EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #191
Which of the following systems includes an independent NAS Head and multiple storage arrays?
- A . Gateway NAS System
- B . FreeNAS
- C . Integrated NAS System
- D . None of these
Correct Answer: A
A
Explanation:
A Gateway NAS System is characterized by having an independent NAS head that manages file services and multiple storage arrays. This configuration allows for the NAS head to be connected to external storage arrays, providing flexibility and scalability. The NAS head serves as the gateway between the clients and the storage arrays, managing file I/O requests and directing them to the appropriate storage resources.
Reference: The information about Gateway NAS systems and their architecture can be found in various educational resources and is consistent with the Certified Network Defender (CND) course materials, which discuss different NAS implementations and their components12.
A
Explanation:
A Gateway NAS System is characterized by having an independent NAS head that manages file services and multiple storage arrays. This configuration allows for the NAS head to be connected to external storage arrays, providing flexibility and scalability. The NAS head serves as the gateway between the clients and the storage arrays, managing file I/O requests and directing them to the appropriate storage resources.
Reference: The information about Gateway NAS systems and their architecture can be found in various educational resources and is consistent with the Certified Network Defender (CND) course materials, which discuss different NAS implementations and their components12.
Question #191
Which of the following systems includes an independent NAS Head and multiple storage arrays?
- A . Gateway NAS System
- B . FreeNAS
- C . Integrated NAS System
- D . None of these
Correct Answer: A
A
Explanation:
A Gateway NAS System is characterized by having an independent NAS head that manages file services and multiple storage arrays. This configuration allows for the NAS head to be connected to external storage arrays, providing flexibility and scalability. The NAS head serves as the gateway between the clients and the storage arrays, managing file I/O requests and directing them to the appropriate storage resources.
Reference: The information about Gateway NAS systems and their architecture can be found in various educational resources and is consistent with the Certified Network Defender (CND) course materials, which discuss different NAS implementations and their components12.
A
Explanation:
A Gateway NAS System is characterized by having an independent NAS head that manages file services and multiple storage arrays. This configuration allows for the NAS head to be connected to external storage arrays, providing flexibility and scalability. The NAS head serves as the gateway between the clients and the storage arrays, managing file I/O requests and directing them to the appropriate storage resources.
Reference: The information about Gateway NAS systems and their architecture can be found in various educational resources and is consistent with the Certified Network Defender (CND) course materials, which discuss different NAS implementations and their components12.
Question #193
Which field is not included in the TCP header?
- A . Source IP address
- B . Acknowledgment number
- C . Sequence number
- D . Source Port
Correct Answer: A
A
Explanation:
The TCP header does not include the Source IP address. The TCP (Transmission Control Protocol) header consists of several fields that are used to manage the transmission of data packets over a network. The fields included in the TCP header are Source Port, Destination Port, Sequence Number, Acknowledgment Number, Header Length, Flags, Window Size, TCP Checksum, and Urgent Pointer123. The Source IP address is actually part of the IP (Internet Protocol) header, which is a different layer in the TCP/IP model. The IP header is responsible for delivering packets from the source host to the destination host based on the IP addresses in the packet headers.
Reference: The information is derived from the TCP header structure as outlined in networking resources and documentation123.
A
Explanation:
The TCP header does not include the Source IP address. The TCP (Transmission Control Protocol) header consists of several fields that are used to manage the transmission of data packets over a network. The fields included in the TCP header are Source Port, Destination Port, Sequence Number, Acknowledgment Number, Header Length, Flags, Window Size, TCP Checksum, and Urgent Pointer123. The Source IP address is actually part of the IP (Internet Protocol) header, which is a different layer in the TCP/IP model. The IP header is responsible for delivering packets from the source host to the destination host based on the IP addresses in the packet headers.
Reference: The information is derived from the TCP header structure as outlined in networking resources and documentation123.
Question #194
Under which of the following acts can an international financial institution be prosecuted if it fails to maintain the privacy of its customer’s information?
- A . GLBA
- B . FISMA
- C . DMCA
- D . SOX
Correct Answer: A
A
Explanation:
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is the correct answer. The GLBA mandates that financial institutions C which can include international financial institutions operating in the United States C protect the privacy of consumers’ personal financial information. The act requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Failure to comply with the GLBA can result in prosecution and significant penalties.
Reference: The information provided is based on my training data which includes knowledge of the GLBA and its implications for financial institutions regarding the privacy and protection of customer information. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
A
Explanation:
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is the correct answer. The GLBA mandates that financial institutions C which can include international financial institutions operating in the United States C protect the privacy of consumers’ personal financial information. The act requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Failure to comply with the GLBA can result in prosecution and significant penalties.
Reference: The information provided is based on my training data which includes knowledge of the GLBA and its implications for financial institutions regarding the privacy and protection of customer information. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
Question #195
What is the best way to describe a mesh network topology?
- A . A network the is extremely cost efficient, offering the best option for allowing computers to communicate amongst each other.
- B . A network in which every computer in the network can communicate with a single central computer.
- C . A network in which every computer in the network has a connection to each and every computer in the network.
- D . A network in which every computer meshes together to form a hybrid between a star and bus topology.
Correct Answer: C
C
Explanation:
A mesh network topology is characterized by each node (computer or device) being interconnected with every other node in the network. This allows for direct data transmission and multiple pathways for the data to route itself, enhancing reliability and robustness. In a mesh topology, the absence of a central hub means that the network can dynamically reroute data if any node fails, maintaining the network’s overall connectivity.
Reference: This description is consistent with the core features of mesh networks as described in the Network Defender (CND) study materials and further explained in various educational resources on computer networks1234.
C
Explanation:
A mesh network topology is characterized by each node (computer or device) being interconnected with every other node in the network. This allows for direct data transmission and multiple pathways for the data to route itself, enhancing reliability and robustness. In a mesh topology, the absence of a central hub means that the network can dynamically reroute data if any node fails, maintaining the network’s overall connectivity.
Reference: This description is consistent with the core features of mesh networks as described in the Network Defender (CND) study materials and further explained in various educational resources on computer networks1234.
Question #196
Which of the following filters can be used to detect UDP scan attempts using Wireshark?
- A . icmp.type==3 and icmp.code==3
- B . icmp.type==13
- C . icmp.type==8 or icmp.type==0
- D . icmp.type==15
Correct Answer: A
A
Explanation:
The correct filter to detect UDP scan attempts using Wireshark is not listed among the options provided. To detect UDP scan attempts, a Wireshark filter that targets UDP traffic specifically would be used, rather than an ICMP type and code filter. A common method to detect a UDP scan is to look for a large amount of UDP packets sent to different ports, which can be indicative of a scanning activity. The filter would typically include parameters that isolate UDP traffic, such as udp.port or udp.dstport combined with a range or list of ports.
Reference: The information provided is based on standard practices for using Wireshark to detect network scanning activities, as outlined in resources like the InfosecMatter guide on detecting network attacks with Wireshark1. While the EC-Council’s Certified Network Defender (CND) course materials would provide detailed methodologies for network defense, including the use of tools like Wireshark, the specific filters for detecting UDP scans would align with the general usage of Wireshark as described in various online resources and documentation1.
A
Explanation:
The correct filter to detect UDP scan attempts using Wireshark is not listed among the options provided. To detect UDP scan attempts, a Wireshark filter that targets UDP traffic specifically would be used, rather than an ICMP type and code filter. A common method to detect a UDP scan is to look for a large amount of UDP packets sent to different ports, which can be indicative of a scanning activity. The filter would typically include parameters that isolate UDP traffic, such as udp.port or udp.dstport combined with a range or list of ports.
Reference: The information provided is based on standard practices for using Wireshark to detect network scanning activities, as outlined in resources like the InfosecMatter guide on detecting network attacks with Wireshark1. While the EC-Council’s Certified Network Defender (CND) course materials would provide detailed methodologies for network defense, including the use of tools like Wireshark, the specific filters for detecting UDP scans would align with the general usage of Wireshark as described in various online resources and documentation1.
Question #197
James was inspecting ARP packets in his organization’s network traffic with the help of Wireshark. He is checking the volume of traffic containing ARP requests as well as the source IP address from which they are originating.
Which type of attack is James analyzing?
- A . ARP Sweep
- B . ARP misconfiguration
- C . ARP spoofinq
- D . ARP Poisioning
Correct Answer: D
D
Explanation:
James is analyzing an ARP Poisoning attack. This type of attack occurs when an attacker sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network. Once the attacker has inserted their MAC address into the ARP cache of other devices, they can intercept, modify, or stop data in transit, effectively performing a man-in-the-middle or denial of service attack.
Reference: The analysis of ARP packets to identify potential ARP Poisoning is a critical skill for network defenders, as outlined in the EC-Council’s Certified Network Defender (CND) course. The course emphasizes understanding and identifying various network threats, including ARP-related attacks, which are fundamental to maintaining network security123.
D
Explanation:
James is analyzing an ARP Poisoning attack. This type of attack occurs when an attacker sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network. Once the attacker has inserted their MAC address into the ARP cache of other devices, they can intercept, modify, or stop data in transit, effectively performing a man-in-the-middle or denial of service attack.
Reference: The analysis of ARP packets to identify potential ARP Poisoning is a critical skill for network defenders, as outlined in the EC-Council’s Certified Network Defender (CND) course. The course emphasizes understanding and identifying various network threats, including ARP-related attacks, which are fundamental to maintaining network security123.
Question #198
Management wants to calculate the risk factor for their organization. Kevin, a network administrator in the organization knows how to calculate the risk factor. Certain parameters are required before calculating risk factor.
What are they? (Select all that apply) Risk factor =………….X……………X………..
- A . Vulnerability
- B . Impact
- C . Attack
- D . Threat
Correct Answer: A,
A,
Explanation:
The risk factor for an organization is typically calculated by considering the potential impact of a threat exploiting a vulnerability. The formula often used is Risk = Threat X Vulnerability X Impact. This means that for a risk to exist, there must be a threat that could exploit a vulnerability and cause an impact on the organization. An attack is not a parameter in the risk calculation but rather the act that occurs when a threat exploits a vulnerability.
Reference: The information is based on the principles of risk assessment and management as outlined in the EC-Council’s Certified Network Defender (CND) course materials, which emphasize the importance of understanding threats, vulnerabilities, and their potential impact to calculate risk effectively12.
A,
Explanation:
The risk factor for an organization is typically calculated by considering the potential impact of a threat exploiting a vulnerability. The formula often used is Risk = Threat X Vulnerability X Impact. This means that for a risk to exist, there must be a threat that could exploit a vulnerability and cause an impact on the organization. An attack is not a parameter in the risk calculation but rather the act that occurs when a threat exploits a vulnerability.
Reference: The information is based on the principles of risk assessment and management as outlined in the EC-Council’s Certified Network Defender (CND) course materials, which emphasize the importance of understanding threats, vulnerabilities, and their potential impact to calculate risk effectively12.
Question #199
Ryan is a network security administrator, who wants to implement local security policies for privileges granted to users and groups, system security audit settings, user authentication, and want to send security audit messages to the Event Log.
Which Windows security component fulfills Ryan’s requirement?
- A . Security Reference Monitor (SRM)
- B . The Security Account Manager (SAM)
- C . The Local Security Authority Subsystem (LSASS)
- D . WinLogon and NetLogon
Correct Answer: C
C
Explanation:
The Local Security Authority Subsystem (LSASS) is the correct answer because it is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. LSASS also writes to the Windows Security Log, which is essential for auditing and compliance. Therefore, it fulfills Ryan’s requirements for implementing local security policies, managing system security audit settings, user authentication, and sending security audit messages to the Event Log123.
Reference: The role of LSASS in Windows security is detailed in Microsoft’s documentation and aligns with the Certified Network Defender (CND) course’s objectives, which include understanding the functions of various Windows security components in maintaining the integrity and security of networked systems123.
C
Explanation:
The Local Security Authority Subsystem (LSASS) is the correct answer because it is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens. LSASS also writes to the Windows Security Log, which is essential for auditing and compliance. Therefore, it fulfills Ryan’s requirements for implementing local security policies, managing system security audit settings, user authentication, and sending security audit messages to the Event Log123.
Reference: The role of LSASS in Windows security is detailed in Microsoft’s documentation and aligns with the Certified Network Defender (CND) course’s objectives, which include understanding the functions of various Windows security components in maintaining the integrity and security of networked systems123.
Question #200
Which of the information below can be gained through network sniffing? (Select all that apply)
- A . Telnet Passwords
- B . Syslog traffic
- C . DNS traffic
- D . Programming errors
Correct Answer: A, B, C
A, B, C
Explanation:
Network sniffing is a technique used to capture and analyze packets traveling across a network. Through network sniffing, one can potentially gain access to a variety of sensitive information, depending on the protocols being used and the security measures in place.
Telnet Passwords (A): Telnet is an older protocol that transmits data, including login credentials, in clear text. This makes Telnet passwords particularly vulnerable to network sniffing1.
Syslog Traffic (B): Syslog is a standard for message logging. If not properly secured, syslog traffic can be intercepted, revealing system messages and metadata about network activities1.
DNS Traffic ©: DNS traffic includes queries and responses that can be captured to reveal which domains are being requested by users on the network. This can provide insights into user behavior and network structure1.
Programming Errors (D): While network sniffing can capture packets that may contain the results of programming errors, such as error messages or malformed packets, it does not directly reveal the programming errors themselves. Sniffing tools capture the traffic but do not analyze the code within the applications generating that traffic.
Reference: The information has been verified from the EC-Council’s resources on network sniffing and network defense strategies, which discuss the types of data that can be captured through sniffing and the implications for network security123.
A, B, C
Explanation:
Network sniffing is a technique used to capture and analyze packets traveling across a network. Through network sniffing, one can potentially gain access to a variety of sensitive information, depending on the protocols being used and the security measures in place.
Telnet Passwords (A): Telnet is an older protocol that transmits data, including login credentials, in clear text. This makes Telnet passwords particularly vulnerable to network sniffing1.
Syslog Traffic (B): Syslog is a standard for message logging. If not properly secured, syslog traffic can be intercepted, revealing system messages and metadata about network activities1.
DNS Traffic ©: DNS traffic includes queries and responses that can be captured to reveal which domains are being requested by users on the network. This can provide insights into user behavior and network structure1.
Programming Errors (D): While network sniffing can capture packets that may contain the results of programming errors, such as error messages or malformed packets, it does not directly reveal the programming errors themselves. Sniffing tools capture the traffic but do not analyze the code within the applications generating that traffic.
Reference: The information has been verified from the EC-Council’s resources on network sniffing and network defense strategies, which discuss the types of data that can be captured through sniffing and the implications for network security123.