EC-Council 312-38 Practice Exams
Last updated on Oct 23,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 23,2026
Question #331
Cindy is the network security administrator for her company. She just got back from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. She is worried about the current security state of her company’s network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established, she sends RST packets to those hosts to stop the session. She has done this to see how her intrusion detection system will log the traffic.
What type of scan is Cindy attempting here?
- A . The type of scan she is usinq is called a NULL scan.
- B . Cindy is using a half-open scan to find live hosts on her network.
- C . Cindy is attempting to find live hosts on her company’s network by using a XMAS scan.
- D . She is utilizing a RST scan to find live hosts that are listening on her network.
Correct Answer: B
B
Explanation:
The technique Cindy is using is known as a half-open scan, or SYN scan. This method involves sending SYN packets, which are the initial step in establishing a TCP connection, to various hosts to determine if the ports are listening. If a host responds with a SYN/ACK, it indicates that the port is open and ready to establish a connection. Cindy then sends an RST packet to terminate the session before the connection is fully established. This type of scan is useful for mapping out live hosts on a network without completing the TCP three-way handshake, thus avoiding the creation of a full connection and reducing the likelihood of detection by intrusion detection systems.
Reference: The information about half-open scans can be found in various security resources and
aligns with the ECCouncil’s Network Defender (CND) objectives. It is a common technique discussed in network security literature for its efficiency and stealth123.
B
Explanation:
The technique Cindy is using is known as a half-open scan, or SYN scan. This method involves sending SYN packets, which are the initial step in establishing a TCP connection, to various hosts to determine if the ports are listening. If a host responds with a SYN/ACK, it indicates that the port is open and ready to establish a connection. Cindy then sends an RST packet to terminate the session before the connection is fully established. This type of scan is useful for mapping out live hosts on a network without completing the TCP three-way handshake, thus avoiding the creation of a full connection and reducing the likelihood of detection by intrusion detection systems.
Reference: The information about half-open scans can be found in various security resources and
aligns with the ECCouncil’s Network Defender (CND) objectives. It is a common technique discussed in network security literature for its efficiency and stealth123.
Question #332
Timothy works as a network administrator in a multinational organization. He decides to implement a dedicated network for sharing storage resources. He uses a_______as it seperates the storage units from the servers and the user network.
- A . SAN
- B . SCSA
- C . NAS
- D . SAS
Correct Answer: A
A
Explanation:
Storage Area Network (SAN), which is a dedicated high-speed network that connects servers to storage devices, allowing for the sharing of storage resources. A SAN is designed to handle large amounts of data and provides a way to centralize storage management, making it an efficient solution for enterprises that require reliable and scalable storage infrastructure. It separates the storage units from the servers and the user network, which aligns with the scenario described for Timothy’s organization.
Reference: The concept of a SAN as a dedicated network for sharing storage resources is well-documented and aligns with industry standards and practices1234.
A
Explanation:
Storage Area Network (SAN), which is a dedicated high-speed network that connects servers to storage devices, allowing for the sharing of storage resources. A SAN is designed to handle large amounts of data and provides a way to centralize storage management, making it an efficient solution for enterprises that require reliable and scalable storage infrastructure. It separates the storage units from the servers and the user network, which aligns with the scenario described for Timothy’s organization.
Reference: The concept of a SAN as a dedicated network for sharing storage resources is well-documented and aligns with industry standards and practices1234.
Question #333
How can organizations obtain information about threats through human intelligence?
- A . By extracting information from security blogs and forums
- B . By discovering vulnerabilities through exploration, understanding malware behavior through malware processing, etc.
- C . From the data of past incidents and network monitoring
- D . From attackers through the dark web and honeypots
Correct Answer: A
A
Explanation:
Human intelligence (HUMINT) in the context of network defense involves the collection of information from human sources. This can include extracting insights from security blogs, forums, and other platforms where cybersecurity professionals and enthusiasts discuss vulnerabilities, threats, and incidents. By monitoring these discussions, organizations can gain valuable information about emerging threats, techniques used by attackers, and potential security weaknesses that need to be addressed.
Reference: The role of human intelligence in gathering threat information is highlighted in cybersecurity literature. For example, CrowdStrike discusses the importance of HUMINT in cybersecurity, noting that it involves engaging with threat actors on various platforms to gather information about their activities1. Additionally, the IEEE paper on “Gathering threat intelligence through computer network deception” emphasizes the significance of proactive threat intelligence development by network defenders2.
A
Explanation:
Human intelligence (HUMINT) in the context of network defense involves the collection of information from human sources. This can include extracting insights from security blogs, forums, and other platforms where cybersecurity professionals and enthusiasts discuss vulnerabilities, threats, and incidents. By monitoring these discussions, organizations can gain valuable information about emerging threats, techniques used by attackers, and potential security weaknesses that need to be addressed.
Reference: The role of human intelligence in gathering threat information is highlighted in cybersecurity literature. For example, CrowdStrike discusses the importance of HUMINT in cybersecurity, noting that it involves engaging with threat actors on various platforms to gather information about their activities1. Additionally, the IEEE paper on “Gathering threat intelligence through computer network deception” emphasizes the significance of proactive threat intelligence development by network defenders2.
Question #334
Which of the following VPN topologies establishes a persistent connection between an organization’s main office and its branch offices using a third-party network or the Internet?
- A . Star
- B . Point-to-Point
- C . Full Mesh
- D . Hub-and-Spoke
Correct Answer: D
D
Explanation:
The Hub-and-Spoke VPN topology is designed to establish a persistent connection between a central hub, typically an organization’s main office, and its various branches. This topology is efficient for organizations with many branch offices that need to communicate with the main office but not necessarily with each other directly. It uses a third-party network or the Internet to create these connections, allowing for secure communication over potentially insecure networks like the Internet. The hub-and-spoke model reduces the number of tunnels required compared to other topologies, such as full mesh, which needs a direct tunnel between each site.
Reference: The information aligns with the VPN topologies described in Cisco’s documentation, which details that a hub-and-spoke topology usually represents an intranet VPN that connects an enterprise’s main office with branch offices using persistent connections12.
D
Explanation:
The Hub-and-Spoke VPN topology is designed to establish a persistent connection between a central hub, typically an organization’s main office, and its various branches. This topology is efficient for organizations with many branch offices that need to communicate with the main office but not necessarily with each other directly. It uses a third-party network or the Internet to create these connections, allowing for secure communication over potentially insecure networks like the Internet. The hub-and-spoke model reduces the number of tunnels required compared to other topologies, such as full mesh, which needs a direct tunnel between each site.
Reference: The information aligns with the VPN topologies described in Cisco’s documentation, which details that a hub-and-spoke topology usually represents an intranet VPN that connects an enterprise’s main office with branch offices using persistent connections12.
Question #335
James wants to implement certain control measures to prevent denial-of-service attacks against the organization.
Which of the following control measures can help James?
- A . Strong passwords
- B . Reduce the sessions time-out duration for the connection attempts
- C . A honeypot in DMZ
- D . Provide network-based anti-virus
Correct Answer: C
C
Explanation:
Implementing a honeypot in the Demilitarized Zone (DMZ) can be an effective control measure against denial-of-service (DoS) attacks. A honeypot is a decoy system designed to attract attackers and divert them from legitimate targets. By deploying a honeypot in the DMZ, James can monitor and analyze incoming traffic to identify and mitigate DoS attacks. This proactive security measure allows the organization to detect and respond to malicious activities before they impact critical systems and services.
Reference: The Certified Network Defender (CND) course by EC-Council includes strategies for defending against DoS attacks, which cover the use of honeypots as a part of a layered security approach1. Additionally, industry best practices suggest that honeypots can serve as an early warning system and a means to study attacker behavior, which aligns with the objectives of the CND curriculum2.
C
Explanation:
Implementing a honeypot in the Demilitarized Zone (DMZ) can be an effective control measure against denial-of-service (DoS) attacks. A honeypot is a decoy system designed to attract attackers and divert them from legitimate targets. By deploying a honeypot in the DMZ, James can monitor and analyze incoming traffic to identify and mitigate DoS attacks. This proactive security measure allows the organization to detect and respond to malicious activities before they impact critical systems and services.
Reference: The Certified Network Defender (CND) course by EC-Council includes strategies for defending against DoS attacks, which cover the use of honeypots as a part of a layered security approach1. Additionally, industry best practices suggest that honeypots can serve as an early warning system and a means to study attacker behavior, which aligns with the objectives of the CND curriculum2.
Question #336
Alex is administrating the firewall in the organization’s network.
What command will he use to check the ports applications open?
- A . Netstat -an
- B . Netstat -o
- C . Netstat -a
- D . Netstat -ao
Correct Answer: A
A
Explanation:
The netstat -an command is used to display all active connections and the TCP and UDP ports on which the computer is listening, without resolving the hostnames. This command provides a list that includes both listening ports and established connections, making it a suitable choice for an administrator like Alex to check the ports that applications have opened on a firewall.
Reference: This explanation is based on standard networking practices and the functionality of the netstat command as described in networking and security documentation123.
A
Explanation:
The netstat -an command is used to display all active connections and the TCP and UDP ports on which the computer is listening, without resolving the hostnames. This command provides a list that includes both listening ports and established connections, making it a suitable choice for an administrator like Alex to check the ports that applications have opened on a firewall.
Reference: This explanation is based on standard networking practices and the functionality of the netstat command as described in networking and security documentation123.
Question #337
Which type of attack is used to hack an IoT device and direct large amounts of network traffic toward a web server, resulting in overloading the server with connections and preventing any new connections?
- A . XSS
- B . DDoS
- C . XCRF
- D . Sniffing
Correct Answer: B
B
Explanation:
The type of attack that is used to hack an IoT device and direct large amounts of network traffic toward a web server, causing it to overload with connections and preventing any new connections, is known as a Distributed Denial of Service (DDoS) attack. In a DDoS attack, multiple compromised computer systems, which can include IoT devices, are used to target a single system causing a Denial of Service (DoS) attack. These attacks can overwhelm the target with a flood of internet traffic, which can lead to the server being unable to process legitimate requests, effectively taking it offline.
Reference: The concept of DDoS attacks utilizing IoT devices to flood targets with traffic is well-documented in cybersecurity literature. Such attacks exploit the connectivity and processing power of IoT devices to launch large-scale assaults on web servers and other online services, leading to the overloading of these systems123. This aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and defending against such network security threats.
B
Explanation:
The type of attack that is used to hack an IoT device and direct large amounts of network traffic toward a web server, causing it to overload with connections and preventing any new connections, is known as a Distributed Denial of Service (DDoS) attack. In a DDoS attack, multiple compromised computer systems, which can include IoT devices, are used to target a single system causing a Denial of Service (DoS) attack. These attacks can overwhelm the target with a flood of internet traffic, which can lead to the server being unable to process legitimate requests, effectively taking it offline.
Reference: The concept of DDoS attacks utilizing IoT devices to flood targets with traffic is well-documented in cybersecurity literature. Such attacks exploit the connectivity and processing power of IoT devices to launch large-scale assaults on web servers and other online services, leading to the overloading of these systems123. This aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which includes understanding and defending against such network security threats.
Question #338
Which type of firewall consists of three interfaces and allows further subdivision of the systems based on specific security objectives of the organization?
- A . Screened subnet
- B . Bastion host
- C . Unscreened subnet
- D . Multi-homed firewall
Correct Answer: D
D
Explanation:
A multi-homed firewall is designed with three or more network interfaces. This type of firewall allows an organization to create multiple subnets, each serving different security objectives. The multi-homed firewall can enforce security policies and control traffic flow between these subnets, effectively segmenting the network based on the organization’s specific needs. This segmentation enhances security by isolating different parts of the network, reducing the risk of widespread network compromise in the event of a security breach.
Reference: The concept of a multi-homed firewall aligns with network security best practices and is consistent with the Certified Network Defender (CND) curriculum, which emphasizes the importance of network segmentation and firewall configuration for organizational security.
D
Explanation:
A multi-homed firewall is designed with three or more network interfaces. This type of firewall allows an organization to create multiple subnets, each serving different security objectives. The multi-homed firewall can enforce security policies and control traffic flow between these subnets, effectively segmenting the network based on the organization’s specific needs. This segmentation enhances security by isolating different parts of the network, reducing the risk of widespread network compromise in the event of a security breach.
Reference: The concept of a multi-homed firewall aligns with network security best practices and is consistent with the Certified Network Defender (CND) curriculum, which emphasizes the importance of network segmentation and firewall configuration for organizational security.
Question #339
Hacktivists are threat actors, who can be described as ——————-
- A . People motivated by religious beliefs
- B . Disgruntled/terminated employees
- C . People motivated by monetary gams
- D . People having political or social agenda
Correct Answer: D
D
Explanation:
Hacktivists are individuals or groups that use computer networks and hacking techniques to promote a political or social agenda. Unlike other threat actors who may be motivated by financial gain or personal beliefs, hacktivists typically aim to draw attention to social, environmental, or political issues. They often engage in activities such as website defacement, denial-of-service attacks, or the release of confidential information to make a statement or force change related to their cause.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses various types of threat actors, including hacktivists, as part of its curriculum on network security and defense strategies1. The program emphasizes the importance of understanding the motivations behind
different threat actors to effectively protect, detect, respond, and predict network security incidents1.
D
Explanation:
Hacktivists are individuals or groups that use computer networks and hacking techniques to promote a political or social agenda. Unlike other threat actors who may be motivated by financial gain or personal beliefs, hacktivists typically aim to draw attention to social, environmental, or political issues. They often engage in activities such as website defacement, denial-of-service attacks, or the release of confidential information to make a statement or force change related to their cause.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses various types of threat actors, including hacktivists, as part of its curriculum on network security and defense strategies1. The program emphasizes the importance of understanding the motivations behind
different threat actors to effectively protect, detect, respond, and predict network security incidents1.
Question #340
In _______ mechanism, the system or application sends log records either on the local disk or over the network.
- A . Network-based
- B . Pull-based
- C . Push-based
- D . Host-based
Correct Answer: C
C
Explanation:
In a push-based mechanism, the system or application actively sends log records to a designated storage location, which can be on the local disk or over the network. This is in contrast to a pull-based mechanism, where the log records are retrieved by a separate process. The push-based approach ensures that log records are sent immediately and consistently, which is crucial for real-time monitoring and analysis.
Reference: The concept of push-based log record mechanisms is a standard practice in network security for ensuring timely and reliable delivery of log data for analysis. This information aligns with the best practices for log management and monitoring as described in various network security resources1.
C
Explanation:
In a push-based mechanism, the system or application actively sends log records to a designated storage location, which can be on the local disk or over the network. This is in contrast to a pull-based mechanism, where the log records are retrieved by a separate process. The push-based approach ensures that log records are sent immediately and consistently, which is crucial for real-time monitoring and analysis.
Reference: The concept of push-based log record mechanisms is a standard practice in network security for ensuring timely and reliable delivery of log data for analysis. This information aligns with the best practices for log management and monitoring as described in various network security resources1.