EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #251
Which antenna’s characteristic refer to the calculation of radiated in a particular direction.
It is generally the ratio of radiation intensity in a given direction to the average radiation intensity?
- A . Radiation pattern
- B . Polarization
- C . Directivity
- D . Typical gain
Correct Answer: C
C
Explanation:
Directivity of an antenna refers to the measure of how concentrated the radiation emitted is in a single direction. It is defined as the ratio of the radiation intensity in a given direction from the antenna to the radiation intensity averaged over all directions. In simpler terms, it is the calculation of radiated power in a particular direction compared to the average radiated power in all directions. This characteristic is crucial for antennas designed to transmit or receive signals in a specific direction, making it an essential parameter for many communication systems.
Reference: The concept of directivity and its importance in antenna design is covered in the EC-Council’s Certified Network Defender (CND) course materials, which include discussions on various antenna characteristics and their impact on network security12.
C
Explanation:
Directivity of an antenna refers to the measure of how concentrated the radiation emitted is in a single direction. It is defined as the ratio of the radiation intensity in a given direction from the antenna to the radiation intensity averaged over all directions. In simpler terms, it is the calculation of radiated power in a particular direction compared to the average radiated power in all directions. This characteristic is crucial for antennas designed to transmit or receive signals in a specific direction, making it an essential parameter for many communication systems.
Reference: The concept of directivity and its importance in antenna design is covered in the EC-Council’s Certified Network Defender (CND) course materials, which include discussions on various antenna characteristics and their impact on network security12.
Question #252
Bank of America Enterprise is working on an internet and usage policy in a way to control the internet demand.
What group of policy does this belong to?
- A . Enterprise Information Security Policy
- B . Issue Specific Security Policy
- C . Network Services Specific Security Policy
- D . System Specific Security Policy
Correct Answer: B
B
Explanation:
The development of an internet and usage policy by Bankofamerica Enterprise to control internet demand falls under the category of Issue Specific Security Policy (ISSP). ISSPs are tailored to address specific areas of technology, requiring frequent updates due to changes in the technology or the environment. They provide guidelines on the acceptable use of the company’s internet services, outline the consequences of policy violations, and ensure that the internet resources are not misused.
Reference: The classification of this policy as an ISSP is consistent with the practices outlined in the ECCouncil’s Network Defender (CND) course, which emphasizes the importance of having dedicated policies for specific issues that arise within network security1.
B
Explanation:
The development of an internet and usage policy by Bankofamerica Enterprise to control internet demand falls under the category of Issue Specific Security Policy (ISSP). ISSPs are tailored to address specific areas of technology, requiring frequent updates due to changes in the technology or the environment. They provide guidelines on the acceptable use of the company’s internet services, outline the consequences of policy violations, and ensure that the internet resources are not misused.
Reference: The classification of this policy as an ISSP is consistent with the practices outlined in the ECCouncil’s Network Defender (CND) course, which emphasizes the importance of having dedicated policies for specific issues that arise within network security1.
Question #253
Jason has set a firewall policy that allows only a specific list of network services and denies everything else. This strategy is known as a ____________.
- A . Default allow
- B . Default access
- C . Default accept
- D . Default deny
Correct Answer: D
D
Explanation:
The strategy described is known as a “default deny” firewall policy. This approach means that the firewall is configured to deny all traffic by default, except for the network services that are explicitly allowed. It is a restrictive security stance where only specified services are permitted, and everything else is blocked. This is considered a best practice in firewall configuration because it minimizes the attack surface by ensuring that only necessary services are accessible, thereby reducing the potential vectors for attack.
Reference: The concept of a default deny policy is a fundamental principle in network security and is advocated by various cybersecurity authorities, including the EC-Council’s Certified Network Defender (CND) program. It is also detailed in cybersecurity literature and aligns with best practices from organizations such as the National Institute of Standards and Technology (NIST)123.
D
Explanation:
The strategy described is known as a “default deny” firewall policy. This approach means that the firewall is configured to deny all traffic by default, except for the network services that are explicitly allowed. It is a restrictive security stance where only specified services are permitted, and everything else is blocked. This is considered a best practice in firewall configuration because it minimizes the attack surface by ensuring that only necessary services are accessible, thereby reducing the potential vectors for attack.
Reference: The concept of a default deny policy is a fundamental principle in network security and is advocated by various cybersecurity authorities, including the EC-Council’s Certified Network Defender (CND) program. It is also detailed in cybersecurity literature and aligns with best practices from organizations such as the National Institute of Standards and Technology (NIST)123.
Question #254
Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago. He has focused primarily on securing network devices, firewalls, and traffic traversing in and
out of the network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets.
What is this type of server called?
- A . Bastion host
- B . Edge transport server
- C . SOCKS hsot
- D . Session layer firewall
Correct Answer: A
A
Explanation:
The server described in the question is known as a Bastion host. A Bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. It is typically placed in a network’s demilitarized zone (DMZ) and acts as a proxy server, offering limited services and filtering packets to protect the internal private network from the public network. It is hardened due to its exposure to potential attacks and usually hosts a single application, like a proxy server, while all other services are removed or limited to reduce the threat surface1.
Reference: The definition and role of a Bastion host align with the objectives and documents of the EC-Council’s Certified Network Defender (CND) course, which emphasizes the importance of securing network devices and managing traffic between internal and external networks1
A
Explanation:
The server described in the question is known as a Bastion host. A Bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. It is typically placed in a network’s demilitarized zone (DMZ) and acts as a proxy server, offering limited services and filtering packets to protect the internal private network from the public network. It is hardened due to its exposure to potential attacks and usually hosts a single application, like a proxy server, while all other services are removed or limited to reduce the threat surface1.
Reference: The definition and role of a Bastion host align with the objectives and documents of the EC-Council’s Certified Network Defender (CND) course, which emphasizes the importance of securing network devices and managing traffic between internal and external networks1
Question #255
Jason has set a firewall policy that allows only a specific list of network services and deny everything else. This strategy is known as a____________.
- A . Default allow
- B . Default deny
- C . Default restrict
- D . Default access
Correct Answer: B
B
Explanation:
The strategy Jason has set up is known as a Default Deny policy. This approach to network security is designed to block all access by default, only allowing services that are explicitly permitted. This is a more secure posture compared to the Default Allow policy, which allows all traffic unless it is specifically blocked. The Default Deny strategy aligns with the principle of least privilege, ensuring that only the minimum necessary access is granted, thereby reducing the attack surface and potential for unauthorized access.
Reference: The concept of Default Deny is a fundamental security posture that is widely recognized and implemented in various cybersecurity frameworks and guidelines. It is also a key feature of the Zero Trust security model, which does not inherently trust any user or device inside or outside the network perimeter and requires continuous verification and authorization for any access attempt.
B
Explanation:
The strategy Jason has set up is known as a Default Deny policy. This approach to network security is designed to block all access by default, only allowing services that are explicitly permitted. This is a more secure posture compared to the Default Allow policy, which allows all traffic unless it is specifically blocked. The Default Deny strategy aligns with the principle of least privilege, ensuring that only the minimum necessary access is granted, thereby reducing the attack surface and potential for unauthorized access.
Reference: The concept of Default Deny is a fundamental security posture that is widely recognized and implemented in various cybersecurity frameworks and guidelines. It is also a key feature of the Zero Trust security model, which does not inherently trust any user or device inside or outside the network perimeter and requires continuous verification and authorization for any access attempt.
Question #256
What defines the maximum time period an organization is willing to lose data during a major IT outage event?
- A . BC
- B . RTO
- C . DR
- D . RPO
Correct Answer: D
D
Explanation:
The term that defines the maximum time period an organization is willing to lose data during a major IT outage event is known as the Recovery Point Objective (RPO). RPO is a critical concept in business continuity and disaster recovery planning. It represents the maximum age of the files that an organization must recover from backup storage for normal operations to resume after a disaster. In other words, it’s the maximum amount of data loss an organization can tolerate. For instance, if an RPO is set to one hour, the system must be backed up at least every hour so that in case of a system failure, no more than one hour’s worth of data is lost.
Reference: The explanation provided is based on standard definitions and practices within the field of IT disaster recovery, as outlined in resources like the EC-Council’s Certified Network Defender (CND) course and other industry-standard documentation on business continuity and disaster recovery planning.
D
Explanation:
The term that defines the maximum time period an organization is willing to lose data during a major IT outage event is known as the Recovery Point Objective (RPO). RPO is a critical concept in business continuity and disaster recovery planning. It represents the maximum age of the files that an organization must recover from backup storage for normal operations to resume after a disaster. In other words, it’s the maximum amount of data loss an organization can tolerate. For instance, if an RPO is set to one hour, the system must be backed up at least every hour so that in case of a system failure, no more than one hour’s worth of data is lost.
Reference: The explanation provided is based on standard definitions and practices within the field of IT disaster recovery, as outlined in resources like the EC-Council’s Certified Network Defender (CND) course and other industry-standard documentation on business continuity and disaster recovery planning.
Question #257
Which of the following is true regarding any attack surface?
- A . Decrease in vulnerabilities decreases the attack surface
- B . Increase in vulnerabilities decreases the attack surface
- C . Decrease in risk exposures increases the attack surface
- D . Decrease in vulnerabilities increases the attack surface
Correct Answer: A
A
Explanation:
The attack surface of a system refers to the sum of all potential points where an unauthorized user can try to enter or extract data from that system. It encompasses all the vulnerabilities, including software flaws, unsecured network ports, and unprotected system endpoints. Therefore, when vulnerabilities are decreased, the attack surface is reduced because there are fewer opportunities for an attacker to exploit. This is a fundamental concept in network security, as reducing the attack surface is a critical step in protecting systems against unauthorized access and potential breaches.
Reference: The explanation aligns with the definitions and concepts of attack surfaces as described in network security literature and the Certified Network Defender (CND) course, which emphasizes the importance of minimizing vulnerabilities to reduce the overall attack surface123.
A
Explanation:
The attack surface of a system refers to the sum of all potential points where an unauthorized user can try to enter or extract data from that system. It encompasses all the vulnerabilities, including software flaws, unsecured network ports, and unprotected system endpoints. Therefore, when vulnerabilities are decreased, the attack surface is reduced because there are fewer opportunities for an attacker to exploit. This is a fundamental concept in network security, as reducing the attack surface is a critical step in protecting systems against unauthorized access and potential breaches.
Reference: The explanation aligns with the definitions and concepts of attack surfaces as described in network security literature and the Certified Network Defender (CND) course, which emphasizes the importance of minimizing vulnerabilities to reduce the overall attack surface123.
Question #257
Which of the following is true regarding any attack surface?
- A . Decrease in vulnerabilities decreases the attack surface
- B . Increase in vulnerabilities decreases the attack surface
- C . Decrease in risk exposures increases the attack surface
- D . Decrease in vulnerabilities increases the attack surface
Correct Answer: A
A
Explanation:
The attack surface of a system refers to the sum of all potential points where an unauthorized user can try to enter or extract data from that system. It encompasses all the vulnerabilities, including software flaws, unsecured network ports, and unprotected system endpoints. Therefore, when vulnerabilities are decreased, the attack surface is reduced because there are fewer opportunities for an attacker to exploit. This is a fundamental concept in network security, as reducing the attack surface is a critical step in protecting systems against unauthorized access and potential breaches.
Reference: The explanation aligns with the definitions and concepts of attack surfaces as described in network security literature and the Certified Network Defender (CND) course, which emphasizes the importance of minimizing vulnerabilities to reduce the overall attack surface123.
A
Explanation:
The attack surface of a system refers to the sum of all potential points where an unauthorized user can try to enter or extract data from that system. It encompasses all the vulnerabilities, including software flaws, unsecured network ports, and unprotected system endpoints. Therefore, when vulnerabilities are decreased, the attack surface is reduced because there are fewer opportunities for an attacker to exploit. This is a fundamental concept in network security, as reducing the attack surface is a critical step in protecting systems against unauthorized access and potential breaches.
Reference: The explanation aligns with the definitions and concepts of attack surfaces as described in network security literature and the Certified Network Defender (CND) course, which emphasizes the importance of minimizing vulnerabilities to reduce the overall attack surface123.
Question #259
John wants to implement a firewall service that works at the session layer of the OSI model. The firewall must also have the ability to hide the private network information.
Which type of firewall service is John thinking of implementing?
- A . Application level gateway
- B . Stateful Multilayer Inspection
- C . Circuit level gateway
- D . Packet Filtering
Correct Answer: C
C
Explanation:
A circuit level gateway is a type of firewall that operates at the session layer of the OSI model, which is Layer 5. This kind of firewall is designed to provide security by validating and managing sessions without inspecting the actual contents of each packet. It is particularly adept at hiding the private network information because it only allows traffic through that is part of an established session, effectively masking the details of the network’s internal structure from the outside. This makes it an ideal choice for John’s requirements.
Reference: The information about circuit level gateways operating at the session layer and their ability to hide private network information is supported by multiple sources within the field, including educational resources and security-focused articles123. Additionally, the ECCouncil’s Certified Network Defender (CND) program covers the necessary knowledge regarding network security and defense strategies, which includes understanding the functions and applications of different types of firewalls45.
C
Explanation:
A circuit level gateway is a type of firewall that operates at the session layer of the OSI model, which is Layer 5. This kind of firewall is designed to provide security by validating and managing sessions without inspecting the actual contents of each packet. It is particularly adept at hiding the private network information because it only allows traffic through that is part of an established session, effectively masking the details of the network’s internal structure from the outside. This makes it an ideal choice for John’s requirements.
Reference: The information about circuit level gateways operating at the session layer and their ability to hide private network information is supported by multiple sources within the field, including educational resources and security-focused articles123. Additionally, the ECCouncil’s Certified Network Defender (CND) program covers the necessary knowledge regarding network security and defense strategies, which includes understanding the functions and applications of different types of firewalls45.
Question #260
John is working as a network defender at a well-reputed multinational company. He wanted to implement security that can help him identify any future attacks that can be targeted toward his organization and take appropriate security measures and actions beforehand to defend against them.
Which one of the following security defense techniques should be implement?
- A . Reactive security approach
- B . Retrospective security approach
- C . Proactive security approach
- D . Preventive security approach
Correct Answer: C
C
Explanation:
John should implement a Proactive security approach. This approach is part of the adaptive security strategy that is built on a 4-pronged approach ― Protect, Detect, Respond, and Predict1. By being proactive, John can anticipate potential threats and vulnerabilities and take steps to mitigate them before they can be exploited. This is in contrast to reactive or retrospective approaches, which deal with threats after they have occurred. The proactive approach is aligned with the Certified Network Defender (CND) program’s emphasis on preparing network defenders to identify parts of an organization that need to be reviewed and tested for security vulnerabilities, and how to reduce, prevent, and mitigate risks in the network2345.
Reference: EC-Council’s Certified Network Defender (CND) course outline and key features2. Information on the CND certification and its focus on proactive defense strategies3. Description of the adaptive security strategy, including the proactive approach, from the CND program1.
Details on the protect, detect, respond, and predict approach to network security covered in the CND program4.
Additional insights into the CND training and its emphasis on proactive security measures5.
C
Explanation:
John should implement a Proactive security approach. This approach is part of the adaptive security strategy that is built on a 4-pronged approach ― Protect, Detect, Respond, and Predict1. By being proactive, John can anticipate potential threats and vulnerabilities and take steps to mitigate them before they can be exploited. This is in contrast to reactive or retrospective approaches, which deal with threats after they have occurred. The proactive approach is aligned with the Certified Network Defender (CND) program’s emphasis on preparing network defenders to identify parts of an organization that need to be reviewed and tested for security vulnerabilities, and how to reduce, prevent, and mitigate risks in the network2345.
Reference: EC-Council’s Certified Network Defender (CND) course outline and key features2. Information on the CND certification and its focus on proactive defense strategies3. Description of the adaptive security strategy, including the proactive approach, from the CND program1.
Details on the protect, detect, respond, and predict approach to network security covered in the CND program4.
Additional insights into the CND training and its emphasis on proactive security measures5.