1. Home
  2. The SecOps Group
  3. The SecOps Group CNSP Certification
  4. CNSP Exam Info

The SecOps Group CNSP Exam Questions - Navigate Your Path to Success

The The SecOps Group Certified Network Security Practitioner (CNSP) exam is a good choice for SecOps Security Analysts and Network Engineers and if the candidate manages to pass The SecOps Group Certified Network Security Practitioner exam, he/she will earn The SecOps Group CNSP Certification. Below are some essential facts for The SecOps Group CNSP exam candidates:

  • TrendyCerts offers 60 Questions that are based on actual The SecOps Group CNSP syllabus.
  • Our The SecOps Group CNSP Exam Practice Questions were last updated on: Mar 10, 2025

Sample Questions for The SecOps Group CNSP Exam Preparation

Question 1

In a Linux-based architecture, what does the /mnt directory contain?

Correct : A

The Linux Filesystem Hierarchy Standard (FHS), per FHS 3.0, defines directory purposes:

/mnt: Designated for temporarily mounted filesystems, typically by system administrators.

Use: Mount points for removable media (e.g., USB drives: mount /dev/sdb1 /mnt/usb) or network shares (e.g., NFS).

Nature: Transient, user-managed, not persistent across reboots (unlike /etc/fstab mounts).

Contrast:

/media: Auto-mounts removable devices (e.g., by desktop environments like GNOME).

/mnt vs. /media: /mnt is manual, /media is system-driven.

Technical Details:

Empty by default; subdirectories (e.g., /mnt/usb) are created as needed.

Permissions: Typically root-owned (0755), requiring sudo for mounts.

Security Implications: Misconfigured /mnt mounts (e.g., world-writable) risk unauthorized access. CNSP likely covers mount security (e.g., nosuid option).

Why other options are incorrect:

B . System config/init scripts: Found in /etc (e.g., /etc/passwd, /etc/init.d).

C . Driver modules: Located in /lib/modules/<kernel-version>.

D . Kernel state: Resides in /proc (e.g., /proc/cpuinfo).

Real-World Context: Admins mount ISOs at /mnt during server provisioning (e.g., mount -o loop image.iso /mnt).


Options Selected by Other Users:
Question 2

Which of the following protocols is not vulnerable to address spoofing attacks if implemented correctly?

Correct : C

Address spoofing fakes a source address (e.g., IP, MAC) to impersonate or amplify attacks. Analyzing protocol resilience:

C . TCP (Transmission Control Protocol):

Mechanism: Three-way handshake (SYN, SYN-ACK, ACK) verifies both endpoints.

Client SYN (Seq=X), Server SYN-ACK (Seq=Y, Ack=X+1), Client ACK (Ack=Y+1).

Spoofing Resistance: Spoofer must predict the server's sequence number (randomized in modern stacks) and receive SYN-ACK, impractical without session hijacking or MITM.

Correct Implementation: RFC 793-compliant, with anti-spoofing (e.g., Linux tcp_syncookies).

A . UDP:

Connectionless (RFC 768), no handshake. Spoofed packets (e.g., source IP 1.2.3.4) are accepted if port is open, enabling reflection attacks (e.g., DNS amplification).

B . ARP (Address Resolution Protocol):

No authentication (RFC 826). Spoofed ARP replies (e.g., fake MAC for gateway IP) poison caches, enabling MITM (e.g., arpspoof).

D . IP:

No inherent validation at Layer 3 (RFC 791). Spoofed source IPs pass unless filtered (e.g., ingress filtering, RFC 2827).

Security Implications: TCP's handshake makes spoofing harder, though not impossible (e.g., blind spoofing with sequence prediction, mitigated since BSD 4.4). CNSP likely contrasts this with UDP/IP's vulnerabilities in DDoS contexts.

Why other options are incorrect:

A, B, D: Lack handshake or authentication, inherently spoofable.

Real-World Context: TCP spoofing was viable pre-1990s (e.g., Mitnick attack); modern randomization thwarts it.


Options Selected by Other Users:
The SecOps Group CNSP