EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #301
David is working in a mid-sized IT company. Management asks him to suggest a framework that can be used effectively to align the IT goals to the business goals of the company. David suggests the______framework, as it provides a set of controls over IT and consolidates them to form a framework.
- A . RMIS
- B . ITIL
- C . ISO 27007
- D . COBIT
Correct Answer: D
D
Explanation:
COBIT (Control Objectives for Information and Related Technologies) is a framework designed to help organizations develop, implement, monitor, and improve IT governance and management practices. It is recognized for its comprehensive approach to aligning IT goals with business objectives, ensuring that IT investments support the overall strategic direction of the company. COBIT provides a set of controls over IT and consolidates them into a framework that helps organizations ensure that their IT infrastructure is secure, reliable, and efficient, while also being aligned with their business goals12.
Reference: ISACA’s “Connecting Business and IT Goals Through COBIT 5” article provides insights into how COBIT 5 connects business goals with IT goals using non-technical, business language1.
The Interface Technical Training blog post on “Aligning IT goals using the COBIT5 Goals Cascade” explains the process of translating stakeholder needs into enterprise goals, IT-related goals, and enabler goals, which is key to supporting alignment between an enterprise’s needs and IT solutions and services2.
D
Explanation:
COBIT (Control Objectives for Information and Related Technologies) is a framework designed to help organizations develop, implement, monitor, and improve IT governance and management practices. It is recognized for its comprehensive approach to aligning IT goals with business objectives, ensuring that IT investments support the overall strategic direction of the company. COBIT provides a set of controls over IT and consolidates them into a framework that helps organizations ensure that their IT infrastructure is secure, reliable, and efficient, while also being aligned with their business goals12.
Reference: ISACA’s “Connecting Business and IT Goals Through COBIT 5” article provides insights into how COBIT 5 connects business goals with IT goals using non-technical, business language1.
The Interface Technical Training blog post on “Aligning IT goals using the COBIT5 Goals Cascade” explains the process of translating stakeholder needs into enterprise goals, IT-related goals, and enabler goals, which is key to supporting alignment between an enterprise’s needs and IT solutions and services2.
Question #302
Consider a scenario consisting of a tree network. The root Node N is connected to two man nodes N1 and N2. N1 is connected to N11 and N12. N2 is connected to N21 and N22.
What will happen if any one of the main nodes fail?
- A . Failure of the main node affects all other child nodes at the same level irrespective of the main node.
- B . Does not cause any disturbance to the child nodes or its tranmission
- C . Failure of the main node will affect all related child nodes connected to the main node
- D . Affects the root node only
Correct Answer: C
C
Explanation:
In a tree network, each node is connected in a hierarchical manner, with the root node at the top. If a main node (such as N1 or N2) fails, all the child nodes connected to it (N11, N12 for N1 and N21, N22 for N2) will be affected because the tree structure relies on the connectivity of the parent node to its children. The failure of a main node will disrupt the transmission path from the root to the child nodes, leading to a loss of connectivity for those child nodes. This is consistent with the principles of network resilience and fault tolerance as outlined in the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of each node in maintaining the network’s overall integrity.
Reference: The explanation is based on the standard network topologies and fault tolerance principles covered in the EC-Council’s Certified Network Defender (CND) curriculum.
C
Explanation:
In a tree network, each node is connected in a hierarchical manner, with the root node at the top. If a main node (such as N1 or N2) fails, all the child nodes connected to it (N11, N12 for N1 and N21, N22 for N2) will be affected because the tree structure relies on the connectivity of the parent node to its children. The failure of a main node will disrupt the transmission path from the root to the child nodes, leading to a loss of connectivity for those child nodes. This is consistent with the principles of network resilience and fault tolerance as outlined in the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of each node in maintaining the network’s overall integrity.
Reference: The explanation is based on the standard network topologies and fault tolerance principles covered in the EC-Council’s Certified Network Defender (CND) curriculum.
Question #303
Which of the following is a data destruction technique that protects the sensitivity of information against a laboratory attack where an unauthorized individual uses signal processing recovery tools in a laboratory environment to recover the information?
- A . Purging
- B . Destroying
- C . Clearing
- D . Disposal
Correct Answer: A
A
Explanation:
Purging is a data destruction technique designed to protect the sensitivity of information against laboratory attacks. In such attacks, unauthorized individuals may use advanced signal processing recovery tools to recover previously stored information. Purging involves removing the stored data in a way that it cannot be reconstructed by any means, including laboratory techniques. This process often includes degaussing, which demagnetizes the magnetic field of storage media, thereby making data recovery virtually impossible.
Reference: The information provided aligns with the Certified Network Defender (CND) course’s objectives regarding data destruction and protection against laboratory attacks. For more detailed information, please refer to the official CND study guide and documents.
A
Explanation:
Purging is a data destruction technique designed to protect the sensitivity of information against laboratory attacks. In such attacks, unauthorized individuals may use advanced signal processing recovery tools to recover previously stored information. Purging involves removing the stored data in a way that it cannot be reconstructed by any means, including laboratory techniques. This process often includes degaussing, which demagnetizes the magnetic field of storage media, thereby making data recovery virtually impossible.
Reference: The information provided aligns with the Certified Network Defender (CND) course’s objectives regarding data destruction and protection against laboratory attacks. For more detailed information, please refer to the official CND study guide and documents.
Question #304
Will is working as a Network Administrator. Management wants to maintain a backup of all the company data as soon as it starts operations. They decided to use a RAID backup storage technology for their data backup plan. To implement the RAID data backup storage, Will sets up a pair of RAID disks so that all the data written to one disk is copied automatically to the other disk as well. This maintains an additional copy of the data.
Which RAID level is used here?
- A . RAID 3
- B . RAID 1
- C . RAID 5
- D . RAID 0
Correct Answer: B
B
Explanation:
The RAID level used here is RAID 1, which is also known as disk mirroring. In this setup, all the data written to one disk is automatically copied to another disk, creating an exact duplicate of the data. This ensures that if one disk fails, the data is still available on the other disk, providing redundancy and protecting against data loss. RAID 1 is a common choice for systems where data availability and integrity are critical.
Reference: This explanation is consistent with the principles outlined in the EC-Council’s Certified Network Defender (CND) course materials, which describe RAID 1 as a configuration that duplicates data across multiple disks to ensure redundancy and data availability1.
B
Explanation:
The RAID level used here is RAID 1, which is also known as disk mirroring. In this setup, all the data written to one disk is automatically copied to another disk, creating an exact duplicate of the data. This ensures that if one disk fails, the data is still available on the other disk, providing redundancy and protecting against data loss. RAID 1 is a common choice for systems where data availability and integrity are critical.
Reference: This explanation is consistent with the principles outlined in the EC-Council’s Certified Network Defender (CND) course materials, which describe RAID 1 as a configuration that duplicates data across multiple disks to ensure redundancy and data availability1.
Question #305
Which of the following is a drawback of traditional perimeter security?
- A . Traditional firewalls are static in nature
- B . Traditional VPNs follow identity centric instead of trust based network centric approach
- C . Traditional perimeter security is identity-centric
- D . Traditional firewalls are dynamic in nature
Correct Answer: A
A
Explanation:
One of the main drawbacks of traditional perimeter security is that it is based on a static model. Traditional firewalls, which are a core component of perimeter security, operate under the assumption that threats can be prevented by establishing a strong, static boundary. This model does not adapt well to the dynamic nature of modern networks, where users, devices, and applications are constantly changing and may exist outside of the traditional network boundary. The static nature of traditional firewalls means they cannot effectively handle the fluid and evolving security demands of today’s interconnected environments.
Reference: The explanation provided aligns with the principles of network security and the limitations of traditional perimeter security models as discussed in various authoritative sources, including Microsoft’s insights on transforming to a Zero Trust model1, and other industry discussions on the need for a shift from traditional network perimeter security to more dynamic and adaptive security approaches23.
A
Explanation:
One of the main drawbacks of traditional perimeter security is that it is based on a static model. Traditional firewalls, which are a core component of perimeter security, operate under the assumption that threats can be prevented by establishing a strong, static boundary. This model does not adapt well to the dynamic nature of modern networks, where users, devices, and applications are constantly changing and may exist outside of the traditional network boundary. The static nature of traditional firewalls means they cannot effectively handle the fluid and evolving security demands of today’s interconnected environments.
Reference: The explanation provided aligns with the principles of network security and the limitations of traditional perimeter security models as discussed in various authoritative sources, including Microsoft’s insights on transforming to a Zero Trust model1, and other industry discussions on the need for a shift from traditional network perimeter security to more dynamic and adaptive security approaches23.
Question #306
Katie has implemented the RAID level that split data into blocks and evenly write the data to multiple hard drives but does not provide data redundancy. This type of RAID level requires a minimum of________in order to setup.
- A . Four drives
- B . Three drives
- C . Two drives
- D . Six drives
Correct Answer: C
C
Explanation:
The RAID level that splits data into blocks and evenly writes the data to multiple hard drives without providing data redundancy is known as RAID 0. This RAID level is also referred to as striping. It requires a minimum of two drives to set up. RAID 0 enhances performance by allowing simultaneous read and write operations across the drives, but it does not offer any fault tolerance. If one drive fails, all data in the array is lost because there is no redundancy.
Reference: RAID 0 is defined by its ability to increase performance by striping data across at least two drives. This information is consistent with the standards and descriptions provided in the EC-Council’s Certified Network Defender (C|ND) course materials and other authoritative sources on RAID configurations123.
C
Explanation:
The RAID level that splits data into blocks and evenly writes the data to multiple hard drives without providing data redundancy is known as RAID 0. This RAID level is also referred to as striping. It requires a minimum of two drives to set up. RAID 0 enhances performance by allowing simultaneous read and write operations across the drives, but it does not offer any fault tolerance. If one drive fails, all data in the array is lost because there is no redundancy.
Reference: RAID 0 is defined by its ability to increase performance by striping data across at least two drives. This information is consistent with the standards and descriptions provided in the EC-Council’s Certified Network Defender (C|ND) course materials and other authoritative sources on RAID configurations123.
Question #307
John has planned to update all Linux workstations in his network. The organization is using various Linux distributions including Red hat, Fedora and Debian.
Which of following commands will he use to update each respective Linux distribution?
- A . 1-iii,2-iv,3-ii,4-v
- B . 1-iv,2-v,3-iv,4-iii
- C . 1-v,2-iii,3-i,4-iv
- D . 1-ii,2-i,3-iv,4-iii
Correct Answer: C
C
Explanation:
The correct commands to update the respective Linux distributions are as follows:
Red Hat: Uses the yum command or the newer dnf command for package management and updates.
Fedora: Originally used yum but now has transitioned to dnf as the default package manager.
Debian: Utilizes the apt-get command for package management tasks, including updates.
The matching from the options provided would be:
1-v: Slackware based systems use Autoupdate.
2-iii: RPM-based systems, which include Fedora, use Swaret.
3-i: Debian based systems use apt-get.
4-iv: Red Hat based systems use up2date.
Reference: This information is based on general knowledge of Linux distribution package managers and their respective update commands. For the most accurate and detailed information, please refer to the official documentation of each Linux distribution and the Certified Network Defender (CND) study materials provided by the EC-Council1.
C
Explanation:
The correct commands to update the respective Linux distributions are as follows:
Red Hat: Uses the yum command or the newer dnf command for package management and updates.
Fedora: Originally used yum but now has transitioned to dnf as the default package manager.
Debian: Utilizes the apt-get command for package management tasks, including updates.
The matching from the options provided would be:
1-v: Slackware based systems use Autoupdate.
2-iii: RPM-based systems, which include Fedora, use Swaret.
3-i: Debian based systems use apt-get.
4-iv: Red Hat based systems use up2date.
Reference: This information is based on general knowledge of Linux distribution package managers and their respective update commands. For the most accurate and detailed information, please refer to the official documentation of each Linux distribution and the Certified Network Defender (CND) study materials provided by the EC-Council1.
Question #308
Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.
Which step should Malone list as the last step in the incident response methodology?
- A . Malone should list a follow-up as the last step in the methodology
- B . Recovery would be the correct choice for the last step in the incident response methodology
- C . He should assign eradication to the last step.
- D . Containment should be listed on Malone’s plan for incident response.
Correct Answer: A
A
Explanation:
In the context of incident response methodology, the last step is typically referred to as ‘Post-Incident Activity’ or ‘Lessons Learned’. This step involves reviewing the incident to understand what happened, how it was handled, and how similar incidents can be prevented or mitigated in the future. It’s a critical phase where the organization can improve its security posture and response strategies. The follow-up step ensures that any residual risk is addressed, and that all documentation is completed. It also provides an opportunity for the incident response team to reflect on their actions and improve the incident handling plan for future responses.
Reference: The importance of the follow-up step as the last phase in the incident response methodology is supported by well-respected frameworks developed by NIST and SANS, which outline ‘Post-Incident Activity’ or ‘Lessons Learned’ as the final step123. These steps align with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
A
Explanation:
In the context of incident response methodology, the last step is typically referred to as ‘Post-Incident Activity’ or ‘Lessons Learned’. This step involves reviewing the incident to understand what happened, how it was handled, and how similar incidents can be prevented or mitigated in the future. It’s a critical phase where the organization can improve its security posture and response strategies. The follow-up step ensures that any residual risk is addressed, and that all documentation is completed. It also provides an opportunity for the incident response team to reflect on their actions and improve the incident handling plan for future responses.
Reference: The importance of the follow-up step as the last phase in the incident response methodology is supported by well-respected frameworks developed by NIST and SANS, which outline ‘Post-Incident Activity’ or ‘Lessons Learned’ as the final step123. These steps align with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.
Question #309
Which type of wireless network attack is characterized by an attacker using a high gain amplifier from a nearby location to drown out the legitimate access point signal?
- A . Jamming signal attack
- B . Ad Hoc Connection attack
- C . Rogue access point attack
- D . Unauthorized association
Correct Answer: A
A
Explanation:
The type of wireless network attack characterized by an attacker using a high gain amplifier to drown out the legitimate access point signal is known as a jamming signal attack. This attack involves the deliberate transmission of radio signals at the same frequency as the access point, thereby overwhelming and interfering with the legitimate signal. High gain amplifiers can be used to increase the strength of the jamming signal, making it more effective at disrupting the wireless communication.
Reference: This explanation is consistent with general network security knowledge regarding the behavior of wireless signals and the impact of amplification on signal strength and interference. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the information aligns with the principles of wireless network attacks and defense strategies.
A
Explanation:
The type of wireless network attack characterized by an attacker using a high gain amplifier to drown out the legitimate access point signal is known as a jamming signal attack. This attack involves the deliberate transmission of radio signals at the same frequency as the access point, thereby overwhelming and interfering with the legitimate signal. High gain amplifiers can be used to increase the strength of the jamming signal, making it more effective at disrupting the wireless communication.
Reference: This explanation is consistent with general network security knowledge regarding the behavior of wireless signals and the impact of amplification on signal strength and interference. While specific references to the EC-Council’s Certified Network Defender (CND) course materials cannot be provided here, the information aligns with the principles of wireless network attacks and defense strategies.
Question #310
Emmanuel works as a Windows system administrator at an MNC. He uses PowerShell to enforce the script execution policy. He wants to allow the execution of the scripts that are signed by a trusted
publisher.
Which of the following script execution policy setting this?
- A . AllSigned
- B . Restricted
- C . RemoteSigned
- D . Unrestricted
Correct Answer: A
A
Explanation:
The AllSigned execution policy in PowerShell requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer. This setting is used when you want to ensure that only scripts that have been examined and signed by a trusted authority are run on your systems, which helps protect against the execution of unauthorized or malicious scripts. When using the AllSigned execution policy, PowerShell will prompt the user to confirm that they trust the signer before running any script.
Reference: This information aligns with the PowerShell documentation and best practices for script execution policies, which recommend the AllSigned policy for environments that require a high level of security12.
A
Explanation:
The AllSigned execution policy in PowerShell requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer. This setting is used when you want to ensure that only scripts that have been examined and signed by a trusted authority are run on your systems, which helps protect against the execution of unauthorized or malicious scripts. When using the AllSigned execution policy, PowerShell will prompt the user to confirm that they trust the signer before running any script.
Reference: This information aligns with the PowerShell documentation and best practices for script execution policies, which recommend the AllSigned policy for environments that require a high level of security12.