EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #261
Which wireless networking topology setup requires same channel name and SSID?
- A . Ad-Hoc standalone network architecture
- B . Infrastructure network topology
- C . Hybrid topology
- D . Mesh topology
Correct Answer: B
B
Explanation:
In an infrastructure network topology, all wireless devices communicate through an access point/base station. The access point serves as the central transmitter and receiver of wireless radio signals. Mainstream wireless APs support the configuration of the same channel name (frequency) and SSID (Service Set Identifier) to facilitate seamless communication between devices. This setup is essential for devices to identify and connect to the correct network, especially in environments where multiple networks may overlap.
Reference: The information aligns with standard networking practices and the objectives of the EC-Council’s Certified Network Defender (CND) program, which emphasizes understanding and implementing network security controls and protocols.
B
Explanation:
In an infrastructure network topology, all wireless devices communicate through an access point/base station. The access point serves as the central transmitter and receiver of wireless radio signals. Mainstream wireless APs support the configuration of the same channel name (frequency) and SSID (Service Set Identifier) to facilitate seamless communication between devices. This setup is essential for devices to identify and connect to the correct network, especially in environments where multiple networks may overlap.
Reference: The information aligns with standard networking practices and the objectives of the EC-Council’s Certified Network Defender (CND) program, which emphasizes understanding and implementing network security controls and protocols.
Question #262
Which of the following is a best practice for wireless network security?
- A . Enabling the remote router login
- B . Do not changing the default SSID
- C . Do not placing packet filter between the AP and the corporate intranet
- D . Using SSID cloaking
Correct Answer: D
D
Explanation:
SSID cloaking is a security measure that involves hiding the Service Set Identifier (SSID) of a wireless network from being broadcasted openly. This prevents the SSID from appearing in the list of available networks on devices within range, reducing the likelihood of unauthorized access attempts. While it does not provide complete security on its own, it is considered a layer of defense that can deter casual attempts to connect to a network. It is important to note that SSID cloaking should be used in conjunction with other security measures, such as strong encryption and authentication protocols, to effectively secure a wireless network.
Reference: The best practices for wireless network security include using strong passwords, enabling encryption, and employing security measures like SSID cloaking to minimize the visibility of the network to unauthorized users12. These practices are aligned with the objectives and guidelines provided by the EC-Council’s Certified Network Defender (CND) program.
D
Explanation:
SSID cloaking is a security measure that involves hiding the Service Set Identifier (SSID) of a wireless network from being broadcasted openly. This prevents the SSID from appearing in the list of available networks on devices within range, reducing the likelihood of unauthorized access attempts. While it does not provide complete security on its own, it is considered a layer of defense that can deter casual attempts to connect to a network. It is important to note that SSID cloaking should be used in conjunction with other security measures, such as strong encryption and authentication protocols, to effectively secure a wireless network.
Reference: The best practices for wireless network security include using strong passwords, enabling encryption, and employing security measures like SSID cloaking to minimize the visibility of the network to unauthorized users12. These practices are aligned with the objectives and guidelines provided by the EC-Council’s Certified Network Defender (CND) program.
Question #263
A VPN Concentrator acts as a bidirectional tunnel endpoint among host machines.
What are the other f unction(s) of the device? (Select all that apply)
- A . Provides access memory, achieving high efficiency
- B . Assigns user addresses
- C . Enables input/output (I/O) operations
- D . Manages security keys
Correct Answer: B,D
B,D
Explanation:
A VPN Concentrator is a network device designed to manage VPN traffic for multiple users. It acts as a bidirectional tunnel endpoint among host machines and has several key functions. Firstly, it assigns user addresses to enable individual identification within the network. Secondly, it manages security keys which are essential for the encryption and decryption processes, ensuring secure data transmission. The concentrator is responsible for authenticating remote users and granting access to the network after verifying their credentials. It also handles the heavy lifting of encryption and decryption, maintaining the integrity and confidentiality of data traffic12.
Reference: The Palo Alto Networks article on “What Is a VPN Concentrator?” provides a detailed explanation of how a VPN Concentrator works, including its role in managing VPN connections and ensuring secure remote access1.
Privacy Affairs’ article on “What is a VPN Concentrator and How does it Work?” discusses the functions of a VPN Concentrator, including user authentication and management of cryptographic keys2.
B,D
Explanation:
A VPN Concentrator is a network device designed to manage VPN traffic for multiple users. It acts as a bidirectional tunnel endpoint among host machines and has several key functions. Firstly, it assigns user addresses to enable individual identification within the network. Secondly, it manages security keys which are essential for the encryption and decryption processes, ensuring secure data transmission. The concentrator is responsible for authenticating remote users and granting access to the network after verifying their credentials. It also handles the heavy lifting of encryption and decryption, maintaining the integrity and confidentiality of data traffic12.
Reference: The Palo Alto Networks article on “What Is a VPN Concentrator?” provides a detailed explanation of how a VPN Concentrator works, including its role in managing VPN connections and ensuring secure remote access1.
Privacy Affairs’ article on “What is a VPN Concentrator and How does it Work?” discusses the functions of a VPN Concentrator, including user authentication and management of cryptographic keys2.
Question #264
Which of the following is consumed into SIEM solutions to take control of chaos, gain in-depth knowledge of threats, eliminate false positives, and implement proactive intelligence-driven defense?
- A . Threat intelligence sources
- B . Threat intelligence feeds
- C . Threat intelligence platform
- D . Threat intelligence professional services
Correct Answer: B
B
Explanation:
SIEM (Security Information and Event Management) solutions are designed to provide a comprehensive view of an organization’s security status by collecting and analyzing security-related data from various sources. To enhance their capabilities, SIEM solutions consume threat intelligence feeds, which are streams of data that provide information about current and potential security threats. These feeds include details such as indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs) used by cybercriminals, and vulnerabilities in software or systems. By integrating threat intelligence feeds, SIEM solutions can improve real-time threat detection, reduce false positives, and support proactive, intelligence-driven defense strategies. This integration allows organizations to stay one step ahead of emerging threats and advisories, providing insights into the attacker’s TTPs and associated IoCs that can accelerate investigation and response efforts1.
Reference: The explanation is based on the general knowledge of SIEM solutions and their use of threat intelligence feeds to enhance security operations. For detailed and specific references, please consult the latest Certified Network Defender (CND) study materials and documents provided by the EC-Council.
B
Explanation:
SIEM (Security Information and Event Management) solutions are designed to provide a comprehensive view of an organization’s security status by collecting and analyzing security-related data from various sources. To enhance their capabilities, SIEM solutions consume threat intelligence feeds, which are streams of data that provide information about current and potential security threats. These feeds include details such as indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs) used by cybercriminals, and vulnerabilities in software or systems. By integrating threat intelligence feeds, SIEM solutions can improve real-time threat detection, reduce false positives, and support proactive, intelligence-driven defense strategies. This integration allows organizations to stay one step ahead of emerging threats and advisories, providing insights into the attacker’s TTPs and associated IoCs that can accelerate investigation and response efforts1.
Reference: The explanation is based on the general knowledge of SIEM solutions and their use of threat intelligence feeds to enhance security operations. For detailed and specific references, please consult the latest Certified Network Defender (CND) study materials and documents provided by the EC-Council.
Question #265
You want to increase your network security implementing a technology that only allows certain MAC addresses in specific ports in the switches; which one of the above is the best choice?
- A . Port Security
- B . Port Detection
- C . Port Authorization
- D . Port Knocking
Correct Answer: A
A
Explanation:
Port Security is a network security feature on switches that allows the specification of which MAC addresses are permitted on each physical port. When Port Security is enabled, the switch will only permit traffic from the allowed MAC addresses to pass through the specified port, effectively preventing unauthorized devices from accessing the network through that port. This feature is particularly useful for controlling access on a network and ensuring that only known devices can communicate through the switch, thereby increasing the security of the network.
Reference: The information provided is consistent with standard network security practices and the functionalities of Port Security as described in network security resources and documentation123.
A
Explanation:
Port Security is a network security feature on switches that allows the specification of which MAC addresses are permitted on each physical port. When Port Security is enabled, the switch will only permit traffic from the allowed MAC addresses to pass through the specified port, effectively preventing unauthorized devices from accessing the network through that port. This feature is particularly useful for controlling access on a network and ensuring that only known devices can communicate through the switch, thereby increasing the security of the network.
Reference: The information provided is consistent with standard network security practices and the functionalities of Port Security as described in network security resources and documentation123.
Question #266
Which firewall can a network administrator use for better bandwidth management, deep packet inspection, and Hateful inspection?
- A . Circuit-level gateway firewall
- B . Next generation firewall
- C . Network address translation
- D . Stateful muIti-layer inspection firewall
Correct Answer: B
B
Explanation:
The next generation firewall (NGFW) is designed to address the requirements of better bandwidth management, deep packet inspection, and advanced inspection capabilities. Unlike traditional firewalls, NGFWs include additional features such as application awareness and control, integrated intrusion prevention, and cloud-delivered threat intelligence. They are capable of performing deeper inspections at Layer 7, identifying applications, and enforcing security policies more effectively. This makes them suitable for managing bandwidth efficiently, conducting deep packet inspection to prevent advanced threats, and performing thorough inspections for harmful activities1234.
Reference: EC-Council’s Certified Network Defender (CND) program outlines the importance of understanding and using IDS/IPS technologies and configuring optimum firewall solutions, which aligns with the capabilities of NGFWs5.
The CND course also emphasizes the protect, detect, respond, and predict approach to network security, which is a core feature of NGFWs6.
Additional information on NGFWs and their role in network security can be found in the detailed descriptions provided by various cybersecurity resources1234.
B
Explanation:
The next generation firewall (NGFW) is designed to address the requirements of better bandwidth management, deep packet inspection, and advanced inspection capabilities. Unlike traditional firewalls, NGFWs include additional features such as application awareness and control, integrated intrusion prevention, and cloud-delivered threat intelligence. They are capable of performing deeper inspections at Layer 7, identifying applications, and enforcing security policies more effectively. This makes them suitable for managing bandwidth efficiently, conducting deep packet inspection to prevent advanced threats, and performing thorough inspections for harmful activities1234.
Reference: EC-Council’s Certified Network Defender (CND) program outlines the importance of understanding and using IDS/IPS technologies and configuring optimum firewall solutions, which aligns with the capabilities of NGFWs5.
The CND course also emphasizes the protect, detect, respond, and predict approach to network security, which is a core feature of NGFWs6.
Additional information on NGFWs and their role in network security can be found in the detailed descriptions provided by various cybersecurity resources1234.
Question #267
The IR team and the network administrator have successfully handled a malware incident on the network. The team is now preparing countermeasure guideline to avoid a future occurrence of the malware incident.
Which of the following countermeasure(s) should be added to deal with future malware incidents? (Select all that apply)
- A . Complying with the company’s security policies
- B . Implementing strong authentication schemes
- C . Implementing a strong password policy
- D . Install antivirus software
Correct Answer: A B C D
A B C D
Explanation:
The countermeasures to deal with future malware incidents involve a multi-layered approach that includes:
Complying with the company’s security policies: Ensuring that all security policies are followed can prevent malware incidents by maintaining a secure network environment.
Implementing strong authentication schemes: Strong authentication can prevent unauthorized access, reducing the risk of malware being introduced by attackers.
Implementing a strong password policy: Robust password policies can deter attackers by making it more difficult to gain access through brute force or other password-related attacks.
Install antivirus software: Antivirus software is essential for detecting, preventing, and removing malware from the network.
These measures align with the Certified Network Defender (CND) program’s emphasis on a defense-
in-depth strategy, which includes protecting endpoints, data, and networks, as well as continuous threat monitoring and response123.
Reference: Certified Network Defender (CND) course material and study guide.
EC-Council’s official Certified Network Defender (CND) resources123.
A B C D
Explanation:
The countermeasures to deal with future malware incidents involve a multi-layered approach that includes:
Complying with the company’s security policies: Ensuring that all security policies are followed can prevent malware incidents by maintaining a secure network environment.
Implementing strong authentication schemes: Strong authentication can prevent unauthorized access, reducing the risk of malware being introduced by attackers.
Implementing a strong password policy: Robust password policies can deter attackers by making it more difficult to gain access through brute force or other password-related attacks.
Install antivirus software: Antivirus software is essential for detecting, preventing, and removing malware from the network.
These measures align with the Certified Network Defender (CND) program’s emphasis on a defense-
in-depth strategy, which includes protecting endpoints, data, and networks, as well as continuous threat monitoring and response123.
Reference: Certified Network Defender (CND) course material and study guide.
EC-Council’s official Certified Network Defender (CND) resources123.
Question #268
Which of the following is a database encryption feature that secures sensitive data by encrypting it in client applications without revealing the encrypted keys to the data engine in MS SQL Server?
- A . IsEncrypted Enabled
- B . NeverEncrypted disabled
- C . Allow Encrypted
- D . Always Encrypted
Correct Answer: D
D
Explanation:
The ‘Always Encrypted’ feature in MS SQL Server is designed to protect sensitive data by performing encryption within client applications. It ensures that the encryption keys are never revealed to the Database Engine. This separation between data owners and data managers provides a secure environment where on-premises database administrators or cloud database operators do not have access to the encryption keys. Always Encrypted allows for a secure storage of sensitive data in the cloud and reduces the risk of data theft by malicious insiders1.
Reference: The information provided is based on the official Microsoft documentation for the Always Encrypted feature in SQL Server123.
D
Explanation:
The ‘Always Encrypted’ feature in MS SQL Server is designed to protect sensitive data by performing encryption within client applications. It ensures that the encryption keys are never revealed to the Database Engine. This separation between data owners and data managers provides a secure environment where on-premises database administrators or cloud database operators do not have access to the encryption keys. Always Encrypted allows for a secure storage of sensitive data in the cloud and reduces the risk of data theft by malicious insiders1.
Reference: The information provided is based on the official Microsoft documentation for the Always Encrypted feature in SQL Server123.
Question #269
Your company is planning to use an uninterruptible power supply (UPS) to avoid damage from power fluctuations. As a network administrator, you need to suggest an appropriate UPS solution suitable for specific resources or conditions.
Match the type of UPS with the use and advantage:
- A . 1-v,2-iv,3-iii,4-i
- B . 1-v,2-iii,3-i,4-ii
- C . 1-iii,2-iv,3-v,4-iv
- D . 1-i,2-iv,3-ii,4-v
Correct Answer: A
A
Explanation:
To provide an accurate answer, I would need to know the specific types of UPS and their corresponding uses and advantages as they relate to the options provided (i.e., 1-v, 2-iv, etc.).
However, based on general knowledge, the three main types of UPS systems are:
Standby UPS (Offline UPS): Provides basic protection and is suitable for less critical equipment or environments with fewer power fluctuations.
Line-Interactive UPS: Offers a moderate level of protection with the ability to correct minor power fluctuations without switching to battery, making it suitable for business environments.
Online UPS (Double Conversion UPS): Delivers the highest level of protection by continuously converting incoming AC power to DC and back to AC, ensuring a consistent and clean power supply suitable for critical and sensitive equipment.
Without the specific context or details provided in the question, it’s challenging to match these types to the given options accurately. Typically, the selection of a UPS type would depend on the criticality of the systems it’s protecting, the environment, and the budget available.
Reference: The general descriptions of the UPS types are based on industry-standard practices and can be found in various educational resources on UPS systems123.
A
Explanation:
To provide an accurate answer, I would need to know the specific types of UPS and their corresponding uses and advantages as they relate to the options provided (i.e., 1-v, 2-iv, etc.).
However, based on general knowledge, the three main types of UPS systems are:
Standby UPS (Offline UPS): Provides basic protection and is suitable for less critical equipment or environments with fewer power fluctuations.
Line-Interactive UPS: Offers a moderate level of protection with the ability to correct minor power fluctuations without switching to battery, making it suitable for business environments.
Online UPS (Double Conversion UPS): Delivers the highest level of protection by continuously converting incoming AC power to DC and back to AC, ensuring a consistent and clean power supply suitable for critical and sensitive equipment.
Without the specific context or details provided in the question, it’s challenging to match these types to the given options accurately. Typically, the selection of a UPS type would depend on the criticality of the systems it’s protecting, the environment, and the budget available.
Reference: The general descriptions of the UPS types are based on industry-standard practices and can be found in various educational resources on UPS systems123.
Question #270
What should a network administrator perform to execute/test the untrusted or untested programs or code from untrusted or unverified third-parties without risking the host system or OS?
- A . Application Whitelisting
- B . Application Blacklisting
- C . Deployment of WAFs
- D . Application Sandboxing
Correct Answer: D
D
Explanation:
Application sandboxing is a security technique that allows untrusted or untested programs or code to be executed in a separate, restricted environment known as a sandbox. This environment is isolated from the host system and operating system, ensuring that any potential malicious behavior contained within the code cannot affect the host. It’s a way to test and execute third-party applications without risking the integrity or security of the main system. Sandboxing provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory, which prevents the programs from affecting other processes and data on the host system.
Reference: The concept of application sandboxing is covered in the EC-Council’s Certified Network Defender (CND) program, which includes key topics such as application whitelisting, blacklisting, and sandboxing. The hands-on lab exercises in the CND program help demonstrate skills in these areas, including application sandboxing1.
D
Explanation:
Application sandboxing is a security technique that allows untrusted or untested programs or code to be executed in a separate, restricted environment known as a sandbox. This environment is isolated from the host system and operating system, ensuring that any potential malicious behavior contained within the code cannot affect the host. It’s a way to test and execute third-party applications without risking the integrity or security of the main system. Sandboxing provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory, which prevents the programs from affecting other processes and data on the host system.
Reference: The concept of application sandboxing is covered in the EC-Council’s Certified Network Defender (CND) program, which includes key topics such as application whitelisting, blacklisting, and sandboxing. The hands-on lab exercises in the CND program help demonstrate skills in these areas, including application sandboxing1.