EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #61
The network admin decides to assign a class B IP address to a host in the network. Identify which of the following addresses fall within a class B IP address range.
- A . 255.255.255.0
- B . 18.12.4.1
- C . 172.168.12.4
- D . 169.254.254.254
Correct Answer: B
B
Explanation:
Class B IP addresses range from 128.0.0.0 to 191.255.255.255. The first two bits of the first octet in a Class B address are always set to ‘10’, and the default subnet mask is 255.255.0.0. Option B, 18.12.4.1, falls within this range, with the first octet being 18, which is between 128 and 191.
Reference: The information is based on the standard IP address classification as per the IPv4 protocol1234.
B
Explanation:
Class B IP addresses range from 128.0.0.0 to 191.255.255.255. The first two bits of the first octet in a Class B address are always set to ‘10’, and the default subnet mask is 255.255.0.0. Option B, 18.12.4.1, falls within this range, with the first octet being 18, which is between 128 and 191.
Reference: The information is based on the standard IP address classification as per the IPv4 protocol1234.
Question #62
James is working as a Network Administrator in a reputed company situated in California. He is monitoring his network traffic with the help of Wireshark. He wants to check and analyze the traffic against a PING sweep attack.
Which of the following Wireshark filters will he use?
- A . lcmp.type==0 and icmp.type==16
- B . lcmp.type==8 or icmp.type==16
- C . lcmp.type==8 and icmp.type==0
- D . lcmp.type==8 or icmp.type==0
Correct Answer: D
D
Explanation:
James should use the Wireshark filter icmp.type==8 or icmp.type==0 to detect a PING sweep attack. This filter will capture both ICMP echo requests and echo replies, which are used in PING sweeps to discover active hosts on a network. When conducting a PING sweep, an attacker sends ICMP echo requests (type 8) to multiple hosts and listens for echo replies (type 0). By monitoring for both types, James can effectively identify a PING sweep attack.
Reference: The use of this filter for detecting PING sweeps is documented in various network security resources, including the InfosecMatter guide on detecting network attacks with Wireshark1, which specifically lists icmp.type==8 or icmp.type==0 as the filter for ICMP ping sweeps. This approach is consistent with standard practices for network monitoring and intrusion detection.
D
Explanation:
James should use the Wireshark filter icmp.type==8 or icmp.type==0 to detect a PING sweep attack. This filter will capture both ICMP echo requests and echo replies, which are used in PING sweeps to discover active hosts on a network. When conducting a PING sweep, an attacker sends ICMP echo requests (type 8) to multiple hosts and listens for echo replies (type 0). By monitoring for both types, James can effectively identify a PING sweep attack.
Reference: The use of this filter for detecting PING sweeps is documented in various network security resources, including the InfosecMatter guide on detecting network attacks with Wireshark1, which specifically lists icmp.type==8 or icmp.type==0 as the filter for ICMP ping sweeps. This approach is consistent with standard practices for network monitoring and intrusion detection.
Question #63
Which of the following Layers of IoT Architecture provides dashboards to monitor, analyze, and implement proactive decisions?
- A . Device Layer
- B . Communication Layer
- C . Cloud Layer
- D . Process Layer
Correct Answer: D
D
Explanation:
In the context of IoT Architecture, the Process Layer is responsible for providing dashboards that are used to monitor, analyze, and implement proactive decisions. This layer encompasses the software platforms and applications that process the data collected from the devices. It is within this layer that data is turned into actionable insights and where dashboards are typically found, allowing for real-time monitoring and analysis, as well as the ability to make proactive decisions based on the processed information.
Reference: The information aligns with the general structure of IoT systems, where the Process Layer serves as the interface for user interaction and data manipulation. It is consistent with the descriptions provided in IoT architecture resources123.
D
Explanation:
In the context of IoT Architecture, the Process Layer is responsible for providing dashboards that are used to monitor, analyze, and implement proactive decisions. This layer encompasses the software platforms and applications that process the data collected from the devices. It is within this layer that data is turned into actionable insights and where dashboards are typically found, allowing for real-time monitoring and analysis, as well as the ability to make proactive decisions based on the processed information.
Reference: The information aligns with the general structure of IoT systems, where the Process Layer serves as the interface for user interaction and data manipulation. It is consistent with the descriptions provided in IoT architecture resources123.
Question #64
A network designer needs to submit a proposal for a company, which has just published a web portal for its clients on the internet. Such a server needs to be isolated from the internal network, placing itself in a DMZ. Faced with this need, the designer will present a proposal for a firewall with three interfaces, one for the internet network, another for the DMZ server farm and another for the internal network.
What kind of topology will the designer propose?
- A . Screened subnet
- B . DMZ, External-Internal firewall
- C . Multi-homed firewall
- D . Bastion host
Correct Answer: A
A
Explanation:
The topology that the network designer will propose is known as a screened subnet. This topology involves the use of two or more firewalls to create a network segment referred to as a demilitarized zone (DMZ). The DMZ acts as a buffer zone between the public internet and the internal network. It contains the public-facing servers, such as the web portal mentioned, which is isolated from the internal network for added security. The screened subnet topology typically includes a firewall at the network’s edge connected to the internet, another firewall separating the DMZ from the internal network, and the DMZ itself. This setup allows for strict control of traffic between the internet, the DMZ, and the internal network, providing an additional layer of security.
Reference: The concept of a screened subnet as a network topology is consistent with the Certified Network Defender (CND) course materials, which cover network perimeter security and the implementation of firewalls to protect networked systems12.
A
Explanation:
The topology that the network designer will propose is known as a screened subnet. This topology involves the use of two or more firewalls to create a network segment referred to as a demilitarized zone (DMZ). The DMZ acts as a buffer zone between the public internet and the internal network. It contains the public-facing servers, such as the web portal mentioned, which is isolated from the internal network for added security. The screened subnet topology typically includes a firewall at the network’s edge connected to the internet, another firewall separating the DMZ from the internal network, and the DMZ itself. This setup allows for strict control of traffic between the internet, the DMZ, and the internal network, providing an additional layer of security.
Reference: The concept of a screened subnet as a network topology is consistent with the Certified Network Defender (CND) course materials, which cover network perimeter security and the implementation of firewalls to protect networked systems12.
Question #65
Daniel works as a network administrator in an Information Security company. He has just deployed an IDS in his organization’s network and wants to calculate the false positive rate for his implementation.
Which of the following formulae can he use to so?
- A . False Negative/False Negative+True Positive
- B . False Positive/False Positive+True Negative
- C . True Negative/False Negative+True Positive
- D . False Negative/True Negative+True positive
Correct Answer: B
B
Explanation:
The false positive rate is a measure used to evaluate the performance of an IDS (Intrusion Detection
System). It is calculated by dividing the number of false positives (FP) by the sum of false positives
and true negatives (TN).
The formula is:
False Positive Rate=FP+TNFP
This formula helps in determining how often the IDS incorrectly classifies an event as a threat, which is actually benign. A lower false positive rate indicates a more accurate IDS.
Reference: This formula and its application are consistent with standard practices in network security and align with the Certified Network Defender (CND) course material. For further details, please refer to the official CND study guide and documents.
B
Explanation:
The false positive rate is a measure used to evaluate the performance of an IDS (Intrusion Detection
System). It is calculated by dividing the number of false positives (FP) by the sum of false positives
and true negatives (TN).
The formula is:
False Positive Rate=FP+TNFP
This formula helps in determining how often the IDS incorrectly classifies an event as a threat, which is actually benign. A lower false positive rate indicates a more accurate IDS.
Reference: This formula and its application are consistent with standard practices in network security and align with the Certified Network Defender (CND) course material. For further details, please refer to the official CND study guide and documents.
Question #66
Which of the following best describes the Log Normalization process?
- A . It is a process of accepting logs from homogenous sources with the same formats and converting them into a different format
- B . It is a process of accepting logs from homogenous sources with different formats and converting them into a common format
- C . It is a process of accepting logs from heterogeneous sources with different formats and converting them into a common format
- D . It is a process of accepting logs from heterogeneous sources with the same formats and converting them into a different format
Correct Answer: C
C
Explanation:
Log normalization is a critical process in network security, particularly within the context of Security Information and Event Management (SIEM) systems. The primary goal of log normalization is to standardize the format of log data received from various sources, which often have different formats and structures. This standardization allows for more efficient and effective analysis, correlation, and storage of log data. By converting disparate log data into a common format, SIEM systems can more easily identify patterns, detect anomalies, and trigger alerts for potential security incidents. This process is essential for managing the complexity and volume of log data in modern network environments.
Reference: The explanation provided is based on the general practices and objectives of network security and SIEM systems as outlined in the Certified Network Defender (CND) curriculum. For the most accurate and detailed information, please refer to the latest CND study materials and documents available through the EC-Council’s official resources.
C
Explanation:
Log normalization is a critical process in network security, particularly within the context of Security Information and Event Management (SIEM) systems. The primary goal of log normalization is to standardize the format of log data received from various sources, which often have different formats and structures. This standardization allows for more efficient and effective analysis, correlation, and storage of log data. By converting disparate log data into a common format, SIEM systems can more easily identify patterns, detect anomalies, and trigger alerts for potential security incidents. This process is essential for managing the complexity and volume of log data in modern network environments.
Reference: The explanation provided is based on the general practices and objectives of network security and SIEM systems as outlined in the Certified Network Defender (CND) curriculum. For the most accurate and detailed information, please refer to the latest CND study materials and documents available through the EC-Council’s official resources.
Question #67
Match the following NIST security life cycle components with their activities:
- A . 1-ii, 2-i, 3-v, 4-iv
- B . 1-iii, 2-iv, 3-v, 4-i
- C . 1-iv, 2-iii, 3-v, 4-i
- D . 1-i, 2-v, 3-iii, 4-ii
Correct Answer: C
C
Explanation:
The NIST security life cycle components and their activities are correctly matched in option C: Implement (1) corresponds with iv. Sets security controls within an enterprise architecture. This involves integrating the selected security controls into the enterprise architecture during the implementation phase.
Authorize (2) matches with iii. Determines risk to organizational operations and assets. Authorization involves assessing the risks to the organization’s operations and assets and determining if the implemented controls are adequate.
Categorize (3) aligns with v. Defines criticality of information system according to potential worst-case. Categorization is the process of determining the criticality of information systems based on the potential impact of worst-case scenarios.
Select (4) is associated with i. Determines security control effectiveness. Selection involves choosing the appropriate security controls and determining their effectiveness in protecting the system.
Reference: The information provided is based on the NIST guidelines for the system development life cycle, which include security considerations as an integral part of the process1234.
C
Explanation:
The NIST security life cycle components and their activities are correctly matched in option C: Implement (1) corresponds with iv. Sets security controls within an enterprise architecture. This involves integrating the selected security controls into the enterprise architecture during the implementation phase.
Authorize (2) matches with iii. Determines risk to organizational operations and assets. Authorization involves assessing the risks to the organization’s operations and assets and determining if the implemented controls are adequate.
Categorize (3) aligns with v. Defines criticality of information system according to potential worst-case. Categorization is the process of determining the criticality of information systems based on the potential impact of worst-case scenarios.
Select (4) is associated with i. Determines security control effectiveness. Selection involves choosing the appropriate security controls and determining their effectiveness in protecting the system.
Reference: The information provided is based on the NIST guidelines for the system development life cycle, which include security considerations as an integral part of the process1234.
Question #68
Which technique is used in RAID level 0 where the data is split into blocks and written evenly across multiple disks?
- A . Disk mirroring
- B . Disk stripping
- C . Data splitting
- D . Disk partition
Correct Answer: B
B
Explanation:
RAID level 0 employs a technique known as disk stripping, which involves splitting data into blocks and distributing them evenly across multiple disks. This method enhances performance by allowing simultaneous read and write operations on multiple drives. However, it does not provide redundancy, meaning if one drive fails, all data on the array could be lost. The primary advantage of disk stripping is the improved I/O performance due to the parallel processing of data across the drives.
Reference: This explanation is based on standard RAID technology descriptions, which are part of the Certified Network Defender (CND) curriculum that covers various data storage strategies, including RAID configurations1234.
B
Explanation:
RAID level 0 employs a technique known as disk stripping, which involves splitting data into blocks and distributing them evenly across multiple disks. This method enhances performance by allowing simultaneous read and write operations on multiple drives. However, it does not provide redundancy, meaning if one drive fails, all data on the array could be lost. The primary advantage of disk stripping is the improved I/O performance due to the parallel processing of data across the drives.
Reference: This explanation is based on standard RAID technology descriptions, which are part of the Certified Network Defender (CND) curriculum that covers various data storage strategies, including RAID configurations1234.
Question #69
Which of the following intrusion detection techniques observes the network for abnormal usage patterns by determining the performance parameters for regular activities and monitoring for actions beyond the normal parameters?
- A . Signature/Pattern matching
- B . Stateful protocol analysis
- C . None of these
- D . Statistical anomaly detection
Correct Answer: D
D
Explanation:
Statistical anomaly detection is an intrusion detection technique that models the normal behavior of a network’s traffic and identifies deviations from this norm. It uses statistical metrics such as median, mean, mode, and standard deviation to establish a baseline of regular activities. When network traffic deviates from these established performance parameters, the system flags these events as potential intrusions. This method is effective in observing the network for abnormal usage patterns that could indicate a security breach.
Reference: The explanation is based on the principles of statistical anomaly detection as described in various Network Defender (CND) documents and study guides. Specifically, it aligns with the descriptions found in resources like the Saylor Academy’s module on Intrusion Detection Systems1, which details how a statistics-based IDS builds a distribution model for normal behavior and flags low probability events as potential intrusions.
D
Explanation:
Statistical anomaly detection is an intrusion detection technique that models the normal behavior of a network’s traffic and identifies deviations from this norm. It uses statistical metrics such as median, mean, mode, and standard deviation to establish a baseline of regular activities. When network traffic deviates from these established performance parameters, the system flags these events as potential intrusions. This method is effective in observing the network for abnormal usage patterns that could indicate a security breach.
Reference: The explanation is based on the principles of statistical anomaly detection as described in various Network Defender (CND) documents and study guides. Specifically, it aligns with the descriptions found in resources like the Saylor Academy’s module on Intrusion Detection Systems1, which details how a statistics-based IDS builds a distribution model for normal behavior and flags low probability events as potential intrusions.
Question #70
Which event type indicates a significant problem such as loss of data or loss of functionality?
- A . Error
- B . Warning
- C . Information
- D . Failure Audit
Correct Answer: A
A
Explanation:
In the context of network security and event management, an ‘Error’ event type typically indicates a significant problem that could result in loss of data or loss of functionality. These events are logged when a system or application experiences a severe issue that prevents it from continuing normal operation. Unlike warnings or informational events, error events suggest a critical condition that may require immediate attention to prevent further damage or data loss.
Reference: The Certified Network Defender (CND) course by EC-Council includes detailed discussions on various event types and their significance in the realm of cybersecurity. The curriculum covers the importance of monitoring and managing error events as part of maintaining network security and ensuring the integrity and availability of data and services1.
A
Explanation:
In the context of network security and event management, an ‘Error’ event type typically indicates a significant problem that could result in loss of data or loss of functionality. These events are logged when a system or application experiences a severe issue that prevents it from continuing normal operation. Unlike warnings or informational events, error events suggest a critical condition that may require immediate attention to prevent further damage or data loss.
Reference: The Certified Network Defender (CND) course by EC-Council includes detailed discussions on various event types and their significance in the realm of cybersecurity. The curriculum covers the importance of monitoring and managing error events as part of maintaining network security and ensuring the integrity and availability of data and services1.