EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #201
Riya bought some clothes and a watch from an online shopping site a few days back. Since then, whenever she accesses any other application (games, browser, etc.) on her mobile, she is spammed with advertisements for clothes and watches similar to the ones she bought.
What can be the underlying reason for Riya’s situation?
- A . Ria’s system was infected by Adware
- B . Ria’s system was infected by Spyware
- C . Ria’s system was infected by Backdoor
- D . Ria’s system was infected by Rootkit
Correct Answer: A
A
Explanation:
Adware is a type of software designed to throw advertisements up on your screen, most often within a web browser. This typically happens when a user installs a free application or software that includes adware in its installation package. In Riya’s case, the sudden influx of advertisements for clothes and watches similar to her recent purchases suggests that adware might have been installed on her device. This adware is likely tracking her browsing habits and displaying targeted ads based on her online shopping activity.
Reference: The explanation aligns with the objectives and documents of the Certified Network Defender (CND) course, which covers various types of malware, including adware, and their characteristics. For more detailed information, refer to the CND study guide and materials provided by the EC-Council on malware and its impact on network security.
A
Explanation:
Adware is a type of software designed to throw advertisements up on your screen, most often within a web browser. This typically happens when a user installs a free application or software that includes adware in its installation package. In Riya’s case, the sudden influx of advertisements for clothes and watches similar to her recent purchases suggests that adware might have been installed on her device. This adware is likely tracking her browsing habits and displaying targeted ads based on her online shopping activity.
Reference: The explanation aligns with the objectives and documents of the Certified Network Defender (CND) course, which covers various types of malware, including adware, and their characteristics. For more detailed information, refer to the CND study guide and materials provided by the EC-Council on malware and its impact on network security.
Question #202
You are monitoring your network traffic with the Wireshark utility and noticed that your network is experiencing a large amount of traffic from certain region. You suspect a DoS incident on the network.
What will be your first reaction as a first responder?
- A . Disable Virus Protection
- B . Make an initial assessment
- C . Communicate the incident
- D . Avoid Fear, Uncertainty and Doubt
Correct Answer: B
B
Explanation:
As a first responder to a suspected DoS incident, the initial step is to make an assessment of the situation. This involves analyzing the network traffic using tools like Wireshark to confirm the nature of the traffic and determine if it is indeed a DoS attack. The assessment will help in understanding the scope and impact of the incident and is crucial for deciding the subsequent steps in the response process123.
Reference: The importance of making an initial assessment is highlighted in various cybersecurity incident response guidelines and best practices, which recommend starting with an evaluation of the situation before proceeding with any other actions123.
B
Explanation:
As a first responder to a suspected DoS incident, the initial step is to make an assessment of the situation. This involves analyzing the network traffic using tools like Wireshark to confirm the nature of the traffic and determine if it is indeed a DoS attack. The assessment will help in understanding the scope and impact of the incident and is crucial for deciding the subsequent steps in the response process123.
Reference: The importance of making an initial assessment is highlighted in various cybersecurity incident response guidelines and best practices, which recommend starting with an evaluation of the situation before proceeding with any other actions123.
Question #203
Which of the following defines the extent to which an interruption affects normal business operations and the amount of revenue lost due to that interruption?
- A . RPO
- B . RFO
- C . RSP
- D . RTO
Correct Answer: D
D
Explanation:
The term that defines the extent to which an interruption affects normal business operations and the amount of revenue lost due to that interruption is the Recovery Time Objective (RTO). RTO is a critical metric in business continuity and disaster recovery planning. It refers to the maximum acceptable length of time that a service, product, or activity can be offline after a disaster before significantly impacting the organization. This metric helps businesses determine the amount of time they can afford to be without their critical functions before the loss becomes unacceptable.
Reference: The concept of RTO is widely recognized in business continuity planning and is a fundamental part of the disaster recovery strategy, ensuring that businesses can continue to operate or quickly resume key operations after an interruption12345.
D
Explanation:
The term that defines the extent to which an interruption affects normal business operations and the amount of revenue lost due to that interruption is the Recovery Time Objective (RTO). RTO is a critical metric in business continuity and disaster recovery planning. It refers to the maximum acceptable length of time that a service, product, or activity can be offline after a disaster before significantly impacting the organization. This metric helps businesses determine the amount of time they can afford to be without their critical functions before the loss becomes unacceptable.
Reference: The concept of RTO is widely recognized in business continuity planning and is a fundamental part of the disaster recovery strategy, ensuring that businesses can continue to operate or quickly resume key operations after an interruption12345.
Question #204
Identify the firewall technology that monitors the TCP handshake between the packets to determine whether a requested session is legitimate.
- A . Packet Filtering Firewall
- B . Stateful Multilayer Inspection
- C . Circuit Level Gateway
- D . Network Address Translation
Correct Answer: B
B
Explanation:
Stateful Multilayer Inspection firewalls monitor the state of active connections and determine which network packets to allow through the firewall. They are designed to inspect the TCP handshake, which is the initial connection setup process between two hosts in a network. By monitoring this handshake, the firewall can determine whether a requested session is legitimate. This technology allows the firewall to not only filter packets based on predefined rules but also to ensure that the packets are part of an established and approved connection.
Reference: The role of Stateful Multilayer Inspection in monitoring TCP handshakes is covered in the Certified Network Defender (CND) course materials, which detail the functionalities of different firewall technologies and their application in network security123.
B
Explanation:
Stateful Multilayer Inspection firewalls monitor the state of active connections and determine which network packets to allow through the firewall. They are designed to inspect the TCP handshake, which is the initial connection setup process between two hosts in a network. By monitoring this handshake, the firewall can determine whether a requested session is legitimate. This technology allows the firewall to not only filter packets based on predefined rules but also to ensure that the packets are part of an established and approved connection.
Reference: The role of Stateful Multilayer Inspection in monitoring TCP handshakes is covered in the Certified Network Defender (CND) course materials, which detail the functionalities of different firewall technologies and their application in network security123.
Question #205
Which of the following creates passwords for individual administrator accounts and stores them in Windows AD?
- A . LSASS
- B . SRM
- C . SAM
- D . LAPS
Correct Answer: D
D
Explanation:
The Local Administrator Password Solution (LAPS) is a Microsoft tool that provides a solution for managing the local administrator password on domain-joined computers. Its primary function is to generate a unique password for each local administrator account and then securely store this password in the Active Directory (AD). When LAPS is implemented, it enhances security by ensuring that local administrator accounts have unique passwords, which reduces the risk of Pass-the-Hash attacks and other similar credential theft techniques.
Reference: This information aligns with the objectives and documentation of the ECCouncil’s Certified Network Defender (CND) program, which emphasizes the importance of securing credentials and managing privileged accounts in a Windows AD environment12.
D
Explanation:
The Local Administrator Password Solution (LAPS) is a Microsoft tool that provides a solution for managing the local administrator password on domain-joined computers. Its primary function is to generate a unique password for each local administrator account and then securely store this password in the Active Directory (AD). When LAPS is implemented, it enhances security by ensuring that local administrator accounts have unique passwords, which reduces the risk of Pass-the-Hash attacks and other similar credential theft techniques.
Reference: This information aligns with the objectives and documentation of the ECCouncil’s Certified Network Defender (CND) program, which emphasizes the importance of securing credentials and managing privileged accounts in a Windows AD environment12.
Question #206
The risk assessment team in Southern California has estimated that the probability of an incident that has potential to impact almost 80% of the bank’s business is very high.
How should this risk be categorized in the risk matrix?
- A . High
- B . Medium
- C . Extreme
- D . Low
Correct Answer: C
C
Explanation:
In the context of risk assessment, an incident that has a very high probability of occurring and the potential to impact almost 80% of a business is considered an extreme risk. This categorization is based on the severity of the impact and the likelihood of the event. The risk matrix, a tool used in risk assessment, helps in the classification of risks by considering both the impact and the probability of potential incidents. An event that affects such a significant portion of the business would typically necessitate immediate attention and the implementation of mitigation strategies to prevent substantial loss or damage.
Reference: The Certified Network Defender (CND) curriculum includes principles of risk assessment and the use of risk matrices to categorize and prioritize risks. It outlines that risks with high impact and high probability should be classified as extreme, requiring urgent action12.
C
Explanation:
In the context of risk assessment, an incident that has a very high probability of occurring and the potential to impact almost 80% of a business is considered an extreme risk. This categorization is based on the severity of the impact and the likelihood of the event. The risk matrix, a tool used in risk assessment, helps in the classification of risks by considering both the impact and the probability of potential incidents. An event that affects such a significant portion of the business would typically necessitate immediate attention and the implementation of mitigation strategies to prevent substantial loss or damage.
Reference: The Certified Network Defender (CND) curriculum includes principles of risk assessment and the use of risk matrices to categorize and prioritize risks. It outlines that risks with high impact and high probability should be classified as extreme, requiring urgent action12.
Question #207
Disaster Recovery is a _________.
- A . Operation-centric strategy
- B . Security-centric strategy
- C . Data-centric strategy
- D . Business-centric strategy
Correct Answer: D
D
Explanation:
Disaster Recovery (DR) is a subset of business continuity planning which focuses on the IT systems and operations of a business after a disaster. It’s a comprehensive approach that ensures all critical business functions can be resumed quickly and effectively in the event of a crisis. DR is not just about data or security; it encompasses all aspects of the business that are necessary to continue operations and protect the interests of stakeholders.
Reference: The explanation aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of business continuity and disaster recovery as part of a defense-in-depth security strategy. This includes protecting endpoints, data, and networks, as well as continuous threat monitoring and response12345.
D
Explanation:
Disaster Recovery (DR) is a subset of business continuity planning which focuses on the IT systems and operations of a business after a disaster. It’s a comprehensive approach that ensures all critical business functions can be resumed quickly and effectively in the event of a crisis. DR is not just about data or security; it encompasses all aspects of the business that are necessary to continue operations and protect the interests of stakeholders.
Reference: The explanation aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of business continuity and disaster recovery as part of a defense-in-depth security strategy. This includes protecting endpoints, data, and networks, as well as continuous threat monitoring and response12345.
Question #208
Based on which of the following registry key, the Windows Event log audit configurations are recorded?
- A . HKEY_LOCAL_MACHINESYSTEMServicesEventLog < ErrDev >
- B . HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEventLog < EntAppsvc >
- C . HKEY_LOCAL_MACHINECurrentControlSetServicesEventLog< ESENT >
- D . HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLog < Event Log >
Correct Answer: D
D
Explanation:
The Windows Event Log audit configurations are recorded in the registry key path HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLog. This key contains subkeys for each of the event logs on the system, including the Application, Security, and System logs, among others. Each of these subkeys can contain a number of values that determine how events are logged, which can include the maximum size of the log, the retention method, and the file path where the log is stored. Audit policies can be configured to determine which events are recorded in these logs, and the configurations are reflected in the registry under this key.
Reference: The information provided is based on standard Windows operating system behavior and aligns with the Certified Network Defender (CND) curriculum, which includes understanding and managing Windows logging and auditing settings as part of network security monitoring and defense strategies.
D
Explanation:
The Windows Event Log audit configurations are recorded in the registry key path HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLog. This key contains subkeys for each of the event logs on the system, including the Application, Security, and System logs, among others. Each of these subkeys can contain a number of values that determine how events are logged, which can include the maximum size of the log, the retention method, and the file path where the log is stored. Audit policies can be configured to determine which events are recorded in these logs, and the configurations are reflected in the registry under this key.
Reference: The information provided is based on standard Windows operating system behavior and aligns with the Certified Network Defender (CND) curriculum, which includes understanding and managing Windows logging and auditing settings as part of network security monitoring and defense strategies.
Question #209
Kelly is taking backups of the organization’s data. Currently, he is taking backups of only those files which are created or modified after the last backup.
What type of backup is Kelly using?
- A . Full backup
- B . Incremental backup
- C . Differential Backup
- D . Normal Backup
Correct Answer: B
B
Explanation:
An incremental backup is a type of data backup that copies only the files that have been created or modified since the last backup operation of any type. This method is efficient because it only backs up data that has changed, which can save on storage space and reduce the time needed to complete the backup. In Kelly’s case, since he is backing up only the new or changed files since the last backup, he is using an incremental backup approach.
Reference: The explanation aligns with the standard backup methodologies where an incremental backup captures only the changes made since the last backup, which can be either a full or another incremental backup1234.
B
Explanation:
An incremental backup is a type of data backup that copies only the files that have been created or modified since the last backup operation of any type. This method is efficient because it only backs up data that has changed, which can save on storage space and reduce the time needed to complete the backup. In Kelly’s case, since he is backing up only the new or changed files since the last backup, he is using an incremental backup approach.
Reference: The explanation aligns with the standard backup methodologies where an incremental backup captures only the changes made since the last backup, which can be either a full or another incremental backup1234.
Question #210
Which of the following provides the target for designing DR and BC solutions?
- A . RCO
- B . RTO
- C . RPO
- D . RGO
Correct Answer: B
B
Explanation:
The correct answer is Recovery Time Objective (RTO). RTO is a critical metric in disaster recovery (DR) and business continuity (BC) planning. It defines the target time within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in business continuity. It is essentially the maximum acceptable length of time that a computer, system, network, or application can be down after a failure or disaster occurs. An RTO is set by business continuity planners to ensure that the DR and BC solutions are designed to meet the specific time constraints of the organization.
Reference: The explanation provided is based on standard definitions and practices within the field of disaster recovery and business continuity planning. The RTO is a well-established concept in DR and BC solutions, as outlined in various authoritative resources on the subject1234. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
B
Explanation:
The correct answer is Recovery Time Objective (RTO). RTO is a critical metric in disaster recovery (DR) and business continuity (BC) planning. It defines the target time within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in business continuity. It is essentially the maximum acceptable length of time that a computer, system, network, or application can be down after a failure or disaster occurs. An RTO is set by business continuity planners to ensure that the DR and BC solutions are designed to meet the specific time constraints of the organization.
Reference: The explanation provided is based on standard definitions and practices within the field of disaster recovery and business continuity planning. The RTO is a well-established concept in DR and BC solutions, as outlined in various authoritative resources on the subject1234. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.