EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #131
An administrator wants to monitor and inspect large amounts of traffic and detect unauthorized attempts from inside the organization, with the help of an IDS. They are not able to recognize the exact location to deploy the IDS sensor.
Can you help him spot the location where the IDS sensor should be placed?
- A . Location 2
- B . Location 3
- C . Location 4
- D . Location 1
Correct Answer: B
B
Explanation:
In the context of Certified Network Defender (CND), an IDS sensor should be placed at a location where it can effectively monitor and inspect traffic to detect unauthorized attempts. Location 3, which is situated after the firewall but before the network backbone, is ideal for this purpose. At this location, the IDS can analyze traffic that has passed through the firewall, allowing it to focus on potentially harmful traffic that could affect the internal network. It provides visibility into both incoming and outgoing traffic, enabling comprehensive monitoring and detection of any unauthorized or malicious activity.
Reference: The placement of IDS is crucial for effective monitoring and detection, as discussed in EC-Council’s Certified Network Defender courseware12. It is also aligned with the NIST Cybersecurity Framework, which emphasizes the importance of identifying, protecting, detecting, responding, and recovering from security incidents2.
B
Explanation:
In the context of Certified Network Defender (CND), an IDS sensor should be placed at a location where it can effectively monitor and inspect traffic to detect unauthorized attempts. Location 3, which is situated after the firewall but before the network backbone, is ideal for this purpose. At this location, the IDS can analyze traffic that has passed through the firewall, allowing it to focus on potentially harmful traffic that could affect the internal network. It provides visibility into both incoming and outgoing traffic, enabling comprehensive monitoring and detection of any unauthorized or malicious activity.
Reference: The placement of IDS is crucial for effective monitoring and detection, as discussed in EC-Council’s Certified Network Defender courseware12. It is also aligned with the NIST Cybersecurity Framework, which emphasizes the importance of identifying, protecting, detecting, responding, and recovering from security incidents2.
Question #132
A network is setup using an IP address range of 0.0.0.0 to 127.255.255.255. The network has a default subnet mask of 255.0.0.0.
What IP address class is the network range a part of?
- A . Class C
- B . Class A
- C . Class B
- D . Class D
Correct Answer: B
B
Explanation:
The IP address range from 0.0.0.0 to 127.255.255.255 falls under Class A. In the Class A type of network, the first octet (the first 8 bits of the IP address) is used for the network part, and the remaining 24 bits are used for host addresses. The default subnet mask for Class A is 255.0.0.0, which aligns with the given network’s default subnet mask. Class A networks are designed to support a very large number of hosts. The first bit of a Class A address is always set to 0, which means the first octet can range from 1 to 127, thus including the given IP address range.
Reference: This explanation is based on standard networking principles regarding IP address classes as outlined in resources like the Meridian Outpost article on IPv4 address classes1, and is consistent with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
B
Explanation:
The IP address range from 0.0.0.0 to 127.255.255.255 falls under Class A. In the Class A type of network, the first octet (the first 8 bits of the IP address) is used for the network part, and the remaining 24 bits are used for host addresses. The default subnet mask for Class A is 255.0.0.0, which aligns with the given network’s default subnet mask. Class A networks are designed to support a very large number of hosts. The first bit of a Class A address is always set to 0, which means the first octet can range from 1 to 127, thus including the given IP address range.
Reference: This explanation is based on standard networking principles regarding IP address classes as outlined in resources like the Meridian Outpost article on IPv4 address classes1, and is consistent with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
Question #133
Which of the following can be used to disallow a system/user from accessing all applications except a specific folder on a system?
- A . Hash rule
- B . Path rule
- C . Internet zone rule
- D . Certificate rule
Correct Answer: B
B
Explanation:
The Path rule is used to specify a path to a folder or application and control access based on that path. By setting a Path rule, an administrator can disallow a system or user from accessing all applications except for those located in a specified folder. This is particularly useful for creating a secure environment where users can only run applications from a trusted location, thereby preventing the execution of unauthorized or potentially harmful programs.
Reference: This explanation is consistent with the principles of application whitelisting and access control in network security, as outlined in the Certified Network Defender (CND) course materials and objectives, which emphasize the importance of controlling access to system resources to protect against threats.
B
Explanation:
The Path rule is used to specify a path to a folder or application and control access based on that path. By setting a Path rule, an administrator can disallow a system or user from accessing all applications except for those located in a specified folder. This is particularly useful for creating a secure environment where users can only run applications from a trusted location, thereby preventing the execution of unauthorized or potentially harmful programs.
Reference: This explanation is consistent with the principles of application whitelisting and access control in network security, as outlined in the Certified Network Defender (CND) course materials and objectives, which emphasize the importance of controlling access to system resources to protect against threats.
Question #134
On which layer of the OSI model does the packet filtering firewalls work?
- A . Network Layer
- B . Application Layer
- C . Session Layer
- D . Physical Layer
Correct Answer: A
A
Explanation:
Packet filtering firewalls operate at the Network Layer of the OSI model. This layer is responsible for the transmission of data packets across network boundaries, which is a fundamental function of packet filtering firewalls. They analyze incoming and outgoing packets and make decisions based on set rules, such as IP addresses, protocols, and ports, to allow or block traffic. This is crucial for protecting the network from unauthorized access and potential threats.
Reference: The information aligns with standard networking principles and the functionalities of packet filtering firewalls as they are commonly understood in the field of network security123.
A
Explanation:
Packet filtering firewalls operate at the Network Layer of the OSI model. This layer is responsible for the transmission of data packets across network boundaries, which is a fundamental function of packet filtering firewalls. They analyze incoming and outgoing packets and make decisions based on set rules, such as IP addresses, protocols, and ports, to allow or block traffic. This is crucial for protecting the network from unauthorized access and potential threats.
Reference: The information aligns with standard networking principles and the functionalities of packet filtering firewalls as they are commonly understood in the field of network security123.
Question #135
An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors 24 hours.
What is the best option to do this job?
- A . Install a CCTV with cameras pointing to the entrance doors and the street
- B . Use fences in the entrance doors
- C . Use lights in all the entrance doors and along the company’s perimeter
- D . Use an IDS in the entrance doors and install some of them near the corners
Correct Answer: A
A
Explanation:
The best option for 24-hour monitoring of the physical perimeter and entrance doors is to install a CCTV system. CCTV cameras serve as both a deterrent to unauthorized entry and a means of surveillance to monitor activities. They can be positioned to cover the entrance doors and the street, providing a broad view of the area that needs to be secured. This aligns with the principles of intrusion detection and prevention, which include deterrence through visible security measures like cameras, and detection through continuous monitoring.
Reference: The information aligns with the core principles of intrusion detection systems, which include deterrence and detection, as outlined in the resources related to Physical Intrusion Detection Systems (PIDS) and Certified Network Defender (CND) training materials12.
A
Explanation:
The best option for 24-hour monitoring of the physical perimeter and entrance doors is to install a CCTV system. CCTV cameras serve as both a deterrent to unauthorized entry and a means of surveillance to monitor activities. They can be positioned to cover the entrance doors and the street, providing a broad view of the area that needs to be secured. This aligns with the principles of intrusion detection and prevention, which include deterrence through visible security measures like cameras, and detection through continuous monitoring.
Reference: The information aligns with the core principles of intrusion detection systems, which include deterrence and detection, as outlined in the resources related to Physical Intrusion Detection Systems (PIDS) and Certified Network Defender (CND) training materials12.
Question #136
Which type of training can create awareness among employees regarding compliance issues?
- A . Social engineering awareness training
- B . Security policy training
- C . Physical security awareness training
- D . Training on data classification
Correct Answer: B
B
Explanation:
Security policy training is designed to create awareness among employees regarding compliance issues. This type of training typically includes information on the organization’s security policies, the importance of compliance, and the consequences of non-compliance. It helps ensure that employees understand their role in maintaining the security and integrity of the organization’s data and systems. Security policy training is essential for enforcing the organization’s security strategy and ensuring that employees are aware of the policies they need to follow.
Reference: The information aligns with the Certified Network Defender (CND) program’s focus on creating a secure mindset among IT and systems administrators, which includes understanding and adhering to security policies and procedures as part of a defense-in-depth security strategy1. Additionally, the CND program emphasizes the importance of policies, procedures, and awareness in protecting network security1.
B
Explanation:
Security policy training is designed to create awareness among employees regarding compliance issues. This type of training typically includes information on the organization’s security policies, the importance of compliance, and the consequences of non-compliance. It helps ensure that employees understand their role in maintaining the security and integrity of the organization’s data and systems. Security policy training is essential for enforcing the organization’s security strategy and ensuring that employees are aware of the policies they need to follow.
Reference: The information aligns with the Certified Network Defender (CND) program’s focus on creating a secure mindset among IT and systems administrators, which includes understanding and adhering to security policies and procedures as part of a defense-in-depth security strategy1. Additionally, the CND program emphasizes the importance of policies, procedures, and awareness in protecting network security1.
Question #137
Which of the following provides a set of voluntary recommended cyber security features to include in network-capable loT devices?
- A . GCMA
- B . FCMA
- C . NIST
- D . GLBA
Correct Answer: C
C
Explanation:
The National Institute of Standards and Technology (NIST) has released a guide that identifies a set of voluntary recommended cybersecurity features to include in network-capable IoT devices. This guide, known as the “Core Baseline,” is intended to assist manufacturers and users by providing practical advice for securing IoT devices that connect to computer networks. The recommendations are designed to mitigate risks to IoT security and are not mandatory rules but rather best practices to follow.
Reference: The information is based on the NIST’s publication titled “NIST Releases Draft Security Feature Recommendations for IoT Devices” which outlines the voluntary cybersecurity features for IoT devices1. Additionally, the NIST Cybersecurity for IoT Program provides further guidance on the subject2.
C
Explanation:
The National Institute of Standards and Technology (NIST) has released a guide that identifies a set of voluntary recommended cybersecurity features to include in network-capable IoT devices. This guide, known as the “Core Baseline,” is intended to assist manufacturers and users by providing practical advice for securing IoT devices that connect to computer networks. The recommendations are designed to mitigate risks to IoT security and are not mandatory rules but rather best practices to follow.
Reference: The information is based on the NIST’s publication titled “NIST Releases Draft Security Feature Recommendations for IoT Devices” which outlines the voluntary cybersecurity features for IoT devices1. Additionally, the NIST Cybersecurity for IoT Program provides further guidance on the subject2.
Question #138
Stephanie is currently setting up email security so all company data is secured when passed through email. Stephanie first sets up encryption to make sure that a specific user’s email is protected. Next, she needs to ensure that the incoming and the outgoing mail has not been modified or altered using digital signatures.
What is Stephanie working on?
- A . Confidentiality
- B . Availability
- C . Data Integrity
- D . Usability
Correct Answer: C
C
Explanation:
Stephanie is working on ensuring data integrity for her company’s email communications. Data integrity refers to the assurance that data has not been altered or tampered with during transit. By setting up encryption, Stephanie is ensuring confidentiality, which protects the contents of the email from being read by unauthorized parties. However, to ensure that the emails have not been modified, she is implementing digital signatures. Digital signatures provide a means to verify the authenticity of the sender and to ensure that the message has not been changed, which directly relates to the concept of data integrity in cybersecurity.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of protecting data integrity through measures like digital signatures as part of a defense-in-depth security strategy1.
C
Explanation:
Stephanie is working on ensuring data integrity for her company’s email communications. Data integrity refers to the assurance that data has not been altered or tampered with during transit. By setting up encryption, Stephanie is ensuring confidentiality, which protects the contents of the email from being read by unauthorized parties. However, to ensure that the emails have not been modified, she is implementing digital signatures. Digital signatures provide a means to verify the authenticity of the sender and to ensure that the message has not been changed, which directly relates to the concept of data integrity in cybersecurity.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of protecting data integrity through measures like digital signatures as part of a defense-in-depth security strategy1.
Question #139
Martin is a professional hacker. He is performing reconnaissance on an organization to hack a few target systems. As a part of this method, he needs to determine what hosts are available on the network, what services those hosts are offering, what operating systems they are running, what type of packet filters/firewalls, etc. To obtain such information, Martin decided to use automated tools.
Which of the following tool must be employed by Martin?
- A . Burp Suite
- B . FOCA
- C . Nmap
- D . Zendio
Correct Answer: C
C
Explanation:
Nmap (Network Mapper) is a security scanner used to discover hosts and services on a computer network, thus building a “map” of the network. It is designed to scan large networks rapidly, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It is highly flexible, allowing for a wide range of advanced techniques, such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Therefore, for the reconnaissance purposes described in the question, Nmap is the appropriate tool for Martin to employ.
Reference: The information about Nmap and its capabilities aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) course, which includes understanding and utilizing various network security tools and techniques for defense, including reconnaissance and scanning tools like Nmap12.
C
Explanation:
Nmap (Network Mapper) is a security scanner used to discover hosts and services on a computer network, thus building a “map” of the network. It is designed to scan large networks rapidly, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It is highly flexible, allowing for a wide range of advanced techniques, such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Therefore, for the reconnaissance purposes described in the question, Nmap is the appropriate tool for Martin to employ.
Reference: The information about Nmap and its capabilities aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) course, which includes understanding and utilizing various network security tools and techniques for defense, including reconnaissance and scanning tools like Nmap12.
Question #140
Implementing access control mechanisms, such as a firewall, to protect the network is an example of which of the following network defense approach?
- A . Proactive approach
- B . Retrospective approach
- C . Preventive approach
- D . Reactive approach
Correct Answer: C
C
Explanation:
Implementing access control mechanisms like a firewall is a preventive measure in network defense. The preventive approach focuses on establishing barriers and safeguards to stop security incidents before they occur. Firewalls are a core component of this strategy, as they control incoming and outgoing network traffic based on predetermined security rules, thereby preventing unauthorized access to or from a network.
Reference: The Certified Network Defender (CND) program emphasizes a multi-layered defense strategy, which includes the Protect, Detect, Respond, and Predict framework. Within this framework, the Protect phase aligns with the preventive approach, as it involves the implementation of security measures that aim to prevent threats from compromising the network1. This is further supported by the NIST Cybersecurity Framework, which outlines Identify, Protect, Detect, Respond, and Recover as the five core functions for a comprehensive cybersecurity approach2.
C
Explanation:
Implementing access control mechanisms like a firewall is a preventive measure in network defense. The preventive approach focuses on establishing barriers and safeguards to stop security incidents before they occur. Firewalls are a core component of this strategy, as they control incoming and outgoing network traffic based on predetermined security rules, thereby preventing unauthorized access to or from a network.
Reference: The Certified Network Defender (CND) program emphasizes a multi-layered defense strategy, which includes the Protect, Detect, Respond, and Predict framework. Within this framework, the Protect phase aligns with the preventive approach, as it involves the implementation of security measures that aim to prevent threats from compromising the network1. This is further supported by the NIST Cybersecurity Framework, which outlines Identify, Protect, Detect, Respond, and Recover as the five core functions for a comprehensive cybersecurity approach2.