EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #271
Who is an IR custodian?
- A . An individual responsible for conveying company details after an incident
- B . An individual who receives the initial IR alerts and leads the IR team in all the IR activities
- C . An individual who makes a decision on the classifications and the severity of the incident identified
- D . An individual responsible for the remediation and resolution of the incident that occurred
Correct Answer: C
C
Explanation:
An IR custodian is typically responsible for making decisions on the classifications and the severity of the incident identified. This role involves determining the impact of the incident, categorizing its severity, and guiding the appropriate response according to the organization’s incident response plan. The custodian plays a critical role in the incident response process by ensuring that incidents are properly identified, classified, and escalated to the relevant parties for further action.
Reference: The information provided aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which includes understanding the roles and responsibilities within an incident response team. For more detailed information, refer to the official CND study guide and materials provided by the EC-Council.
C
Explanation:
An IR custodian is typically responsible for making decisions on the classifications and the severity of the incident identified. This role involves determining the impact of the incident, categorizing its severity, and guiding the appropriate response according to the organization’s incident response plan. The custodian plays a critical role in the incident response process by ensuring that incidents are properly identified, classified, and escalated to the relevant parties for further action.
Reference: The information provided aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which includes understanding the roles and responsibilities within an incident response team. For more detailed information, refer to the official CND study guide and materials provided by the EC-Council.
Question #272
Which encryption algorithm does S/MIME protocol implement for digital signatures in emails?
- A . Rivest-Shamir-Adleman encryption
- B . Digital Encryption Standard
- C . Triple Data Encryption Standard
- D . Advanced Encryption Standard
Correct Answer: A
A
Explanation:
S/MIME (Secure/Multipurpose Internet Mail Extensions) protocol implements the Rivest-Shamir-Adleman (RSA) encryption algorithm for digital signatures in emails. Digital signatures are a key component of S/MIME, providing authentication, message integrity, and non-repudiation. RSA is a widely used public-key cryptosystem that facilitates secure data transmission and is known for its role in digital signatures. It works on the principle of asymmetric cryptography, where a pair of keys is used: a public key, which is shared openly, and a private key, which is kept secret by the owner. In the context of S/MIME, the sender’s email client uses the sender’s private key to create a digital signature, and the recipient’s email client uses the sender’s public key to verify the signature.
Reference: The information provided is based on the S/MIME protocol’s use of RSA encryption for digital signatures, as detailed in industry-standard documentation and resources like Microsoft Learn1 and the S/MIME Wikipedia page2.
A
Explanation:
S/MIME (Secure/Multipurpose Internet Mail Extensions) protocol implements the Rivest-Shamir-Adleman (RSA) encryption algorithm for digital signatures in emails. Digital signatures are a key component of S/MIME, providing authentication, message integrity, and non-repudiation. RSA is a widely used public-key cryptosystem that facilitates secure data transmission and is known for its role in digital signatures. It works on the principle of asymmetric cryptography, where a pair of keys is used: a public key, which is shared openly, and a private key, which is kept secret by the owner. In the context of S/MIME, the sender’s email client uses the sender’s private key to create a digital signature, and the recipient’s email client uses the sender’s public key to verify the signature.
Reference: The information provided is based on the S/MIME protocol’s use of RSA encryption for digital signatures, as detailed in industry-standard documentation and resources like Microsoft Learn1 and the S/MIME Wikipedia page2.
Question #273
Syslog and SNMP are the two main _______ protocols through which log records are transferred.
- A . Pull-based
- B . Push-based
- C . Host-based
- D . Network-based
Correct Answer: B
B
Explanation:
Syslog and SNMP (Simple Network Management Protocol) are protocols used for different purposes in network management and monitoring. Syslog is primarily a standard for message logging, used to collect system event information from various systems and devices, and it typically sends log data to a centralized Syslog server. SNMP, on the other hand, is used to manage and monitor network devices, and it can send alerts or ‘traps’ to a management station. Both Syslog and SNMP are considered push-based protocols because the information is generally sent (or ‘pushed’) from the devices to the server or management station without the server requesting (or ‘pulling’) the data1234.
Reference: The information provided here is based on standard network management practices and the functionalities of Syslog and SNMP as outlined in network management and monitoring literature. For more detailed information, please refer to the official Certified Network Defender (CND) study materials and documents provided by the EC-Council.
B
Explanation:
Syslog and SNMP (Simple Network Management Protocol) are protocols used for different purposes in network management and monitoring. Syslog is primarily a standard for message logging, used to collect system event information from various systems and devices, and it typically sends log data to a centralized Syslog server. SNMP, on the other hand, is used to manage and monitor network devices, and it can send alerts or ‘traps’ to a management station. Both Syslog and SNMP are considered push-based protocols because the information is generally sent (or ‘pushed’) from the devices to the server or management station without the server requesting (or ‘pulling’) the data1234.
Reference: The information provided here is based on standard network management practices and the functionalities of Syslog and SNMP as outlined in network management and monitoring literature. For more detailed information, please refer to the official Certified Network Defender (CND) study materials and documents provided by the EC-Council.
Question #274
As a network administrator, you have implemented WPA2 encryption in your corporate wireless network. The WPA2’s _________integrity check mechanism provides security against a replay attack
- A . CRC-32
- B . CRC-MAC
- C . CBC-MAC
- D . CBC-32
Correct Answer: C
C
Explanation:
The integrity check mechanism used by WPA2 to provide security against replay attacks is the Cipher Block Chaining Message Authentication Code (CBC-MAC). This mechanism is part of the protocol suite that ensures data integrity and authenticity by using a combination of cipher block chaining (CBC) and message authentication code (MAC) to produce a secure and unique code for each data packet.
Reference: This information is consistent with the security protocols outlined in WPA2 standards, which specify the use of CBC-MAC for integrity checks12.
C
Explanation:
The integrity check mechanism used by WPA2 to provide security against replay attacks is the Cipher Block Chaining Message Authentication Code (CBC-MAC). This mechanism is part of the protocol suite that ensures data integrity and authenticity by using a combination of cipher block chaining (CBC) and message authentication code (MAC) to produce a secure and unique code for each data packet.
Reference: This information is consistent with the security protocols outlined in WPA2 standards, which specify the use of CBC-MAC for integrity checks12.
Question #275
Which encryption algorithm is used by WPA3 encryption?
- A . RC4
- B . RC4, TKIP
- C . AES-CCMP
- D . AES-GCMP 256
Correct Answer: D
D
Explanation:
WPA3 encryption utilizes the AES-GCMP 256 algorithm. This is an advanced encryption standard that uses Galois/Counter Mode Protocol (GCMP) with a 256-bit key length. It provides a higher level of security than the previous encryption methods used in WPA2, which included AES-CCMP with a 128-bit key. The use of a 256-bit key in AES-GCMP makes it more resistant to brute-force attacks and provides better data protection.
Reference: The information provided here is based on the latest security standards for wireless networks as outlined by the Wi-Fi Alliance and documented sources like Cisco Meraki and TechTarget, which detail the encryption methods used in WPA3123. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the explanation aligns with the general knowledge of network security practices and the use of WPA3 for secure wireless communication.
D
Explanation:
WPA3 encryption utilizes the AES-GCMP 256 algorithm. This is an advanced encryption standard that uses Galois/Counter Mode Protocol (GCMP) with a 256-bit key length. It provides a higher level of security than the previous encryption methods used in WPA2, which included AES-CCMP with a 128-bit key. The use of a 256-bit key in AES-GCMP makes it more resistant to brute-force attacks and provides better data protection.
Reference: The information provided here is based on the latest security standards for wireless networks as outlined by the Wi-Fi Alliance and documented sources like Cisco Meraki and TechTarget, which detail the encryption methods used in WPA3123. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the explanation aligns with the general knowledge of network security practices and the use of WPA3 for secure wireless communication.
Question #276
Which policies exist only on AWS IAM identity (user, group, or role)?
- A . Inline Policies
- B . Customer-Managed Policies
- C . Power-user AWS managed policies
- D . Full access AWS managed policie
Correct Answer: A
A
Explanation:
Inline policies are exclusive to AWS IAM identities, which include users, groups, and roles. These are policies that you create and manage and are directly embedded into a single IAM identity. Unlike managed policies, which can be attached to multiple IAM identities, inline policies are strictly one-to-one; they are an integral part of the IAM identity to which they are attached. This means that if the user, group, or role is deleted, the inline policy is also deleted. Inline policies are typically used for ensuring that specific permissions are tightly bound to an IAM identity and are not inadvertently assigned elsewhere.
Reference: The information provided is based on the AWS documentation on IAM policies, which outlines the different types of policies and their use cases, including the unique characteristics of inline policies12. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
A
Explanation:
Inline policies are exclusive to AWS IAM identities, which include users, groups, and roles. These are policies that you create and manage and are directly embedded into a single IAM identity. Unlike managed policies, which can be attached to multiple IAM identities, inline policies are strictly one-to-one; they are an integral part of the IAM identity to which they are attached. This means that if the user, group, or role is deleted, the inline policy is also deleted. Inline policies are typically used for ensuring that specific permissions are tightly bound to an IAM identity and are not inadvertently assigned elsewhere.
Reference: The information provided is based on the AWS documentation on IAM policies, which outlines the different types of policies and their use cases, including the unique characteristics of inline policies12. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.
Question #277
Castle-and-Moat model
- A . Both 1 and 2
- B . 1 only
- C . 2 only
- D . None
Correct Answer: B
B
Explanation:
The Zero-trust network model is designed to ensure strict identity verification for every user or device attempting to access network resources, regardless of whether they are inside or outside the network perimeter. This model operates on the principle of “never trust, always verify,” which means that no one is trusted by default, and verification is required from everyone trying to gain access to resources on the network. On the other hand, the Castle-and-Moat model operates on the principle that once inside the network, users or devices are generally trusted. This model does not enforce strict identity verification for every user or device within the network, which is a fundamental difference from the Zero-trust model.
Reference: The information about the Zero-trust network model aligns with the Certified Network Defender (CND) course objectives, which include understanding various network security models and their characteristics. The Zero-trust model’s emphasis on strict identity verification is a key aspect of modern network security practices12. The Castle-and-Moat model’s approach of trusting users once they are inside the network is contrasted with the Zero-trust model in various security literature34.
B
Explanation:
The Zero-trust network model is designed to ensure strict identity verification for every user or device attempting to access network resources, regardless of whether they are inside or outside the network perimeter. This model operates on the principle of “never trust, always verify,” which means that no one is trusted by default, and verification is required from everyone trying to gain access to resources on the network. On the other hand, the Castle-and-Moat model operates on the principle that once inside the network, users or devices are generally trusted. This model does not enforce strict identity verification for every user or device within the network, which is a fundamental difference from the Zero-trust model.
Reference: The information about the Zero-trust network model aligns with the Certified Network Defender (CND) course objectives, which include understanding various network security models and their characteristics. The Zero-trust model’s emphasis on strict identity verification is a key aspect of modern network security practices12. The Castle-and-Moat model’s approach of trusting users once they are inside the network is contrasted with the Zero-trust model in various security literature34.
Question #278
Which of the following attack surface increase when you keep USB ports enabled on your laptop unnecessarily?
- A . Human attack surface
- B . Network attack surface
- C . Physical attack surface
- D . Software attack surface
Correct Answer: C
C
Explanation:
Keeping USB ports enabled on a laptop when not necessary increases the physical attack surface. This is because USB ports can be used to connect devices that may be malicious or compromised, such as USB drives containing malware or tools designed to exploit vulnerabilities in the system’s hardware or software. By leaving USB ports enabled, an attacker with physical access to the laptop could potentially use these ports to launch an attack, bypass security measures, or steal data.
Reference: The concept of physical attack surfaces includes all the physical means through which an attacker can gain unauthorized access to a system or network. This aligns with the cybersecurity best practices that recommend disabling unnecessary ports and services to minimize the attack surface, as detailed in various security frameworks and guidelines, including those from the EC-Council’s Certified Network Defender (CND) program123.
C
Explanation:
Keeping USB ports enabled on a laptop when not necessary increases the physical attack surface. This is because USB ports can be used to connect devices that may be malicious or compromised, such as USB drives containing malware or tools designed to exploit vulnerabilities in the system’s hardware or software. By leaving USB ports enabled, an attacker with physical access to the laptop could potentially use these ports to launch an attack, bypass security measures, or steal data.
Reference: The concept of physical attack surfaces includes all the physical means through which an attacker can gain unauthorized access to a system or network. This aligns with the cybersecurity best practices that recommend disabling unnecessary ports and services to minimize the attack surface, as detailed in various security frameworks and guidelines, including those from the EC-Council’s Certified Network Defender (CND) program123.
Question #279
How can a WAF validate traffic before it reaches a web application?
- A . It uses a role-based filtering technique
- B . It uses an access-based filtering technique
- C . It uses a sandboxing filtering technique
- D . It uses a rule-based filtering technique
Correct Answer: D
D
Explanation:
A Web Application Firewall (WAF) validates traffic before it reaches a web application by using a rule-based filtering technique. This involves inspecting HTTP requests and applying predefined rules to identify and block potentially malicious traffic. The rules are designed to detect common web-based threats and vulnerabilities, ensuring that only safe traffic is allowed to reach the application. By analyzing parts of the HTTP conversation such as GET and POST requests, headers, query strings, and the body of requests, the WAF can effectively prevent data breaches and other attacks by blocking traffic that matches known malicious patterns12345.
Reference: The function and operation of WAFs are detailed in cybersecurity resources and align with the Certified Network Defender (CND) program’s objectives and documents. These sources explain how WAFs use rule-based filtering to protect web applications from various cyber threats12345.
D
Explanation:
A Web Application Firewall (WAF) validates traffic before it reaches a web application by using a rule-based filtering technique. This involves inspecting HTTP requests and applying predefined rules to identify and block potentially malicious traffic. The rules are designed to detect common web-based threats and vulnerabilities, ensuring that only safe traffic is allowed to reach the application. By analyzing parts of the HTTP conversation such as GET and POST requests, headers, query strings, and the body of requests, the WAF can effectively prevent data breaches and other attacks by blocking traffic that matches known malicious patterns12345.
Reference: The function and operation of WAFs are detailed in cybersecurity resources and align with the Certified Network Defender (CND) program’s objectives and documents. These sources explain how WAFs use rule-based filtering to protect web applications from various cyber threats12345.
Question #280
Tom works as a network administrator in a multinational organization having branches across North America and Europe. Tom wants to implement a storage technology that can provide centralized data storage and provide free data backup on the server. He should be able to perform data backup and recovery more efficiently with the selected technology.
Which of the following storage technologies best suits Tom’s requirements?
- A . DAS
- B . PAS
- C . RAID
- D . NAS
Correct Answer: D
D
Explanation:
Network-attached storage (NAS) is the most suitable technology for Tom’s requirements. NAS systems are designed to provide centralized data storage, allowing multiple clients or computers to access the same storage space. This centralization simplifies data management, protection, and backup. NAS systems typically include features that support efficient data backup and recovery, such as automatic backup to other devices and fault tolerance through RAID configurations. Unlike direct-attached storage (DAS), which is limited to one user at a time, NAS allows multiple users to access the storage simultaneously, making it ideal for a multinational organization with dispersed teams. NAS also offers remote data availability, which is beneficial for Tom’s organization that spans across different regions.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on network security, data protection, and efficient network operation as outlined in the EC-Council’s CND documentation12. Additionally, the benefits of NAS in centralized data storage and backup are supported by various sources that discuss the advantages of NAS for organizational use34.
D
Explanation:
Network-attached storage (NAS) is the most suitable technology for Tom’s requirements. NAS systems are designed to provide centralized data storage, allowing multiple clients or computers to access the same storage space. This centralization simplifies data management, protection, and backup. NAS systems typically include features that support efficient data backup and recovery, such as automatic backup to other devices and fault tolerance through RAID configurations. Unlike direct-attached storage (DAS), which is limited to one user at a time, NAS allows multiple users to access the storage simultaneously, making it ideal for a multinational organization with dispersed teams. NAS also offers remote data availability, which is beneficial for Tom’s organization that spans across different regions.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on network security, data protection, and efficient network operation as outlined in the EC-Council’s CND documentation12. Additionally, the benefits of NAS in centralized data storage and backup are supported by various sources that discuss the advantages of NAS for organizational use34.