EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #111
A stateful multilayer inspection firewall combines the aspects of Application level gateway, Circuit level gateway and Packet filtering firewall.
On which layers of the OSI model, does the Stateful multilayer inspection firewall works?
- A . Network, Session & Application
- B . Physical & application
- C . Session & network
- D . Physical, session & application
Correct Answer: A
A
Explanation:
A stateful multilayer inspection firewall operates across multiple layers of the OSI model, specifically the Network, Session, and Application layers. It combines the features of packet filtering, circuit-level gateway, and application-level gateway firewalls. This type of firewall inspects the state and context of network traffic, ensuring that all packets are part of a known and valid session. It can make decisions based on the connection state as well as the contents of the traffic, providing a thorough inspection across these layers.
Reference: The information is consistent with the characteristics of stateful multilayer inspection firewalls as described in various sources, which confirm that they work across the Network, Session, and Application layers of the OSI model1234.
A
Explanation:
A stateful multilayer inspection firewall operates across multiple layers of the OSI model, specifically the Network, Session, and Application layers. It combines the features of packet filtering, circuit-level gateway, and application-level gateway firewalls. This type of firewall inspects the state and context of network traffic, ensuring that all packets are part of a known and valid session. It can make decisions based on the connection state as well as the contents of the traffic, providing a thorough inspection across these layers.
Reference: The information is consistent with the characteristics of stateful multilayer inspection firewalls as described in various sources, which confirm that they work across the Network, Session, and Application layers of the OSI model1234.
Question #112
Which of the following examines Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs) for a disaster recovery strategy?
- A . Risk Assessment
- B . Risk Management
- C . Business Continuity Plan
- D . Business Impact Analysis
Correct Answer: D
D
Explanation:
Business Impact Analysis (BIA) is the process that determines the potential impacts of business function disruptions and gathers information needed to develop recovery strategies. A critical part of BIA is examining Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs) for a disaster recovery strategy. RPOs define the maximum age of files that must be recovered from backup storage for normal operations to resume after a disaster, while RTOs specify the maximum amount of time that a resource can remain unavailable after a disaster.
Reference: The role of BIA in examining RPOs and RTOs is a fundamental concept in disaster recovery and business continuity planning, which is covered in the EC-Council’s Certified Network Defender (CND) curriculum. The importance of BIA in disaster recovery is also supported by industry best practices and guidelines12.
D
Explanation:
Business Impact Analysis (BIA) is the process that determines the potential impacts of business function disruptions and gathers information needed to develop recovery strategies. A critical part of BIA is examining Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs) for a disaster recovery strategy. RPOs define the maximum age of files that must be recovered from backup storage for normal operations to resume after a disaster, while RTOs specify the maximum amount of time that a resource can remain unavailable after a disaster.
Reference: The role of BIA in examining RPOs and RTOs is a fundamental concept in disaster recovery and business continuity planning, which is covered in the EC-Council’s Certified Network Defender (CND) curriculum. The importance of BIA in disaster recovery is also supported by industry best practices and guidelines12.
Question #113
Andrew would like to configure IPsec in a manner that provides confidentiality for the content of packets.
What component of IPsec provides this capability?
- A . ESP
- B . AH
- C . IKE
- D . ISAKMP
Correct Answer: A
A
Explanation:
The Encapsulating Security Payload (ESP) component of IPsec is designed to provide confidentiality for the content of packets. ESP encrypts the data payload of IP packets to ensure that the information being transmitted remains confidential and cannot be accessed or intercepted by unauthorized parties. This encryption is crucial for protecting sensitive data as it travels across insecure networks, such as the internet.
Reference: The role of ESP in providing confidentiality within the IPsec protocol is well-documented and aligns with the security objectives of IPsec to protect IP traffic through encryption and other security measures1234.
A
Explanation:
The Encapsulating Security Payload (ESP) component of IPsec is designed to provide confidentiality for the content of packets. ESP encrypts the data payload of IP packets to ensure that the information being transmitted remains confidential and cannot be accessed or intercepted by unauthorized parties. This encryption is crucial for protecting sensitive data as it travels across insecure networks, such as the internet.
Reference: The role of ESP in providing confidentiality within the IPsec protocol is well-documented and aligns with the security objectives of IPsec to protect IP traffic through encryption and other security measures1234.
Question #114
Sophie has been working as a Windows network administrator at an MNC over the past 7 years. She wants to check whether SMB1 is enabled or disabled.
Which of the following command allows Sophie to do so?
- A . Get-WindowsOptionalFeatures -Online -FeatureNames SMB1Protocol
- B . Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
- C . Get-WindowsOptionalFeature -Online -FeatureNames SMB1Protocol
- D . Get-WindowsOptionalFeatures -Online -FeatureName SMB1Protocol
Correct Answer: B
B
Explanation:
To check if SMB1 is enabled or disabled, the correct PowerShell command is Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. This command queries the status of the SMB1Protocol feature in the running instance of Windows. If SMB1 is enabled, the command will return its status as ‘Enabled’, and if it is disabled, it will return ‘Disabled’.
Reference: The correct syntax for the command is documented in various official Windows resources, including Microsoft’s own documentation on managing SMB protocols1. It is also aligned with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes knowledge of managing Windows network protocols and features.
B
Explanation:
To check if SMB1 is enabled or disabled, the correct PowerShell command is Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. This command queries the status of the SMB1Protocol feature in the running instance of Windows. If SMB1 is enabled, the command will return its status as ‘Enabled’, and if it is disabled, it will return ‘Disabled’.
Reference: The correct syntax for the command is documented in various official Windows resources, including Microsoft’s own documentation on managing SMB protocols1. It is also aligned with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes knowledge of managing Windows network protocols and features.
Question #115
Which component of the data packets is encrypted in Transport mode encryption of an IPsec server?
- A . Payload
- B . Header
- C . Header and Payload
- D . Encryption is not used in IPsec server
Correct Answer: A
A
Explanation:
In Transport mode encryption of an IPsec server, only the payload of the data packet is encrypted. This mode is designed to encrypt the message within an IP packet, while the header remains unencrypted. Transport mode is used for end-to-end communication between a client and a server, where the server can interpret the headers to route the packet to the correct application or process.
Reference: The information is consistent with the IPsec standards and documentation, which specify that in Transport mode, the data within the original IP packet is protected, but not the IP header123.
This ensures that the packet retains its original IP header, allowing it to be routed properly through the network.
A
Explanation:
In Transport mode encryption of an IPsec server, only the payload of the data packet is encrypted. This mode is designed to encrypt the message within an IP packet, while the header remains unencrypted. Transport mode is used for end-to-end communication between a client and a server, where the server can interpret the headers to route the packet to the correct application or process.
Reference: The information is consistent with the IPsec standards and documentation, which specify that in Transport mode, the data within the original IP packet is protected, but not the IP header123.
This ensures that the packet retains its original IP header, allowing it to be routed properly through the network.
Question #116
How does Windows’ in-built security component, AppLocker, whitelist applications?
- A . Using Path Rule
- B . Using Signature Rule
- C . Using Certificate Rule
- D . Using Internet Zone Rule
Correct Answer: A
A
Explanation:
AppLocker whitelists applications by creating rules that specify which files are allowed to run. One of the primary methods for specifying these rules is through the use of Path Rules. Path Rules allow administrators to specify an allowed file or folder path, and any application within that path is permitted to run. This method is particularly useful for allowing applications from a known directory while blocking others that are not explicitly approved.
Reference: The official Microsoft documentation explains that AppLocker functions as an allowlist by default, where only files covered by one or more allow rules are permitted to run. Path Rules are a fundamental part of this allowlisting approach1. Additionally, other resources like security guidelines and best practices for Windows reinforce the use of Path Rules as a method for application whitelisting within AppLocker2
A
Explanation:
AppLocker whitelists applications by creating rules that specify which files are allowed to run. One of the primary methods for specifying these rules is through the use of Path Rules. Path Rules allow administrators to specify an allowed file or folder path, and any application within that path is permitted to run. This method is particularly useful for allowing applications from a known directory while blocking others that are not explicitly approved.
Reference: The official Microsoft documentation explains that AppLocker functions as an allowlist by default, where only files covered by one or more allow rules are permitted to run. Path Rules are a fundamental part of this allowlisting approach1. Additionally, other resources like security guidelines and best practices for Windows reinforce the use of Path Rules as a method for application whitelisting within AppLocker2
Question #117
Which of the following incident handling stage removes the root cause of the incident?
- A . Eradication
- B . Recovery
- C . Detection
- D . Containment
Correct Answer: A
A
Explanation:
The eradication stage in incident handling is responsible for removing the root cause of the incident.
This stage involves identifying and eliminating the threats that caused the incident, such as malware or unauthorized access. It also includes patching vulnerabilities and strengthening security controls to prevent similar incidents in the future. The goal of eradication is to ensure that the incident is completely resolved and cannot recur.
Reference: The information about the eradication phase aligns with best practices in incident response, as detailed in various cybersecurity resources12.
A
Explanation:
The eradication stage in incident handling is responsible for removing the root cause of the incident.
This stage involves identifying and eliminating the threats that caused the incident, such as malware or unauthorized access. It also includes patching vulnerabilities and strengthening security controls to prevent similar incidents in the future. The goal of eradication is to ensure that the incident is completely resolved and cannot recur.
Reference: The information about the eradication phase aligns with best practices in incident response, as detailed in various cybersecurity resources12.
Question #118
Assume that you are working as a network administrator in the head office of a bank. One day a bank employee informed you that she is unable to log in to her system. At the same time, you get a call from another network administrator informing you that there is a problem connecting to the main server.
How will you prioritize these two incidents?
- A . Based on approval from management
- B . Based on a first come first served basis
- C . Based on a potential technical effect of the incident
- D . Based on the type of response needed for the incident
Correct Answer: C
C
Explanation:
Prioritizing incidents in a network environment, especially within a critical infrastructure like a bank, should be based on the potential technical effect of the incident. This approach ensures that the most severe and impactful issues are addressed first to maintain business continuity and minimize potential damage. The incident involving the main server would likely take precedence because it could affect a larger number of systems and operations within the bank, compared to an individual’s login issue. The ITIL framework supports this prioritization method by emphasizing the importance of impact and urgency when managing network incidents12.
Reference: The prioritization strategy aligns with best practices outlined in the ITIL framework for IT service management, which suggests managing incidents based on their severity, urgency, and impact on business operations12.
C
Explanation:
Prioritizing incidents in a network environment, especially within a critical infrastructure like a bank, should be based on the potential technical effect of the incident. This approach ensures that the most severe and impactful issues are addressed first to maintain business continuity and minimize potential damage. The incident involving the main server would likely take precedence because it could affect a larger number of systems and operations within the bank, compared to an individual’s login issue. The ITIL framework supports this prioritization method by emphasizing the importance of impact and urgency when managing network incidents12.
Reference: The prioritization strategy aligns with best practices outlined in the ITIL framework for IT service management, which suggests managing incidents based on their severity, urgency, and impact on business operations12.
Question #119
Sean has built a site-to-site VPN architecture between the head office and the branch office of his company. When users in the branch office and head office try to communicate with each other, the traffic is encapsulated. As the traffic passes though the gateway, it is encapsulated again. The header and payload both are encapsulated. This second encapsulation occurs only in the __________implementation of a VPN.
- A . Full Mesh Mode
- B . Point-to-Point Mode
- C . Transport Mode
- D . Tunnel Mode
Correct Answer: D
D
Explanation:
In the context of VPNs, when both the header and payload of traffic are encapsulated, it indicates the use of Tunnel Mode. This mode is typically employed in site-to-site VPNs where the entire IP packet is wrapped with a new IP header. Tunnel Mode is designed to secure traffic between different networks over the internet, making it suitable for connecting multiple sites of an organization. Unlike Transport Mode, which only encrypts the payload and leaves the original IP header intact, Tunnel Mode encrypts the entire IP packet and adds a new header, which allows for the secure passage of the traffic through untrusted networks.
Reference: The explanation provided aligns with standard VPN implementations and the principles outlined in network security documents and study guides related to Certified Network Defender (CND) objectives.
D
Explanation:
In the context of VPNs, when both the header and payload of traffic are encapsulated, it indicates the use of Tunnel Mode. This mode is typically employed in site-to-site VPNs where the entire IP packet is wrapped with a new IP header. Tunnel Mode is designed to secure traffic between different networks over the internet, making it suitable for connecting multiple sites of an organization. Unlike Transport Mode, which only encrypts the payload and leaves the original IP header intact, Tunnel Mode encrypts the entire IP packet and adds a new header, which allows for the secure passage of the traffic through untrusted networks.
Reference: The explanation provided aligns with standard VPN implementations and the principles outlined in network security documents and study guides related to Certified Network Defender (CND) objectives.
Question #120
Elden is working as a network administrator at an IT company. His organization opted for a virtualization technique in which the guest OS is aware of the virtual environment in which it is running and communicates with the host machines for requesting resources. Identify the virtualization technique implemented by Elden’s organization.
- A . Hybrid virtualization
- B . Hardware-assisted virtualization
- C . Full virtualization
- D . Para virtualization
Correct Answer: D
D
Explanation:
Para virtualization is a virtualization technique where the guest operating system is aware of the virtual environment and can communicate directly with the host machine’s hypervisor to request resources. This direct communication allows for a more efficient system, as it does not require the same level of emulation and overhead as full virtualization. In para virtualization, the guest OS is typically modified to interact with a thin layer of software called a hypervisor, which coordinates access to the physical hardware resources. This setup is designed to reduce the performance overhead that typically occurs with full virtualization, where the guest OS must go through a more complex abstraction layer to access resources.
Reference: The information provided is based on standard practices of para virtualization in network security and aligns with the Certified Network Defender (CND) curriculum, which includes understanding various virtualization techniques as part of network infrastructure management12.
D
Explanation:
Para virtualization is a virtualization technique where the guest operating system is aware of the virtual environment and can communicate directly with the host machine’s hypervisor to request resources. This direct communication allows for a more efficient system, as it does not require the same level of emulation and overhead as full virtualization. In para virtualization, the guest OS is typically modified to interact with a thin layer of software called a hypervisor, which coordinates access to the physical hardware resources. This setup is designed to reduce the performance overhead that typically occurs with full virtualization, where the guest OS must go through a more complex abstraction layer to access resources.
Reference: The information provided is based on standard practices of para virtualization in network security and aligns with the Certified Network Defender (CND) curriculum, which includes understanding various virtualization techniques as part of network infrastructure management12.