EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #151
Richard has been working as a Linux system administrator at an MNC. He wants to maintain a productive and secure environment by improving the performance of the systems through Linux patch management. Richard is using Ubuntu and wants to patch the Linux systems manually.
Which among the following command installs updates (new ones) for Debun based Linux OSes?
- A . sudo apt-get dist-upgrade
- B . sudo apt-get update
- C . sudo apt-get dist-update
- D . sudo apt-get upgrate
Correct Answer: A
A
Explanation:
The command sudo apt-get dist-upgrade is used to install updates for Debian-based Linux operating systems, which includes Ubuntu. This command intelligently handles changes with new versions of packages and will install the newest versions of all packages currently installed on the system. It also handles changing dependencies with new versions of packages and will attempt to upgrade the most important packages at the expense of less important ones if necessary. The dist-upgrade command, therefore, will install or remove packages as necessary to complete the full update.
Reference: This information is consistent with the best practices for maintaining a Debian-based system, as outlined in the Debian and Ubuntu documentation. The apt-get command is a powerful package management tool used in Debian-based systems for handling packages, and dist-upgrade is a specific option within apt-get that is designed for an intelligent system-wide upgrade12.
A
Explanation:
The command sudo apt-get dist-upgrade is used to install updates for Debian-based Linux operating systems, which includes Ubuntu. This command intelligently handles changes with new versions of packages and will install the newest versions of all packages currently installed on the system. It also handles changing dependencies with new versions of packages and will attempt to upgrade the most important packages at the expense of less important ones if necessary. The dist-upgrade command, therefore, will install or remove packages as necessary to complete the full update.
Reference: This information is consistent with the best practices for maintaining a Debian-based system, as outlined in the Debian and Ubuntu documentation. The apt-get command is a powerful package management tool used in Debian-based systems for handling packages, and dist-upgrade is a specific option within apt-get that is designed for an intelligent system-wide upgrade12.
Question #152
Damian is the chief security officer of Enigma Electronics. To block intruders and prevent any environmental accidents, he needs to set a two-factor authenticated keypad lock at the entrance, rig a fire suppression system, and link any video cameras at various corridors to view the feeds in the surveillance room.
What layer of network defense-in-depth strategy is he trying to follow?
- A . Physical
- B . Perimeter
- C . Policies and procedures
- D . Host
Correct Answer: A
A
Explanation:
The measures Damian is implementing are part of the Physical layer of network defense-in-depth strategy. This layer involves securing the physical infrastructure of the organization, which includes controlling physical access to the building through mechanisms like two-factor authenticated locks and monitoring the environment with video surveillance. Additionally, implementing fire suppression systems is a part of safeguarding the physical premises against environmental hazards. These measures are essential to prevent unauthorized physical access and to protect against physical threats that could harm the network’s infrastructure.
Reference: The Certified Network
Defender (CND) program by EC-Council covers a defense-in-depth security strategy that includes the
Physical layer as one of its core components12.
A
Explanation:
The measures Damian is implementing are part of the Physical layer of network defense-in-depth strategy. This layer involves securing the physical infrastructure of the organization, which includes controlling physical access to the building through mechanisms like two-factor authenticated locks and monitoring the environment with video surveillance. Additionally, implementing fire suppression systems is a part of safeguarding the physical premises against environmental hazards. These measures are essential to prevent unauthorized physical access and to protect against physical threats that could harm the network’s infrastructure.
Reference: The Certified Network
Defender (CND) program by EC-Council covers a defense-in-depth security strategy that includes the
Physical layer as one of its core components12.
Question #153
Identify the virtualization level that creates a massive pool of storage areas for different virtual machines running on the hardware.
- A . Fabric virtualization
- B . Storage device virtualization
- C . Server virtualization
- D . File system virtualization
Correct Answer: B
B
Explanation:
Storage device virtualization is the correct answer because it involves abstracting physical storage resources into a pool of storage that can be managed centrally and allocated to different virtual machines. This level of virtualization allows for the creation of a massive pool of storage areas that are not tied to a single physical device, providing flexibility and scalability in managing storage resources for various virtual machines running on the hardware.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which covers various aspects of network security, including virtualization and storage strategies as part of a comprehensive defense approach12.
B
Explanation:
Storage device virtualization is the correct answer because it involves abstracting physical storage resources into a pool of storage that can be managed centrally and allocated to different virtual machines. This level of virtualization allows for the creation of a massive pool of storage areas that are not tied to a single physical device, providing flexibility and scalability in managing storage resources for various virtual machines running on the hardware.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which covers various aspects of network security, including virtualization and storage strategies as part of a comprehensive defense approach12.
Question #154
As a network administrator, you have implemented WPA2 encryption in your corporate wireless network. The WPA2’s_________integrity check mechanism provides security against a replay attack
- A . CBC-32
- B . CRC-MAC
- C . CRC-32
- D . CBC-MAC
Correct Answer: D
D
Explanation:
WPA2 uses the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), which employs the Advanced Encryption Standard (AES) block cipher for data encryption. The integrity check mechanism within WPA2 that provides security against replay attacks is the Cipher Block Chaining Message Authentication Code (CBC-MAC). CBC-MAC is used to authenticate packets and ensure their integrity, preventing the data from being altered, spoofed, or resent by attackers.
Reference: The information is consistent with the security protocols defined in the IEEE 802.11i standard for WPA2, which includes the use of CBC-MAC for packet authentication and integrity
checks as part of the CCMP1234.
D
Explanation:
WPA2 uses the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), which employs the Advanced Encryption Standard (AES) block cipher for data encryption. The integrity check mechanism within WPA2 that provides security against replay attacks is the Cipher Block Chaining Message Authentication Code (CBC-MAC). CBC-MAC is used to authenticate packets and ensure their integrity, preventing the data from being altered, spoofed, or resent by attackers.
Reference: The information is consistent with the security protocols defined in the IEEE 802.11i standard for WPA2, which includes the use of CBC-MAC for packet authentication and integrity
checks as part of the CCMP1234.
Question #155
Which of the following NIST incident category includes any activity that seeks to access or identify a federal agency computer, open ports, protocols, service or any combination for later exploit?
- A . Scans/Probes/Attempted Access
- B . Malicious code
- C . Improper usage
- D . Denial-of-Service
Correct Answer: A
A
Explanation:
According to NIST guidelines, the incident category that includes activities seeking to access or identify a federal agency computer, open ports, protocols, services, or any combination thereof for later exploitation is categorized as ‘Scans/Probes/Attempted Access’. This category encompasses any unauthorized attempts to access systems, networks, or data, which may include scanning for vulnerabilities or probing to discover open ports and services.
Reference: The NIST Special Publication 800-61 Revision 2, titled “Computer Security Incident Handling Guide,” outlines the various categories of incidents and recommends best practices for incident response. It details how to handle incidents such as scans, probes, and attempted access, which are precursors to more serious attacks12.
A
Explanation:
According to NIST guidelines, the incident category that includes activities seeking to access or identify a federal agency computer, open ports, protocols, services, or any combination thereof for later exploitation is categorized as ‘Scans/Probes/Attempted Access’. This category encompasses any unauthorized attempts to access systems, networks, or data, which may include scanning for vulnerabilities or probing to discover open ports and services.
Reference: The NIST Special Publication 800-61 Revision 2, titled “Computer Security Incident Handling Guide,” outlines the various categories of incidents and recommends best practices for incident response. It details how to handle incidents such as scans, probes, and attempted access, which are precursors to more serious attacks12.
Question #156
Daniel is giving training on designing and implementing a security policy in the organization. He is explaining the hierarchy of the security policy which demonstrates how policies are drafted, designed and implemented.
What is the correct hierarchy for a security policy implementation?
- A . Laws, Policies, Regulations, Procedures and Standards
- B . Regulations, Policies, Laws, Standards and Procedures
- C . Laws, Regulations, Policies, Standards and Procedures
- D . Procedures, Policies, Laws, Standards and Regulations
Correct Answer: C
C
Explanation:
The correct hierarchy for implementing a security policy starts with the Laws, which are the highest level of legal requirements that an organization must follow. Next are the Regulations, which are specific rules that are derived from laws and apply to certain sectors or types of data. Following regulations, we have Policies, which are high-level statements of management intent and direction for security within the organization. Standards come next; they are specific mandatory controls, rules, and configurations that implement the policies. Finally, Procedures are detailed step-by-step instructions that ensure consistent and repeatable compliance with the standards.
Reference: This hierarchy is supported by various sources, including industry best practices and guidelines on information security policy implementation. The hierarchy aligns with the principles outlined in resources such as the LinkedIn article on Information Security Policy Hierarchy1 and the Gartner community post which states "Policy sets goals, Standards define rules. Controls implement standards, procedures detail steps. Secure baseline config ensures compliance."2.
C
Explanation:
The correct hierarchy for implementing a security policy starts with the Laws, which are the highest level of legal requirements that an organization must follow. Next are the Regulations, which are specific rules that are derived from laws and apply to certain sectors or types of data. Following regulations, we have Policies, which are high-level statements of management intent and direction for security within the organization. Standards come next; they are specific mandatory controls, rules, and configurations that implement the policies. Finally, Procedures are detailed step-by-step instructions that ensure consistent and repeatable compliance with the standards.
Reference: This hierarchy is supported by various sources, including industry best practices and guidelines on information security policy implementation. The hierarchy aligns with the principles outlined in resources such as the LinkedIn article on Information Security Policy Hierarchy1 and the Gartner community post which states "Policy sets goals, Standards define rules. Controls implement standards, procedures detail steps. Secure baseline config ensures compliance."2.
Question #157
Docker provides Platforms-a-Service (PaaS) through __________ and deliver*; containerized software packages
- A . Storage-level virtualization
- B . Network level virtualization
- C . OS level visualization
- D . Server-level visualization
Correct Answer: C
C
Explanation:
Docker provides Platform-as-a-Service (PaaS) through OS-level virtualization. This form of virtualization allows for the deployment of software in packages called containers. Containers are isolated from each other and bundle their own software, libraries, and configuration files; they can communicate with each other through well-defined channels. OS-level virtualization is lightweight compared to other forms of virtualization because it does not require a hypervisor to create virtual machines. Instead, the Docker Engine enables the containers to run directly within the host machine’s operating system but with separate namespaces, which is why it’s considered OS-level.
Reference: The information provided is consistent with the Certified Network Defender (CND) course’s objectives regarding understanding different types of virtualization and their purposes in network security. Docker’s use of OS-level virtualization is a fundamental concept covered in the study materials12.
C
Explanation:
Docker provides Platform-as-a-Service (PaaS) through OS-level virtualization. This form of virtualization allows for the deployment of software in packages called containers. Containers are isolated from each other and bundle their own software, libraries, and configuration files; they can communicate with each other through well-defined channels. OS-level virtualization is lightweight compared to other forms of virtualization because it does not require a hypervisor to create virtual machines. Instead, the Docker Engine enables the containers to run directly within the host machine’s operating system but with separate namespaces, which is why it’s considered OS-level.
Reference: The information provided is consistent with the Certified Network Defender (CND) course’s objectives regarding understanding different types of virtualization and their purposes in network security. Docker’s use of OS-level virtualization is a fundamental concept covered in the study materials12.
Question #158
Mark is monitoring the network traffic on his organization’s network. He wants to detect TCP and UDP ping sweeps on his network.
Which type of filter will be used to detect this?
- A . tcp.dstport==7 and udp.srcport==7
- B . tcp.dstport==7 and udp.dstport==7
- C . tcp.dstport==7 and udp.dstport==7
- D . tcp.dstport==7 and udp.srcport==7
Correct Answer: D
D
Explanation:
To detect TCP and UDP ping sweeps, the filter used would be one that checks for packets with a source port of 7, which is commonly associated with the “echo” service used in ping operations. This filter is applied to both TCP and UDP traffic to identify any ping sweeps occurring on those protocols.
Reference: The answer is based on standard network monitoring practices for detecting ping sweeps, which involve looking for traffic on the echo service port, typically port 71.
D
Explanation:
To detect TCP and UDP ping sweeps, the filter used would be one that checks for packets with a source port of 7, which is commonly associated with the “echo” service used in ping operations. This filter is applied to both TCP and UDP traffic to identify any ping sweeps occurring on those protocols.
Reference: The answer is based on standard network monitoring practices for detecting ping sweeps, which involve looking for traffic on the echo service port, typically port 71.
Question #159
Steven’s company has recently grown from 5 employees to over 50. Every workstation has a public IP address and navigated to the Internet with little to no protection. Steven wants to use a firewall. He also wants IP addresses to be private addresses, to prevent public Internet devices direct access to them.
What should Steven implement on the firewall to ensure this happens?
- A . Steven should use a Demilitarized Zone (DMZ)
- B . Steven should use Open Shortest Path First (OSPF)
- C . Steven should use IPsec
- D . Steven should enabled Network Address Translation (NAT)
Correct Answer: D
D
Explanation:
Steven should implement Network Address Translation (NAT) on the firewall to ensure that the IP
addresses of the workstations are private and not directly accessible from the public Internet. NAT translates the private IP addresses of the workstations to a public IP address before they are sent out to the Internet, and vice versa for incoming traffic. This not only hides the internal IP addresses but also allows multiple devices to share a single public IP address, which is essential as the company grows.
Reference: The concept of NAT and its role in protecting internal network resources while allowing Internet access is a fundamental topic covered in the Certified Network Defender (CND) course. It is also a standard practice in network security, aligning with the objectives of ensuring the confidentiality and integrity of network infrastructure.
D
Explanation:
Steven should implement Network Address Translation (NAT) on the firewall to ensure that the IP
addresses of the workstations are private and not directly accessible from the public Internet. NAT translates the private IP addresses of the workstations to a public IP address before they are sent out to the Internet, and vice versa for incoming traffic. This not only hides the internal IP addresses but also allows multiple devices to share a single public IP address, which is essential as the company grows.
Reference: The concept of NAT and its role in protecting internal network resources while allowing Internet access is a fundamental topic covered in the Certified Network Defender (CND) course. It is also a standard practice in network security, aligning with the objectives of ensuring the confidentiality and integrity of network infrastructure.
Question #160
What is Azure Key Vault?
- A . It is secure storage for the keys used to encrypt data at rest in Azure services
- B . It is secure storage for the keys used to encrypt data in motion in Azure services
- C . It is secure storage for the keys used to encrypt data in use in Azure services
- D . It is secure storage for the keys used to configure IAM in Azure services
Correct Answer: A
A
Explanation:
Azure Key Vault is a cloud service provided by Microsoft Azure that allows users to securely store and manage sensitive information such as encryption keys, secrets, and certificates. It is designed to safeguard cryptographic keys and other secrets used by cloud applications and services. Azure Key Vault helps ensure that data at rest is protected by providing secure storage for encryption keys, which can be used to encrypt data stored in Azure services. It also supports key management tasks such as creating, importing, rotating, and controlling access to keys, making it an essential tool for managing data security in the cloud.
Reference: The use and management of Azure Key Vault are integral to the Certified Network Defender (CND) curriculum, which aligns with EC-Council’s objectives for network security and defense. The CND materials provide guidance on implementing and managing key vaults as part of a comprehensive security strategy1.
A
Explanation:
Azure Key Vault is a cloud service provided by Microsoft Azure that allows users to securely store and manage sensitive information such as encryption keys, secrets, and certificates. It is designed to safeguard cryptographic keys and other secrets used by cloud applications and services. Azure Key Vault helps ensure that data at rest is protected by providing secure storage for encryption keys, which can be used to encrypt data stored in Azure services. It also supports key management tasks such as creating, importing, rotating, and controlling access to keys, making it an essential tool for managing data security in the cloud.
Reference: The use and management of Azure Key Vault are integral to the Certified Network Defender (CND) curriculum, which aligns with EC-Council’s objectives for network security and defense. The CND materials provide guidance on implementing and managing key vaults as part of a comprehensive security strategy1.