EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #31
Blake is working on the company’s updated disaster and business continuity plan. The last section of the plan covers computer and data incidence response. Blake is outlining the level of severity for each type of incident in the plan.
Unsuccessful scans and probes are at what severity level?
- A . High severity level
- B . Extreme severity level
- C . Mid severity level
- D . Low severity level
Correct Answer: D
D
Explanation:
In the context of incident response, unsuccessful scans and probes are typically considered a low severity level. This is because they often indicate an attempted reconnaissance or mapping of systems rather than a successful compromise or disruption of services. While they should be monitored and analyzed to improve defenses and detect patterns of malicious activity, they do not usually signify an immediate threat to the integrity, availability, or confidentiality of systems.
Reference: The classification of unsuccessful scans and probes as low severity is consistent with standard practices in incident response and is supported by various cybersecurity frameworks and guidelines, including those from the EC-Council’s Certified Network Defender (CND) program.
D
Explanation:
In the context of incident response, unsuccessful scans and probes are typically considered a low severity level. This is because they often indicate an attempted reconnaissance or mapping of systems rather than a successful compromise or disruption of services. While they should be monitored and analyzed to improve defenses and detect patterns of malicious activity, they do not usually signify an immediate threat to the integrity, availability, or confidentiality of systems.
Reference: The classification of unsuccessful scans and probes as low severity is consistent with standard practices in incident response and is supported by various cybersecurity frameworks and guidelines, including those from the EC-Council’s Certified Network Defender (CND) program.
Question #32
What is the correct order of activities that a IDS is supposed to attempt in order to detect an intrusion?
- A . Prevention, Intrusion Monitoring, Intrusion Detection, Response
- B . Intrusion Monitoring, Intrusion Detection, Response, Prevention
- C . Intrusion Detection, Response, Prevention, Intrusion Monitoring
- D . Prevention, Intrusion Detection, Response, Intrusion Monitoring
Correct Answer: B
B
Explanation:
An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious actions or policy violations. The correct order of activities that an IDS follows to detect an intrusion starts with Intrusion Monitoring, where it observes the network traffic or system events. Following this, Intrusion Detection takes place, where the IDS analyzes the monitored data to identify potential security breaches. Once a potential intrusion is detected, the Response mechanism is activated to address the intrusion, which may include alerts or automatic countermeasures. Finally, Prevention is applied to improve the system’s defenses against future intrusions based on the detected patterns and responses.
Reference: This explanation is based on the standard operational procedure of IDS as per the Network Defender (CND) objectives and documents1.
B
Explanation:
An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious actions or policy violations. The correct order of activities that an IDS follows to detect an intrusion starts with Intrusion Monitoring, where it observes the network traffic or system events. Following this, Intrusion Detection takes place, where the IDS analyzes the monitored data to identify potential security breaches. Once a potential intrusion is detected, the Response mechanism is activated to address the intrusion, which may include alerts or automatic countermeasures. Finally, Prevention is applied to improve the system’s defenses against future intrusions based on the detected patterns and responses.
Reference: This explanation is based on the standard operational procedure of IDS as per the Network Defender (CND) objectives and documents1.
Question #33
_______________ is a structured and continuous process which integrates information security and risk management activities into the system development life cycle (SDLC).
- A . COBIT Framework
- B . NIST Risk Management Framework
- C . ERM Framework
- D . COSO ERM Framework
Correct Answer: B
B
Explanation:
The NIST Risk Management Framework (RMF) is a structured process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle (SDLC). It provides a disciplined and structured process that integrates information security and risk management activities into the SDLC. The RMF is designed to help organizations manage the security of their information systems by guiding them through a step-by-step process that includes categorizing information systems, selecting and implementing appropriate security controls, assessing the effectiveness of the controls, authorizing information system operation, and continuously monitoring the security state of the system.
Reference: NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach1.
NIST Special Publication 800-64, Revision 2, Security Considerations in the System Development Life Cycle2.
NIST’s official website on the Risk Management Framework (RMF)3.
B
Explanation:
The NIST Risk Management Framework (RMF) is a structured process that integrates security, privacy, and cyber supply chain risk management activities into the system development life cycle (SDLC). It provides a disciplined and structured process that integrates information security and risk management activities into the SDLC. The RMF is designed to help organizations manage the security of their information systems by guiding them through a step-by-step process that includes categorizing information systems, selecting and implementing appropriate security controls, assessing the effectiveness of the controls, authorizing information system operation, and continuously monitoring the security state of the system.
Reference: NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach1.
NIST Special Publication 800-64, Revision 2, Security Considerations in the System Development Life Cycle2.
NIST’s official website on the Risk Management Framework (RMF)3.
Question #34
In what type of IoT communication model do devices interact with each other through the internet, primarily using protocols such as ZigBee, Z-Wave, or Bluetooth?
- A . Back-End Data-Sharing Model
- B . Device-to-Gateway Model
- C . Device-to-Cloud Model
- D . Device-to-Device Model
Correct Answer: D
D
Explanation:
In the context of IoT communication models, the Device-to-Device (D2D) model refers to the direct interaction between devices without the need for intermediary devices or services. This model is characterized by the use of protocols such as ZigBee, Z-Wave, or Bluetooth, which are designed to facilitate direct communication between devices in close proximity. These protocols are commonly used in home automation, where devices like sensors, lights, and locks need to communicate with each other to perform their functions effectively.
Reference: The information provided is based on my training data up to September 2021, which includes knowledge of various IoT communication protocols and their applications. For the most current and detailed information, please refer to the latest Certified Network Defender (CND) documents and study guides from the EC-Council or other authoritative sources on IoT communication models.
D
Explanation:
In the context of IoT communication models, the Device-to-Device (D2D) model refers to the direct interaction between devices without the need for intermediary devices or services. This model is characterized by the use of protocols such as ZigBee, Z-Wave, or Bluetooth, which are designed to facilitate direct communication between devices in close proximity. These protocols are commonly used in home automation, where devices like sensors, lights, and locks need to communicate with each other to perform their functions effectively.
Reference: The information provided is based on my training data up to September 2021, which includes knowledge of various IoT communication protocols and their applications. For the most current and detailed information, please refer to the latest Certified Network Defender (CND) documents and study guides from the EC-Council or other authoritative sources on IoT communication models.
Question #35
Which type of antenna is based on the principle of a satellite dish and can pick up Wi-Fi signals from a distance of ten miles of more?
- A . Yagi antenna
- B . Directional antenna
- C . Omnidirectional antenna
- D . Parabolic Grid antenna
Correct Answer: D
D
Explanation:
The Parabolic Grid antenna is designed based on the principle of a satellite dish. This type of antenna can focus the radio waves onto a particular direction and is capable of picking up Wi-Fi signals from very long distances, often ten miles or more, depending on the specific design and conditions. It is highly directional and has a narrow focus, making it ideal for point-to-point communication in long-range Wi-Fi networks.
Reference: The EC-Council’s Certified Network Defender (CND) course materials include information on various types of antennas and their uses in network defense. The Parabolic Grid antenna is mentioned as a type of antenna that can pick up signals from a great distance, which aligns with the principles of satellite dishes as described in the CND study guide1.
D
Explanation:
The Parabolic Grid antenna is designed based on the principle of a satellite dish. This type of antenna can focus the radio waves onto a particular direction and is capable of picking up Wi-Fi signals from very long distances, often ten miles or more, depending on the specific design and conditions. It is highly directional and has a narrow focus, making it ideal for point-to-point communication in long-range Wi-Fi networks.
Reference: The EC-Council’s Certified Network Defender (CND) course materials include information on various types of antennas and their uses in network defense. The Parabolic Grid antenna is mentioned as a type of antenna that can pick up signals from a great distance, which aligns with the principles of satellite dishes as described in the CND study guide1.
Question #36
Chris is a senior network administrator. Chris wants to measure the Key Risk Indicator (KRI) to assess the organization.
Why is Chris calculating the KRI for his organization? It helps Chris to:
- A . Identifies adverse events
- B . Facilitates backward
- C . Facilitates post Incident management
- D . Notifies when risk has reached threshold levels
Correct Answer: D
D
Explanation:
Key Risk Indicators (KRIs) are crucial metrics used in risk management to measure the likelihood of potential risks and their impact on an organization. They are designed to provide an early warning signal to notify management when a risk has reached a level that may exceed the organization’s risk appetite and could have a profoundly negative impact on its ability to succeed. KRIs are not typically used to identify adverse events, which is more the role of Key Performance Indicators (KPIs), nor are they used to facilitate backward or post-incident management directly. Instead, KRIs are forward-looking indicators that help in predicting and preventing risks before they materialize into significant threats.
Reference: The explanation provided is based on industry-standard practices for Key Risk Indicators as outlined in resources such as TechTarget and Safety Culture, which align with the objectives and documents of the Certified Network Defender (CND) program12.
D
Explanation:
Key Risk Indicators (KRIs) are crucial metrics used in risk management to measure the likelihood of potential risks and their impact on an organization. They are designed to provide an early warning signal to notify management when a risk has reached a level that may exceed the organization’s risk appetite and could have a profoundly negative impact on its ability to succeed. KRIs are not typically used to identify adverse events, which is more the role of Key Performance Indicators (KPIs), nor are they used to facilitate backward or post-incident management directly. Instead, KRIs are forward-looking indicators that help in predicting and preventing risks before they materialize into significant threats.
Reference: The explanation provided is based on industry-standard practices for Key Risk Indicators as outlined in resources such as TechTarget and Safety Culture, which align with the objectives and documents of the Certified Network Defender (CND) program12.
Question #37
Rick has implemented several firewalls and IDS systems across his enterprise network.
What should he do to effectively correlate all incidents that pass through these security controls?
- A . Use firewalls in Network Address Transition (NAT) mode
- B . Implement IPsec
- C . Implement Simple Network Management Protocol (SNMP)
- D . Use Network Time Protocol (NTP)
Correct Answer: D
D
Explanation:
To effectively correlate incidents across various security controls like firewalls and IDS systems, it is essential to ensure that the timestamps of logs and events are synchronized. This is where Network Time Protocol (NTP) comes into play. NTP ensures that all devices on the network are on the same time setting, which is crucial for event correlation. Without synchronized time settings, it would be challenging to establish a timeline of events and understand the sequence in which they occurred, making incident response and forensic analysis more difficult.
Reference: The importance of using NTP for incident correlation is well-documented in network security best practices and is also highlighted in the EC-Council’s Certified Network Defender (CND) course materials. The CND course emphasizes the role of NTP in maintaining accurate time stamps across network devices for effective security incident management and analysis.
D
Explanation:
To effectively correlate incidents across various security controls like firewalls and IDS systems, it is essential to ensure that the timestamps of logs and events are synchronized. This is where Network Time Protocol (NTP) comes into play. NTP ensures that all devices on the network are on the same time setting, which is crucial for event correlation. Without synchronized time settings, it would be challenging to establish a timeline of events and understand the sequence in which they occurred, making incident response and forensic analysis more difficult.
Reference: The importance of using NTP for incident correlation is well-documented in network security best practices and is also highlighted in the EC-Council’s Certified Network Defender (CND) course materials. The CND course emphasizes the role of NTP in maintaining accurate time stamps across network devices for effective security incident management and analysis.
Question #38
————is a group of broadband wireless communications standards for Metropolitan Area Networks (MANs)
- A . 802.15
- B . 802.16
- C . 802.15.4
- D . 802.12
Correct Answer: B
B
Explanation:
The IEEE 802.16 is a series of wireless broadband standards, also known as Wireless MAN, that are designed for Metropolitan Area Networks (MANs). This standard specifies the air interface, including the medium access control layer (MAC) and physical layer (PHY), of combined fixed and mobile point-to-multipoint broadband wireless access systems. It supports multiple services and enables the deployment of interoperable multivendor broadband wireless access products.
Reference: The information is based on the IEEE Standard for Local and metropolitan area networks Part 16: Air Interface for Broadband Wireless Access Systems, which is detailed in the IEEE 802.16-2009 document1. Additionally, the Wikipedia page for IEEE 802.16 provides an overview of the standard’s purpose for broadband wireless metropolitan area networks2.
B
Explanation:
The IEEE 802.16 is a series of wireless broadband standards, also known as Wireless MAN, that are designed for Metropolitan Area Networks (MANs). This standard specifies the air interface, including the medium access control layer (MAC) and physical layer (PHY), of combined fixed and mobile point-to-multipoint broadband wireless access systems. It supports multiple services and enables the deployment of interoperable multivendor broadband wireless access products.
Reference: The information is based on the IEEE Standard for Local and metropolitan area networks Part 16: Air Interface for Broadband Wireless Access Systems, which is detailed in the IEEE 802.16-2009 document1. Additionally, the Wikipedia page for IEEE 802.16 provides an overview of the standard’s purpose for broadband wireless metropolitan area networks2.
Question #39
Which biometric technique authenticates people by analyzing the layer of blood vessels at the back of their eyes?
- A . Fingerprinting
- B . Iris Scanning
- C . Retina Scanning
- D . Vein Structure Recognition
Correct Answer: C
C
Explanation:
The biometric technique that authenticates individuals by analyzing the layer of blood vessels at the back of their eyes is Retina Scanning. This method uses the unique patterns of the retinal blood vessels for identification, which are stable and distinctive to each person. Retina scanning involves shining a low-intensity light source through an optical coupler to scan the retina’s unique patterns123.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on understanding various biometric techniques and their application in network security. Retina scanning is highlighted for its precision and uniqueness, making it suitable for high-security requirements123.
C
Explanation:
The biometric technique that authenticates individuals by analyzing the layer of blood vessels at the back of their eyes is Retina Scanning. This method uses the unique patterns of the retinal blood vessels for identification, which are stable and distinctive to each person. Retina scanning involves shining a low-intensity light source through an optical coupler to scan the retina’s unique patterns123.
Reference: The information aligns with the Certified Network Defender (CND) course’s focus on understanding various biometric techniques and their application in network security. Retina scanning is highlighted for its precision and uniqueness, making it suitable for high-security requirements123.
Question #40
An US-based organization decided to implement a RAID storage technology for their data backup plan. John wants to setup a RAID level that require a minimum of six drives but will meet high fault tolerance and with a high speed for the data read and write operations.
What RAID level is John considering to meet this requirement?
- A . RAID level 1
- B . RAID level 10
- C . RAID level 5
- D . RAID level 50
Correct Answer: D
D
Explanation:
RAID level 50, also known as RAID 5+0, combines the features of RAID 5 and RAID 0. It requires a
minimum of six drives and offers high fault tolerance and high speed for data read and write operations. RAID 50 arrays are created by striping data across RAID 5 arrays, which are themselves striped sets with distributed parity. This configuration provides both the speed of RAID 0 and the redundancy of RAID 51.
Reference: The TechTarget article on “RAID 50: How to select the right RAID level” explains that RAID 50 is suitable for applications that require high reliability and can handle high request rates and high data transfer, with a lower cost of disks than RAID 101.
The DNSChecker RAID Calculator mentions that RAID 50 requires a minimum of six disks2.
D
Explanation:
RAID level 50, also known as RAID 5+0, combines the features of RAID 5 and RAID 0. It requires a
minimum of six drives and offers high fault tolerance and high speed for data read and write operations. RAID 50 arrays are created by striping data across RAID 5 arrays, which are themselves striped sets with distributed parity. This configuration provides both the speed of RAID 0 and the redundancy of RAID 51.
Reference: The TechTarget article on “RAID 50: How to select the right RAID level” explains that RAID 50 is suitable for applications that require high reliability and can handle high request rates and high data transfer, with a lower cost of disks than RAID 101.
The DNSChecker RAID Calculator mentions that RAID 50 requires a minimum of six disks2.