EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #91
John is the Vice-President of a BPO. He wants to implement a policy allowing employees to use and manage devices purchased by the organization but restrict the use of the device for business use only.
Which among the following policies does John want to implement?
- A . COBO policy
- B . CYOD policy
- C . BYOD policy
- D . COPE policy
Correct Answer: B
B
Explanation:
John wants to implement a policy that allows employees to use and manage devices purchased by the organization but restricts the use of the device for business use only. This is known as a COBO (Company Owned, Business Only) policy. Under a COBO policy, the company provides the devices to the employees and maintains control over them, ensuring that they are used solely for business purposes123.
Reference: The concept of COBO is well-documented in enterprise mobility and device management literature, where it is described as a policy where the organization owns the devices and restricts their use to business activities only123. This approach is in contrast to BYOD (Bring Your Own Device), CYOD (Choose Your Own Device), and COPE (Company Owned, Personally Enabled) policies, which offer varying degrees of personal use456789.
B
Explanation:
John wants to implement a policy that allows employees to use and manage devices purchased by the organization but restricts the use of the device for business use only. This is known as a COBO (Company Owned, Business Only) policy. Under a COBO policy, the company provides the devices to the employees and maintains control over them, ensuring that they are used solely for business purposes123.
Reference: The concept of COBO is well-documented in enterprise mobility and device management literature, where it is described as a policy where the organization owns the devices and restricts their use to business activities only123. This approach is in contrast to BYOD (Bring Your Own Device), CYOD (Choose Your Own Device), and COPE (Company Owned, Personally Enabled) policies, which offer varying degrees of personal use456789.
Question #92
Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.
What is the last step he should list?
- A . Assign eradication.
- B . Recovery
- C . Containment
- D . A follow-up.
Correct Answer: D
D
Explanation:
The last step Malone should list in his incident handling plan is ‘A follow-up’. This step is crucial as it involves analyzing the incident to understand how it occurred and what can be done to prevent similar incidents in the future. It often includes a review of the effectiveness of the response, identification of lessons learned, updating policies and procedures accordingly, and conducting training sessions if necessary. This step ensures that the organization improves its security posture and is better prepared for future incidents.
Reference: The follow-up step is aligned with the incident response life cycle which includes preparation, identification, containment, eradication, recovery, and then follow-up as the final phase. This is consistent with the best practices in incident response and is covered in the Certified Network Defender (CND) curriculum as well as in the NIST guidelines on incident response1.
D
Explanation:
The last step Malone should list in his incident handling plan is ‘A follow-up’. This step is crucial as it involves analyzing the incident to understand how it occurred and what can be done to prevent similar incidents in the future. It often includes a review of the effectiveness of the response, identification of lessons learned, updating policies and procedures accordingly, and conducting training sessions if necessary. This step ensures that the organization improves its security posture and is better prepared for future incidents.
Reference: The follow-up step is aligned with the incident response life cycle which includes preparation, identification, containment, eradication, recovery, and then follow-up as the final phase. This is consistent with the best practices in incident response and is covered in the Certified Network Defender (CND) curriculum as well as in the NIST guidelines on incident response1.
Question #93
Assume that you are a network administrator and the company has asked you to draft an Acceptable Use Policy (AUP) for employees.
Under which category of an information security policy does AUP fall into?
- A . System Specific Security Policy (SSSP)
- B . Incident Response Policy (IRP)
- C . Enterprise Information Security Policy (EISP)
- D . Issue Specific Security Policy (ISSP)
Correct Answer: D
D
Explanation:
An Acceptable Use Policy (AUP) is a type of Issue Specific Security Policy (ISSP) that outlines the constraints and practices that users must agree to in order to access the corporate network, endpoints, applications, and the internet. It is designed to provide guidelines for the appropriate use of an organization’s IT resources, including employee conduct, data usage, system access privileges, and the handling of confidential information. The AUP is a crucial part of the security policy framework as it directly addresses specific issues related to the acceptable use of IT resources by employees.
Reference: The categorization of AUP as an ISSP is consistent with standard information security policy frameworks and best practices123.
D
Explanation:
An Acceptable Use Policy (AUP) is a type of Issue Specific Security Policy (ISSP) that outlines the constraints and practices that users must agree to in order to access the corporate network, endpoints, applications, and the internet. It is designed to provide guidelines for the appropriate use of an organization’s IT resources, including employee conduct, data usage, system access privileges, and the handling of confidential information. The AUP is a crucial part of the security policy framework as it directly addresses specific issues related to the acceptable use of IT resources by employees.
Reference: The categorization of AUP as an ISSP is consistent with standard information security policy frameworks and best practices123.
Question #94
Albert works as a Windows system administrator at an MNC. He uses PowerShell logging to identify any suspicious scripting activity across the network. He wants to record pipeline execution details as
PowerShell executes, including variable initialization and command invocations.
Which PowerShell logging component records pipeline execution details as PowerShell executes?
- A . Module logging
- B . Script block logging
- C . Event logging
- D . Transcript logging
Correct Answer: B
B
Explanation:
Script block logging is the PowerShell logging component that records the details of pipeline execution as PowerShell executes, including variable initialization and command invocations. This feature is particularly useful for identifying and recording suspicious scripting activity, as it captures the full content of script blocks as they are executed, providing a detailed audit trail. This level of logging is essential for security forensics and understanding the context of commands executed within the PowerShell environment.
Reference: The explanation is based on the functionality of PowerShell’s logging capabilities, where script block logging is designed to capture and record detailed information about script execution, which is crucial for security monitoring and incident response1.
B
Explanation:
Script block logging is the PowerShell logging component that records the details of pipeline execution as PowerShell executes, including variable initialization and command invocations. This feature is particularly useful for identifying and recording suspicious scripting activity, as it captures the full content of script blocks as they are executed, providing a detailed audit trail. This level of logging is essential for security forensics and understanding the context of commands executed within the PowerShell environment.
Reference: The explanation is based on the functionality of PowerShell’s logging capabilities, where script block logging is designed to capture and record detailed information about script execution, which is crucial for security monitoring and incident response1.
Question #95
A local bank wants to protect their cardholder data.
Which standard should the bark comply with in order to ensure security of this data?
- A . GDPR
- B . HIPAA
- C . SOX
- D . PCI DSS
Correct Answer: D
D
Explanation:
The Payment Card Industry Data Security Standard (PCI DSS) is the relevant standard for any organization that stores, processes, or transmits cardholder data. It outlines a set of requirements designed to ensure that all companies that handle credit card information maintain a secure environment. This includes specific measures for protecting stored cardholder data, encrypting data transmission across public networks, and maintaining a vulnerability management program, among others123.
Reference: The information provided is based on the PCI DSS Quick Reference Guide and other official documents that detail the requirements for securing cardholder data as per the standards set by the PCI Security Standards Council123.
D
Explanation:
The Payment Card Industry Data Security Standard (PCI DSS) is the relevant standard for any organization that stores, processes, or transmits cardholder data. It outlines a set of requirements designed to ensure that all companies that handle credit card information maintain a secure environment. This includes specific measures for protecting stored cardholder data, encrypting data transmission across public networks, and maintaining a vulnerability management program, among others123.
Reference: The information provided is based on the PCI DSS Quick Reference Guide and other official documents that detail the requirements for securing cardholder data as per the standards set by the PCI Security Standards Council123.
Question #96
Kyle is an IT consultant working on a contract for a large energy company in Houston. Kyle was hired on to do contract work three weeks ago so the company could prepare for an external IT security audit. With suggestions from upper management, Kyle has installed a network-based IDS system. This system checks for abnormal behavior and patterns found in network traffic that appear to be dissimilar from the traffic normally recorded by the IDS.
What type of detection is this network-based IDS system using?
- A . This network-based IDS system is using anomaly detection.
- B . This network-based IDS system is using dissimilarity algorithms.
- C . This system is using misuse detection.
- D . This network-based IDS is utilizing definition-based detection.
Correct Answer: A
A
Explanation:
Anomaly detection in network-based Intrusion Detection Systems (IDS) involves establishing a baseline of normal behavior for the network or system and then monitoring for deviations from this baseline. The IDS analyzes traffic patterns, system performance, user behavior, and other metrics to detect anomalies that could indicate a potential security breach. This method is particularly effective for identifying new or unknown threats that do not match any known signatures or definitions. By focusing on irregular patterns rather than predefined signatures, anomaly detection can provide early warnings of malicious activities that might otherwise go unnoticed.
Reference: The concept of anomaly detection within IDS is discussed in various cybersecurity resources, including academic publications and industry guides, which align with the ECCouncil’s Network Defender (CND) objectives and documents1234.
A
Explanation:
Anomaly detection in network-based Intrusion Detection Systems (IDS) involves establishing a baseline of normal behavior for the network or system and then monitoring for deviations from this baseline. The IDS analyzes traffic patterns, system performance, user behavior, and other metrics to detect anomalies that could indicate a potential security breach. This method is particularly effective for identifying new or unknown threats that do not match any known signatures or definitions. By focusing on irregular patterns rather than predefined signatures, anomaly detection can provide early warnings of malicious activities that might otherwise go unnoticed.
Reference: The concept of anomaly detection within IDS is discussed in various cybersecurity resources, including academic publications and industry guides, which align with the ECCouncil’s Network Defender (CND) objectives and documents1234.
Question #97
Kyle, a front office executive, suspects that a Trojan has infected his computer.
What should be his first course of action to deal with the incident?
- A . Contain the damage
- B . Disconnect the five infected devices from the network
- C . Inform the IRT about the incident and wait for their response
- D . Inform everybody in the organization about the attack
Correct Answer: A
A
Explanation:
When a Trojan is suspected to have infected a computer, the first course of action should be to contain the damage to prevent the malware from spreading or causing further harm. This involves disconnecting the infected device from the network to isolate it and prevent the Trojan from communicating with potential command and control servers or infecting other systems123. While informing the Incident Response Team (IRT) and other members of the organization is also important, these actions come after the immediate threat has been contained. Therefore, the correct answer is to contain the damage (A), which aligns with the Certified Network Defender (CND) objectives that prioritize immediate containment to minimize the impact of security incidents45678.
Reference: The response is based on best practices for dealing with Trojans as outlined in network security and incident response guidelines, including those from the EC-Council’s Certified Network Defender (CND) program. The CND framework emphasizes the importance of quick containment to protect network integrity and prevent further damage45678.
A
Explanation:
When a Trojan is suspected to have infected a computer, the first course of action should be to contain the damage to prevent the malware from spreading or causing further harm. This involves disconnecting the infected device from the network to isolate it and prevent the Trojan from communicating with potential command and control servers or infecting other systems123. While informing the Incident Response Team (IRT) and other members of the organization is also important, these actions come after the immediate threat has been contained. Therefore, the correct answer is to contain the damage (A), which aligns with the Certified Network Defender (CND) objectives that prioritize immediate containment to minimize the impact of security incidents45678.
Reference: The response is based on best practices for dealing with Trojans as outlined in network security and incident response guidelines, including those from the EC-Council’s Certified Network Defender (CND) program. The CND framework emphasizes the importance of quick containment to protect network integrity and prevent further damage45678.
Question #98
An attacker uses different types of password cracking techniques to crack the password and gain unauthorized access to a system. An attacker uses a file containing a list of commonly used passwords. They then upload this file into the cracking application that runs against the user accounts.
Which of the following password cracking techniques is the attacker trying?
- A . Bruteforce
- B . Rainbow table
- C . Hybrid
- D . Dictionary
Correct Answer: D
D
Explanation:
The attacker is employing a Dictionary attack, which is a method where a file containing a list of commonly used passwords is used to attempt to gain unauthorized access to user accounts. This technique relies on the probability that many users will use common passwords that are easy to guess. It is more efficient than a brute-force attack since it uses a predefined list of words, rather than trying all possible combinations of characters.
Reference: The Dictionary attack is defined as a word-based brute force method1, and it is specifically mentioned as a password cracking test that can be automated with tools2. This technique is distinct from the other options because:
A Brute-force attack involves trying all possible combinations of characters until the correct one is found1.
A Rainbow table attack uses precomputed tables of hash values to crack encrypted passwords1. A Hybrid attack combines elements of both brute-force and dictionary attacks, often by adding numbers or symbols to dictionary words2.
D
Explanation:
The attacker is employing a Dictionary attack, which is a method where a file containing a list of commonly used passwords is used to attempt to gain unauthorized access to user accounts. This technique relies on the probability that many users will use common passwords that are easy to guess. It is more efficient than a brute-force attack since it uses a predefined list of words, rather than trying all possible combinations of characters.
Reference: The Dictionary attack is defined as a word-based brute force method1, and it is specifically mentioned as a password cracking test that can be automated with tools2. This technique is distinct from the other options because:
A Brute-force attack involves trying all possible combinations of characters until the correct one is found1.
A Rainbow table attack uses precomputed tables of hash values to crack encrypted passwords1. A Hybrid attack combines elements of both brute-force and dictionary attacks, often by adding numbers or symbols to dictionary words2.
Question #99
What should an administrator do while installing a sniffer on a system to listen to all data transmitted over the network?
- A . Set the system’s NIC to managed mode
- B . Set the system’s NIC to master mode
- C . Set the system’s NIC to ad-hoc mode
- D . Set the system’s NIC to promiscuous mode
Correct Answer: D
D
Explanation:
In the context of network sniffing, promiscuous mode is a specific setting for a network interface controller (NIC) that allows the NIC to pass all traffic it receives to the central processing unit, rather than just the frames that the NIC is specifically programmed to receive. This mode is essential for network sniffers, as it enables them to capture all network traffic, including packets not addressed to the NIC’s MAC address. When a NIC is not in promiscuous mode, it will ignore packets not intended for its MAC address.
Reference: The explanation provided aligns with standard networking practices and the information available from various security resources, including the Information Security Stack Exchange1 and TechTarget2. These sources confirm the role of promiscuous mode in enabling a network device to intercept and read all network packets that arrive, which is necessary for the operation of network sniffers.
D
Explanation:
In the context of network sniffing, promiscuous mode is a specific setting for a network interface controller (NIC) that allows the NIC to pass all traffic it receives to the central processing unit, rather than just the frames that the NIC is specifically programmed to receive. This mode is essential for network sniffers, as it enables them to capture all network traffic, including packets not addressed to the NIC’s MAC address. When a NIC is not in promiscuous mode, it will ignore packets not intended for its MAC address.
Reference: The explanation provided aligns with standard networking practices and the information available from various security resources, including the Information Security Stack Exchange1 and TechTarget2. These sources confirm the role of promiscuous mode in enabling a network device to intercept and read all network packets that arrive, which is necessary for the operation of network sniffers.
Question #100
The SOC manager is reviewing logs in AlienVault USM to investigate an intrusion on the network.
Which CND approach is being used?
- A . Preventive
- B . Reactive
- C . Retrospective
- D . Deterrent
Correct Answer: B
B
Explanation:
The SOC manager reviewing logs in AlienVault USM to investigate an intrusion is employing a reactive approach. This approach is characterized by actions taken in response to an event or incident that has already occurred. In this context, the SOC manager is analyzing the logs to understand the intrusion after it has been detected, which is a form of reactive security measure.
Reference: The use of AlienVault USM for log review and intrusion investigation is a common practice in Security Operations Centers (SOCs) as part of their incident response procedures, which is a reactive approach to cybersecurity threats1.
B
Explanation:
The SOC manager reviewing logs in AlienVault USM to investigate an intrusion is employing a reactive approach. This approach is characterized by actions taken in response to an event or incident that has already occurred. In this context, the SOC manager is analyzing the logs to understand the intrusion after it has been detected, which is a form of reactive security measure.
Reference: The use of AlienVault USM for log review and intrusion investigation is a common practice in Security Operations Centers (SOCs) as part of their incident response procedures, which is a reactive approach to cybersecurity threats1.