EC-Council 312-38 Practice Exams
Last updated on Oct 22,2026- Exam Code: 312-38
- Exam Name: Certified Network Defender
- Certification Provider: EC-Council
- Latest update: Oct 22,2026
Wallcot, a retail chain in US and Canada, wants to improve the security of their administration offices. They want to implement a mechanism with two doors. Only one of the doors can be opened at a time. Once people enter from the first door, they have to be authorized to open the next one. Failing the authorization, the person will be locked between the doors until an authorized person lets him or her out.
What is such a mechanism called?
- A . Mantrap
- B . Physical locks
- C . Concealed detection device
- D . Alarm system
A
Explanation:
The apt-get command is a powerful and free package management utility for Debian-based Linux distributions. It is used for handling packages and is utilized to install, update, and remove software on Debian systems. The apt-get command is the recommended tool for doing upgrades from one Debian GNU/Linux release to another, as it effectively manages dependencies and ensures that all necessary changes are made during an upgrade.
Reference: The Debian Wiki recommends using apt-get for upgrading Debian distributions1. It is a well-documented and widely recognized tool within the Debian community and is included in the official Debian documentation as the preferred method for system updates and upgrades.
The network administrator wants to strengthen physical security in the organization. Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials.
Which of following physical security measures should the administrator use?
- A . Bollards
- B . Fence
- C . Video surveillance
- D . Mantrap
D
Explanation:
A mantrap is a physical security mechanism designed to control access to a secure area through a small space with two sets of interlocking doors. It is an effective measure to prevent unauthorized access, as it allows only one person to pass through at a time after authentication, thereby stopping any attempt at ‘tailgating’ or ‘piggybacking’ where an unauthorized individual might try to follow an authorized person into a restricted zone.
Reference: The concept of a mantrap as a physical security control is aligned with the EC-Council’s Certified Network Defender (CND) program, which covers the protect, detect, respond, and predict approach to network security. The CND program emphasizes the importance of various security controls, including physical security measures, to safeguard against unauthorized access and ensure the integrity of the network environment12.
Which of the following includes examining the probability, impact status, and exposure of risk?
- A . Risk Review
- B . Risk Tracking
- C . Risk Identification
- D . Risk Assessment
D
Explanation:
Risk assessment is a fundamental process in network security that involves evaluating the potential risks that could affect a system or organization. This process includes examining the probability of occurrence for various threats, the impact that these threats could have if they were to occur, and the exposure level of the organization’s assets to these threats. By assessing these factors, an organization can prioritize risks and apply appropriate controls to mitigate them. The Certified Network Defender (CND) program emphasizes the importance of risk assessment in the overall risk management strategy, which is essential for protecting network infrastructure.
Reference: The Certified Network Defender (CND) course materials and study guide provide detailed information on risk assessment as part of the broader topic of risk management. This includes methodologies for assessing risk probability, impact, and exposure, which are critical for network defenders in identifying and responding to potential security threats1.
Management asked their network administrator to suggest an appropriate backup medium for their backup plan that best suits their organization’s need.
Which of the following factors will the administrator consider when deciding on the appropriate backup medium?
- A . Capability
- B . Accountability
- C . Extensibility
- D . Reliability
D
Explanation:
When deciding on the appropriate backup medium, the network administrator will consider Reliability as the primary factor. This is because the backup medium must be dependable for restoring data in case of data loss or system failure. The reliability of a backup medium ensures that data can be recovered accurately and completely when needed.
Reference: The importance of reliability in choosing a backup medium is supported by best practices in data backup and recovery, which emphasize the need for a dependable backup solution to ensure data integrity and availability1234.
Bryson is the IT manager and sole IT employee working for a federal agency in California. The agency was just given a grant and was able to hire on 30 more employees for a new extended project. Because of this,
Bryson has hired on two more IT employees to train up and work. Both of his new hires are straight out of college and do not have any practical IT experience. Bryson has spent the last two weeks teaching the new employees the basics of computers, networking, troubleshooting techniques etc. To see how these two new hires are doing, he asks them at what layer of the OSI model do Network Interface Cards (NIC) work on.
What should the new employees answer?
- A . NICs work on the Session layer of the OSI model.
- B . The new employees should say that NICs perform on the Network layer.
- C . They should tell Bryson that NICs perform on the Physical layer
- D . They should answer with the Presentation layer.
C
Explanation:
Network Interface Cards (NICs) operate at the Physical layer of the OSI model. This layer is responsible for the actual physical connection between devices. It transmits individual bits from one node to the next and is involved in the electrical, mechanical, procedural, and functional aspects of activating, maintaining, and deactivating physical connections. It’s also where hardware like cables, switches, and NICs come into play.
Reference: The information provided aligns with the OSI model’s definition and the role of the Physical layer as described in networking literature and resources such as GeeksforGeeks and freeCodeCamp articles on the OSI model12.
John has successfully remediated the vulnerability of an internal application that could have caused a threat to the network. He is scanning the application for the existence of a remediated vulnerability, this process is called a________and it has to adhere to the_________
- A . Verification, Security Policies
- B . Mitigation, Security policies
- C . Vulnerability scanning, Risk Analysis
- D . Risk analysis, Risk matrix
A
Explanation:
The process of scanning an application for the existence of a remediated vulnerability is known as verification. This step is crucial to ensure that the vulnerability has been properly addressed and that the application is no longer susceptible to the previously identified threat. Verification must adhere to the organization’s security policies, which provide the framework and guidelines for all security-related activities. These policies ensure that the verification process is conducted in a manner that is consistent with the organization’s overall security posture and compliance requirements.
Reference: The Certified Network Defender (CND) program emphasizes the importance of adhering to security policies during all stages of network defense, including the verification of remediated vulnerabilities. This ensures that the network remains secure and that all defense measures are in line with the established security protocols123.
An organization’s web server was recently compromised triggering its admin team into action to defend the network. The admin team wants to place the web server in such a way that, even if it is attacked, the other network resources will be unavailable to the attacker. Moreover, the network monitoring will easily detect the future attacks.
How can the admin team implement this plan?
- A . They can place the web server outside of the organization in a remote place
- B . They can remove the web server from their organization
- C . They can place it in a separate DMZ area behind the firewall
- D . They can place it beside the firewall
C
Explanation:
Placing the web server in a separate Demilitarized Zone (DMZ) behind the firewall is a security best practice that allows an organization to isolate its public-facing services from the internal network. This setup ensures that if the web server is compromised, the attacker would not have direct access to the internal network resources. Additionally, the DMZ provides a controlled environment where network traffic to and from the web server can be monitored effectively, facilitating the detection of any future attacks. The firewall serves as a barrier, with specific rules that only allow necessary communication to and from the DMZ, thereby enhancing the overall security posture of the organization.
Reference: The best practice of using a DMZ is widely recognized in the field of network security and is supported by various security resources, including those provided by the EC-Council’s Certified Network Defender (CND) course and other industry-standard documentation on network security and architecture123.
Which type of risk treatment process Includes not allowing the use of laptops in an organization to ensure its security?
- A . Risk avoidance
- B . Mitigate the risk
- C . Eliminate the risk
- D . Reduce the risk
A
Explanation:
The risk treatment process that includes not allowing the use of laptops in an organization to ensure its security is known as risk avoidance. Risk avoidance is a strategy that involves identifying a potential risk and making the decision to not engage in the activity that presents the risk. In the context of information security, this could mean choosing not to use certain technologies or systems that could pose a security threat. By not using laptops, an organization can avoid the risks associated with loss, theft, or unauthorized access that laptops, being portable, are particularly susceptible to.
Reference: The answer aligns with the principles of risk management in network security, as outlined in the Certified Network Defender (CND) course by EC-Council, which emphasizes understanding and applying the appropriate risk treatment strategies, including avoidance, mitigation, transfer, and acceptance.
Henry needs to design a backup strategy for the organization with no service level downtime.
Which backup method will he select?
- A . Normal backup
- B . Warm backup
- C . Hot backup
- D . Cold backup
C
Explanation:
A hot backup, also known as an online backup or dynamic backup, is the process of backing up data while the system continues to be in operation. This means that there is no need for system downtime or interruption in services while the backup is taking place. It is mostly used in systems where operations are critical and cannot afford any downtime, such as databases and servers that must be available 24/7. The hot backup method allows for data to be backed up at regular intervals with minimal impact on the system’s performance, ensuring that the organization can maintain continuous service levels.
Reference: The concept of hot backup is aligned with the ECCouncil’s Network Defender (CND) objectives and is supported by industry best practices as detailed in sources like MiniTool1 and NinjaOne2, which discuss the advantages of hot backups in maintaining uninterrupted service and business continuity.
Henry needs to design a backup strategy for the organization with no service level downtime.
Which backup method will he select?
- A . Normal backup
- B . Warm backup
- C . Hot backup
- D . Cold backup
C
Explanation:
A hot backup, also known as an online backup or dynamic backup, is the process of backing up data while the system continues to be in operation. This means that there is no need for system downtime or interruption in services while the backup is taking place. It is mostly used in systems where operations are critical and cannot afford any downtime, such as databases and servers that must be available 24/7. The hot backup method allows for data to be backed up at regular intervals with minimal impact on the system’s performance, ensuring that the organization can maintain continuous service levels.
Reference: The concept of hot backup is aligned with the ECCouncil’s Network Defender (CND) objectives and is supported by industry best practices as detailed in sources like MiniTool1 and NinjaOne2, which discuss the advantages of hot backups in maintaining uninterrupted service and business continuity.