EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #291
Which of the following is an example of Indicators of Attack?
- A . Malware
- B . Signatures
- C . Exploits
- D . Remote code execution
Correct Answer: C
C
Explanation:
Indicators of Attack (IOAs) are behaviors or actions that suggest an attacker’s intent to compromise a system. Unlike Indicators of Compromise (IOCs), which are evidence that an attack has already occurred, IOAs focus on the detection of attack attempts before they can cause harm. Exploits are a prime example of IOAs because they are tools or techniques used to take advantage of vulnerabilities in systems, often before any actual damage is done. This can include exploiting security holes, system weaknesses, or software bugs to gain unauthorized access or perform unauthorized actions.
Reference: The concept of IOAs, including the use of exploits as an example, aligns with cybersecurity best practices and the objectives of the Certified Network Defender (CND) program. The information provided is based on standard cybersecurity frameworks and the CND’s focus on understanding and identifying potential threats before they manifest into actual attacks123.
C
Explanation:
Indicators of Attack (IOAs) are behaviors or actions that suggest an attacker’s intent to compromise a system. Unlike Indicators of Compromise (IOCs), which are evidence that an attack has already occurred, IOAs focus on the detection of attack attempts before they can cause harm. Exploits are a prime example of IOAs because they are tools or techniques used to take advantage of vulnerabilities in systems, often before any actual damage is done. This can include exploiting security holes, system weaknesses, or software bugs to gain unauthorized access or perform unauthorized actions.
Reference: The concept of IOAs, including the use of exploits as an example, aligns with cybersecurity best practices and the objectives of the Certified Network Defender (CND) program. The information provided is based on standard cybersecurity frameworks and the CND’s focus on understanding and identifying potential threats before they manifest into actual attacks123.
Question #292
Which of the following can be used to suppress fire from Class K sources?
- A . Foam
- B . Carbon dioxide
- C . Water
- D . Dry Chemical
Correct Answer: A
A
Explanation:
Class K fires involve cooking oils and fats, which are highly combustible and can ignite quickly at high temperatures. To suppress a Class K fire, a specific type of extinguishing agent is required that can separate and absorb the heat elements of the fire C the fuel, oxygen, and heat necessary to start a fire. Foam extinguishers are most suitable for Class K fires because they use a substance that turns oils into foam, effectively smothering the fire and preventing re-ignition. Water should not be used on Class K fires as it can cause the oil to splatter and spread the fire. Carbon dioxide and dry chemical extinguishers are also not recommended for Class K fires as they do not adequately remove the heat from the fire.
Reference: The information provided is based on standard fire safety guidelines and classifications for fire types, particularly for Class K fires involving cooking media such as oils and fats12.
A
Explanation:
Class K fires involve cooking oils and fats, which are highly combustible and can ignite quickly at high temperatures. To suppress a Class K fire, a specific type of extinguishing agent is required that can separate and absorb the heat elements of the fire C the fuel, oxygen, and heat necessary to start a fire. Foam extinguishers are most suitable for Class K fires because they use a substance that turns oils into foam, effectively smothering the fire and preventing re-ignition. Water should not be used on Class K fires as it can cause the oil to splatter and spread the fire. Carbon dioxide and dry chemical extinguishers are also not recommended for Class K fires as they do not adequately remove the heat from the fire.
Reference: The information provided is based on standard fire safety guidelines and classifications for fire types, particularly for Class K fires involving cooking media such as oils and fats12.
Question #293
How is the chip-level security of an IoT device achieved?
- A . By closing insecure network services
- B . By turning off the device when not needed or not in use
- C . By encrypting the JTAG interface
- D . By changing the password of the router
Correct Answer: C
C
Explanation:
Chip-level security for an IoT device is achieved by implementing measures that protect the device’s hardware, particularly against physical attacks and unauthorized access to debugging ports. Encrypting the JTAG (Joint Test Action Group) interface is a critical step in securing an IoT device at the chip level. The JTAG interface is a standard for testing PCBs (Printed Circuit Boards) and widely used for debugging embedded systems. If left unsecured, it can be exploited to reverse engineer the device firmware or to inject malicious code. Encryption of the JTAG interface ensures that even if attackers gain physical access to the JTAG port, they cannot use it to compromise the device without the encryption key.
Reference: The response is informed by industry practices for securing IoT devices at the hardware level, including the protection of interfaces and ports that could be exploited if left unencrypted12.
C
Explanation:
Chip-level security for an IoT device is achieved by implementing measures that protect the device’s hardware, particularly against physical attacks and unauthorized access to debugging ports. Encrypting the JTAG (Joint Test Action Group) interface is a critical step in securing an IoT device at the chip level. The JTAG interface is a standard for testing PCBs (Printed Circuit Boards) and widely used for debugging embedded systems. If left unsecured, it can be exploited to reverse engineer the device firmware or to inject malicious code. Encryption of the JTAG interface ensures that even if attackers gain physical access to the JTAG port, they cannot use it to compromise the device without the encryption key.
Reference: The response is informed by industry practices for securing IoT devices at the hardware level, including the protection of interfaces and ports that could be exploited if left unencrypted12.
Question #293
How is the chip-level security of an IoT device achieved?
- A . By closing insecure network services
- B . By turning off the device when not needed or not in use
- C . By encrypting the JTAG interface
- D . By changing the password of the router
Correct Answer: C
C
Explanation:
Chip-level security for an IoT device is achieved by implementing measures that protect the device’s hardware, particularly against physical attacks and unauthorized access to debugging ports. Encrypting the JTAG (Joint Test Action Group) interface is a critical step in securing an IoT device at the chip level. The JTAG interface is a standard for testing PCBs (Printed Circuit Boards) and widely used for debugging embedded systems. If left unsecured, it can be exploited to reverse engineer the device firmware or to inject malicious code. Encryption of the JTAG interface ensures that even if attackers gain physical access to the JTAG port, they cannot use it to compromise the device without the encryption key.
Reference: The response is informed by industry practices for securing IoT devices at the hardware level, including the protection of interfaces and ports that could be exploited if left unencrypted12.
C
Explanation:
Chip-level security for an IoT device is achieved by implementing measures that protect the device’s hardware, particularly against physical attacks and unauthorized access to debugging ports. Encrypting the JTAG (Joint Test Action Group) interface is a critical step in securing an IoT device at the chip level. The JTAG interface is a standard for testing PCBs (Printed Circuit Boards) and widely used for debugging embedded systems. If left unsecured, it can be exploited to reverse engineer the device firmware or to inject malicious code. Encryption of the JTAG interface ensures that even if attackers gain physical access to the JTAG port, they cannot use it to compromise the device without the encryption key.
Reference: The response is informed by industry practices for securing IoT devices at the hardware level, including the protection of interfaces and ports that could be exploited if left unencrypted12.
Question #295
Jason works as a System Administrator for www.company.com Inc. The company has a Windows based network. Sam, an employee of the company, accidentally changes some of the applications and
system settings. He complains to Jason that his system is not working properly. To troubleshoot the problem, Jason diagnoses the internals of his computer and observes that some changes have been made in Sam’s computer registry. To rectify the issue, Jason has to restore the registry.
Which of the following utilities can Jason use to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
- A . Resplendent registrar
- B . Reg.exe
- C . Regedit.exe
- D . EventCombMT
Correct Answer: B, C
B, C
To restore the registry on a Windows-based network, a system administrator can utilize several utilities. The Reg.exe utility is a command-line tool that allows for manipulation of the Windows registry from the command prompt, including the ability to restore it1Regedit.exe is another utility that provides a graphical interface for users to view and modify the registry2. Both these tools are capable of restoring the registry to a previous state if changes have been made that affect system performance or stability.
Reference: The use of Reg.exe and Regedit.exe for registry restoration is documented in Windows support articles and is consistent with the practices outlined in the Certified Network Defender (CND) course materials12.
B, C
To restore the registry on a Windows-based network, a system administrator can utilize several utilities. The Reg.exe utility is a command-line tool that allows for manipulation of the Windows registry from the command prompt, including the ability to restore it1Regedit.exe is another utility that provides a graphical interface for users to view and modify the registry2. Both these tools are capable of restoring the registry to a previous state if changes have been made that affect system performance or stability.
Reference: The use of Reg.exe and Regedit.exe for registry restoration is documented in Windows support articles and is consistent with the practices outlined in the Certified Network Defender (CND) course materials12.
Question #296
Which of the following manages the Docker images, containers, networks, and storage volume and processes the request of Docker API?
- A . Docker CLI
- B . Docker Engine REST API
- C . Docker Daemon
- D . Docker Registries
Correct Answer: C
C
Explanation:
The Docker Daemon is responsible for managing Docker images, containers, networks, and storage volumes, as well as processing requests from the Docker API. The Docker daemon (dockerd) listens for Docker API requests and manages these Docker objects1. It is a background service that manages the Docker containers and handles the container life cycle, which includes running, stopping, and deleting containers. It also manages networking for the containers and the storage volumes that containers use.
Reference: The explanation provided is based on the official Docker documentation, which outlines the responsibilities and functionalities of the Docker daemon in the context of container management1.
C
Explanation:
The Docker Daemon is responsible for managing Docker images, containers, networks, and storage volumes, as well as processing requests from the Docker API. The Docker daemon (dockerd) listens for Docker API requests and manages these Docker objects1. It is a background service that manages the Docker containers and handles the container life cycle, which includes running, stopping, and deleting containers. It also manages networking for the containers and the storage volumes that containers use.
Reference: The explanation provided is based on the official Docker documentation, which outlines the responsibilities and functionalities of the Docker daemon in the context of container management1.
Question #297
Patrick wants to change the file permission of a file with permission value 755 to 744. He used a Linux command chmod [permission Value] [File Name] to make these changes.
What will be the change in the file access?
- A . He changed the file permission from rwxr-xr-x to rwx-r–r–
- B . He changes the file permission from rwxr-xr-x to rw-rw-rw-
- C . He changed the file permission from rw——- to rw-r–r–
- D . He changed the file permission from rwxrwxrwx to rwx——
Correct Answer: A
A
Explanation:
In Linux file permissions, the numerical value 755 represents the permissions rwxr-xr-x, where ‘r’ stands for read, ‘w’ for write, and ‘x’ for execute. The first digit ‘7’ corresponds to the file owner’s permissions, allowing read, write, and execute. The second and third digits ‘5’ and ‘5’ correspond to the group and others’ permissions, allowing read and execute. Changing the permission to 744 changes the group and others’ permissions to read only (rC), removing the execute permission.
Reference: This explanation is based on standard Linux permission conventions and the use of the chmod command to change file permissions1.
A
Explanation:
In Linux file permissions, the numerical value 755 represents the permissions rwxr-xr-x, where ‘r’ stands for read, ‘w’ for write, and ‘x’ for execute. The first digit ‘7’ corresponds to the file owner’s permissions, allowing read, write, and execute. The second and third digits ‘5’ and ‘5’ correspond to the group and others’ permissions, allowing read and execute. Changing the permission to 744 changes the group and others’ permissions to read only (rC), removing the execute permission.
Reference: This explanation is based on standard Linux permission conventions and the use of the chmod command to change file permissions1.
Question #298
Kyle is an IT technician managing 25 workstations and 4 servers. The servers run applications and mostly store confidential data. Kyle must backup the server’s data daily to ensure nothing is lost. The power in the company’s office is not always reliable, Kyle needs to make sure the servers do not go down or are without power for too long. Kyle decides to purchase an Uninterruptible Power Supply (UPS) that has a pair of inverters and converters to charge the battery and provides power when needed.
What type of UPS has Kyle purchased?
- A . Kyle purchased a Ferro resonant Standby UPS.
- B . Kyle purchased a Line-Interactive UPS
- C . He has bought a Standby UPS
- D . He purchased a True Online UPS.
Correct Answer: D
D
Explanation:
A True Online UPS is designed to provide continuous, uninterrupted power supply to equipment. It has a pair of inverters and converters that work together to continuously charge the battery and convert the battery’s DC power back to AC power for the equipment. This ensures that there is zero transfer time to the battery when power is lost, providing the most reliable power for sensitive equipment and critical applications that cannot tolerate any interruption in power. Kyle’s choice of a True Online UPS is appropriate for ensuring that the servers, which store confidential data and run applications, are not affected by unreliable power sources.
Reference: The Certified Network Defender (CND) program by EC-Council includes the study of various types of UPS systems as part of its module on Business Continuity and Disaster Recovery. The program outlines the importance of maintaining power to critical systems and the role of a True Online UPS in providing the highest level of protection against power inconsistencies12.
D
Explanation:
A True Online UPS is designed to provide continuous, uninterrupted power supply to equipment. It has a pair of inverters and converters that work together to continuously charge the battery and convert the battery’s DC power back to AC power for the equipment. This ensures that there is zero transfer time to the battery when power is lost, providing the most reliable power for sensitive equipment and critical applications that cannot tolerate any interruption in power. Kyle’s choice of a True Online UPS is appropriate for ensuring that the servers, which store confidential data and run applications, are not affected by unreliable power sources.
Reference: The Certified Network Defender (CND) program by EC-Council includes the study of various types of UPS systems as part of its module on Business Continuity and Disaster Recovery. The program outlines the importance of maintaining power to critical systems and the role of a True Online UPS in providing the highest level of protection against power inconsistencies12.
Question #299
Identify the correct statements regarding a DMZ zone:
- A . It is a file integrity monitoring mechanism
- B . It is a Neutral zone between a trusted network and an untrusted network
- C . It serves as a proxy
- D . It includes sensitive internal servers such as database servers
Correct Answer: B
B
Explanation:
A DMZ, or demilitarized zone, is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN): an external attacker only has direct access to equipment in the DMZ, rather than any other part of the network. The term ‘neutral zone’ refers to the fact that the DMZ is separated from both the internal network and the untrusted network, which helps prevent attackers from directly accessing internal servers and data. It is not a file integrity monitoring mechanism, does not serve as a proxy, and typically does not include sensitive internal servers like database servers, which are kept inside the trusted network for security reasons123.
Reference: Fortinet’s explanation of a DMZ network1.
EC-Council’s Certified Network Defender (CND) course outline2.
An article on strengthening network security with DMZ3.
B
Explanation:
A DMZ, or demilitarized zone, is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN): an external attacker only has direct access to equipment in the DMZ, rather than any other part of the network. The term ‘neutral zone’ refers to the fact that the DMZ is separated from both the internal network and the untrusted network, which helps prevent attackers from directly accessing internal servers and data. It is not a file integrity monitoring mechanism, does not serve as a proxy, and typically does not include sensitive internal servers like database servers, which are kept inside the trusted network for security reasons123.
Reference: Fortinet’s explanation of a DMZ network1.
EC-Council’s Certified Network Defender (CND) course outline2.
An article on strengthening network security with DMZ3.
Question #300
Which of the following statement holds true in terms of containers?
- A . Container requires more memory space
- B . Each container runs in its own OS
- C . Container is fully isolated; hence, more secure
- D . Process-level isolation happens; a container in hence less secure
Correct Answer: D
D
Explanation:
Containers are designed to be lightweight, running directly within the host’s kernel without the need for a guest operating system. This means they share the same OS kernel but maintain separate user spaces. While this architecture provides process-level isolation, it does not offer the same level of security as a fully isolated virtual machine (VM). VMs include a full copy of an operating system, a virtual copy of the hardware that the OS requires to run, and provide complete isolation from the host system. Containers, on the other hand, are less secure because if the host OS is compromised, all containers could potentially be compromised. The Certified Network Defender (CND) program emphasizes understanding the security implications of different technologies, including containers, and the importance of implementing appropriate security measures to protect network resources123.
Reference: The information provided here is aligned with the EC-Council’s Certified Network Defender (CND) curriculum, which covers network security, defense strategies, and the differences between containers and VMs in terms of security45. For more detailed information, please refer to the official CND study materials and documents provided by the EC-Council.
D
Explanation:
Containers are designed to be lightweight, running directly within the host’s kernel without the need for a guest operating system. This means they share the same OS kernel but maintain separate user spaces. While this architecture provides process-level isolation, it does not offer the same level of security as a fully isolated virtual machine (VM). VMs include a full copy of an operating system, a virtual copy of the hardware that the OS requires to run, and provide complete isolation from the host system. Containers, on the other hand, are less secure because if the host OS is compromised, all containers could potentially be compromised. The Certified Network Defender (CND) program emphasizes understanding the security implications of different technologies, including containers, and the importance of implementing appropriate security measures to protect network resources123.
Reference: The information provided here is aligned with the EC-Council’s Certified Network Defender (CND) curriculum, which covers network security, defense strategies, and the differences between containers and VMs in terms of security45. For more detailed information, please refer to the official CND study materials and documents provided by the EC-Council.