EC-Council 312-38 Practice Exams
Last updated on Oct 24,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 24,2026
Question #341
If there is a fire incident caused by an electrical appliance short-circuit, which fire suppressant should be used to control it?
- A . Water
- B . Wet chemical
- C . Dry chemical
- D . Raw chemical
Correct Answer: C
C
Explanation:
For a fire caused by an electrical appliance short-circuit, the appropriate fire suppressant is a dry chemical extinguisher. This type of extinguisher is effective because it can smother the fire without conducting electricity, which is crucial for electrical fires. Dry chemical extinguishers typically contain agents like mono-ammonium phosphate or sodium bicarbonate, which help to interrupt the chemical reaction of the fire, effectively putting it out. It’s important not to use water or wet chemicals on electrical fires, as they can conduct electricity and exacerbate the situation.
Reference: The use of dry chemical fire extinguishers for electrical fires is a standard safety protocol, as they provide a non-conductive means to extinguish the fire, aligning with the safety measures outlined in the EC-Council’s Certified Network Defender (CND) program12.
C
Explanation:
For a fire caused by an electrical appliance short-circuit, the appropriate fire suppressant is a dry chemical extinguisher. This type of extinguisher is effective because it can smother the fire without conducting electricity, which is crucial for electrical fires. Dry chemical extinguishers typically contain agents like mono-ammonium phosphate or sodium bicarbonate, which help to interrupt the chemical reaction of the fire, effectively putting it out. It’s important not to use water or wet chemicals on electrical fires, as they can conduct electricity and exacerbate the situation.
Reference: The use of dry chemical fire extinguishers for electrical fires is a standard safety protocol, as they provide a non-conductive means to extinguish the fire, aligning with the safety measures outlined in the EC-Council’s Certified Network Defender (CND) program12.
Question #342
Management decides to implement a risk management system to reduce and maintain the organization’s risk at an acceptable level.
Which of the following is the correct order in the risk management phase?
- A . Risk Identification, Risk Assessment, Risk Treatment, Risk Monitoring & Review
- B . Risk Treatment, Risk Monitoring & Review, Risk Identification, Risk Assessment
- C . Risk Assessment, Risk Treatment, Risk Monitoring & Review, Risk Identification
- D . Risk Identification. Risk Assessment. Risk Monitoring & Review, Risk Treatment
Correct Answer: A
A
Explanation:
The correct order in the risk management phase starts with Risk Identification, where potential business risks are determined. This is followed by Risk Assessment, which involves analyzing and prioritizing the identified risks. Next is Risk Treatment, where plans are made to mitigate the risks. Finally, Risk Monitoring & Review is conducted to oversee the risk management process and make necessary adjustments. This sequence ensures a structured and effective approach to managing risks within an organization.
Reference: The sequence aligns with the widely recognized ISO 31000 risk management standard, which outlines these core steps in managing risks123.
A
Explanation:
The correct order in the risk management phase starts with Risk Identification, where potential business risks are determined. This is followed by Risk Assessment, which involves analyzing and prioritizing the identified risks. Next is Risk Treatment, where plans are made to mitigate the risks. Finally, Risk Monitoring & Review is conducted to oversee the risk management process and make necessary adjustments. This sequence ensures a structured and effective approach to managing risks within an organization.
Reference: The sequence aligns with the widely recognized ISO 31000 risk management standard, which outlines these core steps in managing risks123.
Question #343
The GMT enterprise is working on their internet and web usage policies. GMT would like to control internet bandwidth consumption by employees.
Which group of policies would this belong to?
- A . Enterprise Information Security Policy
- B . System Specific Security Policy
- C . Network Services Specific Security Policy
- D . Issue Specific Security Policy
Correct Answer: C
C
Explanation:
The control of internet bandwidth consumption by employees falls under the Network Services Specific Security Policy. This category of policy is designed to manage and secure the services that are provided over the network, which includes internet access and usage. It encompasses the rules and procedures that govern how network services, such as bandwidth, are allocated and used within an organization. By implementing such policies, GMT enterprise aims to ensure that the network’s bandwidth is utilized effectively and in alignment with the company’s operational requirements and objectives.
Reference: The answer is derived from the understanding of network security policies as outlined in the Certified Network Defender (CND) course by EC-Council, which emphasizes the importance of specific policies for managing network services and resources.
C
Explanation:
The control of internet bandwidth consumption by employees falls under the Network Services Specific Security Policy. This category of policy is designed to manage and secure the services that are provided over the network, which includes internet access and usage. It encompasses the rules and procedures that govern how network services, such as bandwidth, are allocated and used within an organization. By implementing such policies, GMT enterprise aims to ensure that the network’s bandwidth is utilized effectively and in alignment with the company’s operational requirements and objectives.
Reference: The answer is derived from the understanding of network security policies as outlined in the Certified Network Defender (CND) course by EC-Council, which emphasizes the importance of specific policies for managing network services and resources.
Question #344
Arman transferred some money to his friend’s account using a net banking service. After a few hours, his friend informed him that he hadn’t received the money yet. Arman logged on to the bank’s website to investigate and discovered that the amount had been transferred to an unknown account instead. The bank, upon receiving Arman’s complaint, discovered that someone had established a station between Arman’s and the bank server’s communication system. The station intercepted the communication and inserted another account number replacing his friend’s account number.
What is such an attack called?
- A . Privilege Escalation
- B . DNS Poisoning
- C . Man-in-the-Middle Attack
- D . DNS Cache Poisoning
Correct Answer: C
C
Explanation:
The scenario described is a classic example of a Man-in-the-Middle (MitM) attack. In this type of cyberattack, the attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. The attacker has inserted themselves between the two parties, in this case, Arman and the bank’s server, and has intercepted the communication to redirect the funds to a different account. This type of attack can occur in various forms, such as eavesdropping on or altering the communication over an insecure network service, but it is characterized by the attacker’s ability to intercept and modify the data being exchanged without either legitimate party noticing.
Reference: The definition and explanation of a Man-in-the-Middle attack are based on standard cybersecurity knowledge and documented instances of such attacks123456.
C
Explanation:
The scenario described is a classic example of a Man-in-the-Middle (MitM) attack. In this type of cyberattack, the attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. The attacker has inserted themselves between the two parties, in this case, Arman and the bank’s server, and has intercepted the communication to redirect the funds to a different account. This type of attack can occur in various forms, such as eavesdropping on or altering the communication over an insecure network service, but it is characterized by the attacker’s ability to intercept and modify the data being exchanged without either legitimate party noticing.
Reference: The definition and explanation of a Man-in-the-Middle attack are based on standard cybersecurity knowledge and documented instances of such attacks123456.
Question #345
George was conducting a recovery drill test as a part of his network operation. Recovery drill tests are conducted on the______________.
- A . Archived data
- B . Deleted data
- C . Data in transit
- D . Backup data
Correct Answer: D
D
Explanation:
Recovery drill tests are an essential part of disaster recovery planning. They are conducted on backup data to ensure that the data can be successfully restored in the event of a disaster. During these drills, the backup systems are tested to verify that they function correctly and that the data is intact and recoverable. This process helps organizations prepare for actual disaster scenarios and ensures that their backup solutions are effective and reliable.
Reference: The practice of conducting recovery drill tests on backup data is a standard procedure in disaster recovery and business continuity planning, as outlined in various IT and network security resources123.
D
Explanation:
Recovery drill tests are an essential part of disaster recovery planning. They are conducted on backup data to ensure that the data can be successfully restored in the event of a disaster. During these drills, the backup systems are tested to verify that they function correctly and that the data is intact and recoverable. This process helps organizations prepare for actual disaster scenarios and ensures that their backup solutions are effective and reliable.
Reference: The practice of conducting recovery drill tests on backup data is a standard procedure in disaster recovery and business continuity planning, as outlined in various IT and network security resources123.
Question #346
A company has the right to monitor the activities of their employees on different information systems according to the _______policy.
- A . Information system
- B . User access control
- C . Internet usage
- D . Confidential data
Correct Answer: B
B
Explanation:
The right of a company to monitor the activities of their employees on its information systems is typically defined under the "User Access Control" policy. This policy sets out the rules and conditions under which employee activities can be monitored, ensuring that monitoring is conducted legally and ethically while protecting the privacy rights of employees. It often includes provisions for the monitoring of email, internet use, and other digital interactions to safeguard company assets and ensure compliance with corporate policies.
Reference: The establishment and enforcement of user access control policies are fundamental principles in cybersecurity management and are discussed in Network Defender training materials.
B
Explanation:
The right of a company to monitor the activities of their employees on its information systems is typically defined under the "User Access Control" policy. This policy sets out the rules and conditions under which employee activities can be monitored, ensuring that monitoring is conducted legally and ethically while protecting the privacy rights of employees. It often includes provisions for the monitoring of email, internet use, and other digital interactions to safeguard company assets and ensure compliance with corporate policies.
Reference: The establishment and enforcement of user access control policies are fundamental principles in cybersecurity management and are discussed in Network Defender training materials.
Question #347
Larry is responsible for the company’s network consisting of 300 workstations and 25 servers. After using a hosted email service for a year, the company wants to control the email internally. Larry likes this idea because it will give him more control over the email. Larry wants to purchase a server for email but does not want the server to be on the internal network due to the potential to cause security risks. He decides to place the server outside of the company’s internal firewall. There is another firewall connected directly to the Internet that will protect traffic from accessing the email server. The server will be placed between the two firewalls.
What logical area is Larry putting the new email server into?
- A . He is going to place the server in a Demilitarized Zone (DMZ)
- B . He will put the email server in an IPsec zone.
- C . Larry is going to put the email server in a hot-server zone.
- D . For security reasons, Larry is going to place the email server in the company’s Logical Buffer Zone (LBZ).
Correct Answer: A
A
Explanation:
Larry is placing the new email server in a Demilitarized Zone (DMZ). A DMZ is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network. The email server placed in the DMZ can be accessed from the internet, but it does not have direct access to the internal network, which reduces the risk of an internal security breach if the email server is compromised.
Reference: The concept of a DMZ is covered in the EC-Council’s Certified Network Defender (C|ND) program, which teaches network administrators how to secure their networks against threats. The C|ND program includes strategies for protecting network infrastructure and creating secure architectures, which involves the use of DMZs123.
A
Explanation:
Larry is placing the new email server in a Demilitarized Zone (DMZ). A DMZ is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network. The email server placed in the DMZ can be accessed from the internet, but it does not have direct access to the internal network, which reduces the risk of an internal security breach if the email server is compromised.
Reference: The concept of a DMZ is covered in the EC-Council’s Certified Network Defender (C|ND) program, which teaches network administrators how to secure their networks against threats. The C|ND program includes strategies for protecting network infrastructure and creating secure architectures, which involves the use of DMZs123.
Question #348
Which of the following information security standards defines security policies, technologies and ongoing processes for organizations that handle cardholder information for debit, credit, prepaid, epurse, ATM, and POS cards?
- A . Health Insurance Portability and Accountability Act (HIPAA)
- B . Payment Card Industry Data Security Standard (PCI-DSS)
- C . Information Security Acts: Gramm-Leach-Bliley Act (GLBA)
- D . Information Security Acts: Sarbanes Oxley Act (SOX)
Correct Answer: B
B
Explanation:
The Payment Card Industry Data Security Standard (PCI-DSS) is the information security standard that defines security policies, technologies, and ongoing processes for organizations that handle cardholder information for various types of cards, including debit, credit, prepaid, e-purse, ATM, and POS cards. PCI-DSS was developed by major credit card companies to create a secure environment for processing, storing, and transmitting cardholder data. Compliance with PCI-DSS involves adhering to a set of requirements that ensure the secure handling, storage, and transmission of cardholder information.
Reference: The significance and requirements of PCI-DSS are detailed in resources such as the Cloud Security Alliance’s guide on “Understanding PCI DSS: A Guide to the Payment Card Industry Data Security Standard” and the official PCI Security Standards Council documentation12.
B
Explanation:
The Payment Card Industry Data Security Standard (PCI-DSS) is the information security standard that defines security policies, technologies, and ongoing processes for organizations that handle cardholder information for various types of cards, including debit, credit, prepaid, e-purse, ATM, and POS cards. PCI-DSS was developed by major credit card companies to create a secure environment for processing, storing, and transmitting cardholder data. Compliance with PCI-DSS involves adhering to a set of requirements that ensure the secure handling, storage, and transmission of cardholder information.
Reference: The significance and requirements of PCI-DSS are detailed in resources such as the Cloud Security Alliance’s guide on “Understanding PCI DSS: A Guide to the Payment Card Industry Data Security Standard” and the official PCI Security Standards Council documentation12.
Question #349
Michael decides to view the—————–to track employee actions on the organization’s network.
- A . Firewall policy
- B . Firewall log
- C . Firewall settings
- D . Firewall rule set
Correct Answer: B
B
Explanation:
Michael would view the firewall log to track employee actions on the organization’s network. Firewall logs are records of events that are captured by the firewall. They typically include details about allowed and denied traffic, network connections, and other transactions through the firewall. By analyzing these logs, network administrators can monitor network usage, detect unusual patterns of activity, and identify potential security threats or breaches.
Reference: The importance of monitoring firewall logs is emphasized in the EC-Council’s Certified Network Defender (C|ND) program. It is part of the network traffic monitoring and analysis, which is crucial for detecting and responding to incidents on the network123.
B
Explanation:
Michael would view the firewall log to track employee actions on the organization’s network. Firewall logs are records of events that are captured by the firewall. They typically include details about allowed and denied traffic, network connections, and other transactions through the firewall. By analyzing these logs, network administrators can monitor network usage, detect unusual patterns of activity, and identify potential security threats or breaches.
Reference: The importance of monitoring firewall logs is emphasized in the EC-Council’s Certified Network Defender (C|ND) program. It is part of the network traffic monitoring and analysis, which is crucial for detecting and responding to incidents on the network123.
Question #350
Which of the following technologies can be used to leverage zero-trust model security?
- A . Software defined networking (SDN)
- B . Network function visualization (NFV)
- C . Network visualization (NV)
- D . Software defined perimeter (SDP)
Correct Answer: D
D
Explanation:
The zero-trust model is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access. The Software Defined Perimeter (SDP) aligns with this model by creating a dynamic, context-aware, and secure boundary around network resources. SDP controls access to resources based on identity, authentication, and authorization, ensuring that only authenticated and authorized users or systems can access the services they require. This approach minimizes the attack surface by hiding network resources from unauthorized or unauthenticated users, which is a core principle of zero-trust security.
Reference: The information aligns with the principles of zero-trust security as outlined in the NIST 800-207 standard for Zero Trust1 and is supported by the Cloud Security Alliance’s documentation on Software-Defined Perimeter (SDP) and Zero Trust2. Additionally, the relationship between SDP and zero-trust is discussed in various industry sources, highlighting SDP as an architecture that enables the zero-trust model by providing secure and authenticated access to network resources34.
D
Explanation:
The zero-trust model is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access. The Software Defined Perimeter (SDP) aligns with this model by creating a dynamic, context-aware, and secure boundary around network resources. SDP controls access to resources based on identity, authentication, and authorization, ensuring that only authenticated and authorized users or systems can access the services they require. This approach minimizes the attack surface by hiding network resources from unauthorized or unauthenticated users, which is a core principle of zero-trust security.
Reference: The information aligns with the principles of zero-trust security as outlined in the NIST 800-207 standard for Zero Trust1 and is supported by the Cloud Security Alliance’s documentation on Software-Defined Perimeter (SDP) and Zero Trust2. Additionally, the relationship between SDP and zero-trust is discussed in various industry sources, highlighting SDP as an architecture that enables the zero-trust model by providing secure and authenticated access to network resources34.