EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #311
The agency Jacob works for stores and transmits vast amounts of sensitive government data that cannot be compromised. Jacob has implemented Encapsulating Security Payload (ESP) to encrypt IP traffic. Jacob wants to encrypt the IP traffic by inserting the ESP header in the IP datagram before the transport layer protocol header.
What mode of ESP does Jacob need to use to encrypt the IP traffic?
- A . He should use ESP in transport mode.
- B . Jacob should utilize ESP in tunnel mode.
- C . Jacob should use ESP in pass-through mode.
- D . He should use ESP in gateway mode
Correct Answer: B
B
Explanation:
Jacob needs to use ESP in tunnel mode to encrypt the IP traffic. In tunnel mode, the entire original IP packet, including both the payload and the IP header, is encrypted and then encapsulated within a new IP packet with a new IP header123. This mode is particularly useful for encrypting traffic between different networks, such as in a site-to-site VPN, where the data and security endpoints may differ from the original source and destination IP addresses2. Transport mode, on the other hand, would only encrypt the payload of the IP packet, leaving the original IP header unencrypted123. Since Jacob’s goal is to encrypt the entire IP datagram before the transport layer protocol header, tunnel mode is the appropriate choice.
Reference: The information provided here is consistent with the principles of IPsec and ESP as described in various networking resources, including the Twingate article on IPsec Tunnel Mode vs. Transport Mode1, TutorialsPoint’s explanation of ESP in tunnel and transport mode2, and the STIGViewer’s guidelines on IPsec VPN Gateway requirements3.
B
Explanation:
Jacob needs to use ESP in tunnel mode to encrypt the IP traffic. In tunnel mode, the entire original IP packet, including both the payload and the IP header, is encrypted and then encapsulated within a new IP packet with a new IP header123. This mode is particularly useful for encrypting traffic between different networks, such as in a site-to-site VPN, where the data and security endpoints may differ from the original source and destination IP addresses2. Transport mode, on the other hand, would only encrypt the payload of the IP packet, leaving the original IP header unencrypted123. Since Jacob’s goal is to encrypt the entire IP datagram before the transport layer protocol header, tunnel mode is the appropriate choice.
Reference: The information provided here is consistent with the principles of IPsec and ESP as described in various networking resources, including the Twingate article on IPsec Tunnel Mode vs. Transport Mode1, TutorialsPoint’s explanation of ESP in tunnel and transport mode2, and the STIGViewer’s guidelines on IPsec VPN Gateway requirements3.
Question #312
HexCom, a leading IT Company in the USA, realized that their employees were having trouble accessing multiple servers with different passwords. Due to this, the centralized server was also being overburdened by avoidable network traffic.
To overcome the issue, what type of authentication can be given to the employees?
- A . Two-Factor Authentication
- B . Biometric Authentication
- C . Single Sign-on (SSO)
- D . Smart Card Authentication
Correct Answer: C
C
Explanation:
Single Sign-on (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials, thereby reducing the need for multiple passwords. This not only simplifies the user experience but also reduces the load on the centralized server by decreasing the network traffic caused by repeated authentication requests. SSO is particularly beneficial in an environment like HexCom’s, where employees need to access various servers and systems, as it streamlines the login process and improves security by minimizing the chances of password fatigue and the resultant poor password practices.
Reference: The explanation aligns with the principles of network security and access management, which are core components of the Certified Network Defender (CND) curriculum. The benefits of SSO in reducing network traffic and improving user experience are well-documented in network security literature12.
C
Explanation:
Single Sign-on (SSO) is an authentication process that allows a user to access multiple applications with one set of login credentials, thereby reducing the need for multiple passwords. This not only simplifies the user experience but also reduces the load on the centralized server by decreasing the network traffic caused by repeated authentication requests. SSO is particularly beneficial in an environment like HexCom’s, where employees need to access various servers and systems, as it streamlines the login process and improves security by minimizing the chances of password fatigue and the resultant poor password practices.
Reference: The explanation aligns with the principles of network security and access management, which are core components of the Certified Network Defender (CND) curriculum. The benefits of SSO in reducing network traffic and improving user experience are well-documented in network security literature12.
Question #313
How is a “risk” represented?
- A . Asset + threat
- B . Motive (goal) + method
- C . Asset + threat + vulnerability
- D . Motive (goal) + method + vulnerability
Correct Answer: C
C
Explanation:
In cybersecurity, risk is represented by the combination of an asset, a threat, and a vulnerability. This means that for a risk to exist, there must be something of value (an asset) that could be negatively impacted, a potential source of harm (a threat), and a weakness that could be exploited (a vulnerability). The presence of an asset alone does not constitute a risk without the potential for a threat to exploit a vulnerability. Similarly, a threat without the ability to exploit a vulnerability does not pose a risk to an asset. Therefore, the representation of risk encompasses all three elements: the asset that needs protection, the threat that could cause harm, and the vulnerability that could allow the threat to affect the asset.
Reference: This definition aligns with the principles of risk management and cybersecurity frameworks, such as those from the National Institute of Standards and Technology (NIST) and is consistent with the EC-Council’s Certified Network Defender (CND) program guidelines1234.
C
Explanation:
In cybersecurity, risk is represented by the combination of an asset, a threat, and a vulnerability. This means that for a risk to exist, there must be something of value (an asset) that could be negatively impacted, a potential source of harm (a threat), and a weakness that could be exploited (a vulnerability). The presence of an asset alone does not constitute a risk without the potential for a threat to exploit a vulnerability. Similarly, a threat without the ability to exploit a vulnerability does not pose a risk to an asset. Therefore, the representation of risk encompasses all three elements: the asset that needs protection, the threat that could cause harm, and the vulnerability that could allow the threat to affect the asset.
Reference: This definition aligns with the principles of risk management and cybersecurity frameworks, such as those from the National Institute of Standards and Technology (NIST) and is consistent with the EC-Council’s Certified Network Defender (CND) program guidelines1234.
Question #314
Which firewall technology can filler application-specific commands such as CET and POST requests?
- A . Circuit-level gateways
- B . Application-level gateways
- C . Application proxy
- D . Stateful multi-layer inspection
Correct Answer: B
B
Explanation:
Application-level gateways, also known as proxy firewalls, operate at the application layer of the OSI model and can filter traffic based on application-specific commands such as HTTP GET and POST requests. These firewalls examine the content of the traffic and make decisions based on the specifics of the application protocol. They can allow or deny traffic based on the actual commands being sent, providing a high level of security by ensuring that only valid types of transactions are completed.
Reference: The explanation aligns with the Certified Network Defender (CND) curriculum, which covers various firewall technologies and their capabilities in filtering and securing network traffic12.
B
Explanation:
Application-level gateways, also known as proxy firewalls, operate at the application layer of the OSI model and can filter traffic based on application-specific commands such as HTTP GET and POST requests. These firewalls examine the content of the traffic and make decisions based on the specifics of the application protocol. They can allow or deny traffic based on the actual commands being sent, providing a high level of security by ensuring that only valid types of transactions are completed.
Reference: The explanation aligns with the Certified Network Defender (CND) curriculum, which covers various firewall technologies and their capabilities in filtering and securing network traffic12.
Question #315
Daniel is monitoring network traffic with the help of a network monitoring tool to detect any abnormalities.
What type of network security approach is Daniel adopting?
- A . Preventative
- B . Reactive
- C . Retrospective
- D . Defense-in-depth
Correct Answer: B
B
Explanation:
Daniel is adopting a Reactive network security approach. This approach involves monitoring network traffic to detect any abnormalities or intrusions as they occur. The goal of reactive security is to identify and respond to threats in real-time. It is a part of the broader defense strategy that includes Protect, Detect, Respond, and Predict, where ‘Detect’ aligns with the reactive approach. By using network monitoring tools, Daniel is able to observe the network for any signs of compromise or unusual activity and then take appropriate action to mitigate the threat.
Reference: The Certified Network Defender (CND) program by EC-Council emphasizes the importance of a continual/adaptive security strategy, which includes the ability to detect ongoing threats as a critical component of network defense12. This strategy is further detailed in the CND course outline, which covers key topics such as network traffic monitoring and analysis, indicating the reactive nature of such activities1.
B
Explanation:
Daniel is adopting a Reactive network security approach. This approach involves monitoring network traffic to detect any abnormalities or intrusions as they occur. The goal of reactive security is to identify and respond to threats in real-time. It is a part of the broader defense strategy that includes Protect, Detect, Respond, and Predict, where ‘Detect’ aligns with the reactive approach. By using network monitoring tools, Daniel is able to observe the network for any signs of compromise or unusual activity and then take appropriate action to mitigate the threat.
Reference: The Certified Network Defender (CND) program by EC-Council emphasizes the importance of a continual/adaptive security strategy, which includes the ability to detect ongoing threats as a critical component of network defense12. This strategy is further detailed in the CND course outline, which covers key topics such as network traffic monitoring and analysis, indicating the reactive nature of such activities1.
Question #316
Which BC/DR activity includes action taken toward resuming all services that are dependent on business-critical applications?
- A . Response
- B . Recovery
- C . Resumption
- D . Restoration
Correct Answer: C
C
Explanation:
In the context of Business Continuity/Disaster Recovery (BC/DR), the activity that includes actions taken toward resuming all services that are dependent on business-critical applications is referred to as Resumption. This phase focuses on the steps necessary to bring critical functions back into operation after a disruption. Recovery, on the other hand, is more about the actions taken to return the business to normal operating conditions post-disaster, which may include repairs, restorations, and return to normalcy. Response is the immediate reaction to an incident, and Restoration is the process of rebuilding or restoring IT systems and operations.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes understanding and implementing proper BC/DR activities.
C
Explanation:
In the context of Business Continuity/Disaster Recovery (BC/DR), the activity that includes actions taken toward resuming all services that are dependent on business-critical applications is referred to as Resumption. This phase focuses on the steps necessary to bring critical functions back into operation after a disruption. Recovery, on the other hand, is more about the actions taken to return the business to normal operating conditions post-disaster, which may include repairs, restorations, and return to normalcy. Response is the immediate reaction to an incident, and Restoration is the process of rebuilding or restoring IT systems and operations.
Reference: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes understanding and implementing proper BC/DR activities.
Question #317
Management wants to bring their organization into compliance with the ISO standard for information security risk management.
Which ISO standard will management decide to implement?
- A . ISO/IEC 27004
- B . ISO/IEC 27002
- C . ISO/IEC 27006
- D . ISO/IEC 27005
Correct Answer: D
D
Explanation:
ISO/IEC 27005 is the standard dedicated to information security risk management. It provides guidelines for information security risk management and supports the general concepts specified in ISO/IEC 27001. It is designed to assist the implementation of information security based on a risk management approach and is applicable to all types of organizations which intend to manage risks that can compromise the organization’s information security.
Reference: The ISO/IEC 27005 standard is referenced in various resources as the go-to standard for information security risk management, which aligns with the objectives of bringing an organization into compliance with ISO standards for this purpose12. Additionally, the ECCouncil’s Certified Network Defender (CND) study materials and guidelines would include references to such standards as part of the curriculum for network security and defense34.
D
Explanation:
ISO/IEC 27005 is the standard dedicated to information security risk management. It provides guidelines for information security risk management and supports the general concepts specified in ISO/IEC 27001. It is designed to assist the implementation of information security based on a risk management approach and is applicable to all types of organizations which intend to manage risks that can compromise the organization’s information security.
Reference: The ISO/IEC 27005 standard is referenced in various resources as the go-to standard for information security risk management, which aligns with the objectives of bringing an organization into compliance with ISO standards for this purpose12. Additionally, the ECCouncil’s Certified Network Defender (CND) study materials and guidelines would include references to such standards as part of the curriculum for network security and defense34.
Question #318
Which of the following helps in viewing account activity and events for supported services made by AWS?
- A . AWS CloudFormation
- B . AWS Certificate Manager
- C . AWS CloudHSM
- D . AWS CloudTrial
Correct Answer: D
D
Explanation:
AWS CloudTrail is the service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It allows you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. It is specifically designed for reviewing account activity and events for supported services made by AWS.
Reference: The information about AWS CloudTrail as a service for viewing account activity and events is detailed in the AWS CloudTrail user guide and is a fundamental aspect of AWS security best practices1.
D
Explanation:
AWS CloudTrail is the service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It allows you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. It is specifically designed for reviewing account activity and events for supported services made by AWS.
Reference: The information about AWS CloudTrail as a service for viewing account activity and events is detailed in the AWS CloudTrail user guide and is a fundamental aspect of AWS security best practices1.
Question #319
Simran is a network administrator at a start-up called Revolution. To ensure that neither party in the company can deny getting email notifications or any other communication, she mandates authentication
before a connection establishment or message transfer occurs.
What fundamental attribute of network defense is she enforcing?
- A . Integrity
- B . Non-repudiation
- C . Confidentiality
- D . Authentication
Correct Answer: B
B
Explanation:
Non-repudiation is a fundamental attribute of network defense that ensures that neither party can deny the authenticity of their communications. In the context of Simran’s actions as a network administrator, by mandating authentication before any connection establishment or message transfer, she is ensuring that the identity of the communicating parties can be confirmed and that the parties cannot later deny having sent or received the messages. This is crucial for maintaining accountability and trust within the network, as it provides irrefutable proof of the origin and integrity of the communications.
Reference: The concept of non-repudiation is widely recognized in cybersecurity and network defense literature as one of the key attributes that contribute to the security and integrity of digital communications. It is often discussed alongside other core principles such as integrity, availability, authentication, and confidentiality123.
B
Explanation:
Non-repudiation is a fundamental attribute of network defense that ensures that neither party can deny the authenticity of their communications. In the context of Simran’s actions as a network administrator, by mandating authentication before any connection establishment or message transfer, she is ensuring that the identity of the communicating parties can be confirmed and that the parties cannot later deny having sent or received the messages. This is crucial for maintaining accountability and trust within the network, as it provides irrefutable proof of the origin and integrity of the communications.
Reference: The concept of non-repudiation is widely recognized in cybersecurity and network defense literature as one of the key attributes that contribute to the security and integrity of digital communications. It is often discussed alongside other core principles such as integrity, availability, authentication, and confidentiality123.
Question #320
Which type of information security policy addresses the implementation and configuration of technology and user behavior?
- A . Enterprise information security policy
- B . Acceptable use policy
- C . System specific security policy
- D . Issue-specific security policy
Correct Answer: C
C
Explanation:
A System Specific Security Policy (SSSP) is focused on the implementation and configuration of technology and the behavior of users interacting with that specific system. It provides detailed, targeted guidance on how systems should be configured and used securely. This type of policy is often more technical than other policies and includes requirements for system configuration, connections to other systems, and processing and handling of data. It also addresses user responsibilities and expected behavior when using the system.
Reference: The concept of a System Specific Security Policy is consistent with the EC-Council’s Certified Network Defender (CND) curriculum, which includes understanding and applying security policies that are specific to systems as part of a comprehensive network defense strategy123.
C
Explanation:
A System Specific Security Policy (SSSP) is focused on the implementation and configuration of technology and the behavior of users interacting with that specific system. It provides detailed, targeted guidance on how systems should be configured and used securely. This type of policy is often more technical than other policies and includes requirements for system configuration, connections to other systems, and processing and handling of data. It also addresses user responsibilities and expected behavior when using the system.
Reference: The concept of a System Specific Security Policy is consistent with the EC-Council’s Certified Network Defender (CND) curriculum, which includes understanding and applying security policies that are specific to systems as part of a comprehensive network defense strategy123.