EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #101
Identity the method involved in purging technique of data destruction.
- A . Incineration
- B . Overwriting
- C . Degaussing
- D . Wiping
Correct Answer: B
B
Explanation:
The purging technique of data destruction is aimed at making data recovery infeasible using logical methods, which directly target the data at the memory level. Overwriting is a prevalent technique for purging, where data is destroyed by being overwritten with unintelligible characters like 0s and 1s. This method ensures that the original data cannot be recovered.
Reference: The explanation is based on the understanding of data destruction methods, where overwriting is identified as a logical method of purging data to prevent its recovery123. 12.
B
Explanation:
The purging technique of data destruction is aimed at making data recovery infeasible using logical methods, which directly target the data at the memory level. Overwriting is a prevalent technique for purging, where data is destroyed by being overwritten with unintelligible characters like 0s and 1s. This method ensures that the original data cannot be recovered.
Reference: The explanation is based on the understanding of data destruction methods, where overwriting is identified as a logical method of purging data to prevent its recovery123. 12.
Question #102
During a security awareness program, management was explaining the various reasons which create threats to network security.
Which could be a possible threat to network security?
- A . Configuring automatic OS updates
- B . Having a web server in the internal network
- C . Implementing VPN
- D . Patch management
Correct Answer: B
B
Explanation:
Having a web server within the internal network can pose a threat to network security because it increases the attack surface that an adversary can exploit. If not properly secured, internal web servers can be vulnerable to various attacks, such as SQL injection, cross-site scripting, and others. These vulnerabilities can lead to unauthorized access, data breaches, and other security incidents. Therefore, it is crucial to ensure that web servers are securely configured and isolated from the internal network to minimize the risk.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses the importance of understanding the attack surface and the potential threats associated with having critical services like web servers within the internal network. The program emphasizes the need for strategic placement of network resources and the implementation of robust security measures to protect against internal and external threats1
B
Explanation:
Having a web server within the internal network can pose a threat to network security because it increases the attack surface that an adversary can exploit. If not properly secured, internal web servers can be vulnerable to various attacks, such as SQL injection, cross-site scripting, and others. These vulnerabilities can lead to unauthorized access, data breaches, and other security incidents. Therefore, it is crucial to ensure that web servers are securely configured and isolated from the internal network to minimize the risk.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses the importance of understanding the attack surface and the potential threats associated with having critical services like web servers within the internal network. The program emphasizes the need for strategic placement of network resources and the implementation of robust security measures to protect against internal and external threats1
Question #103
Mark is monitoring the network traffic on his organization’s network. He wants to detect a TCP and UDP ping sweep on his network.
Which type of filter will be used to detect this on the network?
- A . Tcp.srcport==7 and udp.srcport==7
- B . Tcp.srcport==7 and udp.dstport==7
- C . Tcp.dstport==7 and udp.srcport==7
- D . Tcp.dstport==7 and udp.dstport==7
Correct Answer: D
D
Explanation:
To detect TCP and UDP ping sweeps on a network, the appropriate filter would be one that checks for packets directed at port 7, which is commonly used for the ‘echo’ service. This service is associated with ping functionality for both TCP and UDP protocols. Therefore, the correct filter to use would be Tcp.dstport==7 and udp.dstport==7, which checks for incoming packets where the destination port is 7 for both TCP and UDP traffic. This allows Mark to identify ping sweep attempts, as these would typically send packets to this port to elicit a response from the network.
Reference: The Certified Network Defender (CND) course material outlines the importance of understanding and utilizing network filters to detect various types of network scans and sweeps, including TCP and UDP ping sweeps1. This is further supported by industry practices and discussions on network security monitoring and defense1.
D
Explanation:
To detect TCP and UDP ping sweeps on a network, the appropriate filter would be one that checks for packets directed at port 7, which is commonly used for the ‘echo’ service. This service is associated with ping functionality for both TCP and UDP protocols. Therefore, the correct filter to use would be Tcp.dstport==7 and udp.dstport==7, which checks for incoming packets where the destination port is 7 for both TCP and UDP traffic. This allows Mark to identify ping sweep attempts, as these would typically send packets to this port to elicit a response from the network.
Reference: The Certified Network Defender (CND) course material outlines the importance of understanding and utilizing network filters to detect various types of network scans and sweeps, including TCP and UDP ping sweeps1. This is further supported by industry practices and discussions on network security monitoring and defense1.
Question #104
Which OSI layer does a Network Interface Card (NIC) work on?
- A . Physical layer
- B . Presentation layer
- C . Network layer
- D . Session layer
Correct Answer: A
A
Explanation:
The Network Interface Card (NIC) operates primarily on the Physical layer of the OSI model. This layer is responsible for the actual transmission and reception of data over a network medium. The NIC provides the physical connection between the computer and the network, converting digital data into electrical, radio, or optical signals for outbound data, and vice versa for inbound data12.
Additionally, the NIC also has functionalities that extend to the Data Link layer, which is responsible for node-to-node data transfer and handling the physical addressing of packets through MAC addresses3.
Reference: Information based on the Certified Network Defender (CND) course material and study guide. Additional details from EC-Council’s official Certified Network Defender (CND) resources and other authoritative sources on network interface cards and the OSI model132.
A
Explanation:
The Network Interface Card (NIC) operates primarily on the Physical layer of the OSI model. This layer is responsible for the actual transmission and reception of data over a network medium. The NIC provides the physical connection between the computer and the network, converting digital data into electrical, radio, or optical signals for outbound data, and vice versa for inbound data12.
Additionally, the NIC also has functionalities that extend to the Data Link layer, which is responsible for node-to-node data transfer and handling the physical addressing of packets through MAC addresses3.
Reference: Information based on the Certified Network Defender (CND) course material and study guide. Additional details from EC-Council’s official Certified Network Defender (CND) resources and other authoritative sources on network interface cards and the OSI model132.
Question #105
Eric is receiving complaints from employees that their systems are very slow and experiencing odd issues including restarting automatically and frequent system hangs. Upon investigating, he is convinced the systems are infected with a virus that forces systems to shut down automatically after period of time.
What type of security incident are the employees a victim of?
- A . Scans and probes
- B . Malicious Code
- C . Denial of service
- D . Distributed denial of service
Correct Answer: B
B
Explanation:
The symptoms described by the employees, such as systems being very slow, restarting automatically, and experiencing frequent hangs, are indicative of a security incident involving malicious code. Malicious code refers to software or scripts designed to cause harm to a computer system, network, or server. In this case, the virus that forces systems to shut down automatically after a period of time is a type of malicious code. It disrupts the normal functioning of the system, leading to decreased performance and unexpected behavior.
Reference: The classification of this type of security incident aligns with the Certified Network
Defender (CND) curriculum, which includes understanding and identifying various types of security threats, including those caused by viruses and other forms of malicious code12. The CND program emphasizes the importance of recognizing the signs of malware infection, which can include system slowdowns, crashes, and other erratic behaviors that impact system availability and performance1.
B
Explanation:
The symptoms described by the employees, such as systems being very slow, restarting automatically, and experiencing frequent hangs, are indicative of a security incident involving malicious code. Malicious code refers to software or scripts designed to cause harm to a computer system, network, or server. In this case, the virus that forces systems to shut down automatically after a period of time is a type of malicious code. It disrupts the normal functioning of the system, leading to decreased performance and unexpected behavior.
Reference: The classification of this type of security incident aligns with the Certified Network
Defender (CND) curriculum, which includes understanding and identifying various types of security threats, including those caused by viruses and other forms of malicious code12. The CND program emphasizes the importance of recognizing the signs of malware infection, which can include system slowdowns, crashes, and other erratic behaviors that impact system availability and performance1.
Question #106
Which of the following types of information can be obtained through network sniffing? (Select all that apply)
- A . Programming errors
- B . DNS traffic
- C . Telnet passwords
- D . Syslog traffic
Correct Answer: B, C, D
B, C, D
Explanation:
Network sniffing is a process used to monitor and capture data packets as they travel across a network.
Through network sniffing, various types of information can be obtained:
DNS traffic: Sniffing can capture the queries and responses exchanged between DNS servers and clients, revealing which domains are being requested by users on the network.
Telnet passwords: Since Telnet transmits data, including login credentials, in clear text, sniffing can easily capture these passwords as they traverse the network.
Syslog traffic: Syslog is a standard for message logging, and sniffing can intercept this traffic, providing insights into the events and statuses reported by network devices.
Programming errors, however, are typically not something that can be captured through network sniffing, as they are related to the code’s logic rather than the data transmitted over the network.
Reference: The information provided is based on standard network security practices and the functionality of network sniffers, which are tools designed to capture and analyze network traffic. This aligns with the teachings of the Certified Network Defender (CND) course regarding network monitoring and threat detection.
B, C, D
Explanation:
Network sniffing is a process used to monitor and capture data packets as they travel across a network.
Through network sniffing, various types of information can be obtained:
DNS traffic: Sniffing can capture the queries and responses exchanged between DNS servers and clients, revealing which domains are being requested by users on the network.
Telnet passwords: Since Telnet transmits data, including login credentials, in clear text, sniffing can easily capture these passwords as they traverse the network.
Syslog traffic: Syslog is a standard for message logging, and sniffing can intercept this traffic, providing insights into the events and statuses reported by network devices.
Programming errors, however, are typically not something that can be captured through network sniffing, as they are related to the code’s logic rather than the data transmitted over the network.
Reference: The information provided is based on standard network security practices and the functionality of network sniffers, which are tools designed to capture and analyze network traffic. This aligns with the teachings of the Certified Network Defender (CND) course regarding network monitoring and threat detection.
Question #107
Which of the following attack signature analysis techniques are implemented to examine the header information and conclude that a packet has been altered?
- A . Context-based signature analysis
- B . Content-based signature analysis
- C . Atomic signature-based analysis
- D . Composite signature-based analysis
Correct Answer: D
D
Explanation:
Composite signature-based analysis is a technique used in intrusion detection systems to examine multiple attributes or behaviors over time to identify potential threats. This method can analyze packet headers to detect anomalies that may indicate a packet has been altered. It looks at a series of packets or fragments to determine if they are part of a legitimate session or if they have been manipulated as part of an attack, such as overlapping fragments which cannot be reassembled properly. This approach is more comprehensive than atomic signature-based analysis, which examines single events or packets in isolation, and provides a more contextual understanding compared to context-based or content-based analyses.
Reference: The concept of composite signature-based analysis and its application in examining packet headers for alterations is supported by industry-standard practices in network security and intrusion detection systems123.
D
Explanation:
Composite signature-based analysis is a technique used in intrusion detection systems to examine multiple attributes or behaviors over time to identify potential threats. This method can analyze packet headers to detect anomalies that may indicate a packet has been altered. It looks at a series of packets or fragments to determine if they are part of a legitimate session or if they have been manipulated as part of an attack, such as overlapping fragments which cannot be reassembled properly. This approach is more comprehensive than atomic signature-based analysis, which examines single events or packets in isolation, and provides a more contextual understanding compared to context-based or content-based analyses.
Reference: The concept of composite signature-based analysis and its application in examining packet headers for alterations is supported by industry-standard practices in network security and intrusion detection systems123.
Question #108
On which of the following OSI layers does the Pretty Good Privacy (PGP) work?
- A . Application
- B . Data Link
- C . Network
- D . Transport
Correct Answer: A
A
Explanation:
Pretty Good Privacy (PGP) is an encryption program that provides confidentiality, integrity, and authentication for data communication. PGP operates at the Application layer of the OSI model. This is because it is used to encrypt and decrypt texts, emails, files, directories, and whole disk partitions and to enhance the security of email communications. PGP provides these services by utilizing cryptographic privacy and authentication through a hybrid approach that combines symmetric and asymmetric encryption, which is implemented at the Application layer.
Reference: The explanation aligns with the functionalities of PGP as described in the context of the OSI model and is consistent with the Certified Network Defender (CND) course material. For further details, please refer to the official CND study guide and documents.
A
Explanation:
Pretty Good Privacy (PGP) is an encryption program that provides confidentiality, integrity, and authentication for data communication. PGP operates at the Application layer of the OSI model. This is because it is used to encrypt and decrypt texts, emails, files, directories, and whole disk partitions and to enhance the security of email communications. PGP provides these services by utilizing cryptographic privacy and authentication through a hybrid approach that combines symmetric and asymmetric encryption, which is implemented at the Application layer.
Reference: The explanation aligns with the functionalities of PGP as described in the context of the OSI model and is consistent with the Certified Network Defender (CND) course material. For further details, please refer to the official CND study guide and documents.
Question #109
Identify the password cracking attempt involving precomputed hash values stored as plaintext and using these to crack the password.
- A . Bruteforce
- B . Rainbow table
- C . Dictionary
- D . Hybrid
Correct Answer: B
B
Explanation:
The password cracking attempt described involves the use of Rainbow tables. A Rainbow table is a precomputed table for reversing cryptographic hash functions, primarily for cracking password hashes. These tables store a mapping between the hash of a password and the correct password for that hash, allowing for quick retrieval of the plaintext password if the hash is known. This method is efficient for cracking passwords because it avoids the time-consuming process of computing hashes on the fly during an attack.
Reference: Rainbow tables are a well-known tool in password cracking that leverage precomputed hash values to expedite the cracking process1. They are particularly useful when dealing with standard hashing algorithms where salting is not used, as they can significantly reduce the time needed to crack a password by avoiding the need for real-time hash calculations23. This technique is distinct from brute force attacks, which try all possible combinations, dictionary attacks, which use a list of likely passwords, and hybrid attacks, which combine elements of brute force and dictionary methods4.
B
Explanation:
The password cracking attempt described involves the use of Rainbow tables. A Rainbow table is a precomputed table for reversing cryptographic hash functions, primarily for cracking password hashes. These tables store a mapping between the hash of a password and the correct password for that hash, allowing for quick retrieval of the plaintext password if the hash is known. This method is efficient for cracking passwords because it avoids the time-consuming process of computing hashes on the fly during an attack.
Reference: Rainbow tables are a well-known tool in password cracking that leverage precomputed hash values to expedite the cracking process1. They are particularly useful when dealing with standard hashing algorithms where salting is not used, as they can significantly reduce the time needed to crack a password by avoiding the need for real-time hash calculations23. This technique is distinct from brute force attacks, which try all possible combinations, dictionary attacks, which use a list of likely passwords, and hybrid attacks, which combine elements of brute force and dictionary methods4.
Question #110
Which among the following options represents professional hackers with an aim of attacking systems for profit?
- A . Script kiddies
- B . Organized hackers
- C . Hacktivists
- D . Cyber terrorists
Correct Answer: B
B
Explanation:
Organized hackers are professional cybercriminals who often work in groups and are motivated by financial gain. They are known for their skills and the ability to carry out sophisticated attacks on systems for profit. Unlike script kiddies, who lack advanced skills and typically use readily available tools, organized hackers use custom-developed tools and methods. Hacktivists are motivated by political or social causes, and cyber terrorists aim to use cyber attacks to create fear or political change, not necessarily for profit.
Reference: The EC-Council’s Certified Network Defender (CND) program covers various types of cyber threats and the motivations behind them, including the distinction between different types of hackers and their objectives. The CND curriculum includes understanding the threat landscape, which encompasses organized hackers and their profit-driven attacks12.
B
Explanation:
Organized hackers are professional cybercriminals who often work in groups and are motivated by financial gain. They are known for their skills and the ability to carry out sophisticated attacks on systems for profit. Unlike script kiddies, who lack advanced skills and typically use readily available tools, organized hackers use custom-developed tools and methods. Hacktivists are motivated by political or social causes, and cyber terrorists aim to use cyber attacks to create fear or political change, not necessarily for profit.
Reference: The EC-Council’s Certified Network Defender (CND) program covers various types of cyber threats and the motivations behind them, including the distinction between different types of hackers and their objectives. The CND curriculum includes understanding the threat landscape, which encompasses organized hackers and their profit-driven attacks12.