eEDA Enterprise Defense Administrator Exam Voucher practice questions

Q: Is this eEDA Enterprise Defense Administrator Exam Voucher practice test free?

Yes. All 44 eEDA Enterprise Defense Administrator Exam Voucher practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real eEDA Enterprise Defense Administrator Exam Voucher exam cost?

The official price is $450. Cyber VK sells the same official eEDA Enterprise Defense Administrator Exam Voucher voucher for $234.99 — a saving of $215.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real eEDA Enterprise Defense Administrator Exam Voucher exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

Which log source would an enterprise defense administrator review first to determine whether a specific user account successfully authenticated to a Windows domain controller?

Accepted Answer

Event ID 4624 in the Security log records successful logons, including the account name, logon type, and source host. The Application, System, and Setup logs record crashes, service installs, and OS setup activity respectively, not authentication outcomes.

Question 2

A defense administrator configures a network firewall rule set that ends with an explicit rule denying all traffic that has not already matched an earlier rule. What is the primary security purpose of this final rule?

Accepted Answer

An explicit cleanup/deny-all rule at the bottom of the policy implements default-deny, ensuring only traffic matching an approved allow rule can pass. The other options describe performance, statefulness, and logging behaviors that are controlled by separate settings.

Question 3

During a Kerberoasting attack, which type of account does the attacker request a service ticket for in order to crack its password offline?

Accepted Answer

Kerberos service tickets are encrypted with the NTLM hash of the account owning the requested SPN, so user accounts with SPNs yield crackable tickets; machine and KRBTGT accounts use long, randomly generated passwords that resist offline cracking.

Question 4

A SIEM correlation rule fires an alert every time a single failed logon occurs, generating thousands of alerts per day that analysts ignore. Which tuning action best preserves detection value while reducing alert volume?

Accepted Answer

Converting a per-event rule into a threshold (aggregation) rule keeps detection of brute-force patterns while suppressing the normal background noise of isolated typos. Disabling, downgrading, or archiving the rule removes analyst visibility into the attack pattern.

Question 5

An administrator must place a network sensor so that it can drop malicious packets in real time rather than only alert on them. Which deployment is required?

Accepted Answer

Only an inline deployment puts the sensor in the forwarding path, which is required for IPS blocking; SPAN ports, passive TAPs, and NetFlow collectors receive copies or metadata and can only detect and alert.

Question 6

An administrator deploys Microsoft LAPS across all domain-joined workstations. Which attack technique is this control primarily intended to disrupt?

Accepted Answer

LAPS assigns each machine a unique, randomized, automatically rotated local administrator password stored in Active Directory, so a hash or password harvested from one endpoint no longer authenticates to any other endpoint.

Question 7

An administrator must detect low-and-slow credential stuffing that spreads a handful of attempts per account across thousands of accounts and multiple source IPs over several days. Which detection approach is most likely to surface this activity?

Accepted Answer

Low-and-slow attacks stay below per-IP and per-account thresholds by design, so only aggregate statistical baselining across the whole authentication surface reveals the anomalous failure ratio. Signature matching fails because attackers routinely randomize or spoof user-agent strings.

Question 8

During analysis of egress traffic, an analyst observes a workstation making frequent DNS TXT queries to a single external authoritative name server, with long randomized subdomain labels and consistently large response payloads. Which control most directly disrupts this activity while preserving normal name resolution?

Accepted Answer

The pattern indicates DNS tunneling, which is countered by funneling all resolution through controlled internal resolvers that inspect query entropy, length, and record types. DNSSEC only provides response integrity, blocking TCP/53 leaves UDP tunneling intact, and DoH would hide the traffic from inspection entirely.

Question 9

A defense administrator wants reliable detection of DCSync activity performed from a non-domain-controller host. Which audit data source provides the most direct evidence?

Accepted Answer

DCSync abuses the directory replication rights, and Event ID 4662 records the specific extended-right GUIDs being exercised; a replication request originating from an account or host that is not a domain controller is a high-fidelity indicator.

Question 10

In the NIST SP 800-61 incident response life cycle, which phase directly follows Detection and Analysis?

Accepted Answer

NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Containment work begins as soon as an incident is confirmed and scoped.

Question 11

Which Windows feature allows an administrator to permit execution only of applications that match approved publisher, path, or file hash rules?

Accepted Answer

AppLocker enforces application allowlisting through publisher, path, and hash rules. BitLocker provides disk encryption, the firewall filters network traffic, and UAC handles privilege elevation prompts.

Question 12

An analyst needs a quick inventory of every TCP and UDP session observed between two internal hosts over the last hour. Which Zeek log should be examined first?

Accepted Answer

Zeek's conn.log records one entry per network connection with source, destination, ports, duration and byte counts, making it the canonical starting point for session-level analysis.

Question 13

A workstation is confirmed to be running an active ransomware process that is encrypting files on a mapped network share. Which containment action should the administrator take first?

Accepted Answer

Network isolation immediately stops further encryption of shared data while preserving volatile memory, running processes, and encryption keys that may still reside in RAM for forensic recovery. Pulling power destroys that volatile evidence, and scanning or restoring does not stop the active spread.

Question 14

An administrator wants to prevent an attacker who has obtained a local administrator password hash from reusing it against every other workstation in the domain. Which control addresses this most directly?

Accepted Answer

LAPS gives every machine a distinct, automatically rotated local administrator password, so a stolen hash or password is useless on other hosts. Password length, lockout, and SMB signing do not eliminate the shared-credential problem that makes lateral movement trivial.

Question 15

Malware is communicating with its C2 server over TLS, and the organization cannot decrypt the traffic. Which technique best supports identifying the malicious client across sessions?

Accepted Answer

JA3 hashes the ordered cipher suites, extensions and curves advertised in the unencrypted Client Hello, producing a fingerprint of the TLS client library that persists even when domains, IPs and certificates change.

Question 16

During evidence collection on a compromised Linux server that must remain running for business reasons, which acquisition order best satisfies the order-of-volatility principle in RFC 3227?

Accepted Answer

RFC 3227 orders collection from most to least volatile: registers and cache, then network and process state, then RAM, then disk, then backups and archival media. Collecting disk or archival media first allows the most perishable evidence to be lost or overwritten.

Question 17

An EDR alert shows a Microsoft Word process spawning a signed Windows binary that then loads a DLL from a user-writable directory. The binary itself is legitimate and digitally signed. Which mitigation best breaks this specific execution chain without removing the signed binary?

Accepted Answer

The chain relies on Office spawning a living-off-the-land binary that side-loads a DLL, so blocking Office child-process creation and constraining DLL search paths severs it while leaving the legitimate system binary intact. Hash-blocking a signed OS binary breaks Windows functionality, and Credential Guard protects secrets rather than execution flow.

Question 18

A hunt team suspects an implant is beaconing to an external server. Which analytic approach is most likely to surface it in flow data?

Accepted Answer

Beacons are defined by regular check-in timing and near-identical request sizes, so low variance in interval and byte count exposes them; volume ranking misses beacons precisely because their traffic footprint is small.

Question 19

Which network device inspects traffic inline and can drop malicious packets before they reach the destination host?

Accepted Answer

A NIPS sits inline in the traffic path and can block or drop packets that match a malicious signature or behavior. A NIDS on a SPAN port sees only a copy of traffic and can alert but not block; TAPs and syslog collectors are passive.

Question 20

In an Active Directory environment, which group membership should be kept as small as possible because its members can modify the AD schema for the entire forest?

Accepted Answer

Schema Admins is the only group with rights to alter the forest-wide AD schema, and membership should normally be empty except during approved changes. The other groups hold significant but domain- or task-scoped privileges.

eEDA Enterprise Defense Administrator Exam Voucher | INE Defense Certification Practice Test

Free Practice Test

eEDA Enterprise Defense Administrator Exam Voucher practice test — common questions