Get Latest and Valid Ec-council 312-38 Exam Questions [2023]

Jonnie Karnath2023-06-01T07:45:14+00:00

If you’re looking to pursue the Certified Network Defender certification, Certspots EC-Council 312-38 exam dumps are the perfect tool to help you prepare for your exam. With Certspots, you can get the latest and most valid Eccouncil 312-38 exam questions to ensure your success. Certspots offers top-quality 312-38 Exam Questionss that are designed to help you pass your exam on the first try. With our comprehensive and up-to-date study materials, you’ll be fully prepared to take on the Certified Network Defender exam and achieve your certification. Choose Certspots for your exam preparation and get the results you deserve. Get started today and take your first step towards becoming a Certified Network Defender!

Page 1 of 6

1. As a network administrator, you have implemented WPA2 encryption in your corporate wireless network. The WPA2's _________integrity check mechanism provides security against a replay attack

CRC-32

CRC-MAC

CBC-MAC

CBC-32

2. A local bank wants to protect their card holder data. The bank should comply with the________standard to ensure the security of card holder data.

HIPAA

ISEC

PCI DSS

SOAX

3. Eric is receiving complaints from employees that their systems are very slow and experiencing odd issues including restarting automatically and frequent system hangs. Upon investigating, he is convinced the systems are infected with a virus that forces systems to shut down automatically after period of time.

What type of security incident are the employees a victim of?

Scans and probes

Malicious Code

Denial of service

Distributed denial of service

4. Castle-and-Moat model

Both 1 and 2

1 only

2 only

None

5. What command is used to terminate certain processes in an Ubuntu system?

#grep Kill [Target Process}

#kill-9[PID]

#ps ax Kill

# netstat Kill [Target Process]

6. Steven's company has recently grown from 5 employees to over 50. Every workstation has a public IP address and navigated to the Internet with little to no protection. Steven wants to use a firewall. He also wants IP addresses to be private addresses, to prevent public Internet devices direct access to them.

What should Steven implement on the firewall to ensure this happens?

Steven should use a Demilitarized Zone (DMZ)

Steven should use Open Shortest Path First (OSPF)

Steven should use IPsec

Steven should enabled Network Address Translation (NAT)

7. A company has the right to monitor the activities of their employees on different information systems according to the _______policy.

Information system

User access control

Internet usage

Confidential data

8. CORRECT TEXT

Identify the minimum number of drives required to setup RAID level 5.

Multiple

9. In _______ mechanism, the system or application sends log records either on the local disk or over the network.

Network-based

Pull-based

Push-based

Host-based

10. Bryson is the IT manager and sole IT employee working for a federal agency in California. The agency was just given a grant and was able to hire on 30 more employees for a new extended project. Because of this, Bryson has hired on two more IT employees to train up and work. Both of his new hires are straight out of college and do not have any practical IT experience. Bryson has spent the last two weeks teaching the new employees the basics of computers, networking, troubleshooting techniques etc. To see how these two new hires are doing, he asks them at what layer of the OSI model do Network Interface Cards (NIC) work on.

What should the new employees answer?

NICs work on the Session layer of the OSI model.

The new employees should say that NICs perform on the Network layer.

They should tell Bryson that NICs perform on the Physical layer

They should answer with the Presentation layer.

Page 2 of 6

11. Which of the following creates passwords for individual administrator accounts and stores them in Windows AD?

LSASS

SRM

SAM

LAPS

12. Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago. He has focused primarily on securing network devices, firewalls, and traffic traversing in and out of the network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets.

What is this type of server called?

Bastion host

Edge transport server

SOCKS hsot

Session layer firewall

13. Identify the password cracking attempt involving precomputed hash values stored as plaintext and using these to crack the password.

Bruteforce

Rainbow table

Dictionary

Hybrid

14. Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?

Application sandboxing

Deployment of WAFS

Application whitelisting

Application blacklisting

15. Which of the following can be used to disallow a system/user from accessing all applications except a specific folder on a system?

Hash rule

Path rule

Internet zone rule

Certificate rule

16. John wants to implement a firewall service that works at the session layer of the OSI model. The firewall must also have the ability to hide the private network information.

Which type of firewall service is John thinking of implementing?

Application level gateway

Stateful Multilayer Inspection

Circuit level gateway

Packet Filtering

17. Choose the correct order of steps to analyze the attack surface.

Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface

Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface

Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface

Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface

18. A network is setup using an IP address range of 0.0.0.0 to 127.255.255.255. The network has a default subnet mask of 255.0.0.0.

What IP address class is the network range a part of?

Class C

Class A

Class B

Class D

19. Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.

What is the last step he should list?

Assign eradication.

Recovery

Containment

A follow-up.

20. James is a network administrator working at a student loan company in Minnesota. This company processes over 20,000 student loans a year from colleges all over the state. Most communication between the company schools, and lenders is carried out through emails. Much of the email communication used at his company contains sensitive information such as social security numbers. For this reason, James wants to utilize email encryption. Since a server-based PKI is not an option for him, he is looking for a low/no cost solution to encrypt emails.

What should James use?

James could use PGP as a free option for encrypting the company's emails.

James should utilize the free OTP software package.

James can use MD5 algorithm to encrypt all the emails

James can enforce mandatory HTTPS in the email clients to encrypt emails

Page 3 of 6

21. John is a network administrator and is monitoring his network traffic with the help of Wireshark. He suspects that someone from outside is making a TCP OS fingerprinting attempt on his organization's network.

Which of the following Wireshark filter(s) will he use to locate the TCP OS fingerprinting attempt?

Tcp.flags==0x2b

Tcp.flags=0x00

Tcp.options.mss_val<1460

Tcp.options.wscale_val==20

22. Daniel is monitoring network traffic with the help of a network monitoring tool to detect any abnormalities.

What type of network security approach is Daniel adopting?

Preventative

Reactive

Retrospective

Defense-in-depth

23. Which of the following attack surface increase when you keep USB ports enabled on your laptop unnecessarily?

Human attack surface

Network attack surface

Physical attack surface

Software attack surface

24. Harry has successfully completed the vulnerability scanning process and found serious vulnerabilities exist in the organization's network. Identify the vulnerability management phases through which he will proceed to ensure all the detected vulnerabilities are addressed and eradicated. (Select all that apply)

Mitigation

Assessment

Verification

Remediation

25. An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors 24 hours.

What is the best option to do this job?

Install a CCTV with cameras pointing to the entrance doors and the street

Use fences in the entrance doors

Use lights in all the entrance doors and along the company's perimeter

Use an IDS in the entrance doors and install some of them near the corners

26. John wants to implement a packet filtering firewall in his organization's network.

What TCP/IP layer does a packet filtering firewall work on?

Application layer

Network Interface layer

TCP layer

IP layer

27. You are responsible for network functions and logical security throughout the corporation. Your company has over 250 servers running Windows Server 2012, 5000 workstations running Windows 10, and 200 mobile users working from laptops on Windows 8. Last week 10 of your company's laptops were stolen from a salesman, while at a conference in Barcelona. These laptops contained proprietary company information. While doing a damage assessment, a news story leaks about a blog post containing information about the stolen laptops and the sensitive information.

What built-in Windows feature could you have implemented to protect the sensitive information on these laptops?

You should have used 3DE

You should have implemented the Distributed File System (DFS).

If you would have implemented Pretty Good Privacy (PGP).

You could have implemented the Encrypted File System (EFS)

28. If an organization has decided to consume PaaS Cloud service model, then identify the organization's responsibility that they need to look after based on shared responsibility model.

Data, interfaces, application, etc.

Data, interfaces, application, middleware, OS, VM, virtual network, etc.

Data, interfaces, application, middleware, OS, VM, virtual network, hypervisors, processing and memory, data storage, network interfaces, facilities and data centers, etc.

Data, interfaces, etc.

29. How is a “risk” represented?

Asset + threat

Motive (goal) + method

Asset + threat + vulnerability

Motive (goal) + method + vulnerability

30. Heather has been tasked with setting up and implementing VPN tunnels to remote offices. She will most likely be implementing IPsec VPN tunnels to connect the offices.

At what layer of the OSI model does an IPsec tunnel function on?

They work on the session layer.

They function on either the application or the physical layer.

They function on the data link layer

They work on the network layer

Page 4 of 6

31. A newly joined network administrator wants to assess the organization against possible risk. He notices the organization doesn't have a________identified which helps measure how risky an activity is.

Risk Severity

Risk Matrix

Key Risk Indicator

Risk levels

32. Consider a scenario consisting of a tree network. The root Node N is connected to two man nodes N1 and N2. N1 is connected to N11 and N12. N2 is connected to N21 and N22.

What will happen if any one of the main nodes fail?

Failure of the main node affects all other child nodes at the same level irrespective of the main node.

Does not cause any disturbance to the child nodes or its tranmission

Failure of the main node will affect all related child nodes connected to the main node

Affects the root node only

33. Frank installed Wireshark at all ingress points in the network. Looking at the logs he notices an odd packet source. The odd source has an address of 1080:0:FF:0:8:800:200C:4171 and is using port 21.

What does this source address signify?

This address means that the source is using an IPv6 address and is spoofed and signifies an IPv4 address of 127.0.0.1.

This source address is IPv6 and translates as 13.1.68.3

This source address signifies that the originator is using 802dot1x to try and penetrate into Frank's network

This means that the source is using IPv4

34. John wants to implement a firewall service that works at the session layer of the OSI model. The firewall must also have the ability to hide the private network information.

Which type of firewall service is John thinking of implementing?

Application level gateway

Circuit level gateway

Stateful Multilayer Inspection

Packet Filtering

35. How is an “attack” represented?

Motive (goal) + method

Motive (goal) + method + vulnerability

Asset + Threat + Vulnerability

Asset + Threat

36. A VPN Concentrator acts as a bidirectional tunnel endpoint among host machines.

What are the other f unction(s) of the device? (Select all that apply)

Provides access memory, achieving high efficiency

Assigns user addresses

Enables input/output (I/O) operations

Manages security keys

37. Kelly is taking backups of the organization's data. Currently, he is taking backups of only

those files which are created or modified after the last backup.

What type of backup is Kelly using?

Full backup

Incremental backup

Differential Backup

Normal Backup

38. 1.Which phase of vulnerability management deals with the actions taken for correcting the discovered vulnerability?

Mitigation

Assessment

Remediation

Verification

39. Stephanie is currently setting up email security so all company data is secured when passed through email. Stephanie first sets up encryption to make sure that a specific user's email is protected. Next, she needs to ensure that the incoming and the outgoing mail has not been modified or altered using digital signatures.

What is Stephanie working on?

Confidentiality

Availability

Data Integrity

Usability

40. Which of the following defines the extent to which an interruption affects normal business operations and the amount of revenue lost due to that interruption?

RPO

RFO

RSP

RTO

Page 5 of 6

41. Kyle is an IT technician managing 25 workstations and 4 servers. The servers run applications and mostly store confidential data. Kyle must backup the server's data daily to ensure nothing is lost. The power in the company's office is not always reliable, Kyle needs to make sure the servers do not go down or are without power for too long. Kyle decides to purchase an Uninterruptible Power Supply (UPS) that has a pair of inverters and converters to charge the battery and provides power when needed.

What type of UPS has Kyle purchased?

Kyle purchased a Ferro resonant Standby UP

Kyle purchased a Line-Interactive UPS

He has bought a Standby UPS

He purchased a True Online UP

42. Geon Solutions INC., had only 10 employees when it started. But as business grew, the organization had to increase the amount of staff. The network administrator is finding it difficult to accommodate an increasing number of employees in the existing network topology. So the organization is planning to implement a new topology where it will be easy to accommodate an increasing number of employees.

Which network topology will help the administrator solve the problem of needing to add new employees and expand?

Bus

Star

Ring

Mesh

43. Elden is working as a network administrator at an IT company. His organization opted for a virtualization technique in which the guest OS is aware of the virtual environment in which it is running and communicates with the host machines for requesting resources. Identify the virtualization technique implemented by Elden’s organization.

Hybrid virtualization

Hardware-assisted virtualization

Full virtualization

Para virtualization

44. Management asked Adam to implement a system allowing employees to use the same credentials to access multiple applications. Adam should implement the-------------------------- authentication technique to satisfy the management request.

Two-factor Authentication

Smart Card Authentication

Single-sign-on

Biometric

45. -----------is a group of broadband wireless communications standards for Metropolitan Area Networks (MANs)

802.15.4

802.15

802.12

802.16

46. John is working as a network defender at a well-reputed multinational company. He wanted to implement security that can help him identify any future attacks that can be targeted toward his organization and take appropriate security measures and actions beforehand to defend against them.

Which one of the following security defense techniques should be implement?

Reactive security approach

Retrospective security approach

Proactive security approach

Preventive security approach

47. Simran is a network administrator at a start-up called Revolution. To ensure that neither party in the company can deny getting email notifications or any other communication, she mandates authentication before a connection establishment or message transfer occurs.

What fundamental attribute of network defense is she enforcing?

Integrity

Non-repudiation

Confidentiality

Authentication

48. Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.

What is the last step he should list?

Containment

Assign eradication

A follow-up

Recovery

49. How is application whitelisting different from application blacklisting?

It allows all applications other than the undesirable applications

It allows execution of trusted applications in a unified environment

It allows execution of untrusted applications in an isolated environment

It rejects all applications other than the allowed applications

50. How can a WAF validate traffic before it reaches a web application?

It uses a role-based filtering technique

It uses an access-based filtering technique

It uses a sandboxing filtering technique

It uses a rule-based filtering technique

Page 6 of 6

51. The IR team and the network administrator have successfully handled a malware incident on the network. The team is now preparing countermeasure guideline to avoid a future occurrence of the malware incident.

Which of the following countermeasure(s) should be added to deal with future malware incidents? (Select all that apply)

Complying with the company's security policies

Implementing strong authentication schemes

Implementing a strong password policy

Install antivirus software

52. Which of the following indicators refers to potential risk exposures that attackers can use to breach the security of an organization?

Indicators of attack

Key risk indicators

Indicators of exposure

Indicators of compromise

Facebook Twitter LinkedIn Google + Email