EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #221
Frank installed Wireshark at all ingress points in the network. Looking at the logs he notices an odd packet source. The odd source has an address of 1080:0:FF:0:8:800:200C:4171 and is using port 21.
What does this source address signify?
- A . This address means that the source is using an IPv6 address and is spoofed and signifies an IPv4 address of 127.0.0.1.
- B . This source address is IPv6 and translates as 13.1.68.3
- C . This source address signifies that the originator is using 802dot1x to try and penetrate into Frank’s network
- D . This means that the source is using IPv4
Correct Answer: A
A
Explanation:
The address 1080:0:FF:0:8:800:200C:4171 is an IPv6 address. IPv6 addresses are 128-bit identifiers for interfaces and sets of interfaces. In this case, the address includes a block ::FFFF: (or 0:FF), which is a reserved subnet prefix to facilitate IPv4 to IPv6 migration. This is known as an IPv4-mapped IPv6 address. It is used to represent an IPv4 address in an IPv6 address format. The last 32 bits of the address represent an IPv4 address, which in this case corresponds to 127.0.0.1 – the loopback address in IPv4 used to establish an IP connection to the same machine or computer being used by the end-user.
Reference: The explanation is based on standard IPv6 addressing rules and the specific structure of IPv4-mapped IPv6 addresses. The information is consistent with the ECCouncil’s Network Defender (CND) course objectives regarding understanding and analyzing network protocols and addressing12.
A
Explanation:
The address 1080:0:FF:0:8:800:200C:4171 is an IPv6 address. IPv6 addresses are 128-bit identifiers for interfaces and sets of interfaces. In this case, the address includes a block ::FFFF: (or 0:FF), which is a reserved subnet prefix to facilitate IPv4 to IPv6 migration. This is known as an IPv4-mapped IPv6 address. It is used to represent an IPv4 address in an IPv6 address format. The last 32 bits of the address represent an IPv4 address, which in this case corresponds to 127.0.0.1 – the loopback address in IPv4 used to establish an IP connection to the same machine or computer being used by the end-user.
Reference: The explanation is based on standard IPv6 addressing rules and the specific structure of IPv4-mapped IPv6 addresses. The information is consistent with the ECCouncil’s Network Defender (CND) course objectives regarding understanding and analyzing network protocols and addressing12.
Question #222
John, a network administrator, is configuring Amazon EC2 cloud service for his organization. Identify the type of cloud service modules his organization adopted.
- A . Software-as-a-Service (SaaS)
- B . Infrastructure-as-a-Service (IaaS)
- C . Platform-as-a-Service (PaaS)
- D . Storage-as-a-Service (SaaS)
Correct Answer: B
B
Explanation:
Amazon EC2 (Elastic Compute Cloud) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. EC2’s simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment. Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change. Hence, Amazon EC2 is an example of Infrastructure-as-a-Service (IaaS), which provides virtualized computing resources over the internet.
Reference: The classification of Amazon EC2 as an IaaS is based on its characteristics and functionalities as described in the official AWS documentation
B
Explanation:
Amazon EC2 (Elastic Compute Cloud) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers. EC2’s simple web service interface allows you to obtain and configure capacity with minimal friction. It provides you with complete control of your computing resources and lets you run on Amazon’s proven computing environment. Amazon EC2 reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change. Hence, Amazon EC2 is an example of Infrastructure-as-a-Service (IaaS), which provides virtualized computing resources over the internet.
Reference: The classification of Amazon EC2 as an IaaS is based on its characteristics and functionalities as described in the official AWS documentation
Question #223
Rosa is working as a network defender at Linda Systems. Recently, the company migrated from Windows to MacOS.
Rosa wants to view the security related logs of her system, where con she find these logs?
- A . /private/var/log
- B . /var/log/cups/access-log
- C . /Library/Logs/Sync
- D . /Library/Logs
Correct Answer: A
A
Explanation:
In MacOS, security-related logs are typically stored in the /private/var/log directory. This location is used to store various system logs, including authentication attempts and other security events. The secure.log file within this directory is particularly relevant for tracking security incidents, as it records authentication attempts and other security-related events. It’s important for network defenders like Rosa to be familiar with these log locations to monitor and respond to potential security issues on the systems they manage12.
Reference: The information provided here is consistent with standard MacOS logging practices and the EC-Council’s Certified Network Defender (CND) curriculum, which includes understanding the security mechanisms of different operating systems and how to locate and interpret system logs12. For more detailed information, please refer to the official CND study materials and documents provided by the EC-Council.
A
Explanation:
In MacOS, security-related logs are typically stored in the /private/var/log directory. This location is used to store various system logs, including authentication attempts and other security events. The secure.log file within this directory is particularly relevant for tracking security incidents, as it records authentication attempts and other security-related events. It’s important for network defenders like Rosa to be familiar with these log locations to monitor and respond to potential security issues on the systems they manage12.
Reference: The information provided here is consistent with standard MacOS logging practices and the EC-Council’s Certified Network Defender (CND) curriculum, which includes understanding the security mechanisms of different operating systems and how to locate and interpret system logs12. For more detailed information, please refer to the official CND study materials and documents provided by the EC-Council.
Question #224
Sam wants to implement a network-based IDS in the network. Sam finds out the one IDS solution which works is based on patterns matching.
Which type of network-based IDS is Sam implementing?
- A . Behavior-based IDS
- B . Anomaly-based IDS
- C . Stateful protocol analysis
- D . Signature-based IDS
Correct Answer: D
D
Explanation:
Sam is implementing a Signature-based Intrusion Detection System (IDS). This type of IDS uses predefined patterns of traffic, known as signatures, to identify and flag potential security threats. These signatures are based on known attack patterns and anomalies that have been identified from past incidents. When network traffic matches a signature within the IDS, an alert is generated, indicating a possible security event or breach. Signature-based IDS is effective in detecting known threats but may not be as effective in identifying new, previously unknown attacks.
Reference: The information aligns with the Certified Network Defender (CND) objectives and documents, which describe the role and function of signature-based IDS within network security. The CND training materials emphasize the importance of understanding various IDS types, including signature-based systems, which are critical for detecting known threats and maintaining network security1.
D
Explanation:
Sam is implementing a Signature-based Intrusion Detection System (IDS). This type of IDS uses predefined patterns of traffic, known as signatures, to identify and flag potential security threats. These signatures are based on known attack patterns and anomalies that have been identified from past incidents. When network traffic matches a signature within the IDS, an alert is generated, indicating a possible security event or breach. Signature-based IDS is effective in detecting known threats but may not be as effective in identifying new, previously unknown attacks.
Reference: The information aligns with the Certified Network Defender (CND) objectives and documents, which describe the role and function of signature-based IDS within network security. The CND training materials emphasize the importance of understanding various IDS types, including signature-based systems, which are critical for detecting known threats and maintaining network security1.
Question #225
Daniel who works as a network administrator has just deployed an in his organizations network. He wants to calculate the False Positive rate for his implementation.
Which of the following formulas will he use to calculate the False Positive rate?
- A . False Positive/False Positive+True Negative
- B . True Negative/False Negative+True Positive
- C . False Negative/False Negative+True Positive
- D . False Negative/True Negative+True Positive
Correct Answer: A
A
Explanation:
The False Positive rate (FPR) is a measure used in statistics and network security to evaluate the performance of a security system. It is calculated by dividing the number of false positives (FP) by the sum of false positives (FP) and true negatives (TN). The formula is represented as: FPR=FP+TNFP
This rate indicates how often benign activities are incorrectly flagged as malicious, which is crucial for a network administrator like Daniel to understand the reliability of the security measures implemented.
Reference: The formula for calculating the False Positive rate is standard across various cybersecurity frameworks and is aligned with the Certified Network Defender (CND) course objectives that cover the evaluation of security system performance metrics. For further details, Daniel can refer to the CND study guide and materials that discuss the interpretation and implications of the False Positive rate in network security.
A
Explanation:
The False Positive rate (FPR) is a measure used in statistics and network security to evaluate the performance of a security system. It is calculated by dividing the number of false positives (FP) by the sum of false positives (FP) and true negatives (TN). The formula is represented as: FPR=FP+TNFP
This rate indicates how often benign activities are incorrectly flagged as malicious, which is crucial for a network administrator like Daniel to understand the reliability of the security measures implemented.
Reference: The formula for calculating the False Positive rate is standard across various cybersecurity frameworks and is aligned with the Certified Network Defender (CND) course objectives that cover the evaluation of security system performance metrics. For further details, Daniel can refer to the CND study guide and materials that discuss the interpretation and implications of the False Positive rate in network security.
Question #226
Which among the following is used to limit the number of cmdlets or administrative privileges of administrator, user, or service accounts?
- A . Just Enough Administration (EA)
- B . User Account Control (UAC)
- C . Windows Security Identifier (SID)
- D . Credential Guard
Correct Answer: A
A
Explanation:
Just Enough Administration (JEA) is a security technology that enables delegated administration for anything managed by PowerShell. JEA helps in reducing the number of administrators on your machines by using virtual accounts or group-managed service accounts to perform privileged actions on behalf of regular users. It limits what users can do by specifying which cmdlets, functions, and external commands they can run. This ensures that users have just enough access to perform their jobs without having unnecessary administrative privileges, which aligns with the principle of least privilege123.
Reference: The information about JEA and its role in limiting cmdlets and administrative privileges is detailed in the Microsoft documentation and training modules on Just Enough Administration (JEA), as well as in the PowerShell-Docs on GitHub123. These sources provide comprehensive guidance on how JEA is used to control administrative privileges and are aligned with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
A
Explanation:
Just Enough Administration (JEA) is a security technology that enables delegated administration for anything managed by PowerShell. JEA helps in reducing the number of administrators on your machines by using virtual accounts or group-managed service accounts to perform privileged actions on behalf of regular users. It limits what users can do by specifying which cmdlets, functions, and external commands they can run. This ensures that users have just enough access to perform their jobs without having unnecessary administrative privileges, which aligns with the principle of least privilege123.
Reference: The information about JEA and its role in limiting cmdlets and administrative privileges is detailed in the Microsoft documentation and training modules on Just Enough Administration (JEA), as well as in the PowerShell-Docs on GitHub123. These sources provide comprehensive guidance on how JEA is used to control administrative privileges and are aligned with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
Question #227
Identify the network topology in which the network devices are connected such that every device has a point-to-point link to all the other devices.
- A . Star Topology
- B . Hybrid Topology
- C . Mesh Topology
- D . Bus Topology
Correct Answer: C
C
Explanation:
The network topology where every device is connected to every other device through a point-to-point link is known as Mesh Topology. In this arrangement, devices have a dedicated link to each other, ensuring a unique path for data to travel between any two devices. This setup enhances the reliability of the network, as there are multiple paths for data transfer, and if one link fails, the system can continue to operate using alternative paths. Mesh topology is characterized by its robustness and is commonly used in applications where reliability is critical, such as military communications and internet service provider networks.
Reference: The explanation aligns with the characteristics of Mesh Topology as described in network topology resources, including the detailed descriptions provided by GeeksforGeeks1 and confirmed by other authoritative sources on network topologies23. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
C
Explanation:
The network topology where every device is connected to every other device through a point-to-point link is known as Mesh Topology. In this arrangement, devices have a dedicated link to each other, ensuring a unique path for data to travel between any two devices. This setup enhances the reliability of the network, as there are multiple paths for data transfer, and if one link fails, the system can continue to operate using alternative paths. Mesh topology is characterized by its robustness and is commonly used in applications where reliability is critical, such as military communications and internet service provider networks.
Reference: The explanation aligns with the characteristics of Mesh Topology as described in network topology resources, including the detailed descriptions provided by GeeksforGeeks1 and confirmed by other authoritative sources on network topologies23. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
Question #228
Which encryption algorithm h used by WPA5 encryption?
- A . RC4.TKIP
- B . RC4
- C . AES-GCMP 256
- D . AES-CCMP
Correct Answer: C
C
Explanation:
WPA5 is not a standard term used in the industry, and there seems to be a confusion or typo in the question. However, based on the context of Wi-Fi security and encryption, the closest relevant standard is WPA3, which uses AES-GCMP 256 as its encryption algorithm. WPA3 is the successor to WPA2 and provides enhanced security features. It uses the Advanced Encryption Standard (AES) with Galois/Counter Mode Protocol (GCMP) 256-bit encryption, which offers a higher level of security than the previous encryption methods used in WPA2, such as AES-CCMP. AES-GCMP 256 provides robust protection against various attacks and is designed to work efficiently on a wide range of devices, including those with limited processing capabilities.
Reference: The information provided is based on the current understanding of Wi-Fi security protocols, specifically the WPA3 standard, which is known to use AES-GCMP 256-bit encryption123.
C
Explanation:
WPA5 is not a standard term used in the industry, and there seems to be a confusion or typo in the question. However, based on the context of Wi-Fi security and encryption, the closest relevant standard is WPA3, which uses AES-GCMP 256 as its encryption algorithm. WPA3 is the successor to WPA2 and provides enhanced security features. It uses the Advanced Encryption Standard (AES) with Galois/Counter Mode Protocol (GCMP) 256-bit encryption, which offers a higher level of security than the previous encryption methods used in WPA2, such as AES-CCMP. AES-GCMP 256 provides robust protection against various attacks and is designed to work efficiently on a wide range of devices, including those with limited processing capabilities.
Reference: The information provided is based on the current understanding of Wi-Fi security protocols, specifically the WPA3 standard, which is known to use AES-GCMP 256-bit encryption123.
Question #229
Harry has successfully completed the vulnerability scanning process and found serious vulnerabilities exist in the organization’s network. Identify the vulnerability management phases through which he will proceed to ensure all the detected vulnerabilities are addressed and eradicated. (Select all that apply)
- A . Mitigation
- B . Assessment
- C . Verification
- D . Remediation
Correct Answer: A, C, D
A, C, D
Explanation:
After completing the vulnerability scanning process and identifying serious vulnerabilities, Harry will proceed through several phases of vulnerability management to address and eradicate these vulnerabilities. The phases include:
Mitigation: This phase involves taking steps to reduce the impact of the detected vulnerabilities. Mitigation strategies may include applying patches, adjusting configurations, or implementing compensating controls to lower the risk associated with the vulnerabilities.
Verification: In this phase, Harry will verify that the vulnerabilities have been successfully mitigated or remediated. This typically involves re-scanning the network to ensure that the vulnerabilities are no longer present or that their risk has been sufficiently reduced.
Remediation: This is the phase where Harry will take action to fix the vulnerabilities. Remediation can involve patching software, closing unnecessary ports, changing passwords, or other actions that directly address the identified security issues.
These phases are part of a broader vulnerability management lifecycle, which also includes assessing vulnerabilities and reassessing the network after remediation efforts to ensure continuous protection.
Reference: The explanation provided is based on the standard vulnerability management lifecycle, which includes assessment, prioritization, action (mitigation and remediation), reassessment, and improvement as outlined in cybersecurity resources123.
A, C, D
Explanation:
After completing the vulnerability scanning process and identifying serious vulnerabilities, Harry will proceed through several phases of vulnerability management to address and eradicate these vulnerabilities. The phases include:
Mitigation: This phase involves taking steps to reduce the impact of the detected vulnerabilities. Mitigation strategies may include applying patches, adjusting configurations, or implementing compensating controls to lower the risk associated with the vulnerabilities.
Verification: In this phase, Harry will verify that the vulnerabilities have been successfully mitigated or remediated. This typically involves re-scanning the network to ensure that the vulnerabilities are no longer present or that their risk has been sufficiently reduced.
Remediation: This is the phase where Harry will take action to fix the vulnerabilities. Remediation can involve patching software, closing unnecessary ports, changing passwords, or other actions that directly address the identified security issues.
These phases are part of a broader vulnerability management lifecycle, which also includes assessing vulnerabilities and reassessing the network after remediation efforts to ensure continuous protection.
Reference: The explanation provided is based on the standard vulnerability management lifecycle, which includes assessment, prioritization, action (mitigation and remediation), reassessment, and improvement as outlined in cybersecurity resources123.
Question #230
Which of the following is not part of the recommended first response steps for network defenders?
- A . Restrict yourself from doing the investigation
- B . Extract relevant data from the suspected devices as early as possible
- C . Disable virus protection
- D . Do not change the state of the suspected device
Correct Answer: C
C
Explanation:
The recommended first response steps for network defenders typically include preserving the state of the suspected devices and extracting relevant data as early as possible. Disabling virus protection is not part of the recommended first response steps because it could compromise the system’s security further and potentially destroy evidence. The primary goal in the initial response is to maintain the integrity of the system and the evidence it contains.
Reference: This approach aligns with best practices for incident response, which emphasize the importance of not altering the state of a system during the initial investigation to avoid evidence tampering or loss12.
C
Explanation:
The recommended first response steps for network defenders typically include preserving the state of the suspected devices and extracting relevant data as early as possible. Disabling virus protection is not part of the recommended first response steps because it could compromise the system’s security further and potentially destroy evidence. The primary goal in the initial response is to maintain the integrity of the system and the evidence it contains.
Reference: This approach aligns with best practices for incident response, which emphasize the importance of not altering the state of a system during the initial investigation to avoid evidence tampering or loss12.