Updated Dec-2025 100% Cover Real CNSP Exam Questions Make Sure You 100% Pass [Q10-Q24]

Encryption ensures confidentiality and integrity of network traffic. Analyzing defaults:
A . DNS (Domain Name System):
Default: Unencrypted (UDP/TCP 53), per RFC 1035. Queries/responses (e.g., “google.com → 142.250.190.14”) are plaintext.
Modern Options: DNS over HTTPS (DoH, TCP 443) or DNS over TLS (DoT, TCP 853) encrypt, but aren’t default in most systems (e.g., pre-2020 Windows).
B . SSH (Secure Shell):
Default: Encrypted (TCP 22), per RFC 4251. Uses asymmetric (e.g., RSA) and symmetric (e.g., AES) crypto for all sessions.
C . FTPS (FTP Secure):
Default: Encrypted (TCP 21 control, dynamic data ports). Extends FTP with SSL/TLS (e.g., RFC 4217), securing file transfers.
Technical Details:
DNS: Plaintext exposes queries to eavesdropping (e.g., ISP snooping) or spoofing (e.g., cache poisoning).
SSH/FTPS: Encryption is baked into their standards; disabling it requires explicit misconfiguration.
Security Implications: Unencrypted DNS risks privacy and integrity (e.g., Kaminsky attack). CNSP likely pushes DoH/DoT adoption.
Why other options are incorrect:
B, C: Encrypt by default.
D: False, as only DNS lacks default encryption.
Real-World Context: The 2013 Snowden leaks exposed DNS monitoring; DoH uptake (e.g., Cloudflare 1.1.1.1) counters this.

UDP is a connectionless protocol, and its behavior when a packet reaches a port depends on whether the port is open or closed. Without a firewall altering the response, the standard protocol applies.
Why A is correct: When a UDP packet is sent to a closed port, the host typically responds with an ICMP Type 3 (Destination Unreachable), Code 3 (Port Unreachable) message, indicating no service is listening. CNSP notes this as a key indicator in port scanning.
Why other options are incorrect:
B: RST packets are TCP-specific, not used in UDP.
C: No response occurs for open UDP ports unless an application replies, not closed ports.
D: A is correct, so “none of the above” is invalid.

TCP’s three-way handshake, per RFC 793, establishes a connection:
Client → Server: SYN (Synchronize) packet (e.g., port 80).
Server → Client: SYN-ACK (Synchronize-Acknowledge) packet if the port is open and listening.
Client → Server: ACK (Acknowledge) completes the connection.
Scenario: An open TCP port (e.g., 80 for HTTP) with no firewall. When a client sends a SYN to an open port (e.g., via telnet 192.168.1.1 80), the server responds with a SYN-ACK packet, indicating willingness to connect. No firewall means no filtering alters this standard response.
Packet Details:
SYN-ACK: Sets SYN and ACK flags in the TCP header, with a sequence number and acknowledgment number.
Example: Client SYN (Seq=100), Server SYN-ACK (Seq=200, Ack=101).
Security Implications: Open ports responding with SYN-ACK are easily detected (e.g., Nmap “open” state), inviting exploits if unneeded (e.g., Telnet on 23). CNSP likely stresses port minimization and monitoring.
Why other options are incorrect:
A . A FIN and an ACK packet: FIN-ACK closes an established connection, not a response to a new SYN.
B . A SYN packet: SYN initiates a connection from the client, not a server response.
D . A RST and an ACK packet: RST-ACK rejects a connection (e.g., closed port), not an open one.
Real-World Context: SYN-ACK from SSH (22/TCP) confirms a server’s presence during reconnaissance.

A null session in Windows is an unauthenticated connection to certain administrative shares, historically used for system enumeration. The net use command connects to a share, and the IPC$ (Inter-Process Communication) share is the standard target for null sessions, allowing access without credentials when configured to permit it.
Why C is correct: The command net use \\hostname\ipc$ “” /u:”” specifies the IPC$ share and uses empty strings for the password (first “”) and username (/u:””), establishing a null session. This syntax is correct for older Windows systems (e.g., XP or 2003) where null sessions were more permissive, a topic covered in CNSP for legacy system vulnerabilities.
Why other options are incorrect:
A: Targets the c$ share (not typically used for null sessions) and uses /u:NULL, which is invalid syntax; the username must be an empty string (“”).
B: Targets c$ instead of ipc$, making it incorrect for null session establishment.
D: Uses ipc$ correctly but specifies /u:NULL, which is not the proper way to denote an empty username.

Online attacks require real-time interaction with a target system (e.g., a login interface), whereas offline attacks occur without direct system interaction, typically after obtaining data like password hashes. A rainbow table attack is an offline method that uses precomputed tables of hash values to reverse-engineer passwords from stolen hash databases, distinguishing it from the other options, which are online.
Why B is correct: Rainbow table attacks are performed offline after an attacker has already acquired a hash (e.g., from a compromised database). The attacker matches the hash against precomputed tables to find the plaintext password, requiring no interaction with the target system during the attack. CNSP classifies this as an offline password recovery technique.
Why other options are incorrect:
A: Brute force attacks involve repeatedly submitting password guesses to a live system (e.g., via SSH or a web login), making it an online attack.
C: Password spraying attacks test a few common passwords across many accounts on a live system, also an online attack aimed at avoiding lockouts.
D: Phishing attacks trick users into submitting credentials through fake interfaces (e.g., emails or websites), requiring real-time interaction and thus classified as online.

Protocols are defined by their transport layer usage (TCP or UDP), impacting their security and performance characteristics.
Why D is correct: SSH (Secure Shell) uses TCP (port 22) for reliable, connection-oriented communication, unlike the UDP-based options. CNSP contrasts TCP and UDP protocol security.
Why other options are incorrect:
A: SNMP uses UDP (ports 161, 162) for lightweight network management.
B: NTP uses UDP (port 123) for time synchronization.
C: IKE (IPsec key exchange) uses UDP (ports 500, 4500).

The screenshot is from Wireshark, a network protocol analyzer, displaying captured network traffic. The relevant columns include the source and destination IP addresses, ports, protocol, and additional information about the packets. Let’s break down the details:
Destination Port Analysis: The screenshot shows multiple packets with a destination port of 443 (e.g., in the “Destination” column, entries like “172.72.61.9:443”). Port 443 is the default port for HTTPS (HTTP Secure), which is HTTP traffic encrypted using SSL/TLS. This indicates that the application is communicating over HTTPS.
Protocol Analysis: The “Protocol” column lists “TLSv1.2” for most packets (e.g., frame numbers 2000084, 2000086). TLS (Transport Layer Security) is the cryptographic protocol used by HTTPS to secure HTTP communications. This confirms that the traffic is HTTPS, not plain HTTP.
Packet Details: The “Info” column provides additional context, such as “Application Data” for TLS packets, indicating encrypted application-layer data (typical of HTTPS). There are also HTTP packets (e.g., frame 2000088), but these are likely part of the HTTPS session (e.g., HTTP/2 over TLS, as noted by “HTTP2”).
Now, let’s evaluate the options:
Option A: “The application is running on port 443 and the HTTPS protocol.” This is correct. The destination port 443 and the use of TLSv1.2 confirm that the application is using HTTPS. HTTPS is the standard protocol for secure web communication, and port 443 is its designated port. CNSP documentation emphasizes that HTTPS traffic on port 443 indicates a secure application-layer protocol, often used for web applications handling sensitive data.
Option B: “The credentials have been submitted over the HTTP protocol.” This is incorrect. HTTP typically uses port 80, but the screenshot shows traffic on port 443 with TLS, indicating HTTPS. Credentials submitted over this connection would be encrypted via HTTPS, not sent in plaintext over HTTP. CNSP highlights the security risks of HTTP for credential submission due to lack of encryption, which isn’t the case here.
Option C: “The credentials have been submitted over the HTTPS protocol.” While this statement could be true (since HTTPS is in use, any credentials would likely be submitted securely), the question asks for the “correct” statement based on the screenshot. The screenshot doesn’t explicitly show credential submission (e.g., a POST request with form data); it only shows the protocol and port. Option A is more directly supported by the screenshot as it focuses on the application’s protocol and port, not the specific action of credential submission. CNSP notes that HTTPS ensures confidentiality, but this option requires more specific evidence of credentials.
Option D: “The application is running on port 80 and the HTTP protocol.” This is incorrect. Port 80 is the default for HTTP, but the screenshot clearly shows port 443 and TLS, indicating HTTPS. CNSP documentation contrasts HTTP (port 80, unencrypted) with HTTPS (port 443, encrypted), making this option invalid.
Conclusion: Option A is the most accurate and comprehensive statement directly supported by the screenshot, confirming the application’s use of port 443 and HTTPS. While Option C might be true in a broader context, it’s less definitive without explicit evidence of credential submission in the captured packets.

UDP’s connectionless nature means it lacks inherent acknowledgment mechanisms, affecting its port response behavior.
Why B is correct: An open UDP port does not respond unless an application explicitly sends a reply. Without a firewall or application response, the sender receives no feedback, per CNSP scanning guidelines.
Why other options are incorrect:
A: ICMP Port Unreachable indicates a closed port, not an open one.
C: SYN packets are TCP-specific, not UDP.
D: FIN packets are also TCP-specific.

In Linux/Unix, file permissions are displayed in a 10-character string (e.g., -rwxr-xr-x), where the first character is the file type (- for regular files) and the next nine are permissions for user (owner), group, and others (rwx = read, write, execute). Special bits like SUID (Set User ID) modify execution behavior:
SUID: When set, a program runs with the owner’s permissions (e.g., root) rather than the executor’s. It’s denoted by an s in the user execute position (replacing x if executable, or capitalized S if not).
Analysis:
-rwxr-sr-x (myfile): User: rwx, Group: r-s (SGID), Others: r-x. The s is in the group execute position, indicating SGID, not SUID.
-rwsr-xr-x (myprogram): User: rws (SUID), Group: r-x, Others: r-x. The s in the user execute position confirms SUID; owned by root, it runs as root.
-rw-r–r-s (anotherfile): User: rw-, Group: r–, Others: r-s. The s is in the others execute position, but no x exists, making it irrelevant (and not SUID). Typically, s here would be a sticky bit on directories, not files.
Security Implications: SUID binaries (e.g., /usr/bin/passwd) are common targets for privilege escalation if misconfigured (e.g., writable by non-root users). CNSP likely emphasizes auditing SUID permissions with find / -perm -u=s.
Why other options are incorrect:
A . myfile: Has SGID (s in group), not SUID.
C . anotherfile: The s doesn’t indicate SUID; it’s a misapplied bit without execute permission.
D . All of the above: Only myprogram has SUID.
Real-World Context: Exploiting SUID binaries is a classic Linux attack vector (e.g., CVE-2016-1247 for Nginx).

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) port numbers are defined by a 16-bit field in their packet headers, as specified in RFC 793 (TCP) and RFC 768 (UDP). A 16-bit integer ranges from 0 to 65,535, yielding a total of 65,536 possible ports (2^16). However, port 0 is universally reserved across both protocols and is not considered “usable” for standard network communication. According to the Internet Assigned Numbers Authority (IANA), port 0 is designated for special purposes, such as indicating an invalid or dynamic port assignment in some systems (e.g., when a client requests an ephemeral port). In practice, operating systems and applications avoid binding to port 0 for listening services, and it’s often used in error conditions or as a placeholder in protocol implementations (e.g., socket programming).
Thus, the usable port range spans from 1 to 65,535, totaling 65,535 ports. These ports are categorized by IANA into:
Well-Known Ports (0-1023): Reserved for system services (e.g., HTTP on 80/TCP). Note that 0 is still reserved within this range.
Registered Ports (1024-49151): Assigned to user applications.
Dynamic/Ephemeral Ports (49152-65535): Used temporarily by clients.
From a security perspective, understanding the usable port count is critical for firewall configuration, port scanning (e.g., with Nmap), and detecting anomalies (e.g., services binding to unexpected ports). Misconfiguring a system to use port 0 could lead to protocol errors or expose vulnerabilities, though it’s rare. The CNSP curriculum likely emphasizes this distinction to ensure practitioners can accurately scope network security assessments.
Why other options are incorrect:
A . 65536: This reflects the total number of possible ports (0-65535), but it includes the reserved port 0, which isn’t usable for typical TCP/UDP communication. In security contexts, including port 0 in a count could lead to misconfigured rules or scanning errors.
C . 63535: This is an arbitrary number with no basis in the 16-bit port structure. It might stem from a typo or misunderstanding (e.g., subtracting 2000 from 65535 incorrectly), but it’s invalid.
D . 65335: Similarly, this lacks grounding in protocol standards. It could be a miscalculation (e.g., subtracting 200 from 65535), but it doesn’t align with TCP/UDP specifications.
Real-World Context: In penetration testing, tools like Nmap scan ports 1-65535 by default, excluding 0 unless explicitly specified (e.g., -p0-65535), reinforcing that 65,535 is the practical usable count.

SNMP community strings authenticate access, with defaults posing security risks if unchanged.
Why C is correct:
A: “public” is the standard read-only default, per SNMP specs and CNSP.
B: “private” is the standard read-write default, also per SNMP and CNSP.
Both are true, making C the answer.
Why other options are incorrect:
1, 2: Exclude one true statement each.
4: Both statements are true, so “none” is wrong.

The Active Directory (AD) database on Windows domain controllers contains critical directory information, stored in a specific file format.
Why D is correct: The NTDS.DIT file (NT Directory Services Directory Information Tree) is the Active Directory database file, located in C:\Windows\NTDS\ on domain controllers. It stores all AD objects (users, groups, computers) and schema data in a hierarchical structure. CNSP identifies NTDS.DIT as the key file for AD data extraction in security audits.
Why other options are incorrect:
A . NTDS.DAT: Not a valid AD database file; may be a confusion with other system files.
B . NTDS.MDB: Refers to an older Microsoft Access database format, not used for AD.
C . MSAD.MDB: Not a recognized file for AD; likely a misnomer.

TCP (Transmission Control Protocol) ensures reliable, ordered data delivery via a connection-oriented handshake, contrasting with UDP’s lightweight, connectionless approach. Analyzing each service:
C . HTTP (Hypertext Transfer Protocol): Uses TCP (port 80) for web traffic. TCP’s reliability ensures HTML, images, etc., arrive intact. HTTPS (TCP 443) extends this with TLS. RFC 2616 mandates TCP.
A . SNMP (Simple Network Management Protocol): Defaults to UDP (port 161) for monitoring devices. UDP’s speed suits its lightweight queries, though TCP variants exist (rarely used).
B . NTP (Network Time Protocol): Uses UDP (port 123) per RFC 5905. UDP minimizes latency for time sync, tolerating occasional packet loss.
D . IKE (Internet Key Exchange): Part of IPsec, uses UDP (port 500) per RFC 7296. UDP suits its negotiation phase; TCP isn’t standard.
Security Implications: TCP services like HTTP are more prone to state-based attacks (e.g., SYN floods) than UDP counterparts. CNSP likely contrasts TCP vs. UDP in protocol analysis.
Why other options are incorrect:
A, B, D: All default to UDP for efficiency, not TCP’s reliability.
Real-World Context: Firewalls prioritize TCP 80/443 rules for HTTP/HTTPS, while UDP 123 is opened for NTP servers.

In Windows, security principals (users, groups) are identified by a Security Identifier (SID), formatted as S-1-<authority>-<domain>-<RID>. The RID (Relative Identifier) is the final component, unique within a domain or machine. For local accounts:
RID 500: Assigned to the built-in Administrator account on every Windows machine (e.g., S-1-5-21-<machine>-500).
Created during OS install, with full system privileges.
Disabled by default in newer Windows versions (e.g., 10/11) unless explicitly enabled.
RID 501: Guest account (e.g., S-1-5-21-<machine>-501), limited access.
Technical Details:
Stored in SAM (C:\Windows\System32\config\SAM).
Enumeration: Tools like wmic useraccount or net user reveal RIDs.
Domain Context: Domain Admins use RID 512, but the question specifies a local machine.
Security Implications: RID 500 is a prime target for brute-forcing or pass-the-hash attacks (e.g., Mimikatz). CNSP likely advises renaming/disabling it (e.g., via GPO).
Why other options are incorrect:
A . 0: Reserved (e.g., Null SID, S-1-0-0), not a user RID.
C . 501: Guest, not Administrator.
D . 100: Invalid; local user RIDs start at 1000 (e.g., custom accounts).
Real-World Context: Post-compromise, attackers query RID 500 (e.g., net user Administrator) for privilege escalation.