312-38 — EC-Council Certified Network Defender (CND)
EC-Council

EC-Council Certified Network Defender (CND) (312-38) Practice Questions

★★★★★★ 4.8 63 verified reviews
163 questions
✓ Online quiz simulator
▶ Start Free Practice Exam

Sample Questions (17 of 163 shown)

Q1
Peter, a malicious hacker, obtains e-mail addresses by collecting them from messages, blogs, DNS lists, and Web pages. Then he sends a large number of unsolicited commercial e-mail (UCE) messages to these addresses. What e-mail crime is Peter committing?
  1. E-Mail storm
  2. E-Mail bombing
  3. Spam
  4. E-Mail scam
  5. None
✓ Correct Answer: C
Spam is the sending of unsolicited commercial e-mail (UCE) in bulk. E-mail bombing refers to flooding a single address with massive volumes of mail to overwhelm it; an e-mail storm is an automated loop of replies; an e-mail scam is a fraudulent message seeking to deceive the recipient (e.g., phishing). Peter's behavior—harvesting addresses and sending bulk UCE—is the textbook definition of spam.
Q2
Which of the following conditions CANNOT cause a router to enter ROM monitor mode? (Choose all that apply.)
  1. The router does not find a valid operating system image.
  2. The router does not have the configuration file.
  3. The user interrupts the boot sequence.
  4. It is necessary to set the operating parameters.
✓ Correct Answer: B, D
A router enters ROM monitor (ROMmon) mode when it cannot locate a valid IOS image (A) or when the user interrupts the boot sequence (C). The conditions that do NOT lead to ROMmon are: (B) a missing configuration file causes the router to enter Setup mode (not ROMmon), and (D) setting operating parameters is done from privileged EXEC mode. (Note: several public dumps invert this and list A, C as the answer; A and C are precisely the triggers for ROMmon, so B, D is the technically correct choice.)
Q3
Sam wants to implement a network-based IDS. He finds that the IDS solution he is considering works based on pattern matching. Which type of network-based IDS is Sam implementing?
  1. Behavior-based IDS
  2. Anomaly-based IDS
  3. Stateful protocol analysis
  4. Signature-based IDS
✓ Correct Answer: D
Signature-based (or knowledge-based) IDS detects attacks by matching observed traffic/events against a database of known attack patterns (signatures). Because it relies on pattern matching, it is highly accurate for known threats but cannot detect novel attacks. Behavior/anomaly-based IDS and stateful protocol analysis build a baseline of normal activity instead.
Q4
A network designer must propose a topology for a web portal server that needs to be isolated from the internal network and placed in a DMZ. The designer proposes a firewall with three interfaces: one for the Internet, one for the DMZ server farm, and one for the internal network. What kind of firewall topology is this?
  1. Screened subnet
  2. Multi-homed firewall
  3. Bastion host
  4. DMZ, External-Internal firewall
✓ Correct Answer: B
A multi-homed firewall (also called a triple-homed firewall) has at least three network interfaces—typically one each for the Internet, the DMZ, and the internal/private network—providing separated security zones. A screened subnet usually implies two firewalls with a DMZ between them. A bastion host is a hardened single host exposed to the Internet.
Q5
Which of the following protocols is used for exchanging routing information between two gateways in a network of autonomous systems?
  1. IGMP
  2. ICMP
  3. EGP
  4. OSPF
✓ Correct Answer: C
EGP (Exterior Gateway Protocol) is used to exchange routing information between neighboring gateways in separate autonomous systems. OSPF and ICMP are interior/maintenance protocols; IGMP is for IP multicast group management.
Q6
Which of the following wireless networks provides connectivity over a distance up to 20 feet (about 6–10 meters)?
  1. WMAN
  2. WPAN
  3. WLAN
  4. WWAN
✓ Correct Answer: B
A WPAN (Wireless Personal Area Network, e.g., Bluetooth, Zigbee) typically covers short ranges up to about 10 meters (roughly 20–30 feet). WLAN covers building-scale ranges, WMAN covers metropolitan areas, and WWAN covers wide/cellular areas.
Q7
A network administrator is monitoring network traffic with Wireshark. Which of the following filters will she use to view packets that have no TCP flag set, in order to detect TCP Null Scan attempts?
  1. tcp.flags==0x000
  2. tcp.flags==0x029
  3. tcp.dstport==7
  4. tcp.flags==0x003
✓ Correct Answer: A
A TCP Null scan sends packets with no flags set (all flag bits = 0). The Wireshark display filter tcp.flags==0x000 isolates packets where none of the TCP control flags are set, which is the signature of a Null scan. (0x029 and 0x003 correspond to other flag combinations; tcp.dstport==7 is unrelated.)
Q8
Which of the following is a communication protocol that multicasts messages and information among all member devices in an IP multicast group?
  1. ICMP
  2. IGMP
  3. BGP
  4. EGP
✓ Correct Answer: B
IGMP (Internet Group Management Protocol) is used by hosts and adjacent routers to establish membership in IP multicast groups. ICMP is for diagnostics, BGP and EGP are routing protocols.
Q9
Which of the following refers to a potential occurrence of an undesired event that can eventually damage and interrupt the operational and functional activities of an organization?
  1. Attack
  2. Risk
  3. Threat
  4. Vulnerability
✓ Correct Answer: C
A threat is any circumstance or event with the potential to cause harm to an asset (e.g., a natural hazard, a malicious actor, or a system weakness being exploited). An attack is the actual exploitation attempt; risk is the likelihood/impact of a threat exploiting a vulnerability; vulnerability is the weakness itself.
Q10
Management decides to implement a risk management system to reduce and maintain the organization's risk at an acceptable level. Which of the following is the correct order of the risk management phase?
  1. Risk Identification, Risk Assessment, Risk Treatment, Risk Monitoring & Review
  2. Risk Treatment, Risk Monitoring & Review, Risk Identification, Risk Assessment
  3. Risk Assessment, Risk Treatment, Risk Monitoring & Review, Risk Identification
  4. Risk Identification, Risk Assessment, Risk Monitoring & Review, Risk Treatment
✓ Correct Answer: A
The standard risk management lifecycle is: (1) Risk Identification—discover assets, threats, and vulnerabilities; (2) Risk Assessment—analyze likelihood and impact; (3) Risk Treatment—select controls (avoid, mitigate, transfer, accept); (4) Risk Monitoring & Review—continuously track and re-evaluate. This ordering is consistent across ISO 31000 and the EC-Council CND curriculum.
Q11
If a network is at risk from unskilled individuals, what type of threat is this?
  1. External Threats
  2. Structured Threats
  3. Unstructured Threats
  4. Internal Threats
✓ Correct Answer: C
Unstructured threats come from unskilled or amateur attackers using widely available, unsophisticated tools or methods (e.g., script kiddies, accidental misconfiguration). Structured threats originate from highly skilled, well-funded, organized attackers.
Q12
What represents an organization's ability to respond under an emergency in order to minimize damage to its brand name, business operation, and profit?
  1. Disaster recovery
  2. Incident management
  3. Emergency management
  4. Crisis management
✓ Correct Answer: D
Crisis management is the process of responding to an event that threatens to harm the organization's reputation, operations, or profitability, focusing on communication and minimizing broader business impact. Disaster recovery is the IT-focused restoration of systems; incident management is the broader handling of security incidents; emergency management is the public-safety preparedness discipline.
Q13
Which of the following represents an "attack"?
  1. Motive (goal) + method
  2. Motive (goal) + method + vulnerability
  3. Asset + Threat + Vulnerability
  4. Asset + Threat
✓ Correct Answer: B
In network defense, an attack is modeled as the combination of the attacker's motive/goal, the method or technique used, and the vulnerability that is exploited. Without a vulnerability to exploit, the method cannot succeed; without motive and method, there is no directed attack.
Q14
The network administrator wants to strengthen physical security by stopping people from entering restricted zones without proper credentials. Which physical security measure should be used?
  1. Bollards
  2. Fence
  3. Video surveillance
  4. Mantrap
✓ Correct Answer: D
A mantrap is a small space with two interlocking doors that admits only one person at a time after authentication, preventing tailgating/piggybacking into a restricted area. Fences and bollards are perimeter deterrents; video surveillance is detective, not preventive of entry.
Q15
Which type of computer security deals with protection against spurious signals emitted by electrical equipment in the system?
  1. Communication Security
  2. Physical security
  3. Emanation Security
  4. Hardware security
✓ Correct Answer: C
Emanation security protects against compromising emanations—unintended signals (electromagnetic, acoustic, or visible) leaked by equipment such as displays or printers. Tempest is the classic program/standard associated with emanation security.
Q16
Physical access controls help organizations monitor, record, and control access to information assets and facilities. Which category of physical security controls includes security labels and warning signs?
  1. Administrative control
  2. Physical control
  3. Technical control
  4. Environmental control
✓ Correct Answer: B
Security labels and warning signs are themselves physical deterrent/control objects placed in the environment, so they fall under physical controls. Administrative controls are policies/procedures; technical controls are electronic/software mechanisms; environmental controls address fire, HVAC, etc.
Q17
If there is a fire incident caused by an electrical appliance short-circuit, which fire suppressant should be used to control it?
  1. Water
  2. Wet chemical
  3. Dry chemical
  4. Raw chemical
✓ Correct Answer: C
A short-circuit electrical fire is a Class C (energized electrical) fire. Dry chemical extinguishers are appropriate for electrical fires because they do not conduct electricity. Water and wet chemical agents conduct electricity and are dangerous on live equipment.

You've viewed 3 of 163 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The EC-Council Certified Network Defender (312-38), commonly called CND, is a vendor-neutral credential that validates a defensive, blue-team skill set for protecting enterprise networks. Offered by EC-Council and delivered through Pearson VUE or an EC-Council exam center, the 312-38 assessment is built around the operational security lifecycle rather than any single product vendor.

CND targets network administrators, security analysts, and IT professionals who are responsible for the day-to-day defense of an organization's infrastructure. EC-Council recommends roughly two years of IT experience and emphasizes hands-on labs — more than half of the course is practical — so candidates should be comfortable securing endpoints, reviewing traffic and logs, and responding to incidents before they register.

The exam blueprint spans the full network-defense surface: network attacks and defense strategies, perimeter and technical security controls, endpoint protection across Windows, Linux, mobile, and IoT, plus application and data security. It also covers enterprise virtual, cloud, and wireless network security, network traffic and log monitoring and analysis, incident response and forensics, business continuity and disaster recovery, and risk management with attack-surface and threat-intelligence analysis.

Our 312-38 practice materials mirror the real exam's domain mix — from network perimeter defense and firewall/IDS/IPS configuration through endpoint security on Windows and Linux to incident response and business continuity planning. Every online practice question ships with a detailed answer explanation that walks through the reasoning and references CND objectives, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Official Exam Domains & Weighting

EC-Council does not publish per-domain weightings for the 312-38 exam; the blueprint is organized as a set of knowledge areas that together define the network defender's scope. To pass the 312-38 exam, candidates must master the following core areas:
  • Network Attacks and Defense Strategies
Covers the attack lifecycle, common network attacks (DoS, MITM, replay, sniffing), and the proactive, preventive, detective, and retrospective defense approaches used to counter them.
  • Administrative & Technical Network Security
Focuses on security policies, risk-management alignment, and the technical controls — access control models (MAC/Bell-LaPadula), hardening, and configuration baselines — that protect the network.
  • Network Perimeter Security
Tests firewall topologies (screened subnet, multi-homed), packet filtering, circuit-level and application-level gateways, and VPN technologies used to isolate and protect the DMZ and edge.
  • Endpoint Security — Windows, Linux, Mobile, IoT
Spans host hardening across operating systems: Windows policies/registry/AppLocker, Linux PAM and login.defs, mobile device controls, and IoT botnet and DDoS exposure.
  • Application & Data Security
Covers secure coding awareness, data classification, and the three states of data — data in use, at rest, and in transit — plus encryption and PKI fundamentals.
  • Enterprise Virtual, Cloud & Wireless Network Security
Addresses virtualization and cloud shared-responsibility models, cloud assessment tooling (e.g., MicroBurst for Azure), and wireless standards (WPA3, OFDM, 802.11/802.16) with their attacks and defenses.
  • Network Traffic Monitoring and Analysis
Validates protocol-analysis skills with Wireshark filters (e.g., TCP Null/Xmas/SYN-FIN scans), baselining normal traffic (SYN/FIN), and distinguishing active from passive attacks.
  • Network Logs Monitoring and Analysis
Covers log sources across Windows, Linux, and macOS, SIEM-style correlation, and retrospective review of historical logs to reconstruct past intrusions.
  • Incident Response and Forensics Investigation
Tests the incident-response phases, NIST/EC-Council severity classification (e.g., scans/probes = low), first-responder steps, and basic forensics and evidence handling.
  • Business Continuity and Disaster Recovery
Addresses risk treatment, backup strategies (full/differential/incremental, RAID levels), and the recovery/resumption/restoration distinctions after an outage.
  • Risk Anticipation with Risk Management
Covers the risk-management lifecycle (identify → assess → treat → monitor), ISO/IEC 27005, and the NIST Risk Management Framework integrated into the SDLC.
  • Threat Assessment & Threat Prediction
Focuses on attack-surface analysis, indicators of compromise (IoC) versus indicators of attack (IoA), and cyber-threat intelligence for anticipating adversary behavior.

What Our Customers Say 63 verified reviews

4.8 ★★★★★★ Based on 63 reviews
★★★★★★
I studied for 312-38 with this bank and passed comfortably. The questions are well-organized and the UI is clean.
— Lauren C.
★★★★★★
I was really impressed by the quality of the 312-38 questions. No typos, no vague wording — they clearly know the material.
— Stella P.
★★★★★★
Passed the 312-38 certification exam after studying this material for three weekends. Very efficient way to prepare.
— Xavier H.
★★★★★
Passed 312-38 with 94%. If you’re serious about this certification, get this question bank and thank me later.
— Hunter P.
★★★★★★
I was preparing for the 312-38 exam while juggling a newborn at home. The flexibility of this platform was a lifesaver.
— Cooper D.
★★★★★★
The domain-based breakdown in the 312-38 questions really helped me identify which areas needed more work.
— Elena R.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The 312-38 exam validates defensive network skills across the full security lifecycle — network attacks and defense strategies, perimeter and endpoint security (Windows, Linux, mobile, IoT), firewall and IDS/IPS configuration, traffic and log monitoring, incident response and forensics, business continuity, and risk management. It is vendor-neutral, so it tests concepts rather than a single vendor's product. Our 312-38 practice questions are mapped to these same knowledge areas so you study exactly what the blueprint targets.

The official EC-Council 312-38 exam contains 100 questions and lasts 240 minutes (4 hours). Question formats include single-choice, multiple-choice (select-all-that-apply), true/false, drag-and-drop, and scenario-based items. Practicing under a timed 312-38 mock exam helps build the stamina needed for a four-hour sitting.

EC-Council lists the 312-38 passing score at 70% for most exam forms, though the council applies a cut-score range that can vary by form. Treat 70% as your target and aim to score consistently higher on practice runs — our answer explanations point out the reasoning behind each choice so you understand the objective, not just the letter.

CND is aimed at network administrators, security analysts, and IT professionals defending enterprise infrastructure. EC-Council recommends about two years of IT experience and stresses hands-on labs — over half the course is practical. Candidates should be comfortable securing endpoints, reading traffic/logs, and responding to incidents. Pair the official courseware with our 312-38 practice questions and answers to confirm readiness before scheduling.

Yes. Our online 312-38 mock exam simulates the four-hour, 100-question environment with a running timer and mixed question formats (single-choice, multiple-choice, drag-and-drop, scenario-based). Use it to find weak domains — such as firewall/IDS-IPS or incident response — and to practice pacing so the real exam feels familiar on test day.

Absolutely. The full question bank is available as a downloadable PDF, so you can review 312-38 practice questions and answers on a phone, tablet, or printed copy during commutes or anywhere without stable internet. The PDF mirrors the online set exactly, including the detailed answer explanations for every item.

Beyond standard multiple-choice, the real 312-38 exam uses scenario-based items and drag-and-drop ordering (for example, sequencing incident-response steps or attack-surface analysis). Our practice set includes scenario-style questions that require applied judgment — not memorization — and walk-through explanations that teach the underlying CND objective, so you can reason through unfamiliar wording on exam day.