EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #21
Ryan, a network security engineer, after a recent attack, is trying to get information about the kind of attack his users were facing. He has decided to put into production one honeypot called Kojoney. He is interested in emulating the network vulnerability, rather than the real vulnerability system, making this probe safer and more flexible.
Which type of honeypot is he trying to implement?
- A . Research honeypot
- B . High interaction honeypots
- C . Low interaction honeypots
- D . Pure honeypots
Correct Answer: C
C
Explanation:
Ryan is implementing a low interaction honeypot with Kojoney. Low interaction honeypots are designed to emulate services and applications to a certain degree without exposing the real underlying system. They provide a safe environment that can be used to study the attacker’s behavior and methods without the risk of compromising the actual system. Kojoney, specifically, is a low interaction honeypot that emulates an SSH server1. It uses minimal resources and is less complex compared to high interaction honeypots, making it easier to deploy and manage. By simulating network vulnerabilities rather than actual system vulnerabilities, Kojoney can attract attackers and record their interaction, which helps in understanding the attack patterns and potentially identifying the attackers.
Reference: The classification of Kojoney as a low interaction honeypot is based on its design and operational characteristics as described in its official documentation1.
C
Explanation:
Ryan is implementing a low interaction honeypot with Kojoney. Low interaction honeypots are designed to emulate services and applications to a certain degree without exposing the real underlying system. They provide a safe environment that can be used to study the attacker’s behavior and methods without the risk of compromising the actual system. Kojoney, specifically, is a low interaction honeypot that emulates an SSH server1. It uses minimal resources and is less complex compared to high interaction honeypots, making it easier to deploy and manage. By simulating network vulnerabilities rather than actual system vulnerabilities, Kojoney can attract attackers and record their interaction, which helps in understanding the attack patterns and potentially identifying the attackers.
Reference: The classification of Kojoney as a low interaction honeypot is based on its design and operational characteristics as described in its official documentation1.
Question #22
Choose the correct order of steps to analyze the attack surface.
- A . Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface
- B . Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface
- C . Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface
- D . Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface
Correct Answer: A
A
Explanation:
The correct order of steps to analyze the attack surface begins with identifying the indicators of exposure. This step involves recognizing the elements within the system that could potentially be exploited by threats. Following this, the attack surface is visualized to understand the scope and scale of potential attack vectors. Next, a simulation of the attack is conducted to assess the effectiveness of the current security measures and identify any vulnerabilities. Finally, the attack surface is reduced by implementing measures to mitigate the identified risks and vulnerabilities, thereby enhancing the overall security posture.
Reference: This sequence ensures a structured approach to security analysis and is in line with best practices for attack surface analysis as outlined in various cybersecurity frameworks and guidelines1.
A
Explanation:
The correct order of steps to analyze the attack surface begins with identifying the indicators of exposure. This step involves recognizing the elements within the system that could potentially be exploited by threats. Following this, the attack surface is visualized to understand the scope and scale of potential attack vectors. Next, a simulation of the attack is conducted to assess the effectiveness of the current security measures and identify any vulnerabilities. Finally, the attack surface is reduced by implementing measures to mitigate the identified risks and vulnerabilities, thereby enhancing the overall security posture.
Reference: This sequence ensures a structured approach to security analysis and is in line with best practices for attack surface analysis as outlined in various cybersecurity frameworks and guidelines1.
Question #23
Which of the following characteristics represents a normal TCP packet?
- A . SYN and FIN bits are set
- B . Source or destination port b zero
- C . FIN ACK and ACK are used in terminating the connection
- D . The destination address is a broadcast address
Correct Answer: C
C
Explanation:
A normal TCP packet is characterized by the proper use of control flags in the TCP header for managing the state of the connection. The FIN and ACK flags are specifically used during the termination phase of a TCP connection. When a session is being closed, a FIN flag is sent to indicate the end of data transmission, and an ACK flag is used to acknowledge the receipt of the FIN flag. This is part of the graceful shutdown process to ensure that both ends of the connection have successfully finished transmitting data.
Reference: This explanation aligns with the standard TCP connection termination process, where FIN and ACK flags play a crucial role123.
C
Explanation:
A normal TCP packet is characterized by the proper use of control flags in the TCP header for managing the state of the connection. The FIN and ACK flags are specifically used during the termination phase of a TCP connection. When a session is being closed, a FIN flag is sent to indicate the end of data transmission, and an ACK flag is used to acknowledge the receipt of the FIN flag. This is part of the graceful shutdown process to ensure that both ends of the connection have successfully finished transmitting data.
Reference: This explanation aligns with the standard TCP connection termination process, where FIN and ACK flags play a crucial role123.
Question #24
Which of the following entities is responsible for cloud security?
- A . Cloud provider
- B . Cloud consumer
- C . Cloud broker
- D . Both cloud consumer and provider
Correct Answer: D
D
Explanation:
In the context of cloud security, the responsibility is shared between the cloud provider and the cloud consumer. This is known as the shared responsibility model. The cloud provider is responsible for securing the infrastructure that runs all of the services offered in the cloud. On the other hand, the cloud consumer is responsible for managing the security of their data, applications, and operating systems that they run on the cloud infrastructure. The specific responsibilities can vary depending on the service model being used (IaaS, PaaS, SaaS), but the underlying principle is that both parties have a role to play in ensuring the security of cloud services.
Reference: The concept of shared responsibility in cloud security is widely acknowledged and documented by various cloud service providers and security organizations, including Microsoft Azure1 and the Center for Internet Security (CIS)2. These sources provide detailed explanations of the shared responsibility model and outline the security tasks handled by the cloud provider and those that fall under the cloud consumer’s purview.
D
Explanation:
In the context of cloud security, the responsibility is shared between the cloud provider and the cloud consumer. This is known as the shared responsibility model. The cloud provider is responsible for securing the infrastructure that runs all of the services offered in the cloud. On the other hand, the cloud consumer is responsible for managing the security of their data, applications, and operating systems that they run on the cloud infrastructure. The specific responsibilities can vary depending on the service model being used (IaaS, PaaS, SaaS), but the underlying principle is that both parties have a role to play in ensuring the security of cloud services.
Reference: The concept of shared responsibility in cloud security is widely acknowledged and documented by various cloud service providers and security organizations, including Microsoft Azure1 and the Center for Internet Security (CIS)2. These sources provide detailed explanations of the shared responsibility model and outline the security tasks handled by the cloud provider and those that fall under the cloud consumer’s purview.
Question #25
You are an IT security consultant working on a contract for a large manufacturing company to audit their entire network. After performing all the tests and building your report, you present a number of recommendations to the company and what they should implement to become more secure. One recommendation is to install a network-based device that notifies IT employees whenever malicious or questionable traffic is found. From your talks with the company, you know that they do not want a device that actually drops traffic completely, they only want notification.
What type of device are you suggesting?
- A . The best solution to cover the needs of this company would be a HIDS device.
- B . A NIDS device would work best for the company
- C . You are suggesting a NIPS device
- D . A HIPS device would best suite this company
Correct Answer: B
B
Explanation:
The device suggested is a Network Intrusion Detection System (NIDS). A NIDS monitors network traffic for suspicious activity and alerts the system or network administrator. Unlike a Network Intrusion Prevention System (NIPS), which actively blocks traffic deemed malicious, a NIDS does not interfere with the flow of traffic, thus fulfilling the company’s requirement for a device that only notifies rather than drops traffic.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on network security, which includes understanding and implementing devices that protect, detect, respond, and predict network security incidents. The CND course emphasizes the importance of network traffic monitoring and analysis, which is a key function of a NIDS12.
B
Explanation:
The device suggested is a Network Intrusion Detection System (NIDS). A NIDS monitors network traffic for suspicious activity and alerts the system or network administrator. Unlike a Network Intrusion Prevention System (NIPS), which actively blocks traffic deemed malicious, a NIDS does not interfere with the flow of traffic, thus fulfilling the company’s requirement for a device that only notifies rather than drops traffic.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on network security, which includes understanding and implementing devices that protect, detect, respond, and predict network security incidents. The CND course emphasizes the importance of network traffic monitoring and analysis, which is a key function of a NIDS12.
Question #26
USB ports enabled on a laptop is an example of____
- A . System Attack Surface
- B . Network Attack Surface
- C . Physical Attack Surface
- D . Software attack Surface
Correct Answer: C
C
Explanation:
The term “attack surface” refers to the sum of all possible points where an unauthorized user can try to enter data to or extract data from an environment. The enabled USB ports on a laptop are considered a part of the physical attack surface because they allow for physical interaction with the device. This includes the potential for unauthorized devices to be connected, which could be used to compromise security, such as through the introduction of malware or the unauthorized copying of sensitive data.
Reference: This explanation aligns with the definitions provided in network security resources, which categorize attack surfaces based on the nature of the interaction―physical, network, or software12. The reference to the physical attack surface includes any physical means by which data can be compromised, which encompasses USB ports on a laptop1.
C
Explanation:
The term “attack surface” refers to the sum of all possible points where an unauthorized user can try to enter data to or extract data from an environment. The enabled USB ports on a laptop are considered a part of the physical attack surface because they allow for physical interaction with the device. This includes the potential for unauthorized devices to be connected, which could be used to compromise security, such as through the introduction of malware or the unauthorized copying of sensitive data.
Reference: This explanation aligns with the definitions provided in network security resources, which categorize attack surfaces based on the nature of the interaction―physical, network, or software12. The reference to the physical attack surface includes any physical means by which data can be compromised, which encompasses USB ports on a laptop1.
Question #27
Identify the spread spectrum technique that multiplies the original data signal with a pseudo random noise spreading code.
- A . FHSS
- B . DSSS
- C . OFDM
- D . ISM
Correct Answer: B
B
Explanation:
The spread spectrum technique that involves multiplying the original data signal with a pseudo-random noise spreading code is known as Direct Sequence Spread Spectrum (DSSS). In DSSS, the data signal is combined with a higher data-rate bit sequence, also known as a chipping code, which divides the data according to a spreading ratio. The chipping code is a pseudo-random code sequence that spreads the signal across a wider bandwidth. This process allows the signal to be more resistant to interference and eavesdropping.
Reference: The information is consistent with the principles of spread spectrum techniques as outlined in various educational resources on the subject, including academic publications and industry standards related to network security and wireless communications12.
B
Explanation:
The spread spectrum technique that involves multiplying the original data signal with a pseudo-random noise spreading code is known as Direct Sequence Spread Spectrum (DSSS). In DSSS, the data signal is combined with a higher data-rate bit sequence, also known as a chipping code, which divides the data according to a spreading ratio. The chipping code is a pseudo-random code sequence that spreads the signal across a wider bandwidth. This process allows the signal to be more resistant to interference and eavesdropping.
Reference: The information is consistent with the principles of spread spectrum techniques as outlined in various educational resources on the subject, including academic publications and industry standards related to network security and wireless communications12.
Question #28
Which of the Windows security component is responsible for controlling access of a user to Windows resources?
- A . Network Logon Service (Netlogon)
- B . Security Accounts Manager (SAM)
- C . Security Reference Monitor (SRM)
- D . Local Security Authority Subsystem (LSASS)
Correct Answer: C
C
Explanation:
The Security Reference Monitor (SRM) is the core component in Windows operating systems responsible for controlling access to resources. It enforces security policies and checks whether a user’s request to access a resource is allowed by the system’s security policy. SRM operates in the kernel mode and ensures that access rights and permissions are properly enforced, making it a critical part of the Windows security architecture for resource access control.
Reference: The role of SRM in Windows security is well-documented and aligns with the information provided in Microsoft’s official documentation and security model, which describes SRM as the component that enforces access controls and security policies within the system12.
C
Explanation:
The Security Reference Monitor (SRM) is the core component in Windows operating systems responsible for controlling access to resources. It enforces security policies and checks whether a user’s request to access a resource is allowed by the system’s security policy. SRM operates in the kernel mode and ensures that access rights and permissions are properly enforced, making it a critical part of the Windows security architecture for resource access control.
Reference: The role of SRM in Windows security is well-documented and aligns with the information provided in Microsoft’s official documentation and security model, which describes SRM as the component that enforces access controls and security policies within the system12.
Question #29
Which risk management phase helps in establishing context and quantifying risks?
- A . Risk identification
- B . Risk assessment
- C . Risk review
- D . Risk treatment
Correct Answer: B
B
Explanation:
The risk management phase that helps in establishing context and quantifying risks is the risk assessment phase. This phase involves a detailed analysis of the potential risks to determine their magnitude and impact on the organization. It includes identifying vulnerabilities, threats, and the likelihood of their occurrence, which helps in understanding the overall risk exposure of the organization. The risk assessment phase is crucial for prioritizing risks based on their severity and for making informed decisions on how to address them effectively.
Reference: The information aligns with the Certified Network Defender (CND) course material and objectives, which emphasize the importance of the risk assessment phase in the overall risk management process12.
B
Explanation:
The risk management phase that helps in establishing context and quantifying risks is the risk assessment phase. This phase involves a detailed analysis of the potential risks to determine their magnitude and impact on the organization. It includes identifying vulnerabilities, threats, and the likelihood of their occurrence, which helps in understanding the overall risk exposure of the organization. The risk assessment phase is crucial for prioritizing risks based on their severity and for making informed decisions on how to address them effectively.
Reference: The information aligns with the Certified Network Defender (CND) course material and objectives, which emphasize the importance of the risk assessment phase in the overall risk management process12.
Question #30
Phishing-like attempts that present users a fake usage bill of the cloud provider is an example of a:
- A . Cloud to service attack surface
- B . User to service attack surface
- C . User to cloud attack surface
- D . Cloud to user attack surface
Correct Answer: D
D
Explanation:
Phishing attempts that target users with fake usage bills from a cloud provider are examples of a cloud to user attack surface. This type of attack surface refers to the potential vulnerabilities and entry points that exist between the cloud service provider and the user. In this scenario, the attacker is exploiting the trust relationship between the user and the cloud service provider by presenting a fraudulent bill, hoping the user will reveal sensitive information or make a payment based on the fake bill.
Reference: The explanation is consistent with the Certified Network Defender (CND) curriculum, which includes understanding various attack surfaces, including cloud and user-related surfaces, and how they can be exploited through phishing and other social engineering attacks12.
D
Explanation:
Phishing attempts that target users with fake usage bills from a cloud provider are examples of a cloud to user attack surface. This type of attack surface refers to the potential vulnerabilities and entry points that exist between the cloud service provider and the user. In this scenario, the attacker is exploiting the trust relationship between the user and the cloud service provider by presenting a fraudulent bill, hoping the user will reveal sensitive information or make a payment based on the fake bill.
Reference: The explanation is consistent with the Certified Network Defender (CND) curriculum, which includes understanding various attack surfaces, including cloud and user-related surfaces, and how they can be exploited through phishing and other social engineering attacks12.