EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
What is the name of the authority that verifies the certificate authority in digital certificates?
- A . Directory management system
- B . Certificate authority
- C . Registration authority
- D . Certificate Management system
C
Explanation:
In the context of digital certificates, the Registration Authority (RA) is responsible for verifying the identity of entities requesting a certificate before the Certificate Authority (CA) issues it. The RA acts as a verifier for the CA, ensuring that the entity requesting the certificate is who they claim to be. This process is crucial for maintaining trust within a digital environment, as it prevents the issuance of certificates to fraudulent or unauthorized entities.
Reference: The role of the Registration Authority in the verification process is outlined in the EC-Council’s Certified Network Defender (CND) curriculum, which covers the essential concepts of network security, including the management and issuance of digital certificates.
You are monitoring your network traffic with the Wireshark utility and noticed that your network is experiencing a large amount of traffic from a certain region. You suspect a DoS incident on the network.
What will be your first reaction as a first responder?
- A . Avoid Fear, Uncertainty and Doubt
- B . Communicate the incident
- C . Make an initial assessment
- D . Disable Virus Protection
C
Explanation:
As a first responder to a suspected DoS incident, the initial reaction should be to make an initial assessment. This involves quickly evaluating the situation to understand the scope and impact of the incident. An initial assessment helps in determining whether the unusual traffic is indeed a DoS attack or a false positive. It also aids in deciding the next steps, such as whether to escalate the incident, what resources are required, and how to communicate the issue to relevant stakeholders.
Reference: The approach aligns with best practices for incident response, which emphasize the importance of an initial assessment to understand the nature and extent of a security incident before proceeding with further actions123.
Which mobile-use approach allows an organization’s employees to use devices that they are comfortable with and best fits their preferences and work purposes?
- A . BYOD
- B . COPE
- C . COBO
- D . CYOD
A
Explanation:
The mobile-use approach that allows an organization’s employees to use devices they are comfortable with and that best fit their preferences and work purposes is Bring Your Own Device (BYOD). This approach offers the most flexibility for employees, as they can bring and use their personal devices for work-related activities. It is a popular choice for companies that wish to provide a flexible work environment and cater to the diverse preferences of their employees123.
Reference: The concept of BYOD and its implications on workplace flexibility and employee preferences are well-documented in enterprise mobility management literature and align with the Certified Network Defender (CND) course’s objectives regarding understanding and managing mobile device security within an organization123.
A company wants to implement a data backup method which allows them to encrypt the data ensuring its security as well as access at any time and from any location.
What is the appropriate backup method that
should be implemented?
- A . Onsite backup
- B . Hot site backup
- C . Offsite backup
- D . Cloud backup
D
Explanation:
The most appropriate backup method for a company that wants to ensure data encryption and accessibility from any location at any time is cloud backup. Cloud backup solutions provide remote, offsite storage that can be accessed over the internet, which is ideal for ensuring data availability and security. These solutions often include robust encryption protocols to secure data during transfer and
while at rest on the cloud servers. This aligns with the need for a backup method that not only encrypts data but also allows for easy access regardless of the user’s location.
Reference: The explanation is based on standard practices in data backup and security, which are consistent with the objectives and documentation of the Certified Network Defender (CND) course. Cloud backup is widely recognized for its encryption capabilities and remote accessibility, making it a suitable choice for companies looking to secure their data backups.
Which command is used to change the permissions of a file or directory?
- A . rmdir
- B . systemctl
- C . kill
- D . chmod
D
Explanation:
The command used to change the permissions of a file or directory in Linux is chmod (change mode). The chmod command allows users to set or modify the access permissions for file system objects (files and directories). These permissions determine the actions that can be performed by different classes of users: the file owner, members of the file’s group, and others. The command syntax typically includes the permissions to be set, which can be expressed in either symbolic or numeric format, and the name of the target file or directory.
Reference: The use of the chmod command is a fundamental concept covered in the EC-Council’s Certified Network Defender (CND) program, as it pertains to securing data by correctly setting file
and directory permissions as part of system hardening practices123.
Blake is working on the company’s updated disaster and business continuity plan. The last section of the plan covers computer and data incidence response. Blake is outlining the level of severity for each type of incident in the plan.
Unsuccessful scans and probes are at what severity level?
- A . Extreme severity level
- B . Low severity level
- C . Mid severity level
- D . High severity level
B
Explanation:
In the context of incident response, unsuccessful scans and probes are typically considered a low severity level. This is because they often indicate an attempted reconnaissance rather than a successful breach or compromise. These activities are usually automated and widespread, affecting many networks, not just the targeted one. They are often the preliminary steps of an attack, trying to find vulnerabilities but not yet exploiting them. Therefore, while they should be monitored and logged, they do not usually signify an immediate threat to the network’s integrity or the confidentiality of the data.
Reference: The EC-Council’s Certified Network Defender (C|ND) program emphasizes a defense-in-depth security strategy, which includes continuous threat monitoring and incident response. The program outlines that not all incidents require the same level of response, and categorizing the severity of incidents is crucial for effective prioritization and resource allocation1.
According to the company’s security policy, all access to any network resources must use Windows Active Directory Authentication. A Linux server was recently installed to run virtual servers and it is not using Windows Authentication.
What needs to happen to force this server to use Windows Authentication?
- A . Edit the ADLIN file.
- B . Edit the shadow file.
- C . Remove the /var/bin/localauth.conf file.
- D . Edit the PAM file to enforce Windows Authentication
D
Explanation:
To enforce Windows Active Directory Authentication on a Linux server, the Pluggable Authentication Modules (PAM) configuration files must be edited. PAM provides a way to develop programs that are independent of authentication scheme. These files, located in /etc/pam.d/, dictate how a Linux system handles authentication for various services. To integrate Windows Active Directory with a Linux server, specific PAM modules like pam_krb5 or pam_winbind can be used. These modules allow the Linux system to communicate with the Active Directory server for authentication purposes. The process typically involves installing necessary packages, joining the Linux server to the AD domain, and configuring the PAM files to use AD for authentication.
Reference: The procedure for integrating Linux servers with Windows Active Directory is documented in various Linux administration guides and resources12. Specific steps can also be found in tutorials and official documentation from Linux distributions that support Active Directory integration345.
Justine has been tasked by her supervisor to ensure that the company’s physical security is on the same level as their logical security measures. She installs video cameras at all entrances and exits and installs badge access points for all doors. The last item she wants to install is a method to prevent unauthorized people piggybacking employees.
What should she install to prevent piggybacking?
- A . She should install a mantrap
- B . Justine needs to install a biometrics station at each entrance
- C . Justine will need to install a revolving security door
- D . She should install a Thompson Trapdoor.
A
Explanation:
A mantrap is a physical security system designed to control access to a secure area through a small space that can only fit one person at a time. This space typically has two sets of interlocking doors. The first set of doors must close before the second set opens, preventing tailgating or piggybacking, where an unauthorized person follows an authorized person into a restricted area. Mantraps can be equipped with biometric verification systems to ensure that the person in the mantrap is authorized to enter the secure area.
Reference: The concept of a mantrap as a security measure aligns with the Certified Network Defender (CND) objectives which include understanding and implementing physical security controls for network security. The use of mantraps is a recognized method to prevent unauthorized access and is mentioned in various security frameworks and guidelines as an effective physical security measure123.
Frank is a network technician working for a medium-sized law firm in Memphis. Frank and two other IT employees take care of all the technical needs for the firm. The firm’s partners have asked that a secure wireless network be implemented in the office so employees can move about freely without being tied to a network cable. While Frank and his colleagues are familiar with wired Ethernet technologies, 802.3, they are not familiar with how to setup wireless in a business environment.
What IEEE standard should Frank and the other IT employees follow to become familiar with wireless?
- A . The IEEE standard covering wireless is 802.9 and they should follow this.
- B . 802.7 covers wireless standards and should be followed
- C . They should follow the 802.11 standard
- D . Frank and the other IT employees should follow the 802.1 standard.
C
Explanation:
The correct IEEE standard for wireless networking in a business environment is 802.11. This series of standards defines the protocols for implementing wireless local area network (WLAN) communications in various frequencies, including 2.4, 5, and 60 GHz bands. The 802.11 standards are widely used worldwide and form the basis of wireless network products that are marketed under the Wi-Fi brand. Frank and his colleagues should familiarize themselves with the 802.11 standards to set up a secure wireless network for their firm.
Reference: The information is based on the IEEE 802.11 series of standards, which are the foundation for Wi-Fi wireless networks. These standards have been developed to ensure interoperability between wireless devices and to provide a secure and reliable means of communication12.
Fred is a network technician working for Johnson Services, a temporary employment agency in Boston. Johnson Services has three remote offices in New England and the headquarters in Boston where Fred works.
The company relies on a number of customized applications to perform daily tasks and unfortunately these applications require users to be local administrators. Because of this, Fred’s supervisor wants to implement tighter security measures in other areas to compensate for the inherent risks in making those users local admins. Fred’s boss wants a solution that will be placed on all computers throughout the company and monitored by Fred. This solution will gather information on all network traffic to and from the local computers without actually affecting the traffic.
What type of solution does Fred’s boss want to implement?
- A . Fred’s boss wants a NIDS implementation.
- B . Fred’s boss wants Fred to monitor a NIPS system.
- C . Fred’s boss wants to implement a HIPS solution.
- D . Fred’s boss wants to implement a HIDS solution.
A
Explanation:
The solution described is a Network Intrusion Detection System (NIDS). A NIDS is designed to monitor and analyze network traffic for all computers on a network without affecting the traffic flow.
It gathers information on potential security threats and alerts the network administrator―in this case, Fred―without taking direct action to block the traffic. This aligns with the requirement of Fred’s boss for a solution that monitors network traffic and gathers information without impacting it. Unlike a Network Intrusion Prevention System (NIPS), which actively blocks potential threats, or Host-based Intrusion Detection/Prevention Systems (HIDS/HIPS), which are installed on individual hosts, a NIDS operates at the network level to monitor traffic across all systems.
Reference: The characteristics of a NIDS, as opposed to NIPS, HIDS, or HIPS, are well-documented in cybersecurity literature and align with the Certified Network Defender (CND) course objectives and documents.