EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #281
Which firewall technology can be implemented in all (application, session, transport, network, and presentation) layers of the OSl model?
- A . Circuit-level gateway
- B . Network address translation
- C . VPN
- D . Packet filtering
Correct Answer: A
A
Explanation:
A circuit-level gateway is a type of firewall technology that can be implemented across all layers of the OSI model, including the application, session, transport, network, and presentation layers. This type of firewall monitors TCP handshaking and session fulfillment between packets to ensure that the session is legitimate. Circuit-level gateways are effective because they do not inspect the packet itself, but rather the transmission attributes to ensure a trusted session is established.
Reference: This information is based on the firewall technologies’ capabilities as they relate to the OSI model layers, which is a part of the Certified Network Defender (CND) course material provided by EC-Council1.
A
Explanation:
A circuit-level gateway is a type of firewall technology that can be implemented across all layers of the OSI model, including the application, session, transport, network, and presentation layers. This type of firewall monitors TCP handshaking and session fulfillment between packets to ensure that the session is legitimate. Circuit-level gateways are effective because they do not inspect the packet itself, but rather the transmission attributes to ensure a trusted session is established.
Reference: This information is based on the firewall technologies’ capabilities as they relate to the OSI model layers, which is a part of the Certified Network Defender (CND) course material provided by EC-Council1.
Question #282
Alex is administrating the firewall in the organization’s network.
What command will he use to check all the remote addresses and ports in numerical form?
- A . Netstat -o
- B . Netstat -a
- C . Netstat -ao
- D . Netstat -an
Correct Answer: D
D
Explanation:
The netstat -an command is used to display all active connections and listening ports with addresses and port numbers in numerical form. This is particularly useful for administrators who need to quickly identify connections without resolving the hostnames, which can save time and resources, especially when dealing with a large number of connections.
Reference: The usage of the netstat -an command aligns with the objectives and documents of the Certified Network Defender (CND) course, which emphasizes the importance of understanding and utilizing network commands for effective network security management. The -an switch combines two options: -a displays all connections and listening ports, and -n displays addresses and port numbers in numerical form1.
D
Explanation:
The netstat -an command is used to display all active connections and listening ports with addresses and port numbers in numerical form. This is particularly useful for administrators who need to quickly identify connections without resolving the hostnames, which can save time and resources, especially when dealing with a large number of connections.
Reference: The usage of the netstat -an command aligns with the objectives and documents of the Certified Network Defender (CND) course, which emphasizes the importance of understanding and utilizing network commands for effective network security management. The -an switch combines two options: -a displays all connections and listening ports, and -n displays addresses and port numbers in numerical form1.
Question #283
How is an “attack” represented?
- A . Motive (goal) + method
- B . Motive (goal) + method + vulnerability
- C . Asset + Threat + Vulnerability
- D . Asset + Threat
Correct Answer: B
B
Explanation:
An “attack” in the context of network security is represented by a combination of a motive or goal, the method used to carry out the attack, and a vulnerability that can be exploited. The motive is the attacker’s reason for conducting the attack, which could range from financial gain to espionage. The method refers to the technique or strategy the attacker uses to exploit a vulnerability. Finally, the vulnerability is a weakness in the system that allows an attacker to breach security measures. This representation aligns with the principles of risk assessment and threat modeling, which are critical components of network defense.
Reference: The explanation provided is based on standard network security practices and the Certified Network Defender (CND) curriculum, which emphasizes understanding the elements of an attack to effectively defend against them12.
B
Explanation:
An “attack” in the context of network security is represented by a combination of a motive or goal, the method used to carry out the attack, and a vulnerability that can be exploited. The motive is the attacker’s reason for conducting the attack, which could range from financial gain to espionage. The method refers to the technique or strategy the attacker uses to exploit a vulnerability. Finally, the vulnerability is a weakness in the system that allows an attacker to breach security measures. This representation aligns with the principles of risk assessment and threat modeling, which are critical components of network defense.
Reference: The explanation provided is based on standard network security practices and the Certified Network Defender (CND) curriculum, which emphasizes understanding the elements of an attack to effectively defend against them12.
Question #284
Physical access controls help organizations monitor, record, and control access to the information assets and facility. Identify the category of physical security controls which includes security labels and warning signs.
- A . Administrative control
- B . Physical control
- C . Technical control
- D . Environmental control
Correct Answer: B
B
Explanation:
Physical controls are security measures that are designed to deny unauthorized access to facilities, equipment, and resources, and to protect personnel and property from damage or harm. Security labels and warning signs fall under this category as they are part of the physical measures taken to alert individuals about security protocols and to deter unauthorized access. These controls are a critical aspect of an organization’s overall security strategy, ensuring that sensitive information and assets are physically secured against unauthorized access or alterations.
Reference: The categorization of security labels and warning signs as physical controls is consistent with the Certified Network Defender (CND) course materials, which outline various types of security controls and their respective roles in protecting networked systems12.
B
Explanation:
Physical controls are security measures that are designed to deny unauthorized access to facilities, equipment, and resources, and to protect personnel and property from damage or harm. Security labels and warning signs fall under this category as they are part of the physical measures taken to alert individuals about security protocols and to deter unauthorized access. These controls are a critical aspect of an organization’s overall security strategy, ensuring that sensitive information and assets are physically secured against unauthorized access or alterations.
Reference: The categorization of security labels and warning signs as physical controls is consistent with the Certified Network Defender (CND) course materials, which outline various types of security controls and their respective roles in protecting networked systems12.
Question #285
John is a network administrator and is monitoring his network traffic with the help of Wireshark. He suspects that someone from outside is making a TCP OS fingerprinting attempt on his organization’s network.
Which of the following Wireshark filter(s) will he use to locate the TCP OS fingerprinting attempt?
- A . Tcp.flags==0x2b
- B . Tcp.flags=0x00
- C . Tcp.options.mss_val<1460
- D . Tcp.options.wscale_val==20
Correct Answer: C
C
Explanation:
TCP OS fingerprinting attempts can be identified by analyzing various TCP/IP stack behaviors, one of which is the TCP Maximum Segment Size (MSS). The MSS value indicates the size of the largest segment of TCP data that a device is willing to receive. Different operating systems have different default MSS values, and a value less than 1460 can suggest an OS fingerprinting attempt, as it may indicate that the sender is trying to avoid fragmentation or is probing to discover the OS based on MSS response.
Reference: The use of Wireshark to monitor and analyze network traffic, including identifying TCP OS fingerprinting attempts, is covered in the EC-Council’s Certified Network Defender (CND) course. The course materials would include detailed explanations on how to use Wireshark filters to detect such activities, and the reference to MSS values is consistent with standard network analysis practices for identifying OS fingerprinting attempts.
C
Explanation:
TCP OS fingerprinting attempts can be identified by analyzing various TCP/IP stack behaviors, one of which is the TCP Maximum Segment Size (MSS). The MSS value indicates the size of the largest segment of TCP data that a device is willing to receive. Different operating systems have different default MSS values, and a value less than 1460 can suggest an OS fingerprinting attempt, as it may indicate that the sender is trying to avoid fragmentation or is probing to discover the OS based on MSS response.
Reference: The use of Wireshark to monitor and analyze network traffic, including identifying TCP OS fingerprinting attempts, is covered in the EC-Council’s Certified Network Defender (CND) course. The course materials would include detailed explanations on how to use Wireshark filters to detect such activities, and the reference to MSS values is consistent with standard network analysis practices for identifying OS fingerprinting attempts.
Question #285
John is a network administrator and is monitoring his network traffic with the help of Wireshark. He suspects that someone from outside is making a TCP OS fingerprinting attempt on his organization’s network.
Which of the following Wireshark filter(s) will he use to locate the TCP OS fingerprinting attempt?
- A . Tcp.flags==0x2b
- B . Tcp.flags=0x00
- C . Tcp.options.mss_val<1460
- D . Tcp.options.wscale_val==20
Correct Answer: C
C
Explanation:
TCP OS fingerprinting attempts can be identified by analyzing various TCP/IP stack behaviors, one of which is the TCP Maximum Segment Size (MSS). The MSS value indicates the size of the largest segment of TCP data that a device is willing to receive. Different operating systems have different default MSS values, and a value less than 1460 can suggest an OS fingerprinting attempt, as it may indicate that the sender is trying to avoid fragmentation or is probing to discover the OS based on MSS response.
Reference: The use of Wireshark to monitor and analyze network traffic, including identifying TCP OS fingerprinting attempts, is covered in the EC-Council’s Certified Network Defender (CND) course. The course materials would include detailed explanations on how to use Wireshark filters to detect such activities, and the reference to MSS values is consistent with standard network analysis practices for identifying OS fingerprinting attempts.
C
Explanation:
TCP OS fingerprinting attempts can be identified by analyzing various TCP/IP stack behaviors, one of which is the TCP Maximum Segment Size (MSS). The MSS value indicates the size of the largest segment of TCP data that a device is willing to receive. Different operating systems have different default MSS values, and a value less than 1460 can suggest an OS fingerprinting attempt, as it may indicate that the sender is trying to avoid fragmentation or is probing to discover the OS based on MSS response.
Reference: The use of Wireshark to monitor and analyze network traffic, including identifying TCP OS fingerprinting attempts, is covered in the EC-Council’s Certified Network Defender (CND) course. The course materials would include detailed explanations on how to use Wireshark filters to detect such activities, and the reference to MSS values is consistent with standard network analysis practices for identifying OS fingerprinting attempts.
Question #287
Which of the following indicators refers to potential risk exposures that attackers can use to breach the security of an organization?
- A . Indicators of attack
- B . Key risk indicators
- C . Indicators of exposure
- D . Indicators of compromise
Correct Answer: C
C
Explanation:
The term “Indicators of Exposure” (IoE) refers to potential risk exposures that attackers can exploit to breach the security of an organization. IoEs are vulnerabilities or weaknesses in an organization’s security posture that, if left unaddressed, could be leveraged by attackers to gain unauthorized access or cause harm. These indicators help network defenders identify areas that require attention and remediation to prevent potential security incidents. Unlike Indicators of Compromise (IoC), which signal that a breach has already occurred, IoEs are forward-looking and are concerned with identifying and mitigating potential risks before they are exploited1.
Reference: Information on the Certified Network Defender (CND) certification and its focus on identifying and mitigating potential risks, including IoEs1.
C
Explanation:
The term “Indicators of Exposure” (IoE) refers to potential risk exposures that attackers can exploit to breach the security of an organization. IoEs are vulnerabilities or weaknesses in an organization’s security posture that, if left unaddressed, could be leveraged by attackers to gain unauthorized access or cause harm. These indicators help network defenders identify areas that require attention and remediation to prevent potential security incidents. Unlike Indicators of Compromise (IoC), which signal that a breach has already occurred, IoEs are forward-looking and are concerned with identifying and mitigating potential risks before they are exploited1.
Reference: Information on the Certified Network Defender (CND) certification and its focus on identifying and mitigating potential risks, including IoEs1.
Question #288
Which of the following filters car be applied to detect an ICMP ping sweep attempt using Wireshark?
- A . icmp.type==8
- B . icmp.type==13
- C . icmp.type==17
- D . icmp.type==15
Correct Answer: A
A
Explanation:
In Wireshark, the filter icmp.type==8 is used to detect ICMP Echo requests, which are commonly used in ping sweep attempts. A ping sweep is a network scanning technique used to determine which of a range of IP addresses map to live hosts. It involves sending ICMP Echo requests (type 8) to multiple hosts and listening for Echo replies (type 0). If an Echo reply is received, it indicates that the host is active. Therefore, the filter icmp.type==8 can be applied to capture these ICMP Echo requests and detect a ping sweep attempt.
Reference: This information is consistent with network security practices and the use of Wireshark for detecting network attacks, such as ICMP ping sweeps1. The filter icmp.type==8 specifically captures ICMP Echo requests, which are central to the technique of ping sweeping1.
A
Explanation:
In Wireshark, the filter icmp.type==8 is used to detect ICMP Echo requests, which are commonly used in ping sweep attempts. A ping sweep is a network scanning technique used to determine which of a range of IP addresses map to live hosts. It involves sending ICMP Echo requests (type 8) to multiple hosts and listening for Echo replies (type 0). If an Echo reply is received, it indicates that the host is active. Therefore, the filter icmp.type==8 can be applied to capture these ICMP Echo requests and detect a ping sweep attempt.
Reference: This information is consistent with network security practices and the use of Wireshark for detecting network attacks, such as ICMP ping sweeps1. The filter icmp.type==8 specifically captures ICMP Echo requests, which are central to the technique of ping sweeping1.
Question #289
James, a network admin in a large US based IT firm, was asked to audit and implement security controls over all network layers to achieve Defense-in-Depth. While working on this assignment, James has implemented both blacklisting and whitelisting ACLs.
Which layer of defense-in-depth architecture is Jason working on currently?
- A . Application Layer
- B . Host Layer
- C . Internal Network Layer
- D . Perimeter Layer
Correct Answer: D
D
Explanation:
James is working on the Perimeter Layer of the Defense-in-Depth architecture. This layer is responsible for protecting the network’s boundaries from unauthorized access and attacks. The implementation of blacklisting and whitelisting Access Control Lists (ACLs) is a common practice at this layer. Blacklisting ACLs block known malicious entities, while whitelisting ACLs allow only approved entities to access the network. These measures are part of the perimeter defenses that include firewalls, intrusion detection systems, and other boundary security mechanisms designed to prevent attackers from gaining initial access to the network infrastructure1234.
Reference: Defense in depth explained: Layering tools and processes for better security1.
What is a whitelist and a blacklist? – National Cybersecurity Society2.
Blacklisting vs Whitelisting: What’s the Difference? – Instasafe3.
Whitelisting, blacklisting, and your security strategy: It’s not either/or4.
D
Explanation:
James is working on the Perimeter Layer of the Defense-in-Depth architecture. This layer is responsible for protecting the network’s boundaries from unauthorized access and attacks. The implementation of blacklisting and whitelisting Access Control Lists (ACLs) is a common practice at this layer. Blacklisting ACLs block known malicious entities, while whitelisting ACLs allow only approved entities to access the network. These measures are part of the perimeter defenses that include firewalls, intrusion detection systems, and other boundary security mechanisms designed to prevent attackers from gaining initial access to the network infrastructure1234.
Reference: Defense in depth explained: Layering tools and processes for better security1.
What is a whitelist and a blacklist? – National Cybersecurity Society2.
Blacklisting vs Whitelisting: What’s the Difference? – Instasafe3.
Whitelisting, blacklisting, and your security strategy: It’s not either/or4.
Question #290
Which of the following network security protocols protects from sniffing attacks by encrypting entire communication between the clients and server including user passwords?
- A . TACACS+
- B . RADIUS
- C . CHAP
- D . PAP
Correct Answer: A
A
Explanation:
TACACS+ (Terminal Access Controller Access-Control System Plus) is a network security protocol that provides centralized authentication for users who are attempting to gain access to the network. It is designed to protect against sniffing attacks by encrypting the entire packet, which includes both the authentication credentials and the subsequent communication after the credentials have been accepted. This encryption ensures that sensitive information such as user passwords is not transmitted in plain text where it could be intercepted by unauthorized individuals. Unlike RADIUS, which only encrypts the password, TACACS+ encrypts the entire authentication process, providing a higher level of security.
Reference: The information provided here is based on my training data up to September 2021, which includes knowledge of network security protocols and their functionalities. For the most current and detailed explanations, please refer to the latest Network Defender (CND) documents and study guides from the EC-Council and other authoritative sources on network security.
A
Explanation:
TACACS+ (Terminal Access Controller Access-Control System Plus) is a network security protocol that provides centralized authentication for users who are attempting to gain access to the network. It is designed to protect against sniffing attacks by encrypting the entire packet, which includes both the authentication credentials and the subsequent communication after the credentials have been accepted. This encryption ensures that sensitive information such as user passwords is not transmitted in plain text where it could be intercepted by unauthorized individuals. Unlike RADIUS, which only encrypts the password, TACACS+ encrypts the entire authentication process, providing a higher level of security.
Reference: The information provided here is based on my training data up to September 2021, which includes knowledge of network security protocols and their functionalities. For the most current and detailed explanations, please refer to the latest Network Defender (CND) documents and study guides from the EC-Council and other authoritative sources on network security.