EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #121
The network administrator wants to strengthen physical security in the organization. Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials.
Which of following physical security measures should the administrator use?
- A . Video surveillance
- B . Fence
- C . Mantrap
- D . Bollards
Correct Answer: C
C
Explanation:
A mantrap is a physical security mechanism designed to control access to a secure area through a small space that can only fit one person. It typically consists of two sets of interlocking doors. The first set of doors must close before the second set opens, effectively trapping the individual temporarily. This allows security personnel to verify the person’s credentials before granting them access to the restricted zone. Mantraps are particularly effective in sensitive areas where strict access control is required.
Reference: The concept of a mantrap as a physical security measure is discussed in various security frameworks and guidelines. It is a recognized method for strengthening physical security by controlling individual access to secure areas, as outlined in security best practices and standards123.
C
Explanation:
A mantrap is a physical security mechanism designed to control access to a secure area through a small space that can only fit one person. It typically consists of two sets of interlocking doors. The first set of doors must close before the second set opens, effectively trapping the individual temporarily. This allows security personnel to verify the person’s credentials before granting them access to the restricted zone. Mantraps are particularly effective in sensitive areas where strict access control is required.
Reference: The concept of a mantrap as a physical security measure is discussed in various security frameworks and guidelines. It is a recognized method for strengthening physical security by controlling individual access to secure areas, as outlined in security best practices and standards123.
Question #122
The————–protocol works in the network layer and is responsible for handling the error codes during the delivery of packets. This protocol is also responsible for providing communication in the TCP/IP stack.
- A . RARP
- B . ICMP
- C . DHCP
- D . ARP
Correct Answer: B
B
Explanation:
The Internet Control Message Protocol (ICMP) operates at the network layer and is integral to the Internet Protocol suite. It is utilized primarily for error handling during packet delivery, such as informing senders of a failed delivery due to unreachable destinations or other path-related issues. ICMP is also used for diagnostic purposes, with tools like ping and traceroute relying on ICMP messages to test connectivity and trace packet routes. Unlike transport layer protocols like TCP or UDP, ICMP does not establish a connection before sending messages, making it a connectionless protocol. This characteristic allows ICMP to quickly relay error messages and network information without the overhead of establishing a session.
Reference: The role and functions of ICMP are well-documented in resources such as GeeksforGeeks, ExploringBits, and IBM’s TCP/IP concepts, which align with the ECCouncil’s Network Defender (CND) objectives and documents123.
B
Explanation:
The Internet Control Message Protocol (ICMP) operates at the network layer and is integral to the Internet Protocol suite. It is utilized primarily for error handling during packet delivery, such as informing senders of a failed delivery due to unreachable destinations or other path-related issues. ICMP is also used for diagnostic purposes, with tools like ping and traceroute relying on ICMP messages to test connectivity and trace packet routes. Unlike transport layer protocols like TCP or UDP, ICMP does not establish a connection before sending messages, making it a connectionless protocol. This characteristic allows ICMP to quickly relay error messages and network information without the overhead of establishing a session.
Reference: The role and functions of ICMP are well-documented in resources such as GeeksforGeeks, ExploringBits, and IBM’s TCP/IP concepts, which align with the ECCouncil’s Network Defender (CND) objectives and documents123.
Question #123
Maximus Tech Is a multinational company that uses Cisco ASA Firewalls for their systems. Jason is the one of the members of the team that checks the logs at Maximus Tech. As a part of his job. he is going through me logs and he came across a firewall log that looks like this:
May 06 2018 21:27:27 asa 1: % ASA -6-11008: User enable_16′ executed the ‘configure term’ command
Based on the security level mentioned in the log, what did Jason understand about the description of this message?
- A . Normal but significant message
- B . Informational message
- C . Critical condition message
- D . Warning condition message
Correct Answer: B
B
Explanation:
The log entry %ASA-6-11008 indicates that the message is of a severity level 6, which corresponds to an informational message. In the context of Cisco ASA Firewall logs, severity levels range from 0 (emergency) to 7 (debugging), with lower numbers indicating higher severity. A severity level of 6 is used for messages that provide information about normal but significant events. In this case, the log indicates that a user named ‘enable_16’ executed the ‘configure term’ command, which is a noteworthy event but does not indicate an error or critical condition.
Reference: This interpretation is based on the Cisco Secure Firewall ASA Series Syslog Messages documentation, which outlines the different severity levels and their meanings1.
B
Explanation:
The log entry %ASA-6-11008 indicates that the message is of a severity level 6, which corresponds to an informational message. In the context of Cisco ASA Firewall logs, severity levels range from 0 (emergency) to 7 (debugging), with lower numbers indicating higher severity. A severity level of 6 is used for messages that provide information about normal but significant events. In this case, the log indicates that a user named ‘enable_16’ executed the ‘configure term’ command, which is a noteworthy event but does not indicate an error or critical condition.
Reference: This interpretation is based on the Cisco Secure Firewall ASA Series Syslog Messages documentation, which outlines the different severity levels and their meanings1.
Question #124
Which of the following commands can be used to disable unwanted services on Debian, Ubuntu and other Debian-based Linux distributions?
- A . # chkconfig [service name]off
- B . # chkconfig [service name] Cdel
- C . # service [service name] stop
- D . # update-rc.d -f [service name] remove
Correct Answer: D
D
Explanation:
In Debian-based Linux distributions, such as Ubuntu, the update-rc.d command is used to add and remove services from the startup sequence. To disable a service, the -f option (which stands for ‘force’) is used along with the remove parameter to remove the service from the startup sequence. This prevents the service from starting automatically during the system boot.
Reference: The use of update-rc.d for disabling services is documented in various Linux guides and resources. For example, Tecmint’s guide on “How to Stop and Disable Unwanted Services from Linux
System” provides a practical example of using update-rc.d -f apache2 remove to disable the Apache service at system startup1. Additionally, the Linux Consultant website also mentions the use of systemctl followed by the disable argument for fully disabling services2.
D
Explanation:
In Debian-based Linux distributions, such as Ubuntu, the update-rc.d command is used to add and remove services from the startup sequence. To disable a service, the -f option (which stands for ‘force’) is used along with the remove parameter to remove the service from the startup sequence. This prevents the service from starting automatically during the system boot.
Reference: The use of update-rc.d for disabling services is documented in various Linux guides and resources. For example, Tecmint’s guide on “How to Stop and Disable Unwanted Services from Linux
System” provides a practical example of using update-rc.d -f apache2 remove to disable the Apache service at system startup1. Additionally, the Linux Consultant website also mentions the use of systemctl followed by the disable argument for fully disabling services2.
Question #125
Ivan needs to pick an encryption method that is scalable even though it might be slower. He has settled on a method that works where one key is public and the other is private.
What encryption method did Ivan settle on?
- A . Ivan settled on the private encryption method.
- B . Ivan settled on the symmetric encryption method.
- C . Ivan settled on the asymmetric encryption method
- D . Ivan settled on the hashing encryption method
Correct Answer: C
C
Explanation:
Asymmetric encryption, also known as public-key cryptography, involves two keys: a public key, which can be shared widely, and a private key, which is kept confidential. The public key is used for encryption, and the private key is used for decryption. This method is scalable because it allows for secure communication over an open network without the need for the parties to share secret keys in advance. While asymmetric encryption is generally slower than symmetric encryption due to the complex mathematical computations involved, it provides a high level of security and is essential for tasks such as digital signatures and establishing secure connections over the internet1234.
Reference: GeeksforGeeks provides a detailed explanation of asymmetric key cryptography, including its characteristics and how it addresses key distribution and digital signatures1.
Dashlane’s blog offers a complete guide to asymmetric encryption, its definition, uses, and how it works2.
Kiteworks explains the difference between public and private key encryption and the use of asymmetric encryption on the internet3.
Cloudflare discusses asymmetric encryption and its role in securing web communications through protocols like TLS4.
C
Explanation:
Asymmetric encryption, also known as public-key cryptography, involves two keys: a public key, which can be shared widely, and a private key, which is kept confidential. The public key is used for encryption, and the private key is used for decryption. This method is scalable because it allows for secure communication over an open network without the need for the parties to share secret keys in advance. While asymmetric encryption is generally slower than symmetric encryption due to the complex mathematical computations involved, it provides a high level of security and is essential for tasks such as digital signatures and establishing secure connections over the internet1234.
Reference: GeeksforGeeks provides a detailed explanation of asymmetric key cryptography, including its characteristics and how it addresses key distribution and digital signatures1.
Dashlane’s blog offers a complete guide to asymmetric encryption, its definition, uses, and how it works2.
Kiteworks explains the difference between public and private key encryption and the use of asymmetric encryption on the internet3.
Cloudflare discusses asymmetric encryption and its role in securing web communications through protocols like TLS4.
Question #126
An IDS or IDPS can be deployed in two modes.
Which deployment mode allows the IDS to both detect and stop malicious traffic?
- A . promiscuous mode
- B . passive mode
- C . firewall mode
- D . inline mode
Correct Answer: D
D
Explanation:
The deployment mode that allows an Intrusion Detection System (IDS) or Intrusion Detection and Prevention System (IDPS) to both detect and stop malicious traffic is known as inline mode. In this mode, the IDS/IDPS is placed directly in the network’s traffic flow. All traffic must pass through the system, allowing it to inspect packets in real-time and take immediate action to block potential threats before they reach their destination. This contrasts with promiscuous or passive modes, where the system only monitors and alerts on traffic without the ability to intervene directly.
Reference: The functionality of inline mode in IDS/IDPS is well-documented and aligns with the objectives of the Certified Network Defender (CND) course. It is a critical aspect of network security, ensuring active prevention of attacks by analyzing and acting upon traffic as it traverses the network12.
D
Explanation:
The deployment mode that allows an Intrusion Detection System (IDS) or Intrusion Detection and Prevention System (IDPS) to both detect and stop malicious traffic is known as inline mode. In this mode, the IDS/IDPS is placed directly in the network’s traffic flow. All traffic must pass through the system, allowing it to inspect packets in real-time and take immediate action to block potential threats before they reach their destination. This contrasts with promiscuous or passive modes, where the system only monitors and alerts on traffic without the ability to intervene directly.
Reference: The functionality of inline mode in IDS/IDPS is well-documented and aligns with the objectives of the Certified Network Defender (CND) course. It is a critical aspect of network security, ensuring active prevention of attacks by analyzing and acting upon traffic as it traverses the network12.
Question #127
Who is responsible for conveying company details after an incident?
- A . PR specialist
- B . IR officer
- C . IR manager
- D . IR custodians
Correct Answer: A
A
Explanation:
In the context of incident response (IR), the PR specialist is typically responsible for conveying company details after an incident. Their role involves managing communications with the media, stakeholders, and the public to maintain the organization’s reputation. While IR officers, managers, and custodians play crucial roles in handling and responding to the incident itself, the PR specialist is the one who communicates with external parties about the incident.
Reference: The information aligns with the responsibilities outlined for a PR specialist in incident response scenarios, as per the Certified Network Defender (CND) course by EC-Council12.
A
Explanation:
In the context of incident response (IR), the PR specialist is typically responsible for conveying company details after an incident. Their role involves managing communications with the media, stakeholders, and the public to maintain the organization’s reputation. While IR officers, managers, and custodians play crucial roles in handling and responding to the incident itself, the PR specialist is the one who communicates with external parties about the incident.
Reference: The information aligns with the responsibilities outlined for a PR specialist in incident response scenarios, as per the Certified Network Defender (CND) course by EC-Council12.
Question #128
Which of the following is NOT an AWS Shared Responsibility Model devised by AWS?
- A . Shared Responsibility Model for Container Services
- B . Shared Responsibility Model for Infrastructure Services
- C . Shared Responsibility Model for Abstract Services
- D . Shared Responsibility Model for Storage Services
Correct Answer: C
C
Explanation:
The AWS Shared Responsibility Model outlines the security and compliance duties divided between AWS and its customers. AWS is responsible for “Security of the Cloud,” which includes the infrastructure that runs AWS services. The customer is responsible for “Security in the Cloud,” which involves managing the guest operating system, application software, and configuration of the AWS-provided firewall, among other tasks12.
The options A, B, and D are actual components of the AWS Shared Responsibility Model, focusing on container services, infrastructure services, and storage services, respectively. These models define the division of security responsibilities between AWS and the customer for each type of service. However, there is no distinct Shared Responsibility Model for Abstract Services as described in the options. Instead, abstract services fall under the broader categories of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS), each with its own set of shared responsibilities.
Reference: The information about the AWS Shared Responsibility Model can be found in the official AWS documentation and resources that explain the division of responsibilities and provide guidance on how customers can manage their part of the security and compliance requirements12.
C
Explanation:
The AWS Shared Responsibility Model outlines the security and compliance duties divided between AWS and its customers. AWS is responsible for “Security of the Cloud,” which includes the infrastructure that runs AWS services. The customer is responsible for “Security in the Cloud,” which involves managing the guest operating system, application software, and configuration of the AWS-provided firewall, among other tasks12.
The options A, B, and D are actual components of the AWS Shared Responsibility Model, focusing on container services, infrastructure services, and storage services, respectively. These models define the division of security responsibilities between AWS and the customer for each type of service. However, there is no distinct Shared Responsibility Model for Abstract Services as described in the options. Instead, abstract services fall under the broader categories of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS), each with its own set of shared responsibilities.
Reference: The information about the AWS Shared Responsibility Model can be found in the official AWS documentation and resources that explain the division of responsibilities and provide guidance on how customers can manage their part of the security and compliance requirements12.
Question #129
Which of the following data security technology can ensure information protection by obscuring specific areas of information?
- A . Data encryption
- B . Data hashing
- C . Data masking
- D . Data retention
Correct Answer: C
C
Explanation:
Data masking, also known as data obfuscation, is the process of hiding original data with modified content (characters or other data). This technique is used to protect sensitive information while maintaining a functional substitute for occasions when the real data is not required. For example, in a test database environment, data masking can be used to create a version of the data that is safe for developers to use without exposing sensitive information. Unlike encryption, which can be reversed with the correct key, data masking is meant to be non-reversible and maintains the format of the data so that it can be used without decryption.
Reference: The explanation provided aligns with the objectives and documents of the Certified Network Defender (CND) course, which emphasizes the importance of protecting information by obscuring specific areas that contain sensitive data. The reference to data masking as a means to ensure information protection is supported by industry sources123.
C
Explanation:
Data masking, also known as data obfuscation, is the process of hiding original data with modified content (characters or other data). This technique is used to protect sensitive information while maintaining a functional substitute for occasions when the real data is not required. For example, in a test database environment, data masking can be used to create a version of the data that is safe for developers to use without exposing sensitive information. Unlike encryption, which can be reversed with the correct key, data masking is meant to be non-reversible and maintains the format of the data so that it can be used without decryption.
Reference: The explanation provided aligns with the objectives and documents of the Certified Network Defender (CND) course, which emphasizes the importance of protecting information by obscuring specific areas that contain sensitive data. The reference to data masking as a means to ensure information protection is supported by industry sources123.
Question #130
Stephanie is currently setting up email security so all company data is secured when passed through email. Stephanie first sets up encryption to make sure that a specific user’s email is protected. Next, she needs to ensure that the incoming and the outgoing mail has not been modified or altered using digital signatures.
What is Stephanie working on?
- A . Usability
- B . Data Integrity
- C . Availability
- D . Confidentiality
Correct Answer: B
B
Explanation:
Stephanie is working on ensuring Data Integrity, which is a critical aspect of information security. It involves maintaining and assuring the accuracy and consistency of data over its entire lifecycle. By setting up digital signatures, Stephanie ensures that the data, in this case, the email content, has not been altered or tampered with during transit. This process provides a means to verify the origin of the message and confirms that the message received is the same as the message sent, thereby safeguarding the integrity of the data.
Reference: The EC-Council’s Certified Network Defender (CND) program covers key topics related to data security, including data encryption at rest and in transit, data masking, data backup, data retention, data destruction, data loss prevention (DLP), and specifically, data integrity12.
B
Explanation:
Stephanie is working on ensuring Data Integrity, which is a critical aspect of information security. It involves maintaining and assuring the accuracy and consistency of data over its entire lifecycle. By setting up digital signatures, Stephanie ensures that the data, in this case, the email content, has not been altered or tampered with during transit. This process provides a means to verify the origin of the message and confirms that the message received is the same as the message sent, thereby safeguarding the integrity of the data.
Reference: The EC-Council’s Certified Network Defender (CND) program covers key topics related to data security, including data encryption at rest and in transit, data masking, data backup, data retention, data destruction, data loss prevention (DLP), and specifically, data integrity12.