SSL/TLS protocols secure network communication, but older versions have vulnerabilities:

SSLv2 (1995): Weak ciphers, no handshake integrity (e.g., MITM via DROWN attack, CVE-2016-0800).

Deprecated by RFC 6176 (2011).

SSLv3 (1996): Vulnerable to POODLE (CVE-2014-3566), weak block ciphers (e.g., RC4). Deprecated by

RFC 7568 (2015).

TLSv1.0 (1999, RFC 2246): Inherits SSLv3 flaws (e.g., BEAST, CVE-2011-3389), weak CBC ciphers.

Deprecated by PCI DSS (2018) and RFC 8996 (2021).

TLSv1.1 (2006, RFC 4346): Improved over 1.0 but lacks modern cipher suites (e.g., AEAD). Deprecated

with 1.0 by RFC 8996.

TLSv1.2 (2008, RFC 5246): Secure with strong ciphers (e.g., AES-GCM), widely used today.

TLSv1.3 (2018, RFC 8446): Latest, removes legacy weaknesses, mandatory forward secrecy.

Answer: C (A and B)—SSLv2, SSLv3, TLSv1.0, and TLSv1.1 are unsafe due to exploitable

Explanation:flaws. TLSv1.2 and 1.3 remain secure. CNSP likely aligns with IETF/PCI standards,

mandating modern versions.

Why other options are incorrect:

A: Correct but incomplete without B.

B: Correct but incomplete without A.

D: Incorrectly includes TLSv1.2 and 1.3, which are secure and recommended.

Real-World Context: POODLE forced mass SSLv3 disablement in 2014; TLS 1.0/1.1 deprecation hit

legacy systems in 2021.

Reference: CNSP Official Documentation (Cryptographic Protocols); RFC 8996 (TLS Deprecation).

The Active Directory (AD) database on Windows domain controllers contains critical directory

information, stored in a specific file format.

Why D is correct: The NTDS.DIT file (NT Directory Services Directory Information Tree) is the Active

Directory database file, located in C:\Windows\NTDS\ on domain controllers. It stores all AD objects

(users, groups, computers) and schema data in a hierarchical structure. CNSP identifies NTDS.DIT as

the key file for AD data extraction in security audits.

Why other options are incorrect:

A . NTDS.DAT: Not a valid AD database file; may be a confusion with other system files.

B . NTDS.MDB: Refers to an older Microsoft Access database format, not used for AD.

C . MSAD.MDB: Not a recognized file for AD; likely a misnomer.

Reference: CNSP "Windows Active Directory Security" (Section on Database Files) confirms NTDS.DIT

as the Active Directory database file.

Thank you for your visit.

DDoS (Distributed Denial of Service) attacks aim to overwhelm a target’s resources with excessive

traffic, disrupting availability, whereas other attack types target different goals.

Why D is correct: Brute force attacks focus on guessing credentials (e.g., passwords) to gain

unauthorized access, not on denying service. CNSP classifies it as an authentication attack, not a

DDoS method.

Why other options are incorrect:

A: SYN Flood exhausts TCP connection resources, a classic DDoS attack.

B: NTP Amplification leverages amplified responses to flood targets, a DDoS technique.

C: UDP Flood overwhelms a system with UDP packets, another DDoS method.

Reference: CNSP "DDoS Attack Types" (Section on Attack Classification) excludes brute force from

DDoS categories, listing SYN, NTP, and UDP floods as examples.

In Linux, password hashes are stored in a secure file to protect user authentication data. The

evolution of Linux security practices moved password storage from plaintext or weakly protected

files to a more secure location.

Why C is correct: The /etc/shadow file is the standard location for storing password hashes in modern

Linux systems. This file is readable only by the root user, enhancing security by restricting access. It

contains encrypted password hashes (typically using algorithms like SHA-512), along with user

details such as password expiration policies. CNSP documentation on Linux security emphasizes

/etc/shadow as the authoritative source for password hashes, replacing older methods.

Why other options are incorrect:

A . /etc/passwd: Historically, /etc/passwd stored passwords in plaintext or weakly hashed forms (e.g.,

using DES), but modern systems use it only for user account information (e.g., UID, GID, home

directory) and reference /etc/shadow for hashes.

B . /etc/password: This is not a valid file in the Linux file system; it appears to be a typographical error

or misunderstanding, with no recognized role in password storage.

D . /usr/bin/shadow: /usr/bin contains executable binaries, not configuration or data files like

password hashes. /etc/shadow is the correct path.

Reference: CNSP "Linux Authentication Mechanisms" (Section on Password Storage) details the

transition to /etc/shadow for enhanced security and contrasts it with /etc/passwd.

A DNS zone transfer involves replicating the DNS zone data (e.g., all records for a domain) from a

primary to a secondary DNS server, requiring a reliable transport mechanism.

Why A is correct: DNS zone transfers use TCP port 53 because TCP ensures reliable, ordered delivery

of data, which is critical for transferring large zone files. CNSP notes that TCP is the standard protocol

for zone transfers (e.g., AXFR requests), as specified in RFC 5936.

Why other options are incorrect:

B . 53/UDP: UDP port 53 is used for standard DNS queries and responses due to its speed and lower

overhead, but it is not suitable for zone transfers, which require reliability over speed.

C . Both 1 and 2: This is incorrect because zone transfers are exclusively TCP-based, not UDP-based.

D . None of the above: Incorrect, as 53/TCP is the correct port for DNS zone transfers.

Reference: CNSP "DNS Security Practices" (Section on Zone Transfers) specifies TCP port 53 as the

protocol for secure and reliable zone transfer operations.