EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Which among the following tools can help in identifying IoEs to evaluate human attack surface?
- A . securiCAD
- B . Amass
- C . Skybox
- D . SET
D
Explanation:
The tool that can help in identifying Indicators of Exposure (IoEs) to evaluate the human attack surface is the Social-Engineer Toolkit (SET). SET is designed for social engineering penetration tests and is effective in simulating phishing attacks, which are a common method to evaluate the human aspect of security. It helps in identifying the potential human vulnerabilities that could be exploited in an organization.
Reference: The EC-Council’s Certified Network Defender (CND) program includes discussions on various tools and methods for assessing and improving the security of an organization, including the human attack surface and the use of tools like SET for this purpose12.
Identify the network topology where each computer acts as a repeater and the data passes from one computer to the other in a single direction until it reaches the destination.
- A . Ring
- B . Mesh
- C . Bus
- D . Star
A
Explanation:
The network topology where each computer acts as a repeater and data passes from one computer to the other in a single direction until it reaches its destination is known as a ring topology. In a ring topology, each computer is connected to two other computers in the network, forming a circular data path. The data travels in one direction (clockwise or counterclockwise) and is passed along the ring until it reaches its intended recipient. If a device does not need the data, it simply passes it along to the next device in the ring1.
Reference: This explanation is based on standard networking principles regarding network topologies, specifically ring topology, as outlined in resources like Comparitech’s guide on network topologies1. It is consistent with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
Geon Solutions INC., had only 10 employees when it started. But as business grew, the organization had to increase the amount of staff. The network administrator is finding it difficult to accommodate an increasing number of employees in the existing network topology. So the organization is planning to implement a new topology where it will be easy to accommodate an increasing number of employees.
Which network topology will help the administrator solve the problem of needing to add new employees and expand?
- A . Bus
- B . Star
- C . Ring
- D . Mesh
B
Explanation:
The star topology is the most suitable for accommodating an increasing number of employees because it allows for easy addition of new nodes or computers without disrupting the existing network. In a star topology, each node is independently connected to a central hub. If a new employee is added, they can be connected to the hub without affecting the other nodes. This topology also simplifies troubleshooting, as each connection can be individually assessed without taking down the entire network. Furthermore, the star topology is known for its scalability and robustness, making it ideal for a growing company like Geon Solutions INC.
Reference: The information aligns with the best practices for expanding business networks as described in the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of a scalable and robust network topology for business growth12. Additionally, industry sources confirm that the star topology is recommended for large business offices due to its simplicity, scalability, and ease of expansion
John has implemented ________ in the network to restrict the limit of public IP addresses in his organization and to enhance the firewall filtering technique.
- A . DMZ
- B . Proxies
- C . VPN
- D . NAT
D
Explanation:
Network Address Translation (NAT) is a network function that translates private IP addresses into a public IP address. This technique restricts the number of public IP addresses required by an organization, as multiple devices on a private network can share a single public IP address. NAT also enhances firewall filtering techniques by hiding the internal IP addresses from the external network, which adds a layer of security by making it more difficult for attackers to target specific devices within the organization’s network. It is a common practice in network security to use NAT in conjunction with firewalls to manage the traffic entering and leaving the network, ensuring that only authorized access is permitted.
Reference: The information provided aligns with the Certified Network Defender (CND) program’s focus on network defense fundamentals, including the application of network security controls like NAT12. Additionally, NAT’s role in conserving IP addresses and providing security by hiding internal network addresses is well-documented and is part of the network security best practices345.
How is application whitelisting different from application blacklisting?
- A . It allows all applications other than the undesirable applications
- B . It allows execution of trusted applications in a unified environment
- C . It allows execution of untrusted applications in an isolated environment
- D . It rejects all applications other than the allowed applications
D
Explanation:
Application whitelisting is a security approach that allows only pre-approved applications to execute within a system or network. This method operates on a ‘default deny’ principle, meaning if an application is not explicitly listed as approved, it will not be allowed to run. This is in contrast to application blacklisting, which operates on a ‘default allow’ principle where all applications are allowed to run unless they have been specifically identified as malicious or undesirable and added to a blacklist. Whitelisting is generally considered more secure because it prevents any unapproved applications from running, which can include new or unknown threats. However, it can be more challenging to maintain as it requires a comprehensive understanding of all the necessary applications for business operations.
Reference: The concept of application whitelisting and its differentiation from blacklisting is well-documented in cybersecurity literature and aligns with the guidelines provided by the EC-Council’s Certified Network Defender (CND) program. It is also supported by various cybersecurity frameworks and best practices, including those from authoritative sources such as the National Institute of Standards and Technology (NIST).
A popular e-commerce company has recently received a lot of complaints from its customers. Most of the complaints are about the customers being redirected to some other website when trying to access the e-com site, leading to all their systems being compromised and corrupted. Upon investigation, the network admin of the firm discovered that some adversary had manipulated the company’s IP address in the domain name server’s cache.
What is such an attack called?
- A . DNS Poisoning
- B . DNS Application
- C . DNS Attacked by DDoS
- D . DNS Hijacking
A
Explanation:
The attack described is known as DNS Poisoning, also referred to as DNS Spoofing. This type of attack occurs when an attacker manipulates the DNS server’s cache, so that the server returns an incorrect IP address for a website. This results in users being redirected to malicious websites instead of the intended destination. The attacker’s goal is typically to spread malware, steal personal information, or disrupt services. DNS Poisoning is a serious security threat because it can be used to compromise entire networks and is difficult to detect.
Reference: The concept of DNS Poisoning is a well-established security concern and is covered in various cybersecurity resources as a common method of attack12345.
You are responsible for network functions and logical security throughout the corporation. Your company has over 250 servers running Windows Server 2012, 5000 workstations running Windows 10, and 200 mobile users working from laptops on Windows 8. Last week 10 of your company’s laptops were stolen from a salesman, while at a conference in Barcelona. These laptops contained proprietary company information. While doing a damage assessment, a news story leaks about a blog post containing information about the stolen laptops and the sensitive information.
What built-in Windows feature could you have implemented to protect the sensitive information on these laptops?
- A . You should have used 3DES.
- B . You should have implemented the Distributed File System (DFS).
- C . If you would have implemented Pretty Good Privacy (PGP).
- D . You could have implemented the Encrypted File System (EFS)
D
Explanation:
The Encrypted File System (EFS) is a feature of the NTFS file system available in Windows that provides filesystem-level encryption. It allows for the transparent encryption of files, protecting confidential data from attackers who might gain physical access to the computers. EFS uses a combination of symmetric key encryption and public key technology to protect files. The symmetric key, known as the File Encryption Key (FEK), is used to encrypt the file data, and then the FEK itself is encrypted with a public key associated with the user’s identity and stored with the file. This ensures that only authorized users can decrypt the encrypted files. EFS is particularly suitable for protecting sensitive data on laptops that might be lost or stolen, as it ensures that the data remains inaccessible without the appropriate encryption key.
Reference: The information about EFS is consistent with the features and capabilities as described in the Windows documentation and resources on filesystem-level encryption123.
Which of the following DDoS attacks overloads a service by sending inundate packets?
- A . Network-centric attack
- B . Application-centric attack
- C . Web-centric attack
- D . System-centric attack
A
Explanation:
In the context of DDoS (Distributed Denial of Service) attacks, a network-centric attack is one that targets the network layer of a system’s architecture. This type of attack aims to overload a service by inundating it with a flood of packets, which can be achieved through methods like ICMP floods or UDP floods. These attacks consume the bandwidth of the targeted site, effectively saturating it with traffic and preventing legitimate traffic from being processed.
Reference: The explanation provided aligns with the objectives and documents of the Certified Network Defender (CND) course, which covers various types of DDoS attacks, including network-centric attacks that focus on overwhelming a service with excessive traffic.
Individuals in the organization using system resources against acceptable usage policies indicates which of the following security incident:
- A . Malicious Code
- B . Denial-of-Service (DoS)
- C . Improper Usage
- D . Unauthorized Access
C
Explanation:
The term ‘Improper Usage’ refers to instances where individuals use system resources in a manner that is not compliant with the organization’s acceptable usage policies. This could involve a range of activities, from excessive personal use of the internet during work hours to the installation of unauthorized software. It is differentiated from ‘Unauthorized Access,’ which implies gaining access to resources one is not permitted to use, and ‘Malicious Code,’ which relates to software designed to harm or exploit systems. ‘Denial-of-Service’ refers to attacks intended to disrupt service availability.
Reference: The Certified Network Defender (CND) program by EC-Council covers the protect, detect, respond, and predict approach to network security, which includes understanding and identifying improper usage as a security incident12. The CND curriculum is designed to help network defenders understand and mitigate risks in the network, including those arising from improper usage2.
The security network team is trying to implement a firewall capable of operating only in the session layer, monitoring the TCP inter-packet link protocol to determine when a requested session is legitimate or not. Using the type of firewall, they could be able to intercept the communication, making the external network see that the firewall is the source, and facing the user, who responds from the outside is the firewall itself. They are just limiting a requirements previous listed, because they have already have a packet filtering firewall and they must add a cheap solution that meets the objective.
What kind of firewall would you recommend?
- A . Application Proxies
- B . Packet Filtering with NAT
- C . Circuit Level Gateway
- D . Application Level Gateways
C
Explanation:
A Circuit Level Gateway operates at the session layer of the OSI model. It monitors the TCP handshake to ensure that the session is legitimate and can intercept the communication. This type of firewall does not inspect the packets themselves but rather ensures that the connection is valid. It can be seen as a middleman that relays TCP connections between the user and the external network, making it appear as if the firewall is the source or destination of the communication. This is a cost-effective solution that complements the existing packet filtering firewall by adding session-level control without the need for deep packet inspection or application-level gateways, which can be more resource-intensive.
Reference: The functionality of Circuit Level Gateways is described in various cybersecurity resources, including LinkedIn’s explanation of common types of firewalls used in operating systems, which outlines how they operate at the session layer and establish virtual circuits1. Additionally, GeeksforGeeks provides an overview of the Session Layer in the OSI model, which is where Circuit Level Gateways function2.