaches filtering (e.g., iptables -p icmp -j DROP) balanced with diagnostics need.
Why other options are incorrect:
A, B, C individually: All are ICMP-based; D is comprehensive.
Real-World Context: Smurf attacks peaked in the 1990s; modern routers block them by default.
If you find the 111/TCP port open on a Unix system, what is the next logical step to take?
Port 111/TCP is the default port for the RPC (Remote Procedure Call) portmapper service on Unix systems, which registers and manages RPC services.
Why A is correct: Running rpcinfo -p <hostname> queries the portmapper to list all registered RPC services, their programs, versions, and associated ports. This is a logical next step during a security audit or penetration test to identify potential vulnerabilities (e.g., NFS or NIS services). CNSP recommends this command for RPC enumeration.
Why other options are incorrect:
B . Telnet to the port to look for a banner: Telnet might connect, but RPC services don't typically provide a human-readable banner, making this less effective than rpcinfo.
C . Telnet to the port, send 'GET / HTTP/1.0' and gather information from the response: Port 111 is not an HTTP service, so an HTTP request is irrelevant and will likely fail.
D . None of the above: Incorrect, as A is a valid and recommended step.
Which one of the following is not an online attack?
Online attacks require real-time interaction with a target system (e.g., a login interface), whereas offline attacks occur without direct system interaction, typically after obtaining data like password hashes. A rainbow table attack is an offline method that uses precomputed tables of hash values to reverse-engineer passwords from stolen hash databases, distinguishing it from the other options, which are online.
Why B is correct: Rainbow table attacks are performed offline after an attacker has already acquired a hash (e.g., from a compromised database). The attacker matches the hash against precomputed tables to find the plaintext password, requiring no interaction with the target system during the attack. CNSP classifies this as an offline password recovery technique.
Why other options are incorrect:
A: Brute force attacks involve repeatedly submitting password guesses to a live system (e.g., via SSH or a web login), making it an online attack.
C: Password spraying attacks test a few common passwords across many accounts on a live system, also an online attack aimed at avoiding lockouts.
D: Phishing attacks trick users into submitting credentials through fake interfaces (e.g., emails or websites), requiring real-time interaction and thus classified as online.
60 questions covering all exam domains, starting from $20
Exam domains verified against: Official The SecOps Group CNSP exam guide, last checked September 2026.
Covers OSI layer model, IPv4 and IPv6 addressing, and basic networking hardware such as routers, switches and hubs. Understanding TCP/IP fundamentals is essential for recognizing how protocols behave on the wire and identifying security issues in real-world network traffic.
This section examines protocols and techniques used to discover devices and services on a network. Practical experience with tools like Nmap will help you understand how network reconnaissance works and why certain discovery methods are more effective than others.
Focuses on how networks are structured and how to identify targets within them. You should understand common architectural patterns in enterprise environments and how to map network topology to support security assessments.
Sample question from this domain above: Q2
Covers active and passive techniques for scanning networks and identifying systems and services. Practice using Nmap flags and output interpretation to develop intuition for what the exam questions are really asking about service discovery and version detection.
Examines how to assess the security posture of network services. Focus on understanding why services fail and what common misconfigurations introduce risk, rather than memorizing definitions.
Covers foundational cryptographic concepts and their application to network security. This includes understanding cipher suites, protocol versions and which choices introduce vulnerabilities.
Focuses on core security concepts within Active Directory environments. Practical knowledge of common AD misconfigurations and attack vectors is important for real-world security roles.
Covers fundamental security configuration and hardening for both Linux and Windows operating systems. Understand common security misconfigurations and best practices for both platforms.
Examines vulnerabilities specific to Windows services and common misconfigurations that create security risks. Understand why these issues matter and how they can be exploited in real-world scenarios.
Covers security assessment techniques for web servers and application frameworks. Includes identifying common misconfigurations and vulnerabilities in web service deployments.
Introduces fundamental techniques for analyzing malware and understanding its behaviour. This covers static and dynamic analysis approaches at an introductory level.
Sample question from this domain above: Q3
Focuses on understanding how social engineering is used to compromise security. Covers common tactics and how they relate to network security defences.
Covers practical use of industry-standard tools such as Nmap and Wireshark. Build hands-on experience with these tools to understand their output and capabilities for security analysis.
Examines techniques for gathering information from public sources about targets. Understanding OSINT is important for the reconnaissance phase of security assessments.
Sample question from this domain above: Q4
Covers fundamental security concepts for database systems. Includes common misconfigurations and best practices for database hardening.
Focuses on TLS handshake steps, certificate validation and protocol security. Exam questions often present scenarios where you must identify the safest configuration or protocol version. Hands-on experience with tools like OpenSSL to inspect server configurations is valuable.
Covers secure password storage mechanisms including hashing, salting and modern password storage practices. Understanding why certain approaches are more secure than others is important for application and system security.
Common questions about the exam itself
