EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #161
John, who works as a team lead in Zen Technologies, found that his team members were accessing social networking sites, shopping sites and watching movies during office hours. He approached the network admin to block such websites.
What kind of network security device can be used to implement John’s decision?
- A . Firewall
- B . Internet Content Filter
- C . Proxy server
- D . Network Protocol Analyzer
Correct Answer: B
B
Explanation:
An Internet Content Filter is the most appropriate network security device for John’s situation. It is designed to block access to specific categories of websites, such as social networking and video streaming sites, which are not related to work. This aligns with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and implementing various network security controls and devices to protect the network from unauthorized access and misuse1.
Reference: EC-Council’s Certified Network Defender (CND) official courseware and study guide1.
Information on web content filtering from Microsoft Learn, which explains how web content filtering works in a way that is consistent with the CND’s objectives for network protection2.
B
Explanation:
An Internet Content Filter is the most appropriate network security device for John’s situation. It is designed to block access to specific categories of websites, such as social networking and video streaming sites, which are not related to work. This aligns with the objectives of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and implementing various network security controls and devices to protect the network from unauthorized access and misuse1.
Reference: EC-Council’s Certified Network Defender (CND) official courseware and study guide1.
Information on web content filtering from Microsoft Learn, which explains how web content filtering works in a way that is consistent with the CND’s objectives for network protection2.
Question #162
Which subdirectory in /var/log directory stores information related to Apache web server?
- A . /var/log/maillog/
- B . /var/log/httpd/
- C . /var/log/apachelog/
- D . /var/log/lighttpd/
Correct Answer: B
B
Explanation:
The Apache web server typically stores its log files in the /var/log/httpd/ directory on Unix-based systems. This directory contains various log files, including access_log and error_log, which record all requests processed by the server and any errors encountered, respectively. The location of these logs can be configured in the Apache configuration files, but /var/log/httpd/ is the default directory used by many Linux distributions.
Reference: The information is consistent with the official Apache documentation and common Unix/Linux filesystem practices as described in the Apache HTTP Server documentation1, and corroborated by multiple sources including Stack Overflow discussions2 and other educational resources345.
B
Explanation:
The Apache web server typically stores its log files in the /var/log/httpd/ directory on Unix-based systems. This directory contains various log files, including access_log and error_log, which record all requests processed by the server and any errors encountered, respectively. The location of these logs can be configured in the Apache configuration files, but /var/log/httpd/ is the default directory used by many Linux distributions.
Reference: The information is consistent with the official Apache documentation and common Unix/Linux filesystem practices as described in the Apache HTTP Server documentation1, and corroborated by multiple sources including Stack Overflow discussions2 and other educational resources345.
Question #163
Which of following are benefits of using loT devices in loT-enabled environments? I. loT device car be connected anytime M. loT device can be connected at any place ill. loT devices connected to anything
- A . I, II and III
- B . I
- C . II
- D . I and II
Correct Answer: A
A
Explanation:
The benefits of using IoT devices in IoT-enabled environments encompass the ability to connect devices anytime, anywhere, and to anything. This means that IoT devices can be connected and communicate with each other and the internet 24/7 (I), from any location (II), and can be integrated with various systems and applications (III). These capabilities enable a wide range of functionalities, such as remote monitoring, data collection, and control of devices across different environments, leading to improved efficiency, convenience, and decision-making.
Reference: The benefits mentioned are consistent with the advancements and applications of IoT as outlined in various sources, including environmental monitoring, predictive maintenance, and smart environment systems123456.
A
Explanation:
The benefits of using IoT devices in IoT-enabled environments encompass the ability to connect devices anytime, anywhere, and to anything. This means that IoT devices can be connected and communicate with each other and the internet 24/7 (I), from any location (II), and can be integrated with various systems and applications (III). These capabilities enable a wide range of functionalities, such as remote monitoring, data collection, and control of devices across different environments, leading to improved efficiency, convenience, and decision-making.
Reference: The benefits mentioned are consistent with the advancements and applications of IoT as outlined in various sources, including environmental monitoring, predictive maintenance, and smart environment systems123456.
Question #164
Which of the following acts as a verifier for the certificate authority?
- A . Certificate Management system
- B . Certificate authority
- C . Directory management system
- D . Registration authority
Correct Answer: D
D
Explanation:
The Registration Authority (RA) acts as the verifier for the Certificate Authority (CA). The RA is responsible for accepting requests for digital certificates and authenticating the entity making the request before passing the request to the CA for issuance. In essence, the RA serves as a trusted intermediary between the user and the CA, ensuring that the CA can rely on the information provided by the RA when issuing a certificate.
Reference: The role of the RA in the certificate issuance process is a fundamental concept in network security and is covered in the Certified Network Defender (CND) curriculum. For more detailed information, you can refer to the official EC-Council CND study guides and documents.
D
Explanation:
The Registration Authority (RA) acts as the verifier for the Certificate Authority (CA). The RA is responsible for accepting requests for digital certificates and authenticating the entity making the request before passing the request to the CA for issuance. In essence, the RA serves as a trusted intermediary between the user and the CA, ensuring that the CA can rely on the information provided by the RA when issuing a certificate.
Reference: The role of the RA in the certificate issuance process is a fundamental concept in network security and is covered in the Certified Network Defender (CND) curriculum. For more detailed information, you can refer to the official EC-Council CND study guides and documents.
Question #165
Which of the following connects the SDN application layer and SDN controller and allows communication between the network services and business applications?
- A . Eastbound API
- B . Westbound API
- C . Northbound API
- D . Southbound API
Correct Answer: C
C
Explanation:
In the context of Software-Defined Networking (SDN), the Northbound API is the interface that connects the SDN application layer to the SDN controller. It facilitates communication between the network services and business applications. The Northbound API allows applications to communicate their network requirements to the controller, which then translates these requirements into the network configurations necessary to provide the requested services.
Reference: This information is consistent with the SDN architecture overview provided by the Open Networking Foundation1 and further explained in resources like GeeksforGeeks2 and SDxCentral3, which describe the role of Northbound APIs in SDN environments. These APIs are crucial for enabling the application layer to interact with the control layer, allowing for a dynamic, programmable networking infrastructure.
C
Explanation:
In the context of Software-Defined Networking (SDN), the Northbound API is the interface that connects the SDN application layer to the SDN controller. It facilitates communication between the network services and business applications. The Northbound API allows applications to communicate their network requirements to the controller, which then translates these requirements into the network configurations necessary to provide the requested services.
Reference: This information is consistent with the SDN architecture overview provided by the Open Networking Foundation1 and further explained in resources like GeeksforGeeks2 and SDxCentral3, which describe the role of Northbound APIs in SDN environments. These APIs are crucial for enabling the application layer to interact with the control layer, allowing for a dynamic, programmable networking infrastructure.
Question #166
Which of the following Wireshark filters allows an administrator to detect SYN/FIN DDoS attempt on the network?
- A . tcp.flags==0x003
- B . tcp.flags==0X029
- C . TCP.flags==0x300
- D . tcp.dstport==7
Correct Answer: B
B
Explanation:
The correct Wireshark filter to detect a SYN/FIN DDoS attempt is tcp.flags==0X029. This filter is designed to capture packets where both the SYN and FIN flags are set, which is an unusual combination and indicative of a SYN/FIN attack. In a typical three-way TCP handshake, the SYN and FIN flags are not set in the same TCP segment. A SYN flag is used to initiate a connection, and a FIN flag is used to politely close a connection. Therefore, seeing both flags set in the same packet suggests a possible SYN/FIN DDoS attack.
Reference: The answer is based on the standard behavior of TCP flags in network communications and the detection of anomalous flag combinations that signify potential DDoS attacks. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the explanation aligns with the general knowledge of network security practices and the use of Wireshark for network analysis.
B
Explanation:
The correct Wireshark filter to detect a SYN/FIN DDoS attempt is tcp.flags==0X029. This filter is designed to capture packets where both the SYN and FIN flags are set, which is an unusual combination and indicative of a SYN/FIN attack. In a typical three-way TCP handshake, the SYN and FIN flags are not set in the same TCP segment. A SYN flag is used to initiate a connection, and a FIN flag is used to politely close a connection. Therefore, seeing both flags set in the same packet suggests a possible SYN/FIN DDoS attack.
Reference: The answer is based on the standard behavior of TCP flags in network communications and the detection of anomalous flag combinations that signify potential DDoS attacks. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the explanation aligns with the general knowledge of network security practices and the use of Wireshark for network analysis.
Question #167
You are tasked to perform black hat vulnerability assessment for a client. You received official written permission to work with: company site, forum, Linux server with LAMP, where this site is hosted.
Which vulnerability assessment tool should you consider using?
- A . OpenVAS
- B . hping
- C . wireshark
- D . dnsbrute
Correct Answer: A
A
Explanation:
OpenVAS stands out as the most suitable tool for conducting a vulnerability assessment on a Linux server with LAMP. It is a full-featured vulnerability scanner that’s actively maintained and updated, capable of detecting thousands of vulnerabilities in network services and software. For a black hat vulnerability assessment, which implies testing from the perspective of a potential attacker, OpenVAS can simulate attacks on the network services running on the LAMP stack and identify vulnerabilities that could be exploited.
Reference: The choice of OpenVAS is supported by its inclusion in various lists of top vulnerability assessment tools for Linux servers. It is specifically designed to perform comprehensive scans and is frequently updated to include the latest vulnerability checks12.
A
Explanation:
OpenVAS stands out as the most suitable tool for conducting a vulnerability assessment on a Linux server with LAMP. It is a full-featured vulnerability scanner that’s actively maintained and updated, capable of detecting thousands of vulnerabilities in network services and software. For a black hat vulnerability assessment, which implies testing from the perspective of a potential attacker, OpenVAS can simulate attacks on the network services running on the LAMP stack and identify vulnerabilities that could be exploited.
Reference: The choice of OpenVAS is supported by its inclusion in various lists of top vulnerability assessment tools for Linux servers. It is specifically designed to perform comprehensive scans and is frequently updated to include the latest vulnerability checks12.
Question #168
Identify the attack where an attacker manipulates or tricks people into revealing their confidential details like bank account information, credit card details, etc.?
- A . Social Engineering Attacks
- B . Port Scanning
- C . DNS Footprinting
- D . ICMP Scanning
Correct Answer: A
A
Explanation:
The attack described in the question is a Social Engineering Attack. This type of attack involves manipulating or deceiving people into divulging confidential information such as bank account details, credit card numbers, and other sensitive data. Social engineering attacks exploit human psychology rather than technical hacking techniques to gain access to systems, networks, or physical locations, or for financial gain. Attackers may use various tactics such as phishing, pretexting, baiting, or tailgating to trick individuals into providing the information they seek1.
Reference: Understanding and Preventing Social Engineering Attacks – EC-Council1.
Certified Network Defender (CND) Course Outline – EC-Council2.
Certified Network Defender – EC-Council3.
A
Explanation:
The attack described in the question is a Social Engineering Attack. This type of attack involves manipulating or deceiving people into divulging confidential information such as bank account details, credit card numbers, and other sensitive data. Social engineering attacks exploit human psychology rather than technical hacking techniques to gain access to systems, networks, or physical locations, or for financial gain. Attackers may use various tactics such as phishing, pretexting, baiting, or tailgating to trick individuals into providing the information they seek1.
Reference: Understanding and Preventing Social Engineering Attacks – EC-Council1.
Certified Network Defender (CND) Course Outline – EC-Council2.
Certified Network Defender – EC-Council3.
Question #169
Which of the following Wireshark filters can a network administrator use to view the packets without any flags set in order to detect TCP Null Scan attempts?
- A . TCP.flags==0x000
- B . tcp.flags==0X029
- C . tcp.flags==0x003
- D . tcp.dstport==7
Correct Answer: A
A
Explanation:
In Wireshark, a TCP Null Scan can be detected by setting a filter to show packets where no TCP flags are set. This is because a TCP Null Scan is characterized by sending TCP packets with no flags set in an attempt to identify open ports on the target system. The correct filter to use in Wireshark to detect such packets is TCP.flags==0x000, which will display only those packets where all flags are unset.
Reference: The information provided here is consistent with standard network security practices for detecting TCP Null Scans using Wireshark, as described in various educational resources on network security and penetration testing1.
A
Explanation:
In Wireshark, a TCP Null Scan can be detected by setting a filter to show packets where no TCP flags are set. This is because a TCP Null Scan is characterized by sending TCP packets with no flags set in an attempt to identify open ports on the target system. The correct filter to use in Wireshark to detect such packets is TCP.flags==0x000, which will display only those packets where all flags are unset.
Reference: The information provided here is consistent with standard network security practices for detecting TCP Null Scans using Wireshark, as described in various educational resources on network security and penetration testing1.
Question #170
During the recovery process, RTO and RPO should be the main parameters of your disaster recovery plan.
What does RPO refer to?
- A . The hot plugging technique used to replace computer components
- B . The interval after which the data quality is lost
- C . The encryption feature, acting as add-on security to the data
- D . The duration required to restore the data
Correct Answer: B
B
Explanation:
Recovery Point Objective (RPO) refers to the maximum tolerable period in which data might be lost from an IT service due to a major incident. It is a critical parameter in disaster recovery and business continuity planning. RPO is determined based on the acceptable data loss in case of a disruption of operations. It indicates the point in time to which data must be recovered after an outage to resume business operations and avoid unacceptable consequences associated with a break in business continuity.
Reference: EC-Council’s Certified Network Defender (CND) training materials.
Business Continuity and Disaster Recovery Planning definitions and best practices as outlined in the CND curriculum1.
B
Explanation:
Recovery Point Objective (RPO) refers to the maximum tolerable period in which data might be lost from an IT service due to a major incident. It is a critical parameter in disaster recovery and business continuity planning. RPO is determined based on the acceptable data loss in case of a disruption of operations. It indicates the point in time to which data must be recovered after an outage to resume business operations and avoid unacceptable consequences associated with a break in business continuity.
Reference: EC-Council’s Certified Network Defender (CND) training materials.
Business Continuity and Disaster Recovery Planning definitions and best practices as outlined in the CND curriculum1.