Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 13

Question 120

A video-security team is retiring unsupported IP cameras, but the removed devices retain valid client certificates trusted by the video broker. Which offboarding action directly prevents a retired camera identity from reconnecting?

  1. Delete the old camera hostname from the local DNS cache
  2. Revoke each retired identity and remove its certificate or device record from broker authorization
  3. Change the recording retention schedule without touching device identities
  4. Restore factory firmware and continue authorizing the same client certificates

Explanation

Correct Answer

B:

Revoking credentials and deleting enrollment or broker trust entries prevents decommissioned cameras from authenticating as active devices if their former keys are reused.

Incorrect Answers

A:

Removing a cached name does not revoke the device identity or prevent a holder of the certificate from opening a direct connection to the broker.

C:

Retention rules govern how long video is held, not whether an old device certificate remains a valid credential for the streaming service.

D:

A factory reset may erase local settings, but leaving the original trusted identity active means a recovered credential could still authenticate to the broker.

Question 121

An enterprise application allowlist relies on exact file hashes, but a trusted vendor publishes signed weekly patches. Each patch requires manually updating the allowlist. Which policy change best preserves control while reducing maintenance?

  1. Create narrowly scoped publisher or certificate-based rules for the approved product
  2. Allow any binary placed in the user-writable download directory
  3. Exempt the updater and all processes it creates from recording or controls
  4. Disable allowlisting on every endpoint using the product

Explanation

Correct Answer

A:

Verified signer and product rules can accept legitimate signed updates despite file-hash changes, while retaining explicit execution boundaries.

Incorrect Answers

B:

Directory-based trust in a writable location lets an adversary place arbitrary executables in the approved path and bypass intent.

C:

Blanket exemptions leave a broad unmonitored execution chain, unlike a scoped publisher rule with signature validation.

D:

Disabling enforcement resolves compatibility by permitting other unapproved executables, increasing exposure across the endpoint fleet.

Question 122

Analysts must open suspicious PDFs for triage while limiting potential code execution from malicious document exploits. Which control provides the strongest isolation of the document viewer?

  1. Disable audit collection before opening the file
  2. Run the viewer in a constrained sandbox with minimal host access
  3. Scan document attachments only after opening them in the production reader
  4. Store the document in a shared folder accessible by all users
  5. Execute the PDF reader with full administrator rights

Explanation

Correct Answer

B:

Sandboxing reduces the privileges, filesystem paths, and interfaces reachable from exploited document-handling code.

Incorrect Answers

A:

Suppressing logs removes evidence without reducing the viewer's ability to affect the host if exploited.

C:

Delayed scanning may discover malicious content but does not contain code execution if a viewer exploit triggers during opening.

D:

A shared storage location does not confine document execution and may expose the suspicious file to additional users.

E:

Elevated privileges increase the damage an exploited reader can cause and contradict the need for containment.

Question 123

A production web server uses a library with a disclosed critical vulnerability. Which patch-management step should come before deployment across every application instance?

  1. Keep the vulnerable version indefinitely because a WAF exists
  2. Identify affected versions and test the vendor fix with a rollback plan
  3. Disable dependency monitoring to reduce alerts
  4. Change the application name displayed in the browser

Explanation

Correct Answer

B:

Dependency inventory and representative tests reduce the chance of breaking functionality while enabling timely remediation of exposed code.

Incorrect Answers

A:

A WAF may offer limited virtual patching but cannot substitute for fixing the affected code when a safe update is available.

C:

Hiding notifications makes future disclosures harder to correlate with installed versions and does not eliminate the vulnerability.

D:

Branding has no effect on whether the vulnerable library is installed or reachable by attackers.

Question 124

Malicious requests contain a common SQL injection pattern and reach a web application before a code fix can be deployed. Which edge measure is a reasonable temporary defense?

  1. Increasing the database's maximum connection count
  2. A Layer 2 port-security MAC limit on user laptops
  3. A tuned web application firewall rule for the observed attack pattern
  4. A static route pointing to the same web server

Explanation

Correct Answer

C:

A WAF can inspect HTTP requests and reject matching exploit attempts as a compensating measure while the root cause is repaired.

Incorrect Answers

A:

More connections may delay resource exhaustion but do not prevent malicious query construction in the application.

B:

MAC limits do not parse HTTP input or identify SQL injection payloads sent to a public application.

D:

Routing affects destination reachability and cannot distinguish an exploit from a legitimate HTTP transaction.

Question 125

A web page inserts untrusted customer comments into HTML without context-aware encoding. What is the most direct protection against stored cross-site scripting?

  1. Use a longer session expiration alone
  2. Encode output for its HTML or script context and sanitize permitted markup
  3. Tight database permissions without fixing unsafe query construction
  4. Disable database backups for comment tables

Explanation

Correct Answer

B:

Treating comments as data prevents attacker-supplied characters from becoming executable browser code in other users' sessions.

Incorrect Answers

A:

Session duration can limit some fallout but cannot prevent injected JavaScript from running when rendered.

C:

Least-privilege database accounts can limit damage, but they do not stop exploitable SQL syntax from reaching an unsafe query builder.

D:

Backup policy neither neutralizes script syntax nor protects viewers of malicious comments.

Question 126

An authenticated user's browser is tricked into submitting a money-transfer form from a different website. Which application control directly resists this class of attack?

  1. Increase TCP keepalive frequency
  2. Set all form inputs to hidden fields
  3. Accept any POST request with the user's cookie
  4. Validate an unpredictable anti-CSRF token bound to the user's session

Explanation

Correct Answer

D:

A valid token distinguishes intentional application form submissions from cross-site requests that lack authorized request context.

Incorrect Answers

A:

Transport liveness settings do not identify whether the browser initiated a state-changing action from a trusted origin.

B:

Hidden fields remain part of client requests and can be forged unless integrity and authorization are independently validated.

C:

Browsers may attach cookies automatically, so authentication cookies alone do not prove the user intended a cross-site request.

Question 127

An image-fetch API accepts arbitrary URLs and can access the cloud instance metadata endpoint. What should developers restrict first?

  1. The database column display width
  2. Public access to the API documentation alone
  3. Server-side fetch destinations using strict allowlists and network isolation
  4. Only the browser's address-bar autocomplete

Explanation

Correct Answer

C:

Controlling where the application can connect limits server-side request forgery from reaching internal or metadata services.

Incorrect Answers

A:

Field display width does not determine which network addresses the backend HTTP client may request.

B:

Hiding documentation might reduce discoverability but does not remove the underlying untrusted URL-fetch capability.

D:

The vulnerable request originates on the backend, so changing the user's autocomplete cannot constrain server-side connections.

Question 128

A download endpoint accepts a filename parameter and permits sequences such as ../ to reach files outside the document directory. Which coding measure is essential?

  1. Accept every filename if the extension looks familiar
  2. Turn off HTTPS to simplify debugging
  3. Reject ../ text without validating URL decoding and path normalization
  4. Canonicalize paths and enforce an allowed root directory before opening
  5. Increase the maximum file descriptor count

Explanation

Correct Answer

D:

Resolving a path and checking its containment prevents traversal components from escaping the intended document store.

Incorrect Answers

A:

File extensions do not prevent directory traversal into arbitrary filesystem locations or sensitive configuration files.

B:

Removing TLS increases interception risk and cannot fix filesystem path handling on the server.

C:

A literal substring check is bypassable through alternate encodings or path forms; containment must be verified on the resolved target.

E:

More descriptors affect capacity, not authorization or normalization of file paths derived from input.

Question 129

A customer portal accepts document uploads that later become publicly retrievable. Which upload defense best limits active-content execution?

  1. Trust only the client-supplied filename extension
  2. Give uploaded files execute permissions for convenience
  3. Disable malware scanning after a successful upload
  4. Validate file type, store outside executable paths, and serve as inert downloads

Explanation

Correct Answer

D:

Content inspection and nonexecuting storage reduce abuse through disguised scripts, active documents, and unsafe server execution.

Incorrect Answers

A:

An attacker controls the extension and can present executable content under a benign-looking file name.

B:

Executable storage makes server-side compromise more plausible when upload validation or routing fails.

C:

Skipping inspection removes one detection layer without changing the possibility of malicious uploaded content.

Question 130

A mobile application calls a customer API and should read only records belonging to the signed-in customer. Which server-side check is essential?

  1. Enforce object-level authorization on every requested resource
  2. Hide account IDs in the client interface
  3. Permit all numeric identifiers because they are well-formed
  4. Rely only on a successful user login

Explanation

Correct Answer

A:

The backend must compare the authenticated principal with each object's allowed owners or permissions to stop insecure direct object references.

Incorrect Answers

B:

Obscurity of identifiers is not authorization; API clients can construct requests even when the UI conceals values.

C:

Valid syntax says nothing about whether the caller may view or alter that particular record.

D:

Authentication identifies the caller but does not automatically grant access to another customer's object.

Certified Network Defender (312-38) Practice Tests