EC-Council 312-38 Practice Exams
Last updated on Oct 21,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 21,2026
Question #71
Michelle is a network security administrator working at a multinational company. She wants to provide secure access to corporate data (documents, spreadsheets, email, schedules, presentations, and other enterprise data) on mobile devices across organizations networks without being slowed down and also wants to enable easy and secure sharing of information between devices within an enterprise.
Based on the above mentioned requirements, which among the following solution should Michelle implement?
- A . MEM
- B . MAM
- C . MCM
- D . MDM
Correct Answer: C
C
Explanation:
Incident management enables an organization to analyze, identify, and rectify hazards and prevent future recurrence in business continuity management. It involves a systematic process that manages the lifecycle of all incidents. Incident management ensures that normal service operation is restored as quickly as possible and the business impact is minimized. It is an integral part of an organization’s business continuity and disaster recovery plan, focusing on the immediate response to incidents, establishing protocols for communication, and promoting swift recovery actions.
Reference: The explanation is aligned with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of incident management in maintaining business continuity. The CND program covers various aspects of network security, including business continuity and disaster recovery, where incident management plays a crucial role in analyzing and responding to threats to ensure the organization’s resilience123.
C
Explanation:
Incident management enables an organization to analyze, identify, and rectify hazards and prevent future recurrence in business continuity management. It involves a systematic process that manages the lifecycle of all incidents. Incident management ensures that normal service operation is restored as quickly as possible and the business impact is minimized. It is an integral part of an organization’s business continuity and disaster recovery plan, focusing on the immediate response to incidents, establishing protocols for communication, and promoting swift recovery actions.
Reference: The explanation is aligned with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes the importance of incident management in maintaining business continuity. The CND program covers various aspects of network security, including business continuity and disaster recovery, where incident management plays a crucial role in analyzing and responding to threats to ensure the organization’s resilience123.
Question #72
Heather has been tasked with setting up and implementing VPN tunnels to remote offices. She will most likely be implementing IPsec VPN tunnels to connect the offices.
At what layer of the OSI model does an IPsec tunnel function on?
- A . They work on the session layer.
- B . They function on either the application or the physical layer.
- C . They function on the data link layer
- D . They work on the network layer
Correct Answer: D
D
Explanation:
IPsec VPN tunnels operate at the network layer of the OSI model. This is because IPsec is designed to secure IP communications by authenticating and encrypting each IP packet of a communication session. IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to be used during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). By functioning at the network layer, IPsec VPNs are able to secure all traffic that passes through them, not just specific applications or sessions.
Reference: The information provided is based on standard networking protocols and the OSI model as covered in the EC-Council’s Certified Network Defender (CND) program, which includes a comprehensive understanding of network security measures like IPsec123.
D
Explanation:
IPsec VPN tunnels operate at the network layer of the OSI model. This is because IPsec is designed to secure IP communications by authenticating and encrypting each IP packet of a communication session. IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to be used during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). By functioning at the network layer, IPsec VPNs are able to secure all traffic that passes through them, not just specific applications or sessions.
Reference: The information provided is based on standard networking protocols and the OSI model as covered in the EC-Council’s Certified Network Defender (CND) program, which includes a comprehensive understanding of network security measures like IPsec123.
Question #73
John, the network administrator and he wants to enable the NetFlow feature in Cisco routers to collect and monitor the IP network traffic passing through the router.
Which command will John use to enable NetFlow on an interface?
- A . Router (Config-if) # IP route – cache flow
- B . Router# Netmon enable
- C . Router IP route
- D . Router# netflow enable
Correct Answer: A
A
Explanation:
To enable NetFlow on a Cisco router interface, the correct command is ip route-cache flow, which is entered in interface configuration mode. This command enables NetFlow switching on the specified interface. NetFlow is a feature that captures IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things like the source and destination of traffic, class of service, and the causes of congestion1.
Reference: The information provided aligns with the Cisco documentation for configuring NetFlow on Cisco routers, which specifies the command to enable NetFlow on an interface1.
A
Explanation:
To enable NetFlow on a Cisco router interface, the correct command is ip route-cache flow, which is entered in interface configuration mode. This command enables NetFlow switching on the specified interface. NetFlow is a feature that captures IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things like the source and destination of traffic, class of service, and the causes of congestion1.
Reference: The information provided aligns with the Cisco documentation for configuring NetFlow on Cisco routers, which specifies the command to enable NetFlow on an interface1.
Question #74
The bank where you work has 600 windows computers and 400 Red Hat computers which primarily serve as bank teller consoles. You have created a plan and deployed all the patches to the Windows computers and you are now working on updating the Red Hat computers.
What command should you run on the network to update the Red Hat computers, download the security package, force the package installation, and update all currently installed packages?
- A . You should run the up2date -d -f -u command
- B . You should run the up2data -u command
- C . You should run the WSUS -d -f -u command.
- D . You should type the sysupdate -d command
Correct Answer: A
A
Explanation:
The up2date command was used in older versions of Red Hat Enterprise Linux to update installed packages to their latest available versions. The -d option downloads the packages without installing them, -f forces the installation of the package even if it is already installed, and -u updates all installed packages to the latest versions. However, it’s important to note that up2date has been replaced by yum and more recently by dnf in the newer versions of Red Hat Enterprise Linux. For the scenario described, where security is a concern and the systems are likely to be running a more current version of Red Hat, the correct command would be yum update or dnf upgrade.
Reference: The information is based on the standard practices for updating Red Hat systems as per the Red Hat Customer Portal and the ECCouncil’s Certified Network Defender course objectives. Specifically, the use of up2date is referenced from historical Red Hat documentation, while the replacement with yum and dnf is documented in more recent Red Hat Enterprise Linux system management guides1234.
A
Explanation:
The up2date command was used in older versions of Red Hat Enterprise Linux to update installed packages to their latest available versions. The -d option downloads the packages without installing them, -f forces the installation of the package even if it is already installed, and -u updates all installed packages to the latest versions. However, it’s important to note that up2date has been replaced by yum and more recently by dnf in the newer versions of Red Hat Enterprise Linux. For the scenario described, where security is a concern and the systems are likely to be running a more current version of Red Hat, the correct command would be yum update or dnf upgrade.
Reference: The information is based on the standard practices for updating Red Hat systems as per the Red Hat Customer Portal and the ECCouncil’s Certified Network Defender course objectives. Specifically, the use of up2date is referenced from historical Red Hat documentation, while the replacement with yum and dnf is documented in more recent Red Hat Enterprise Linux system management guides1234.
Question #75
Which filter to locate unusual ICMP request an Analyst can use in order to detect a ICMP probes from the attacker to a target OS looking for the response to perform ICMP fingerprinting?
- A . (icmp.type==9 && ((!(icmp.code==9))
- B . (icmp.type==14) || (icmp.type==15 || (icmp.type==17)
- C . (icmp.type==8 && ((!(icmp.code==8))
- D . (icmp.type==12) || (icmp.type==15 || (icmp.type==17)
Correct Answer: C
C
Explanation:
In the context of network security, ICMP fingerprinting is a technique used to determine the operating system of a target machine by analyzing its responses to ICMP requests. The correct filter to detect unusual ICMP requests that could be indicative of ICMP probes from an attacker is option C. This filter looks for ICMP echo requests (type 8) that do not have a corresponding echo reply (code 0). Since the code for an echo request is 0, the filter (!(icmp.code==8)) is used to exclude other ICMP messages with different codes.
Reference: The use of Wireshark filters to identify specific types of ICMP traffic is a common practice in network analysis. The Certified Network Defender (CND) course material covers various network monitoring tools and techniques, including the analysis of ICMP traffic for security purposes1. Additionally, resources like Wireshark documentation and network security forums provide practical examples of filters used to detect ICMP fingerprinting attempts23.
C
Explanation:
In the context of network security, ICMP fingerprinting is a technique used to determine the operating system of a target machine by analyzing its responses to ICMP requests. The correct filter to detect unusual ICMP requests that could be indicative of ICMP probes from an attacker is option C. This filter looks for ICMP echo requests (type 8) that do not have a corresponding echo reply (code 0). Since the code for an echo request is 0, the filter (!(icmp.code==8)) is used to exclude other ICMP messages with different codes.
Reference: The use of Wireshark filters to identify specific types of ICMP traffic is a common practice in network analysis. The Certified Network Defender (CND) course material covers various network monitoring tools and techniques, including the analysis of ICMP traffic for security purposes1. Additionally, resources like Wireshark documentation and network security forums provide practical examples of filters used to detect ICMP fingerprinting attempts23.
Question #75
Which filter to locate unusual ICMP request an Analyst can use in order to detect a ICMP probes from the attacker to a target OS looking for the response to perform ICMP fingerprinting?
- A . (icmp.type==9 && ((!(icmp.code==9))
- B . (icmp.type==14) || (icmp.type==15 || (icmp.type==17)
- C . (icmp.type==8 && ((!(icmp.code==8))
- D . (icmp.type==12) || (icmp.type==15 || (icmp.type==17)
Correct Answer: C
C
Explanation:
In the context of network security, ICMP fingerprinting is a technique used to determine the operating system of a target machine by analyzing its responses to ICMP requests. The correct filter to detect unusual ICMP requests that could be indicative of ICMP probes from an attacker is option C. This filter looks for ICMP echo requests (type 8) that do not have a corresponding echo reply (code 0). Since the code for an echo request is 0, the filter (!(icmp.code==8)) is used to exclude other ICMP messages with different codes.
Reference: The use of Wireshark filters to identify specific types of ICMP traffic is a common practice in network analysis. The Certified Network Defender (CND) course material covers various network monitoring tools and techniques, including the analysis of ICMP traffic for security purposes1. Additionally, resources like Wireshark documentation and network security forums provide practical examples of filters used to detect ICMP fingerprinting attempts23.
C
Explanation:
In the context of network security, ICMP fingerprinting is a technique used to determine the operating system of a target machine by analyzing its responses to ICMP requests. The correct filter to detect unusual ICMP requests that could be indicative of ICMP probes from an attacker is option C. This filter looks for ICMP echo requests (type 8) that do not have a corresponding echo reply (code 0). Since the code for an echo request is 0, the filter (!(icmp.code==8)) is used to exclude other ICMP messages with different codes.
Reference: The use of Wireshark filters to identify specific types of ICMP traffic is a common practice in network analysis. The Certified Network Defender (CND) course material covers various network monitoring tools and techniques, including the analysis of ICMP traffic for security purposes1. Additionally, resources like Wireshark documentation and network security forums provide practical examples of filters used to detect ICMP fingerprinting attempts23.
Question #77
Which authorization lets users access a requested resource on behalf of others?
- A . Explicit Authorization
- B . Decentralized Authorization
- C . Implicit Authorization
- D . Centralized Authorization
Correct Answer: C
C
Explanation:
Implicit Authorization is a type of authorization that allows users to access resources on behalf of others without the need for explicit permission from the resource owner each time. This is commonly implemented through OAuth, where a user grants a third-party application access to their information on another service without sharing their credentials. The application receives an access token that permits it to act on behalf of the user, accessing only what the user is authorized to access.
Reference: The OAuth framework is a prime example of Implicit Authorization, as it enables applications to obtain access tokens for authorization to protected resources, acting on the user’s behalf123.
C
Explanation:
Implicit Authorization is a type of authorization that allows users to access resources on behalf of others without the need for explicit permission from the resource owner each time. This is commonly implemented through OAuth, where a user grants a third-party application access to their information on another service without sharing their credentials. The application receives an access token that permits it to act on behalf of the user, accessing only what the user is authorized to access.
Reference: The OAuth framework is a prime example of Implicit Authorization, as it enables applications to obtain access tokens for authorization to protected resources, acting on the user’s behalf123.
Question #78
According to standard loT security practice, loT Gateway should be connected to a ————-
- A . Border router
- B . Secure router
- C . Pouter that is connected to internal servers
- D . Router that is connected to other subnets
Correct Answer: A
A
Explanation:
According to standard IoT security practices, an IoT Gateway should be connected to a border router. This setup is recommended because a border router acts as a gateway between different networks, managing the traffic between these networks and the internet. It provides an additional layer of security, ensuring that the IoT devices and the internal network are protected from external threats. The border router can implement security measures such as firewalls, intrusion detection systems, and data encryption to safeguard the IoT ecosystem.
Reference: The standard practice of connecting an IoT Gateway to a border router is supported by security guidelines that emphasize the importance of segregating IoT devices from internal networks to prevent potential cyber threats from spreading across networks123.
A
Explanation:
According to standard IoT security practices, an IoT Gateway should be connected to a border router. This setup is recommended because a border router acts as a gateway between different networks, managing the traffic between these networks and the internet. It provides an additional layer of security, ensuring that the IoT devices and the internal network are protected from external threats. The border router can implement security measures such as firewalls, intrusion detection systems, and data encryption to safeguard the IoT ecosystem.
Reference: The standard practice of connecting an IoT Gateway to a border router is supported by security guidelines that emphasize the importance of segregating IoT devices from internal networks to prevent potential cyber threats from spreading across networks123.
Question #79
A CCTV camera, which can be accessed on the smartphone from a remote location, is an example of _____
- A . Device-to-Device communication model
- B . Device-to-Cloud communication model
- C . Device-to-Gateway communication model
- D . Back-End Data-Sharing communication model
Correct Answer: B
B
Explanation:
A CCTV camera that can be accessed on a smartphone from a remote location typically uses the Device-to-Cloud communication model. This model involves devices that connect directly to the cloud where data is stored and processed. Users can access this data through an application on their smartphones, allowing for remote monitoring and control. This setup is common for IP cameras that transmit data over the internet, enabling users to view live footage or recordings from anywhere with an internet connection123.
Reference: The Device-to-Cloud communication model is widely recognized in the context of remote access to surveillance systems, as it provides the necessary infrastructure for transmitting and storing data from CCTV cameras to a cloud platform, which users can then access via smartphones or other devices123.
B
Explanation:
A CCTV camera that can be accessed on a smartphone from a remote location typically uses the Device-to-Cloud communication model. This model involves devices that connect directly to the cloud where data is stored and processed. Users can access this data through an application on their smartphones, allowing for remote monitoring and control. This setup is common for IP cameras that transmit data over the internet, enabling users to view live footage or recordings from anywhere with an internet connection123.
Reference: The Device-to-Cloud communication model is widely recognized in the context of remote access to surveillance systems, as it provides the necessary infrastructure for transmitting and storing data from CCTV cameras to a cloud platform, which users can then access via smartphones or other devices123.
Question #80
In MacOS, how can the user implement disk encryption?
- A . By enabling BitLocker feature
- B . By executing dm-crypt command
- C . By turning on Device Encryption feature
- D . By enabling FileVault feature
Correct Answer: D
D
Explanation:
In MacOS, disk encryption is implemented by enabling the FileVault feature. FileVault is a disk encryption program available in Mac operating systems that uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to information on the startup disk. It’s designed to encrypt the entire drive on your Mac, protecting your data with a password and automatically encrypting everything stored on the Mac. This feature is particularly important for users who handle sensitive information and want to ensure that their data is secure, even if their computer is lost or stolen.
Reference: The explanation is based on the official Apple Support documentation, which provides detailed guidance on using FileVault for disk encryption on MacOS12.
D
Explanation:
In MacOS, disk encryption is implemented by enabling the FileVault feature. FileVault is a disk encryption program available in Mac operating systems that uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to information on the startup disk. It’s designed to encrypt the entire drive on your Mac, protecting your data with a password and automatically encrypting everything stored on the Mac. This feature is particularly important for users who handle sensitive information and want to ensure that their data is secure, even if their computer is lost or stolen.
Reference: The explanation is based on the official Apple Support documentation, which provides detailed guidance on using FileVault for disk encryption on MacOS12.