EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
If Myron, head of network defense at Cyberdyne, wants to change the default password policy settings on the company’s Linux systems, which directory should he access?
- A . /etc/logrotate.conf
- B . /etc/hosts.allow
- C . /etc/crontab
- D . /etc/login.defs
D
Explanation:
The /etc/login.defs file in Linux systems contains the configuration for user login settings, which includes the default password policy settings. This file is used to control several aspects of user management, including password requirements such as password aging, password length, and password complexity. When the head of network defense, like Myron, wants to change these settings, he would access and modify the /etc/login.defs file to implement the new password policies across the company’s Linux systems.
Reference: The explanation is based on standard Linux system documentation and best practices for user password policy management. The Red Hat Enterprise Linux documentation provides detailed information on defining password policies, which is applicable to other Linux distributions as well1. Additionally, resources like OSTechNix’s guide on setting password policies in Linux corroborate the use of /etc/login.defs for this purpose2.
Xenon is a leading real estate firm located in Australia. Recently, the company had decided a bid amount for a prestigious construction project and was sure of being awarded the project.
Unfortunately, the company lost the tender to one of its competitors. A few days later, while performing a network scan, the network admin identified that somebody had captured the confidential e-mails conversions related to the tender. Upon further investigation, the admin discovered that one of the switch ports was left open and an employee had plugged into the network using an Ethernet cable.
Which attack did the employee perform in the above situation?
- A . Network Sniffing
- B . Password Attack
- C . Social Engineering Attack
- D . Man-in-the-Middle Attack
A
Explanation:
In the scenario described, the employee performed a Network Sniffing attack. This type of attack involves capturing and analyzing packets traveling through a network. Since the admin discovered that confidential emails related to the tender were captured and that an open switch port was used to connect to the network, it indicates that the data was intercepted as it traveled across the network, which is characteristic of a sniffing attack. Network sniffing can be either passive or active; however, the scenario suggests a passive approach where the packets were monitored and captured without altering the network traffic.
Reference: The Certified Network Defender (CND) course by EC-Council includes topics on various network attacks, including sniffing. It teaches how sniffing can be used to capture sensitive information like email conversations if proper security controls, such as closing unused switch ports, are not in place1. Additionally, network scanning and monitoring tools that can detect such unauthorized connections and activities are also covered in the CND curriculum1.
Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.
What is the last step he should list?
- A . Containment
- B . Assign eradication
- C . A follow-up
- D . Recovery
C
Explanation:
The last step in the incident response methodology, according to the Network Defender (CND) guidelines, is a follow-up. This step is crucial as it involves reviewing and analyzing the incident to understand what happened, how it was handled, and how similar incidents can be prevented in the future. It includes updating incident response plans, improving security measures, and providing training to prevent future incidents.
Reference: The information aligns with the EC-Council’s Certified Network Defender (CND) program, which emphasizes an incident response life cycle that includes preparation, detection and analysis, containment, eradication and recovery, and post-event activity, where the follow-up is a critical component of post-event activity123.
John wants to implement a packet filtering firewall in his organization’s network.
What TCP/IP layer does a packet filtering firewall work on?
- A . Application layer
- B . Network Interface layer
- C . TCP layer
- D . IP layer
D
Explanation:
A packet filtering firewall operates at the network layer of the TCP/IP model. It analyzes the headers of IP packets, which include source and destination IP addresses, protocol information, and port numbers, to determine whether to allow or block the packets based on predefined rules and access control lists (ACLs). This type of firewall does not perform deep packet inspection but rather checks the packet headers against the ACLs to make decisions1234.
Reference: The explanation aligns with the core functions of packet filtering firewalls as described in various sources, including the Enterprise Networking Planet and NordLayer articles, which detail how these firewalls interact with the IP layer to filter traffic12. GeeksforGeeks also confirms that packet filtering firewalls work at the network layer of the OSI model, which corresponds to the IP layer in the TCP/IP model4.
Harry has sued the company claiming they made his personal information public on a social networking site in the United States. The company denies the allegations and consulted a/an _______ for legal advice to defend them against this allegation.
- A . Evidence Manager
- B . Incident Handler
- C . Attorney
- D . PR Specialist
C
Explanation:
In the context of legal allegations regarding the disclosure of personal information on a social networking site, a company would consult an attorney for legal advice. An attorney is a professional who is qualified to offer legal advice, represent clients in court, and defend them against legal claims. In this scenario, the attorney would help the company understand the legal implications of the allegations, advise on the best course of action, and provide representation if the case goes to court.
Reference: The role of an attorney in defending against allegations of public disclosure of personal information is well-documented in legal resources and aligns with the practices outlined in data litigation defense strategies1. Attorneys are equipped to handle such cases by advising on factual defenses, ensuring compliance with data protection laws, and representing the company in legal proceedings234.
Identify the Password Attack Technique in which the adversary attacks cryptographic hash functions based on the probability, that if a hashing process is used for creating a key, then the same is used for other keys?
- A . Dictionary Attack
- B . Brute Forcing Attack
- C . Hybrid Attack
- D . Birthday Attack
D
Explanation:
The Birthday Attack is a type of cryptographic attack that exploits the mathematics behind the birthday problem in probability theory. This attack is relevant to the question as it involves attacking cryptographic hash functions based on the probability of collisions. In the context of hash functions, a collision occurs when two different inputs produce the same hash output. The Birthday Attack leverages the fact that in a set of randomly chosen keys, it is probable that two keys will have the same hash value. This is analogous to the birthday paradox, where in a group of people, there’s a high probability that two individuals will share the same birthday. The attack does not rely on the strength or weakness of the hash function itself, but on the statistical likelihood of these collisions occurring, which is surprisingly high even for large sets of possible hash values.
Reference: The explanation is based on the principles of cryptographic hash functions and the birthday problem as described in standard cryptography literature and resources123.
What command is used to terminate certain processes in an Ubuntu system?
- A . #grep Kill [Target Process}
- B . #kill-9[PID]
- C . #ps ax Kill
- D . # netstat Kill [Target Process]
B
Explanation:
In Ubuntu, to terminate a specific process, you would use the kill command followed by the signal you want to send and the Process ID (PID) of the target process. The -9 signal is the SIGKILL signal, which forcefully terminates the process. The correct syntax is kill -9 [PID], where [PID] is replaced with the actual numerical ID of the process you wish to terminate.
Reference: This information is consistent with standard Linux documentation and practices as well as the Certified Network Defender (CND) course material, which covers system administration and security tasks including process management. The kill command is a fundamental tool for process management in Unix-like operating systems, which is covered in the CND curriculum.
Simon had all his systems administrators implement hardware and software firewalls to ensure network security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker group was able to get into the network and modify files hosted on the company’s website. After searching through the firewall and server logs, no one could find how the attackers were able to get in. He decides that the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts administrators when a critical file is altered.
What tool could Simon and his administrators implement to accomplish this?
- A . Snort is the best tool for their situation
- B . They can implement Wireshark
- C . They could use Tripwire
- D . They need to use Nessus
C
Explanation:
Simon’s situation requires a tool that can monitor and alert administrators of critical file changes across the network. Tripwire is a File Integrity Monitoring (FIM) tool that serves this exact purpose. It can detect changes to system and configuration files, directories, and registry keys, and it is especially useful for spotting unauthorized changes that could indicate a security breach. Tripwire can help ensure that important files have not been tampered with, which seems to be the concern for Simon’s network following the incident.
Reference: The Certified Network Defender (CND) course material and study guide from EC-Council include discussions on the importance of monitoring critical systems and protecting network integrity. Tripwire is often highlighted in industry resources as a robust FIM tool that aligns with the objectives of maintaining network security and integrity as outlined in the CND curriculum1.
Which Internet access policy starts with all services blocked and the administrator enables safe and necessary services individually, which provides maximum security and logs everything, such as system and network activities?
- A . Internet access policy
- B . Permissive policy
- C . Prudent policy
- D . Paranoid policy
D
Explanation:
The Paranoid policy is an Internet access policy that begins with the premise that all services are blocked by default. Under this policy, the administrator must explicitly enable each service that is deemed safe and necessary. This approach ensures maximum security as it minimizes the potential attack surface by not allowing any services unless they have been vetted and approved. Additionally, this policy typically involves extensive logging of all system and network activities, which can be crucial for monitoring, auditing, and forensic purposes.
Reference: The concept of a Paranoid policy aligns with the best practices for securing network environments, as it emphasizes a default-deny stance and careful control over network services. This information is consistent with the objectives of the Certified Network Defender (CND) program, which advocates for stringent access controls and detailed logging to protect information systems. For the most current and detailed information, please refer to the latest Certified Network Defender (CND) documents and study guides from the EC-Council1.
Sam, a network administrator is using Wireshark to monitor the network traffic of the organization. He wants to detect TCP packets with no flag set to check for a specific attack attempt.
Which filter will he use to view the traffic?
- A . Tcp.flags==0x000
- B . Tcp.flags==0000x
- C . Tcp.flags==000×0
- D . Tcp.flags==x0000
A
Explanation:
In Wireshark, the filter tcp.flags==0x000 is used to detect TCP packets with no flags set. TCP flags are used to indicate the state of a TCP connection or provide additional information to the receiving party. Common flags include SYN, ACK, RST, FIN, among others. A packet with no flags set (represented as 0x000) could be indicative of a network anomaly or a specific type of attack, such as a reconnaissance or scanning attack. It’s important for network administrators like Sam to monitor such packets as they could signify malicious activity on the network.
Reference: The explanation is based on standard TCP/IP protocol behavior and the usage of Wireshark filters, which is consistent with the Network Defender (CND) curriculum that covers network monitoring and analysis tools. The reference to the filter syntax comes from the Wireshark documentation and common networking practices.