EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Question #321
An organization needs to adhere to the______________rules for safeguarding and protecting the electronically stored health information of employees.
- A . HIPAA
- B . PCI DSS
- C . ISEC
- D . SOX
Correct Answer: A
A
Explanation:
The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data. Organizations that deal with protected health information (PHI) must have physical, network, and process security measures in place and follow them to ensure HIPAA Compliance. Covered entities (which include healthcare providers, health plans, and healthcare clearinghouses) and business associates that conduct certain health care transactions electronically must comply with the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information, and the HIPAA Security Rule, which sets standards for the security of electronic protected health information (e-PHI).
Reference: The information is based on the standards established by the HIPAA Privacy Rule and the HIPAA Security Rule, which are designed to protect the privacy and security of certain health information1234.
A
Explanation:
The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data. Organizations that deal with protected health information (PHI) must have physical, network, and process security measures in place and follow them to ensure HIPAA Compliance. Covered entities (which include healthcare providers, health plans, and healthcare clearinghouses) and business associates that conduct certain health care transactions electronically must comply with the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information, and the HIPAA Security Rule, which sets standards for the security of electronic protected health information (e-PHI).
Reference: The information is based on the standards established by the HIPAA Privacy Rule and the HIPAA Security Rule, which are designed to protect the privacy and security of certain health information1234.
Question #322
If an organization has decided to consume PaaS Cloud service model, then identify the organization’s responsibility that they need to look after based on shared responsibility model.
- A . Data, interfaces, application, etc.
- B . Data, interfaces, application, middleware, OS, VM, virtual network, etc.
- C . Data, interfaces, application, middleware, OS, VM, virtual network, hypervisors, processing and memory, data storage, network interfaces, facilities and data centers, etc.
- D . Data, interfaces, etc.
Correct Answer: A
A
Explanation:
In the PaaS (Platform as a Service) cloud service model, the cloud provider manages the infrastructure, including network, servers, operating systems, and storage. The organization’s responsibility is primarily at the application level, which includes the data, interfaces, and the applications themselves. This means the organization must ensure the security and compliance of their data, manage the applications they develop or deploy, and handle the interfaces that connect their applications to other services or users.
Reference: The Certified Network Defender (CND) course by EC-Council discusses the shared responsibility model in cloud services, emphasizing the division of responsibilities between the cloud provider and the consumer123.
A
Explanation:
In the PaaS (Platform as a Service) cloud service model, the cloud provider manages the infrastructure, including network, servers, operating systems, and storage. The organization’s responsibility is primarily at the application level, which includes the data, interfaces, and the applications themselves. This means the organization must ensure the security and compliance of their data, manage the applications they develop or deploy, and handle the interfaces that connect their applications to other services or users.
Reference: The Certified Network Defender (CND) course by EC-Council discusses the shared responsibility model in cloud services, emphasizing the division of responsibilities between the cloud provider and the consumer123.
Question #323
To provide optimum security while enabling safe/necessary services, blocking known dangerous services, and making employees accountable for their online activity, what Internet Access policy would Brian, the network administrator, have to choose?
- A . Prudent policy
- B . Paranoid policy
- C . Promiscuous policy
- D . Permissive policy
Correct Answer: A
A
Explanation:
The Prudent policy is the most appropriate choice for Brian, the network administrator, to provide optimum security while enabling necessary services and blocking known dangerous ones. This policy strikes a balance between security and usability, allowing safe and necessary services to operate while preventing potentially harmful activities. It also includes measures to make employees accountable for their online activity, which is essential for maintaining a secure network environment.
Reference: The EC-Council’s Certified Network Defender (CND) program emphasizes the importance of implementing a prudent Internet Access policy as part of a defense-in-depth security strategy. This approach is critical for protecting the network, data, and ensuring that the organization’s security policies are enforced effectively12.
A
Explanation:
The Prudent policy is the most appropriate choice for Brian, the network administrator, to provide optimum security while enabling necessary services and blocking known dangerous ones. This policy strikes a balance between security and usability, allowing safe and necessary services to operate while preventing potentially harmful activities. It also includes measures to make employees accountable for their online activity, which is essential for maintaining a secure network environment.
Reference: The EC-Council’s Certified Network Defender (CND) program emphasizes the importance of implementing a prudent Internet Access policy as part of a defense-in-depth security strategy. This approach is critical for protecting the network, data, and ensuring that the organization’s security policies are enforced effectively12.
Question #324
Michelle is a network security administrator working in an MNC company. She wants to set a resource limit for CPU in a container.
Which command-line allows Michelle to limit a container to 2 CPUs?
- A . –cpu=“2”
- B . $cpu=“2”
- C . –cpus=“2”
- D . $cpus=“2”
Correct Answer: C
C
Explanation:
In the context of containerization, setting resource limits is crucial for ensuring that applications do not consume more than their fair share of system resources. Michelle can limit a container to use only 2 CPUs by using the –cpus flag when running a container. This flag allows the user to specify the amount of CPU the container is limited to use. For example, –cpus="2" would restrict the container to using no more than two CPU cores.
Reference: This information is based on standard practices for managing Docker containers and their resources. The –cpus flag is a well-documented feature in Docker’s command-line interface for controlling CPU usage1.
C
Explanation:
In the context of containerization, setting resource limits is crucial for ensuring that applications do not consume more than their fair share of system resources. Michelle can limit a container to use only 2 CPUs by using the –cpus flag when running a container. This flag allows the user to specify the amount of CPU the container is limited to use. For example, –cpus="2" would restrict the container to using no more than two CPU cores.
Reference: This information is based on standard practices for managing Docker containers and their resources. The –cpus flag is a well-documented feature in Docker’s command-line interface for controlling CPU usage1.
Question #325
An IT company has just been hit with a severe external security breach. To enhance the company’s security posture, the network admin has decided to first block all the services and then individually enable only the necessary services.
What is such an Internet access policy called?
- A . Prudent Policy
- B . Permissive Policy
- C . Promiscuous Policy
- D . Paranoid Policy
Correct Answer: D
D
Explanation:
The Paranoid Policy is a type of Internet access policy that is characterized by initially blocking all services and then selectively enabling only those that are necessary. This approach is often taken as a security measure following a severe external breach, as it allows the network administrator to ensure that only essential and secure services are accessible, minimizing potential vulnerabilities.
Reference: This information is consistent with best practices in network security management, which advocate for a ‘deny all’ approach as a starting point for securing a network. This strategy is also in line with the Certified Network Defender (CND) course’s teachings on enhancing a company’s security posture through stringent access controls.
D
Explanation:
The Paranoid Policy is a type of Internet access policy that is characterized by initially blocking all services and then selectively enabling only those that are necessary. This approach is often taken as a security measure following a severe external breach, as it allows the network administrator to ensure that only essential and secure services are accessible, minimizing potential vulnerabilities.
Reference: This information is consistent with best practices in network security management, which advocate for a ‘deny all’ approach as a starting point for securing a network. This strategy is also in line with the Certified Network Defender (CND) course’s teachings on enhancing a company’s security posture through stringent access controls.
Question #326
An employee of a medical service company clicked a malicious link in an email sent by an attacker. Suddenly, employees of the company are not able to access billing information or client record as it is encrypted. The attacker asked the company to pay money for gaining access to their data.
Which type of malware attack is described above?
- A . Logic bomb
- B . Rootkits
- C . Trojan
- D . Ransomware
Correct Answer: D
D
Explanation:
The scenario described is a classic example of a ransomware attack. Ransomware is a type of malware that encrypts the victim’s data, rendering it inaccessible, and then demands payment for the decryption key. In this case, the attacker has encrypted the company’s billing information and client records and is asking for money to restore access, which is characteristic of ransomware attacks.
Reference: This definition aligns with the information provided by sources such as IBM, which describes ransomware as malware that holds a victim’s data or device hostage, threatening to keep it locked―or worse―unless a ransom is paid1. Additionally, the Wikipedia page on ransomware provides a comprehensive overview of this type of malware, including its operation and the typical demand for a ransom in exchange for decryption2.
D
Explanation:
The scenario described is a classic example of a ransomware attack. Ransomware is a type of malware that encrypts the victim’s data, rendering it inaccessible, and then demands payment for the decryption key. In this case, the attacker has encrypted the company’s billing information and client records and is asking for money to restore access, which is characteristic of ransomware attacks.
Reference: This definition aligns with the information provided by sources such as IBM, which describes ransomware as malware that holds a victim’s data or device hostage, threatening to keep it locked―or worse―unless a ransom is paid1. Additionally, the Wikipedia page on ransomware provides a comprehensive overview of this type of malware, including its operation and the typical demand for a ransom in exchange for decryption2.
Question #327
John is a senior network security administrator working at a multinational company. He wants to block specific syscalls from being used by container binaries.
Which Linux kernel feature restricts actions within the container?
- A . Cgroups
- B . LSMs
- C . Seccomp
- D . Userns
Correct Answer: C
C
Explanation:
Seccomp, which stands for secure computing mode, is a Linux kernel feature that enables the restriction of a process’s system calls (syscalls). It provides a means to sandbox the privileges of a process, thereby limiting the calls it can make from userspace into the kernel. This feature is particularly useful for enhancing the security of containers by restricting the syscalls that container binaries are allowed to execute, thus preventing potential exploitation of syscall vulnerabilities.
Reference: The explanation is based on the Kubernetes documentation, which outlines how to restrict a container’s syscalls with seccomp, and confirms its stability since Kubernetes v1.191. Further information can be found in the Kubernetes tutorial on seccomp2, and AWS documentation that describes seccomp as a feature for restricting unauthorized syscalls by programs3.
C
Explanation:
Seccomp, which stands for secure computing mode, is a Linux kernel feature that enables the restriction of a process’s system calls (syscalls). It provides a means to sandbox the privileges of a process, thereby limiting the calls it can make from userspace into the kernel. This feature is particularly useful for enhancing the security of containers by restricting the syscalls that container binaries are allowed to execute, thus preventing potential exploitation of syscall vulnerabilities.
Reference: The explanation is based on the Kubernetes documentation, which outlines how to restrict a container’s syscalls with seccomp, and confirms its stability since Kubernetes v1.191. Further information can be found in the Kubernetes tutorial on seccomp2, and AWS documentation that describes seccomp as a feature for restricting unauthorized syscalls by programs3.
Question #328
Fargo, head of network defense at Globadyne Tech, has discovered an undesirable process in several Linux systems, which causes machines to hang every 1 hour.
Fargo would like to eliminate it; what command should he execute?
- A . # update-rc.d -f [service name] remove
- B . # service [service name] stop
- C . # ps ax | grep [Target Process]
- D . # kill -9 [PID]
Correct Answer: D
D
Explanation:
To eliminate an undesirable process that is causing Linux systems to hang, Fargo should use the
command # kill -9 [PID]. This command sends the SIGKILL signal to the process with the specified PID
(Process ID), which forcefully stops the process immediately. The kill -9 command is used when a
process cannot be terminated using normal shutdown commands. It is important to note that this
command should be used with caution, as it does not allow the process to perform any cleanup
operations before shutting down.
Reference: The use of the kill command is a common practice in Linux system administration for terminating unresponsive processes.
The Certified Network Defender (CND) training includes understanding and managing Linux processes as part of network defense strategies.
D
Explanation:
To eliminate an undesirable process that is causing Linux systems to hang, Fargo should use the
command # kill -9 [PID]. This command sends the SIGKILL signal to the process with the specified PID
(Process ID), which forcefully stops the process immediately. The kill -9 command is used when a
process cannot be terminated using normal shutdown commands. It is important to note that this
command should be used with caution, as it does not allow the process to perform any cleanup
operations before shutting down.
Reference: The use of the kill command is a common practice in Linux system administration for terminating unresponsive processes.
The Certified Network Defender (CND) training includes understanding and managing Linux processes as part of network defense strategies.
Question #329
You are using Wireshark to monitor your network traffic and you see a lot of packages with FIN, PUSH and URG flags activated; what can you infer about this behavior?
- A . The Layer 3 Controls are activated in the Switches
- B . The Spanning Tree Protocol is activated in the Switches
- C . One NIC is broadcasting erroneous traffic
- D . An attacker is running a XMAS scan against the network
Correct Answer: D
D
Explanation:
The presence of packets with FIN, PUSH, and URG flags activated in network traffic, as observed through Wireshark, is indicative of a XMAS scan. This type of scan is used by attackers to identify open ports and services available on a networked computer. The peculiar combination of these TCP flags is not used in normal, everyday communications and is easily picked up by intrusion detection systems as anomalous. The XMAS scan derives its name from the fact that the packet lights up like a Christmas tree with several flags set, which is an unusual and conspicuous event in network traffic.
Reference: The characteristics of a XMAS scan and the use of these specific TCP flags are documented in network security literature and align with the Certified Network Defender (CND) course materials, which cover network scanning techniques and their identification123.
D
Explanation:
The presence of packets with FIN, PUSH, and URG flags activated in network traffic, as observed through Wireshark, is indicative of a XMAS scan. This type of scan is used by attackers to identify open ports and services available on a networked computer. The peculiar combination of these TCP flags is not used in normal, everyday communications and is easily picked up by intrusion detection systems as anomalous. The XMAS scan derives its name from the fact that the packet lights up like a Christmas tree with several flags set, which is an unusual and conspicuous event in network traffic.
Reference: The characteristics of a XMAS scan and the use of these specific TCP flags are documented in network security literature and align with the Certified Network Defender (CND) course materials, which cover network scanning techniques and their identification123.
Question #330
Which scan attempt can penetrate through a router and a firewall that filter incoming packets with particular flags set and is not supported by Windows?
- A . ARP scan attempt
- B . TCP full connect scan attempt
- C . TCP null scan attempt
- D . PINC sweep attempt
Correct Answer: C
C
Explanation:
A TCP null scan attempt is a technique used in network scanning where the TCP packet sent has no flags set. This type of scan can sometimes penetrate through routers and firewalls that filter incoming packets based on certain flags because the absence of flags can prevent the packet from being filtered out. The TCP null scan is particularly useful for identifying open ports on a target system. If a port is open, the target system will not respond to the null scan, but if the port is closed, the system will send a TCP RST packet in response. This scanning method is not supported by Windows because Windows systems typically respond with a RST packet regardless of whether the port is open or closed, making it ineffective for distinguishing between the two states on those systems.
Reference: The TCP null scan’s ability to bypass certain types of filters and its behavior in response to open and closed ports are documented in various network security resources, including the Nmap documentation and other network security analysis articles12. These sources confirm the effectiveness of TCP null scans in penetrating through filters set up by routers and firewalls and their unsupported status on Windows systems.
C
Explanation:
A TCP null scan attempt is a technique used in network scanning where the TCP packet sent has no flags set. This type of scan can sometimes penetrate through routers and firewalls that filter incoming packets based on certain flags because the absence of flags can prevent the packet from being filtered out. The TCP null scan is particularly useful for identifying open ports on a target system. If a port is open, the target system will not respond to the null scan, but if the port is closed, the system will send a TCP RST packet in response. This scanning method is not supported by Windows because Windows systems typically respond with a RST packet regardless of whether the port is open or closed, making it ineffective for distinguishing between the two states on those systems.
Reference: The TCP null scan’s ability to bypass certain types of filters and its behavior in response to open and closed ports are documented in various network security resources, including the Nmap documentation and other network security analysis articles12. These sources confirm the effectiveness of TCP null scans in penetrating through filters set up by routers and firewalls and their unsupported status on Windows systems.