EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #1
Harry has sued the company claiming they made his personal information public on a social networking site in the United States. The company denies the allegations and consulted a/an ______for legal advice to defend them against this allegation.
- A . PR Specialist
- B . Attorney
- C . Incident Handler
- D . Evidence Manager
Correct Answer: B
B
Explanation:
In the context of legal proceedings, especially when facing allegations of making personal information public, a company would seek the expertise of an attorney. An attorney is qualified to provide legal advice, represent the company in court, and help navigate the complexities of the law regarding data protection and privacy. They would also assist in formulating a defense strategy and ensure that the company’s rights are protected throughout the legal process.
Reference: The role of an attorney in defending against allegations of public disclosure of personal information is supported by legal practices and the advice provided by law firms and legal experts12345.
B
Explanation:
In the context of legal proceedings, especially when facing allegations of making personal information public, a company would seek the expertise of an attorney. An attorney is qualified to provide legal advice, represent the company in court, and help navigate the complexities of the law regarding data protection and privacy. They would also assist in formulating a defense strategy and ensure that the company’s rights are protected throughout the legal process.
Reference: The role of an attorney in defending against allegations of public disclosure of personal information is supported by legal practices and the advice provided by law firms and legal experts12345.
Question #2
Which of the following interfaces uses hot plugging technique to replace computer components without the need to shut down the system?
- A . SCSI
- B . SATA
- C . SDRAM
- D . IDE
Correct Answer: B
B
Explanation:
The hot plugging technique allows for the replacement of computer components without the need to shut down the system. SATA (Serial Advanced Technology Attachment) is known for supporting hot plugging, which is particularly useful for hard drives and solid-state drives. This feature enables users to connect or disconnect the device while the system is running without risking data loss or damage. SCSI (Small Computer System Interface) also supports hot plugging for some devices, but SATA is more commonly associated with this capability for consumer-level computer components.
Reference: The information provided aligns with industry standards and practices regarding hot
plugging capabilities of computer interfaces12.
B
Explanation:
The hot plugging technique allows for the replacement of computer components without the need to shut down the system. SATA (Serial Advanced Technology Attachment) is known for supporting hot plugging, which is particularly useful for hard drives and solid-state drives. This feature enables users to connect or disconnect the device while the system is running without risking data loss or damage. SCSI (Small Computer System Interface) also supports hot plugging for some devices, but SATA is more commonly associated with this capability for consumer-level computer components.
Reference: The information provided aligns with industry standards and practices regarding hot
plugging capabilities of computer interfaces12.
Question #3
If a network is at risk from unskilled individuals, what type of threat is this?
- A . External Threats
- B . Structured Threats
- C . Unstructured Threats
- D . Internal Threats
Correct Answer: C
C
Explanation:
Unstructured threats typically originate from individuals who lack advanced skills or a sophisticated understanding of network systems. These threats often involve simple methods to disrupt network operations, such as basic malware attacks or exploiting known vulnerabilities that have not been patched. In the context of the Certified Network Defender (CND) program, unstructured threats are recognized as those that can be caused by unskilled individuals who may inadvertently introduce risks to the network through misconfigurations or inadequate security practices.
Reference: The Certified Network Defender (CND) curriculum addresses various types of threats, including unstructured threats, and emphasizes the importance of securing networks against all levels of skill and sophistication among potential attackers12. It also covers the need for continuous monitoring and the implementation of security best practices to mitigate the risks posed by both unstructured and structured threats34.
C
Explanation:
Unstructured threats typically originate from individuals who lack advanced skills or a sophisticated understanding of network systems. These threats often involve simple methods to disrupt network operations, such as basic malware attacks or exploiting known vulnerabilities that have not been patched. In the context of the Certified Network Defender (CND) program, unstructured threats are recognized as those that can be caused by unskilled individuals who may inadvertently introduce risks to the network through misconfigurations or inadequate security practices.
Reference: The Certified Network Defender (CND) curriculum addresses various types of threats, including unstructured threats, and emphasizes the importance of securing networks against all levels of skill and sophistication among potential attackers12. It also covers the need for continuous monitoring and the implementation of security best practices to mitigate the risks posed by both unstructured and structured threats34.
Question #4
An insider in Hexagon, a leading IT company in USA, was testing a packet crafting tool. This tool generated a lot of malformed TCP/IP packets which crashed the main server’s operating system leading
to restricting the employees’ accesses.
Which attack did the insider use in the above situation?
- A . DoS attack
- B . Session Hijacking
- C . Man-in-the-Middle
- D . Cross-Site-Scripting
Correct Answer: A
A
Explanation:
The situation described involves an insider using a packet crafting tool that generated malformed TCP/IP packets, resulting in the crash of the main server’s operating system and restricting employee access. This scenario is indicative of a Denial of Service (DoS) attack. A DoS attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. Malformed packets can cause systems to crash, thereby denying service to legitimate users.
Reference: The reference to a DoS attack is based on standard cybersecurity practices and the objectives of the Certified Network Defender (CND) program, which includes understanding and protecting against such attacks1. The information aligns with the CND’s emphasis on network security and threat mitigation.
A
Explanation:
The situation described involves an insider using a packet crafting tool that generated malformed TCP/IP packets, resulting in the crash of the main server’s operating system and restricting employee access. This scenario is indicative of a Denial of Service (DoS) attack. A DoS attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. Malformed packets can cause systems to crash, thereby denying service to legitimate users.
Reference: The reference to a DoS attack is based on standard cybersecurity practices and the objectives of the Certified Network Defender (CND) program, which includes understanding and protecting against such attacks1. The information aligns with the CND’s emphasis on network security and threat mitigation.
Question #5
Which of the following standards does a cloud service provider has to comply with, to protect the privacy of its customer’s personal information?
- A . ISO/IEC 27018
- B . ISO/IEC 27019
- C . ISO/IEC 27020
- D . ISO/IEC 27021
Correct Answer: A
A
Explanation:
ISO/IEC 27018 is a code of practice for cloud service providers that handle personally identifiable information (PII). It provides a framework for protecting the privacy of PII in the cloud, consistent with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. This standard is particularly relevant for cloud service providers needing to demonstrate they have implemented effective privacy controls to protect their customers’ data. The adoption of ISO/IEC 27018 by a cloud service provider is a strong indication of compliance with privacy laws and regulations, ensuring the protection of personal information in the cloud123.
Reference: ISO/IEC 27018 overview and compliance information as provided by Microsoft Learn1.
Details on ISO/IEC 27018 compliance by Google Cloud2.
General information about ISO 27018 for cloud providers from Schellman3.
EC-Council’s Certified Network Defender (CND) course content4.
A
Explanation:
ISO/IEC 27018 is a code of practice for cloud service providers that handle personally identifiable information (PII). It provides a framework for protecting the privacy of PII in the cloud, consistent with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. This standard is particularly relevant for cloud service providers needing to demonstrate they have implemented effective privacy controls to protect their customers’ data. The adoption of ISO/IEC 27018 by a cloud service provider is a strong indication of compliance with privacy laws and regulations, ensuring the protection of personal information in the cloud123.
Reference: ISO/IEC 27018 overview and compliance information as provided by Microsoft Learn1.
Details on ISO/IEC 27018 compliance by Google Cloud2.
General information about ISO 27018 for cloud providers from Schellman3.
EC-Council’s Certified Network Defender (CND) course content4.
Question #6
Which RAID level system provides very good data performance but does not offer fault tolerance and data redundancy?
- A . PAID level 3
- B . RAID level 5
- C . RAID level 1
- D . RAID level 0
Correct Answer: D
D
Explanation:
RAID level 0, also known as striping, provides very good data performance because it spreads data across multiple disks, which can significantly increase speed for read and write operations. However, it does not offer fault tolerance or data redundancy. If any single disk fails in a RAID 0 setup, all data in the array is lost, making it unsuitable for mission-critical systems.
Reference: The EC-Council’s Certified Network Defender (CND) course materials discuss RAID levels and their characteristics. RAID level 0 is specifically mentioned for its high performance but lack of fault tolerance and redundancy123.
D
Explanation:
RAID level 0, also known as striping, provides very good data performance because it spreads data across multiple disks, which can significantly increase speed for read and write operations. However, it does not offer fault tolerance or data redundancy. If any single disk fails in a RAID 0 setup, all data in the array is lost, making it unsuitable for mission-critical systems.
Reference: The EC-Council’s Certified Network Defender (CND) course materials discuss RAID levels and their characteristics. RAID level 0 is specifically mentioned for its high performance but lack of fault tolerance and redundancy123.
Question #7
Oliver is a Linux security administrator at an MNC. An employee named Alice has resigned from his organization and Oliver wants to disable this user in Ubuntu.
Which of the following commands can be used to accomplish this?
- A . usermod -3 alice
- B . uscrmod- K alice
- C . usermod- L alice
- D . usermod- M alice
Correct Answer: C
C
Explanation:
In Linux, to disable a user account, the usermod command is used with the -L option. This option locks the user’s password, effectively disabling the account by preventing the user from logging in. The command usermod -L alice will lock the user ‘alice’ by adding an exclamation mark (!) in front of the encrypted password in the /etc/shadow file, which is the standard method for disabling an account in Linux.
Reference: This information is consistent with standard Linux administration practices and is also in
line with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and managing user accounts and permissions as part of network security1.
C
Explanation:
In Linux, to disable a user account, the usermod command is used with the -L option. This option locks the user’s password, effectively disabling the account by preventing the user from logging in. The command usermod -L alice will lock the user ‘alice’ by adding an exclamation mark (!) in front of the encrypted password in the /etc/shadow file, which is the standard method for disabling an account in Linux.
Reference: This information is consistent with standard Linux administration practices and is also in
line with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and managing user accounts and permissions as part of network security1.
Question #8
Which of the following statements holds true in terms of virtual machines?
- A . Hardware-level virtualization takes place in VMs
- B . All VMs share the host OS
- C . VMs are light weight than container
- D . OS-level virtualization takes place in VMs
Correct Answer: A
A
Explanation:
Virtual machines (VMs) operate based on hardware-level virtualization, which means they emulate entire hardware systems, including CPUs, memory, and network interfaces, allowing multiple operating systems to run on a single physical machine. Each VM includes a full copy of an operating system, the application, necessary binaries, and libraries – taking up tens of GBs. VMs are completely isolated from the host OS, which is why they do not share the host OS. This is in contrast to containers, which share the host system’s kernel and are more lightweight as they do not require a full OS within each container.
Reference: The Certified Network Defender (CND) course by EC-Council covers various aspects of network security, including enterprise virtual network security, which encompasses the use of VMs and their characteristics12.
A
Explanation:
Virtual machines (VMs) operate based on hardware-level virtualization, which means they emulate entire hardware systems, including CPUs, memory, and network interfaces, allowing multiple operating systems to run on a single physical machine. Each VM includes a full copy of an operating system, the application, necessary binaries, and libraries – taking up tens of GBs. VMs are completely isolated from the host OS, which is why they do not share the host OS. This is in contrast to containers, which share the host system’s kernel and are more lightweight as they do not require a full OS within each container.
Reference: The Certified Network Defender (CND) course by EC-Council covers various aspects of network security, including enterprise virtual network security, which encompasses the use of VMs and their characteristics12.
Question #9
James is a network administrator working at a student loan company in Minnesota. This company processes over 20,000 student loans a year from colleges all over the state. Most communication between the company schools, and lenders is carried out through emails. Much of the email communication used at his company contains sensitive information such as social security numbers. For this reason, James wants to utilize email encryption. Since a server-based PKI is not an option for him, he is looking for a low/no cost solution to encrypt emails.
What should James use?
- A . James could use PGP as a free option for encrypting the company’s emails.
- B . James should utilize the free OTP software package.
- C . James can use MD5 algorithm to encrypt all the emails
- D . James can enforce mandatory HTTPS in the email clients to encrypt emails
Correct Answer: A
A
Explanation:
James should opt for PGP (Pretty Good Privacy) as it is a widely recognized method for encrypting emails. PGP provides a cost-effective solution for securing email communication, which is essential for the sensitive information handled by his company. It uses a combination of data compression, symmetric-key cryptography, and public key cryptography to secure emails. Each user has a pair of keys: a public key that is shared with others to encrypt emails to the user, and a private key that is kept secret by the user to decrypt emails they receive. This method ensures that even if the email is intercepted, without the corresponding private key, the contents remain unreadable.
Reference: The choice of PGP is supported by its longstanding reputation for providing secure email communication. It is designed to be used in scenarios where secure communication is necessary, and it’s a practical option for James since it doesn’t require a server-based PKI system. The other options listed do not provide the same level of security for email encryption. OTP (One-Time Password) systems are not typically used for email encryption, MD5 is a hashing algorithm
A
Explanation:
James should opt for PGP (Pretty Good Privacy) as it is a widely recognized method for encrypting emails. PGP provides a cost-effective solution for securing email communication, which is essential for the sensitive information handled by his company. It uses a combination of data compression, symmetric-key cryptography, and public key cryptography to secure emails. Each user has a pair of keys: a public key that is shared with others to encrypt emails to the user, and a private key that is kept secret by the user to decrypt emails they receive. This method ensures that even if the email is intercepted, without the corresponding private key, the contents remain unreadable.
Reference: The choice of PGP is supported by its longstanding reputation for providing secure email communication. It is designed to be used in scenarios where secure communication is necessary, and it’s a practical option for James since it doesn’t require a server-based PKI system. The other options listed do not provide the same level of security for email encryption. OTP (One-Time Password) systems are not typically used for email encryption, MD5 is a hashing algorithm
Question #10
Smith is an IT technician that has been appointed to his company’s network vulnerability assessment team. He is the only IT employee on the team. The other team members include employees from Accounting, Management, Shipping, and Marketing. Smith and the team members are having their first meeting to discuss how they will proceed.
What is the first step they should do to create the network vulnerability assessment plan?
- A . Their first step is to analyze the data they have currently gathered from the company or interviews.
- B . Their first step is to make a hypothesis of what their final findings will be.
- C . Their first step is to create an initial Executive report to show the management team.
- D . Their first step is the acquisition of required documents, reviewing of security policies and compliance.
Correct Answer: D
D
Explanation:
The first step in creating a network vulnerability assessment plan is to acquire the necessary documents and review the organization’s security policies and compliance requirements. This involves gathering all relevant information that will inform the scope and focus of the vulnerability assessment. It includes understanding the security policies in place, the regulatory compliance obligations the company must adhere to, and any existing security measures and controls. This foundational step ensures that the vulnerability assessment is aligned with the company’s security posture and compliance mandates, providing a clear direction for the subsequent stages of the assessment process.
Reference: This approach is supported by the Certified Network Defender (CND) guidelines, which emphasize the importance of starting with a thorough review of security policies and compliance documents as the initial step in the vulnerability assessment process123.
D
Explanation:
The first step in creating a network vulnerability assessment plan is to acquire the necessary documents and review the organization’s security policies and compliance requirements. This involves gathering all relevant information that will inform the scope and focus of the vulnerability assessment. It includes understanding the security policies in place, the regulatory compliance obligations the company must adhere to, and any existing security measures and controls. This foundational step ensures that the vulnerability assessment is aligned with the company’s security posture and compliance mandates, providing a clear direction for the subsequent stages of the assessment process.
Reference: This approach is supported by the Certified Network Defender (CND) guidelines, which emphasize the importance of starting with a thorough review of security policies and compliance documents as the initial step in the vulnerability assessment process123.