312-38 ECCouncil Certified Network Defender (CND) Free Practice Exam Questions (2025 Updated)

 In Transport mode encryption of an IPsec server, only the payload of the data packet is encrypted. This mode is designed to encrypt the message within an IP packet, while the header remains unencrypted. Transport mode is used for end-to-end communication between a client and a server, where the server can interpret the headers to route the packet to the correct application or process.

References: The information is consistent with the IPsec standards and documentation, which specify that in Transport mode, the data within the original IP packet is protected, but not the IP header123. This ensures that the packet retains its original IP header, allowing it to be routed properly through the network.

The scenario described is a classic example of a ransomware attack. Ransomware is a type of malware that encrypts the victim’s data, rendering it inaccessible, and then demands payment for the decryption key. In this case, the attacker has encrypted the company’s billing information and client records and is asking for money to restore access, which is characteristic of ransomware attacks.

References: This definition aligns with the information provided by sources such as IBM, which describes ransomware as malware that holds a victim’s data or device hostage, threatening to keep it locked—or worse—unless a ransom is paid1. Additionally, the Wikipedia page on ransomware provides a comprehensive overview of this type of malware, including its operation and the typical demand for a ransom in exchange for decryption2.

 In the context of Business Continuity/Disaster Recovery (BC/DR), the activity that includes actions taken toward resuming all services that are dependent on business-critical applications is referred to as Resumption. This phase focuses on the steps necessary to bring critical functions back into operation after a disruption. Recovery, on the other hand, is more about the actions taken to return the business to normal operating conditions post-disaster, which may include repairs, restorations, and return to normalcy. Response is the immediate reaction to an incident, and Restoration is the process of rebuilding or restoring IT systems and operations. References: The information aligns with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program, which emphasizes understanding and implementing proper BC/DR activities.

When deciding on the appropriate backup medium, the network administrator will consider Reliability as the primary factor. This is because the backup medium must be dependable for restoring data in case of data loss or system failure. The reliability of a backup medium ensures that data can be recovered accurately and completely when needed.

References: The importance of reliability in choosing a backup medium is supported by best practices in data backup and recovery, which emphasize the need for a dependable backup solution to ensure data integrity and availability1234.

Indicators of attack (IoA) provide information about the attacker's intent, end goals, and the actions they take to execute an attack. IoAs help identify the methods and behaviors an attacker uses during the attack lifecycle. Unlike Indicators of Compromise (IoCs), which are used to detect evidence of a breach, IoAs are proactive and help in identifying and preventing potential attacks before they occur by analyzing the patterns and tactics used by attackers.

Key risk indicators: Metrics used to signal increased risk exposure.

Indicators of compromise: Artifacts observed on a network or in an operating system that with high confidence indicate a computer intrusion.

Indicators of exposure: Data points or signals that reveal vulnerabilities or weaknesses that could be exploited.

References:

EC-Council Certified Network Defender (CND) Study Guide

Cybersecurity frameworks and documentation on threat detection

 In the context of containerization, setting resource limits is crucial for ensuring that applications do not consume more than their fair share of system resources. Michelle can limit a container to use only 2 CPUs by using the --cpus flag when running a container. This flag allows the user to specify the amount of CPU the container is limited to use. For example, --cpus="2" would restrict the container to using no more than two CPU cores.

References: This information is based on standard practices for managing Docker containers and their resources. The --cpus flag is a well-documented feature in Docker’s command-line interface for controlling CPU usage1.

A threat refers to a potential occurrence of an undesired event that can damage and interrupt the operational and functional activities of an organization. It represents a possible danger that could exploit vulnerabilities to harm the organization’s assets.

Attack: An attempt to exploit a vulnerability to cause harm.

Risk: The potential for loss or damage when a threat exploits a vulnerability.

Vulnerability: A weakness that can be exploited by a threat to cause harm.

In this context, a threat is the potential occurrence of an event that can cause damage, whereas an attack is the actual occurrence, risk is the measure of the likelihood and impact of the threat, and a vulnerability is the weakness that the threat could exploit.

References:

EC-Council Certified Network Defender (CND) Study Guide

Information Security Risk Management documentation

The false positive rate is a measure used to evaluate the performance of an IDS (Intrusion Detection System). It is calculated by dividing the number of false positives (FP) by the sum of false positives and true negatives (TN). The formula is:

False Positive Rate=FP+TNFP​

This formula helps in determining how often the IDS incorrectly classifies an event as a threat, which is actually benign. A lower false positive rate indicates a more accurate IDS.

References: This formula and its application are consistent with standard practices in network security and align with the Certified Network Defender (CND) course material. For further details, please refer to the official CND study guide and documents.

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is the correct answer. The GLBA mandates that financial institutions – which can include international financial institutions operating in the United States – protect the privacy of consumers’ personal financial information. The act requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Failure to comply with the GLBA can result in prosecution and significant penalties.

References: The information provided is based on my training data which includes knowledge of the GLBA and its implications for financial institutions regarding the privacy and protection of customer information. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.

Key Risk Indicators (KRIs) are crucial metrics used in risk management to measure the likelihood of potential risks and their impact on an organization. They are designed to provide an early warning signal to notify management when a risk has reached a level that may exceed the organization’s risk appetite and could have a profoundly negative impact on its ability to succeed. KRIs are not typically used to identify adverse events, which is more the role of Key Performance Indicators (KPIs), nor are they used to facilitate backward or post-incident management directly. Instead, KRIs are forward-looking indicators that help in predicting and preventing risks before they materialize into significant threats.

References: The explanation provided is based on industry-standard practices for Key Risk Indicators as outlined in resources such as TechTarget and SafetyCulture, which align with the objectives and documents of the Certified Network Defender (CND) program12.

WPA3 is the latest wireless encryption standard that provides enhanced password protection, secured IoT connections, and encompasses stronger encryption techniques. It is designed to replace WPA2 and offers improved security features. WPA3 provides robust protections even when users choose weak passwords, and simplifies the process of securing access to Wi-Fi networks. It also offers individualized data encryption to protect data on public networks and a more secure handshake process that prevents offline dictionary attacks. For IoT devices, WPA3 supports Easy Connect, which simplifies the process of connecting devices without a display.

References: The information provided is based on the evolution of wireless security protocols and their features as outlined in various authoritative sources on network security12. For the most accurate and detailed reference, it is recommended to consult the official documents and study guides from the Certified Network Defender (CND) course by the EC-Council.

A Network Protocol Analyzer, such as Wireshark, is a tool that captures and analyzes packets in real-time, displaying them in a human-readable format. It allows network administrators to inspect individual packets deeply, which is essential for identifying and investigating data leaks within an organization. By examining the packet contents, the source and destination of the traffic, and other details, a Network Protocol Analyzer can help pinpoint the exact nature and origin of a data leak.

References: The use of Network Protocol Analyzers for investigating data leaks is a standard practice in network security, aligning with the objectives of the EC-Council’s Certified Network Defender (CND) program. The capabilities of these tools are detailed in resources like the Wireshark user guide and network security best practices123.

The Apache web server typically stores its log files in the /var/log/httpd/ directory on Unix-based systems. This directory contains various log files, including access_log and error_log, which record all requests processed by the server and any errors encountered, respectively. The location of these logs can be configured in the Apache configuration files, but /var/log/httpd/ is the default directory used by many Linux distributions.

References: The information is consistent with the official Apache documentation and common Unix/Linux filesystem practices as described in the Apache HTTP Server documentation1, and corroborated by multiple sources including Stack Overflow discussions2 and other educational resources345.

The netstat command is used to display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. To list all ports available on a server, including both TCP and UDP, along with the listening state and associated program names, the -tunlp options are used:

-t shows TCP ports.

-u shows UDP ports.

-n displays addresses and port numbers in numerical form.

-l shows only listening sockets.

-p shows the PID and name of the program to which each socket belongs.

Therefore, the command sudo netstat -tunlp effectively lists all ports available on a server with detailed information.

References:

EC-Council Certified Network Defender (CND) Study Guide

Linux netstat command documentation

 A circuit level gateway operates at the session layer of the OSI model, which is responsible for establishing, maintaining, and terminating connections between network nodes. It is designed to provide security by verifying the Transmission Control Protocol (TCP) handshaking between packets to ensure that the session is legitimate and by monitoring the state of the connection. Unlike application-level gateways, circuit level gateways do not inspect the packet’s contents but rather the header information to ensure that the traffic conforms to the established rules. This type of firewall is particularly effective at hiding the private network information because it only allows traffic from established sessions and does not expose the details of the network’s internal structure.

References: The information about the operation of circuit level gateways at the session layer and their ability to hide private network information is supported by the definitions and explanations provided in the sources from the web search results123. These sources align with the objectives and documents of the EC-Council’s Certified Network Defender (CND) program.

The RAID level that splits data into blocks and evenly writes the data to multiple hard drives without providing data redundancy is known as RAID 0. This RAID level is also referred to as striping. It requires a minimum of two drives to set up. RAID 0 enhances performance by allowing simultaneous read and write operations across the drives, but it does not offer any fault tolerance. If one drive fails, all data in the array is lost because there is no redundancy.

References: RAID 0 is defined by its ability to increase performance by striping data across at least two drives. This information is consistent with the standards and descriptions provided in the EC-Council’s Certified Network Defender (C|ND) course materials and other authoritative sources on RAID configurations123.

 Class K fires involve cooking oils and fats, which are highly combustible and can ignite quickly at high temperatures. To suppress a Class K fire, a specific type of extinguishing agent is required that can separate and absorb the heat elements of the fire – the fuel, oxygen, and heat necessary to start a fire. Foam extinguishers are most suitable for Class K fires because they use a substance that turns oils into foam, effectively smothering the fire and preventing re-ignition. Water should not be used on Class K fires as it can cause the oil to splatter and spread the fire. Carbon dioxide and dry chemical extinguishers are also not recommended for Class K fires as they do not adequately remove the heat from the fire.

References: The information provided is based on standard fire safety guidelines and classifications for fire types, particularly for Class K fires involving cooking media such as oils and fats12.

Statistical anomaly detection is an intrusion detection technique that models the normal behavior of a network’s traffic and identifies deviations from this norm. It uses statistical metrics such as median, mean, mode, and standard deviation to establish a baseline of regular activities. When network traffic deviates from these established performance parameters, the system flags these events as potential intrusions. This method is effective in observing the network for abnormal usage patterns that could indicate a security breach.

References: The explanation is based on the principles of statistical anomaly detection as described in various Network Defender (CND) documents and study guides. Specifically, it aligns with the descriptions found in resources like the Saylor Academy’s module on Intrusion Detection Systems1, which details how a statistics-based IDS builds a distribution model for normal behavior and flags low probability events as potential intrusions.

Phishing attempts that target users with fake usage bills from a cloud provider are examples of a cloud to user attack surface. This type of attack surface refers to the potential vulnerabilities and entry points that exist between the cloud service provider and the user. In this scenario, the attacker is exploiting the trust relationship between the user and the cloud service provider by presenting a fraudulent bill, hoping the user will reveal sensitive information or make a payment based on the fake bill.

References: The explanation is consistent with the Certified Network Defender (CND) curriculum, which includes understanding various attack surfaces, including cloud and user-related surfaces, and how they can be exploited through phishing and other social engineering attacks12.