EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #41
What can be the possible number of IP addresses that can be assigned to the hosts present in a subnet having 255.255.255.224 subnet mask?
- A . 62
- B . 30
- C . 14
- D . 126
Correct Answer: B
B
Explanation:
A subnet with a mask of 255.255.255.224 (or /27 in CIDR notation) allows for 32 IP addresses in total. However, the first address is reserved for the network address, and the last is reserved for the broadcast address. This leaves 30 usable IP addresses for hosts within the subnet.
Reference: This explanation is based on standard IP addressing rules and subnetting practices that are part of the foundational knowledge for network security and are covered in the EC-Council’s Certified Network Defender (CND) program. The subnetting concept is also supported by resources such as IP subnet calculators and networking cheat sheets12.
B
Explanation:
A subnet with a mask of 255.255.255.224 (or /27 in CIDR notation) allows for 32 IP addresses in total. However, the first address is reserved for the network address, and the last is reserved for the broadcast address. This leaves 30 usable IP addresses for hosts within the subnet.
Reference: This explanation is based on standard IP addressing rules and subnetting practices that are part of the foundational knowledge for network security and are covered in the EC-Council’s Certified Network Defender (CND) program. The subnetting concept is also supported by resources such as IP subnet calculators and networking cheat sheets12.
Question #42
The Circuit-level gateway firewall technology functions at which of the following OSI layer?
- A . Data-link layer
- B . Session layer
- C . Network layer
- D . Transport layer
Correct Answer: B
B
Explanation:
Circuit-level gateway firewall technology operates at the session layer of the OSI model. This type of firewall validates TCP or UDP sessions before allowing traffic through, without inspecting the contents of the data packets. It acts as a handshaking device between trusted clients or servers and untrusted hosts, ensuring that the session packets adhere to established rules for a connection. The session layer, which is Layer 5 in the OSI model, is responsible for setting up, managing, and terminating the connections between applications1234.
Reference: The information about the operation of circuit-level gateways at the session layer is supported by networking resources and documentation1234.
B
Explanation:
Circuit-level gateway firewall technology operates at the session layer of the OSI model. This type of firewall validates TCP or UDP sessions before allowing traffic through, without inspecting the contents of the data packets. It acts as a handshaking device between trusted clients or servers and untrusted hosts, ensuring that the session packets adhere to established rules for a connection. The session layer, which is Layer 5 in the OSI model, is responsible for setting up, managing, and terminating the connections between applications1234.
Reference: The information about the operation of circuit-level gateways at the session layer is supported by networking resources and documentation1234.
Question #43
A company wants to implement a data backup method that allows them to encrypt the data ensuring its security as well as access it at any time and from any location.
What is the appropriate backup method that should be implemented?
- A . Cloud backup
- B . Offsite backup
- C . Hot site backup
- D . Onsite backup
Correct Answer: A
A
Explanation:
The appropriate backup method for a company that wants to ensure data encryption and accessibility from any location at any time is Cloud backup. Cloud backup solutions provide data encryption which secures the data during transmission and storage. Moreover, cloud services are designed to be accessible over the internet, allowing for remote access to the data from any location. This aligns with the company’s requirements for a secure and readily accessible backup method.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses the importance of data security, including data encryption in transit and at rest, and the use of cloud environments for data backup due to their scalability, accessibility, and security features12.
A
Explanation:
The appropriate backup method for a company that wants to ensure data encryption and accessibility from any location at any time is Cloud backup. Cloud backup solutions provide data encryption which secures the data during transmission and storage. Moreover, cloud services are designed to be accessible over the internet, allowing for remote access to the data from any location. This aligns with the company’s requirements for a secure and readily accessible backup method.
Reference: The EC-Council’s Certified Network Defender (CND) program discusses the importance of data security, including data encryption in transit and at rest, and the use of cloud environments for data backup due to their scalability, accessibility, and security features12.
Question #44
Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?
- A . Application sandboxing
- B . Deployment of WAFS
- C . Application whitelisting
- D . Application blacklisting
Correct Answer: A
A
Explanation:
Application sandboxing is a security mechanism that helps prevent the execution of untrusted or untested programs or code from untrusted or unverified third-parties. It does this by running such programs in a restricted environment, known as a sandbox, where they have limited access to files and system resources. This containment ensures that any malicious code or behavior is isolated from the host system, thereby protecting it from potential harm. Sandboxing is a proactive security measure that can significantly reduce the attack surface and mitigate the risk of security breaches.
Reference: The concept of application sandboxing is covered in the Certified Network Defender (CND) course, which discusses various strategies for protecting networks and systems, including the use of sandboxing to contain and control the execution of potentially harmful code12.
A
Explanation:
Application sandboxing is a security mechanism that helps prevent the execution of untrusted or untested programs or code from untrusted or unverified third-parties. It does this by running such programs in a restricted environment, known as a sandbox, where they have limited access to files and system resources. This containment ensures that any malicious code or behavior is isolated from the host system, thereby protecting it from potential harm. Sandboxing is a proactive security measure that can significantly reduce the attack surface and mitigate the risk of security breaches.
Reference: The concept of application sandboxing is covered in the Certified Network Defender (CND) course, which discusses various strategies for protecting networks and systems, including the use of sandboxing to contain and control the execution of potentially harmful code12.
Question #45
Identify the minimum number of drives required to setup RAID level 5.
- A . Multiple
- B . 3
- C . 4
- D . 2
Correct Answer: B
B
Explanation:
RAID level 5 is a robust storage solution that provides fault tolerance and improved read performance. It requires a minimum of three drives to function. This setup allows for data and parity information to be striped across all drives in the array. If one drive fails, the system can use the parity information to reconstruct the lost data, ensuring no data loss occurs. This level of RAID is beneficial for systems where data availability and security are critical, without sacrificing too much storage capacity for parity.
Reference: The minimum number of drives required for RAID level 5 is confirmed by various authoritative sources on RAID technology and storage solutions1234.
B
Explanation:
RAID level 5 is a robust storage solution that provides fault tolerance and improved read performance. It requires a minimum of three drives to function. This setup allows for data and parity information to be striped across all drives in the array. If one drive fails, the system can use the parity information to reconstruct the lost data, ensuring no data loss occurs. This level of RAID is beneficial for systems where data availability and security are critical, without sacrificing too much storage capacity for parity.
Reference: The minimum number of drives required for RAID level 5 is confirmed by various authoritative sources on RAID technology and storage solutions1234.
Question #46
Which among the following filter is used to detect a SYN/FIN attack?
- A . tcp.flags==0x002
- B . tcp.flags==0x004
- C . tcp.flags==0x003
- D . tcp.flags==0x001
Correct Answer: C
C
Explanation:
The filter tcp.flags==0x003 is used to detect SYN/FIN attacks. This filter is designed to identify packets where both the SYN and FIN flags are set, which is an unusual combination and indicative of a potential SYN/FIN attack. In a typical TCP communication, a SYN flag is used to initiate a connection, and a FIN flag is used to gracefully close a connection. Therefore, seeing both flags set in a single packet suggests a malformed or malicious packet, which is characteristic of a SYN/FIN attack.
Reference: The use of the filter tcp.flags==0x003 for detecting SYN/FIN attacks is discussed in various cybersecurity resources and aligns with the knowledge required for the Certified Network Defender (CND) certification. This specific filter is mentioned in discussions about network security and intrusion detection techniques1.
C
Explanation:
The filter tcp.flags==0x003 is used to detect SYN/FIN attacks. This filter is designed to identify packets where both the SYN and FIN flags are set, which is an unusual combination and indicative of a potential SYN/FIN attack. In a typical TCP communication, a SYN flag is used to initiate a connection, and a FIN flag is used to gracefully close a connection. Therefore, seeing both flags set in a single packet suggests a malformed or malicious packet, which is characteristic of a SYN/FIN attack.
Reference: The use of the filter tcp.flags==0x003 for detecting SYN/FIN attacks is discussed in various cybersecurity resources and aligns with the knowledge required for the Certified Network Defender (CND) certification. This specific filter is mentioned in discussions about network security and intrusion detection techniques1.
Question #47
Identity the correct order for a successful black hat operation.
- A . Reconnaissance. Scanning, Gaining Access. Maintaining Access, and Covering Tracks
- B . Scanning, Reconnaissance, Gaining Access. Maintaining Access and Covering Tracks
- C . Reconnaissance. Gaming Access, Scanning. Maintaining Access, and Covering Tracks
- D . Reconnaissance, Scanning, Gaining Access, Covering Tracks, and Maintaining Access
Correct Answer: B
B
Explanation:
The correct sequence for a black hat operation follows a structured approach that begins with Reconnaissance, where the attacker gathers preliminary data or intelligence on the target. Next is Scanning, where the attacker uses technical tools to understand the network and system vulnerabilities. Gaining Access is the phase where the vulnerabilities are exploited to enter the system or network. Maintaining Access involves establishing a persistent presence within the system, often for data exfiltration or additional exploitation. Finally, Covering Tracks is the phase where the attacker erases evidence of the intrusion to avoid detection.
Reference: This answer aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which outlines the phases of cyber attacks in the context of network security and defense strategies.
B
Explanation:
The correct sequence for a black hat operation follows a structured approach that begins with Reconnaissance, where the attacker gathers preliminary data or intelligence on the target. Next is Scanning, where the attacker uses technical tools to understand the network and system vulnerabilities. Gaining Access is the phase where the vulnerabilities are exploited to enter the system or network. Maintaining Access involves establishing a persistent presence within the system, often for data exfiltration or additional exploitation. Finally, Covering Tracks is the phase where the attacker erases evidence of the intrusion to avoid detection.
Reference: This answer aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which outlines the phases of cyber attacks in the context of network security and defense strategies.
Question #48
Which of the following is a windows in-built feature that provides filesystem-level encryption in the OS (starting from Windows 2000). except the Home version of Windows?
- A . Bit Locker
- B . EFS
- C . Disk Utility
- D . FileVault
Correct Answer: B
B
Explanation:
The Encrypting File System (EFS) is a Windows built-in feature that provides filesystem-level encryption, introduced in version 3.0 of NTFS. It enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer. EFS is available in all versions of Windows from Windows 2000 onwards, except the Home versions. This feature allows users to encrypt files on a per-file, per-directory, or per-drive basis, and some EFS settings can be mandated via Group Policy in Windows domain environments.
Reference: The explanation is based on the features and capabilities of EFS as described in the official documentation and resources related to the Windows operating system1.
B
Explanation:
The Encrypting File System (EFS) is a Windows built-in feature that provides filesystem-level encryption, introduced in version 3.0 of NTFS. It enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer. EFS is available in all versions of Windows from Windows 2000 onwards, except the Home versions. This feature allows users to encrypt files on a per-file, per-directory, or per-drive basis, and some EFS settings can be mandated via Group Policy in Windows domain environments.
Reference: The explanation is based on the features and capabilities of EFS as described in the official documentation and resources related to the Windows operating system1.
Question #49
How is the chip-level security of an loT device achieved?
- A . Encrypting JTAC interface
- B . Keeping the device on a that network
- C . Closing insecure network services
- D . Changing the password of the router
Correct Answer: C
C
Explanation:
Chip-level security for IoT devices is achieved by implementing security measures directly into the hardware, such as secure boot, secure firmware updates, and device authentication. This involves storing cryptographic keys in a tamper-resistant environment within the chip, ensuring that sensitive information remains secure even in the event of physical attacks on the device. Closing insecure network services is part of a broader security strategy that includes chip-level measures to protect against cyberattacks. It’s important to note that while changing passwords and encrypting interfaces are also security measures, they do not pertain specifically to chip-level security.
Reference: The information provided is based on industry best practices and insights from sources such as EE Times1 and Semiconductor Digest2, which discuss the importance of establishing a root of trust and securing IoT devices from chip to cloud. These sources emphasize the need for a focus on endpoint devices and the implementation of security mechanisms and techniques depending on their specific function and security requirements. Additionally, they highlight the role of public key infrastructure (PKI) in providing strong identities for IoT devices, which is a critical element of chip-level security.
C
Explanation:
Chip-level security for IoT devices is achieved by implementing security measures directly into the hardware, such as secure boot, secure firmware updates, and device authentication. This involves storing cryptographic keys in a tamper-resistant environment within the chip, ensuring that sensitive information remains secure even in the event of physical attacks on the device. Closing insecure network services is part of a broader security strategy that includes chip-level measures to protect against cyberattacks. It’s important to note that while changing passwords and encrypting interfaces are also security measures, they do not pertain specifically to chip-level security.
Reference: The information provided is based on industry best practices and insights from sources such as EE Times1 and Semiconductor Digest2, which discuss the importance of establishing a root of trust and securing IoT devices from chip to cloud. These sources emphasize the need for a focus on endpoint devices and the implementation of security mechanisms and techniques depending on their specific function and security requirements. Additionally, they highlight the role of public key infrastructure (PKI) in providing strong identities for IoT devices, which is a critical element of chip-level security.
Question #50
David, a network and system admin, encrypted all the files in a Windows system that supports NTFS file system using Encrypted File Systems (EFS). He then backed up the same files into another Windows system that supports FAT file system. Later, he found that the backup files were not encrypted.
What could be the reason for this?
- A . EFS could only encrypt the files that follow NTFS
- B . FAT files cannot be encrypted
- C . EFS is not the encryption system used in Windows
- D . Copied files loses their encryption
Correct Answer: A
A
Explanation:
The Encrypting File System (EFS) is a feature of the NTFS file system that provides encryption at the file system level. It is designed to work specifically with NTFS and does not support the FAT file system. When files encrypted with EFS are copied or backed up to a volume that uses the FAT file system, the encryption is lost because FAT does not support EFS encryption. This is why David found that the backup files were not encrypted after transferring them to a system that supports the FAT file system.
Reference: The explanation is based on the operational characteristics of EFS and its compatibility with different file systems as described in the Certified Network Defender (CND) course materials and further supported by information from reliable sources on EFS and file system encryption1234.
A
Explanation:
The Encrypting File System (EFS) is a feature of the NTFS file system that provides encryption at the file system level. It is designed to work specifically with NTFS and does not support the FAT file system. When files encrypted with EFS are copied or backed up to a volume that uses the FAT file system, the encryption is lost because FAT does not support EFS encryption. This is why David found that the backup files were not encrypted after transferring them to a system that supports the FAT file system.
Reference: The explanation is based on the operational characteristics of EFS and its compatibility with different file systems as described in the Certified Network Defender (CND) course materials and further supported by information from reliable sources on EFS and file system encryption1234.