EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #171
What is composite signature-based analysis?
- A . Multiple packet analysis is required to detect attack signatures
- B . Attack signatures are contained in packet headers
- C . Attack signatures are contained in packet payloads
- D . Single Packet analysis is enough to identify attack signatures
Correct Answer: A
A
Explanation:
Composite signature-based analysis refers to a method of intrusion detection where multiple packets are analyzed to detect an attack signature. Unlike single-packet analysis, which may only require one packet to identify an attack, composite signature-based analysis looks for patterns across several packets to determine whether an attack is underway. This method is particularly useful for detecting complex attacks that cannot be identified by a single packet’s header or payload alone.
Reference: The concept of composite signature-based analysis is part of the broader network defense strategy that includes protecting, detecting, responding, and predicting network security incidents. It aligns with the Certified Network Defender (CND) program’s focus on understanding network traffic signatures and analysis as part of designing network security policies and incident response plans123.
A
Explanation:
Composite signature-based analysis refers to a method of intrusion detection where multiple packets are analyzed to detect an attack signature. Unlike single-packet analysis, which may only require one packet to identify an attack, composite signature-based analysis looks for patterns across several packets to determine whether an attack is underway. This method is particularly useful for detecting complex attacks that cannot be identified by a single packet’s header or payload alone.
Reference: The concept of composite signature-based analysis is part of the broader network defense strategy that includes protecting, detecting, responding, and predicting network security incidents. It aligns with the Certified Network Defender (CND) program’s focus on understanding network traffic signatures and analysis as part of designing network security policies and incident response plans123.
Question #172
Who oversees all the incident response activities in an organization and is responsible for all actions of the IR team and IR function?
- A . IR officer
- B . Attorney
- C . IR custodians
- D . PR specialist
Correct Answer: A
A
Explanation:
In the context of the EC-Council’s Certified Network Defender (CND) program, the individual who oversees all incident response (IR) activities within an organization is typically referred to as the IR officer. This role is responsible for coordinating all actions of the IR team and ensuring that the IR function operates effectively. The IR officer’s responsibilities include overseeing the development and implementation of incident response plans, managing the response to security incidents, and ensuring that the organization’s IR policies and procedures are followed.
Reference: The responsibilities of the IR officer are outlined in the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of having a dedicated individual to manage and lead the incident response efforts within an organization12.
A
Explanation:
In the context of the EC-Council’s Certified Network Defender (CND) program, the individual who oversees all incident response (IR) activities within an organization is typically referred to as the IR officer. This role is responsible for coordinating all actions of the IR team and ensuring that the IR function operates effectively. The IR officer’s responsibilities include overseeing the development and implementation of incident response plans, managing the response to security incidents, and ensuring that the organization’s IR policies and procedures are followed.
Reference: The responsibilities of the IR officer are outlined in the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of having a dedicated individual to manage and lead the incident response efforts within an organization12.
Question #173
Steven is a Linux system administrator at an IT company. He wants to disable unnecessary services in the system, which can be exploited by the attackers.
Which among the following is the correct syntax for disabling a service?
- A . $ sudo system-ctl disable [service]
- B . $ sudo systemctl disable [service]
- C . $ sudo system.ctl disable [service]
- D . $ sudo system ctl disable [service]
Correct Answer: B
B
Explanation:
The correct syntax to disable a service in Linux using the systemctl command is sudo systemctl disable [service-name]. This command is used to prevent a service from starting automatically at boot. The systemctl command is part of the systemd system and service manager, which is used by many Linux distributions to bootstrap the user space and manage system processes after booting. This is the standard way to manage services on systems that use systemd.
Reference: The information is consistent with the usage of the systemctl command as described in various Linux documentation and resources, including the official ECCouncil Network Defender (CND) course materials. It is also corroborated by authoritative sources on Linux service management12.
B
Explanation:
The correct syntax to disable a service in Linux using the systemctl command is sudo systemctl disable [service-name]. This command is used to prevent a service from starting automatically at boot. The systemctl command is part of the systemd system and service manager, which is used by many Linux distributions to bootstrap the user space and manage system processes after booting. This is the standard way to manage services on systems that use systemd.
Reference: The information is consistent with the usage of the systemctl command as described in various Linux documentation and resources, including the official ECCouncil Network Defender (CND) course materials. It is also corroborated by authoritative sources on Linux service management12.
Question #174
Which protocol would the network administrator choose for the wireless network design.
If he needs to satisfy the minimum requirement of 2.4 GHz, 22 MHz of bandwidth, 2 Mbits/s stream for data rate and use DSSS for modulation.
- A . 802.11a
- B . 802.11g
- C . 802.11b
- D . 802.11n
Correct Answer: C
C
Explanation:
The 802.11b protocol is the correct choice for the network administrator to satisfy the specified requirements. This protocol operates in the 2.4 GHz frequency band, uses Direct-Sequence Spread Spectrum (DSSS) for modulation, and provides a data rate of up to 11 Mbits/s, which is well above the minimum requirement of 2 Mbits/s. The 802.11b standard also uses a channel width of 22 MHz, which matches the given specification. It was designed to be backward compatible with the original 802.11 standard and is widely used due to its range and compatibility with many devices.
Reference: IEEE 802.11b-1999 standard documentation.
Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications1.
C
Explanation:
The 802.11b protocol is the correct choice for the network administrator to satisfy the specified requirements. This protocol operates in the 2.4 GHz frequency band, uses Direct-Sequence Spread Spectrum (DSSS) for modulation, and provides a data rate of up to 11 Mbits/s, which is well above the minimum requirement of 2 Mbits/s. The 802.11b standard also uses a channel width of 22 MHz, which matches the given specification. It was designed to be backward compatible with the original 802.11 standard and is widely used due to its range and compatibility with many devices.
Reference: IEEE 802.11b-1999 standard documentation.
Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications1.
Question #175
Cindy is the network security administrator for her company. She just got back from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. She is worried about the current security state of her company’s network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established, she sends RST packets to those hosts to stop the session.
She has done this to see how her intrusion detection system will log the traffic.
What type of scan is Cindy attempting here?
- A . Cindy is using a half-open scan to find live hosts on her network.
- B . The type of scan she is using is called a NULL scan
- C . She is utilizing a RST scan to find live hosts that are listening on her network
- D . Cindy is attempting to find live hosts on her company’s network by using a XMAS scan
Correct Answer: A
A
Explanation:
The technique Cindy is using is known as a SYN scan, also referred to as a half-open scan. This method involves sending SYN packets to initiate a TCP connection. If a SYN/ACK response is received, it indicates that the port is listening (open). Cindy then sends an RST packet to close the session before the handshake is completed. This type of scan is useful for mapping out live hosts on a network without establishing a full TCP connection, which can be logged by intrusion detection systems and is less likely to be logged by the host system.
Reference: The Certified Network Defender (CND) course by EC-Council includes network scanning techniques as part of its curriculum, where the SYN scan is discussed as a method for assessing network security. For more detailed information, refer to the CND study guide and materials that cover network scanning methods and their implications on network security.
A
Explanation:
The technique Cindy is using is known as a SYN scan, also referred to as a half-open scan. This method involves sending SYN packets to initiate a TCP connection. If a SYN/ACK response is received, it indicates that the port is listening (open). Cindy then sends an RST packet to close the session before the handshake is completed. This type of scan is useful for mapping out live hosts on a network without establishing a full TCP connection, which can be logged by intrusion detection systems and is less likely to be logged by the host system.
Reference: The Certified Network Defender (CND) course by EC-Council includes network scanning techniques as part of its curriculum, where the SYN scan is discussed as a method for assessing network security. For more detailed information, refer to the CND study guide and materials that cover network scanning methods and their implications on network security.
Question #176
In ______ method, event logs are arranged in the form of a circular buffer.
- A . Non-wrapping method
- B . LIFO method
- C . Wrapping method
- D . FIFO method
Correct Answer: C
C
Explanation:
In the context of event log management, the wrapping method refers to a technique where event logs are arranged in the form of a circular buffer. This means that when the allocated space for the logs is filled, new events start to overwrite the oldest events. This method ensures that the most recent events are always available, but older events are eventually overwritten as new ones come in. It is particularly useful for systems that generate a large number of events and have limited storage capacity for logs.
Reference: The wrapping method is a standard approach in various logging systems and is often used in scenarios where maintaining the most recent logs is more critical than preserving all historical logs indefinitely12.
C
Explanation:
In the context of event log management, the wrapping method refers to a technique where event logs are arranged in the form of a circular buffer. This means that when the allocated space for the logs is filled, new events start to overwrite the oldest events. This method ensures that the most recent events are always available, but older events are eventually overwritten as new ones come in. It is particularly useful for systems that generate a large number of events and have limited storage capacity for logs.
Reference: The wrapping method is a standard approach in various logging systems and is often used in scenarios where maintaining the most recent logs is more critical than preserving all historical logs indefinitely12.
Question #177
Which firewall technology provides the best of both packet filtering and application-based filtering and is used in Cisco Adaptive Security Appliances?
- A . VPN
- B . Stateful multilayer inspection
- C . Application level gateway
- D . Network address translation
Correct Answer: B
B
Explanation:
Stateful multilayer inspection (SMLI) firewalls provide a robust security mechanism that combines the features of both packet filtering and application-based filtering. They are capable of inspecting the state of active connections and make decisions based on the context of the traffic. Cisco Adaptive Security Appliances (ASA) utilize this technology to offer an integrated approach to network security, which includes application-aware firewall capabilities, intrusion prevention, and content security services. This technology is particularly effective as it not only looks at the state and attributes of the packets but also examines the data within the packet, enabling it to provide more comprehensive protection against various types of network threats.
Reference: The information about the use of stateful multilayer inspection in Cisco ASA is supported by Cisco’s official documentation, which outlines the capabilities of the ASA series and its use of SMLI to deliver a powerful multifunction network security appliance family that provides security breadth, precision, and depth for protecting business networks of all sizes123.
B
Explanation:
Stateful multilayer inspection (SMLI) firewalls provide a robust security mechanism that combines the features of both packet filtering and application-based filtering. They are capable of inspecting the state of active connections and make decisions based on the context of the traffic. Cisco Adaptive Security Appliances (ASA) utilize this technology to offer an integrated approach to network security, which includes application-aware firewall capabilities, intrusion prevention, and content security services. This technology is particularly effective as it not only looks at the state and attributes of the packets but also examines the data within the packet, enabling it to provide more comprehensive protection against various types of network threats.
Reference: The information about the use of stateful multilayer inspection in Cisco ASA is supported by Cisco’s official documentation, which outlines the capabilities of the ASA series and its use of SMLI to deliver a powerful multifunction network security appliance family that provides security breadth, precision, and depth for protecting business networks of all sizes123.
Question #178
Which category of suspicious traffic signatures includes SYN flood attempts?
- A . Informational
- B . Denial of Service
- C . Reconnaissance
- D . Unauthorized access
Correct Answer: B
B
Explanation:
SYN flood attempts are a type of Denial of Service (DoS) attack. They are designed to exploit the TCP handshake process by sending a large number of SYN packets to a target server, which can overwhelm the server’s resources and prevent legitimate users from establishing a connection. The goal of a SYN flood is not to gain unauthorized access or gather information, but rather to disrupt the normal operation of a service, making it a Denial of Service attack.
Reference: The categorization of SYN flood attempts as a Denial of Service attack is consistent with the information provided in various cybersecurity resources, including those related to the Certified Network Defender (CND) course, which outlines the different types of network attacks and their characteristics123.
B
Explanation:
SYN flood attempts are a type of Denial of Service (DoS) attack. They are designed to exploit the TCP handshake process by sending a large number of SYN packets to a target server, which can overwhelm the server’s resources and prevent legitimate users from establishing a connection. The goal of a SYN flood is not to gain unauthorized access or gather information, but rather to disrupt the normal operation of a service, making it a Denial of Service attack.
Reference: The categorization of SYN flood attempts as a Denial of Service attack is consistent with the information provided in various cybersecurity resources, including those related to the Certified Network Defender (CND) course, which outlines the different types of network attacks and their characteristics123.
Question #179
A newly joined network administrator wants to assess the organization against possible risk. He notices the organization doesn’t have a________identified which helps measure how risky an activity is.
- A . Risk Severity
- B . Risk Matrix
- C . Key Risk Indicator
- D . Risk levels
Correct Answer: B
B
Explanation:
A Risk Matrix is a tool used to define and prioritize risks. It helps in assessing the likelihood of an event occurring and the impact it would have on the organization, thus measuring how risky an activity is. By not having a Risk Matrix, the network administrator lacks a structured approach to identify, assess, and prioritize risks, which is crucial for effective risk management.
Reference: The Certified Network Defender (CND) program by EC-Council includes the use of a Risk Matrix as part of its approach to network security, which is essential for identifying and mitigating risks within an organization12. The CND curriculum covers the importance of risk assessment and the tools used for this purpose, including the Risk Matrix3.
B
Explanation:
A Risk Matrix is a tool used to define and prioritize risks. It helps in assessing the likelihood of an event occurring and the impact it would have on the organization, thus measuring how risky an activity is. By not having a Risk Matrix, the network administrator lacks a structured approach to identify, assess, and prioritize risks, which is crucial for effective risk management.
Reference: The Certified Network Defender (CND) program by EC-Council includes the use of a Risk Matrix as part of its approach to network security, which is essential for identifying and mitigating risks within an organization12. The CND curriculum covers the importance of risk assessment and the tools used for this purpose, including the Risk Matrix3.
Question #180
The company has implemented a backup plan. James is working as a network administrator for the company and is taking full backups of the data every time a backup is initiated. Alex who is a senior security manager talks to him about using a differential backup instead and asks him to implement this once a full backup of the data is completed.
What is/are the reason(s) Alex is suggesting that James use a differential backup? (Select all that apply)
- A . Less storage space is required
- B . Father restoration
- C . Slower than a full backup
- D . Faster than a full backup
- E . Less expensive than full backup
Correct Answer: A, E
A, E
Explanation:
Differential backups are advantageous because they only back up data that has changed since the last full backup. This means they require less storage space than taking a full backup every time, which can be significant as data accumulates over time. Additionally, differential backups are generally faster than full backups because they involve less data. This speed can be crucial for maintaining regular backup schedules without disrupting network operations. Lastly, because differential backups involve less data and take less time, they can be less expensive than full backups, considering the costs associated with storage and the time required for backup operations.
Reference: The Certified Network Defender (CND) program by EC-Council includes discussions on various backup strategies, including differential backups, as part of its comprehensive approach to network security. The program emphasizes the importance of efficient and effective backup strategies as a part of disaster recovery and business continuity planning12.
A, E
Explanation:
Differential backups are advantageous because they only back up data that has changed since the last full backup. This means they require less storage space than taking a full backup every time, which can be significant as data accumulates over time. Additionally, differential backups are generally faster than full backups because they involve less data. This speed can be crucial for maintaining regular backup schedules without disrupting network operations. Lastly, because differential backups involve less data and take less time, they can be less expensive than full backups, considering the costs associated with storage and the time required for backup operations.
Reference: The Certified Network Defender (CND) program by EC-Council includes discussions on various backup strategies, including differential backups, as part of its comprehensive approach to network security. The program emphasizes the importance of efficient and effective backup strategies as a part of disaster recovery and business continuity planning12.