Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 14

Question 130

A mobile application calls a customer API and should read only records belonging to the signed-in customer. Which server-side check is essential?

  1. Enforce object-level authorization on every requested resource
  2. Hide account IDs in the client interface
  3. Permit all numeric identifiers because they are well-formed
  4. Rely only on a successful user login

Explanation

Correct Answer

A:

The backend must compare the authenticated principal with each object's allowed owners or permissions to stop insecure direct object references.

Incorrect Answers

B:

Obscurity of identifiers is not authorization; API clients can construct requests even when the UI conceals values.

C:

Valid syntax says nothing about whether the caller may view or alter that particular record.

D:

Authentication identifies the caller but does not automatically grant access to another customer's object.

Question 131

A site wants an additional browser-side restriction on which script origins can run, complementing normal output encoding. What should be configured?

  1. A longer HTTP server name header
  2. A wider wildcard CORS policy
  3. A broad allow rule for all inline scripts
  4. A restrictive Content Security Policy

Explanation

Correct Answer

D:

CSP can limit permitted script sources and some injection effects, but it supplements rather than replaces correct application encoding.

Incorrect Answers

A:

Advertising more server detail does not constrain browser script execution and can aid fingerprinting.

B:

Permissive cross-origin resource sharing can expand access and does not provide equivalent script source restrictions.

C:

Unrestricted inline execution may undermine intended CSP protections against injected script content.

Question 132

Developers need to identify unsafe data flow from untrusted input to SQL construction before the application runs. Which assessment method fits?

  1. A routine DNS zone transfer
  2. Static application security testing (SAST)
  3. A switch port bandwidth test
  4. Dynamic application security testing only

Explanation

Correct Answer

B:

Source or intermediate-code analysis can identify risky input paths and insecure constructs without requiring an executing deployment.

Incorrect Answers

A:

DNS data inspection is unrelated to taint analysis or vulnerable database query assembly within application code.

C:

Throughput testing measures network performance, not whether application source constructs unsafe SQL statements.

D:

DAST probes running behavior and can find exploitable endpoints, but it does not primarily trace source-level flows before runtime.

Question 133

A running public API has unknown request-validation defects that developers want to discover from the outside. Which testing approach directly exercises its endpoints?

  1. Reviewing only stored source comments
  2. Measuring the fiber interface optical power
  3. Linting only the infrastructure inventory spreadsheet
  4. Dynamic application security testing against an approved test target

Explanation

Correct Answer

D:

DAST sends crafted HTTP requests to an executing service to identify observable security failures in deployed behavior.

Incorrect Answers

A:

Comments may describe intent but cannot show how a deployed endpoint actually responds to malformed requests.

B:

Optical measurements can troubleshoot the link but provide no evidence of application-layer validation flaws.

C:

Inventory consistency does not exercise the API and therefore cannot directly reveal request-handling vulnerabilities.

Question 134

A web team's dependency scanner reports a malicious package version in its build manifest. What is the best supply-chain response?

  1. Publish the artifact without checking transitive dependencies
  2. Reuse the compromised artifact because its unit tests passed
  3. Remove the affected dependency and rebuild from trusted pinned artifacts
  4. Suppress the scanner permanently to avoid release delays

Explanation

Correct Answer

C:

Reproducible dependency resolution and trusted sources limit exposure to substituted packages before release into production.

Incorrect Answers

A:

Indirect packages can introduce the same compromise and require inventory and verification as part of remediation.

B:

Functional success does not prove a package is nonmalicious; malicious code may activate only under specific conditions.

D:

Removing detection leaves the vulnerable software path active and hides future dependency substitutions.

Question 135

A public login endpoint suffers password-guessing bursts from many addresses. Which application-layer countermeasure reduces automated trials without breaking normal user access?

  1. Unlimited authentication retries because traffic is encrypted
  2. Adaptive rate limiting with account and risk signals
  3. Trust all requests that use standard browser user-agent strings
  4. Disable failed-login records to conserve storage

Explanation

Correct Answer

B:

Controls based on identity, request rate, and suspicious patterns can throttle abusive attempts while minimizing collateral lockouts.

Incorrect Answers

A:

TLS protects transport but does not limit how often an attacker can test credentials at the login application.

C:

User-agent headers are client-controlled and do not establish legitimacy or prevent scripted authentication attempts.

D:

Suppressing evidence does not slow automation and makes abusive patterns harder to detect and investigate.

Question 136

A support technician must see a customer's ticket status but not its full payment information. Which data-access approach best fits?

  1. Give every help-desk employee database administrator rights
  2. Publish the payment table on an internal anonymous share
  3. Remove audit logging for support queries
  4. Field-level authorization with least-privilege presentation

Explanation

Correct Answer

D:

Granting only job-required fields reduces unnecessary disclosure while preserving the agent's ability to perform support tasks.

Incorrect Answers

A:

Full DB authority vastly exceeds ticket status access and creates exposure to unrelated customer records.

B:

Internal network location does not justify unrestricted exposure of regulated or sensitive payment information.

C:

Hiding access removes evidence of misuse and does not prevent unauthorized disclosure of sensitive fields.

Question 137

A distributor supplies a large file and publishes a trusted SHA-256 digest through a separately authenticated channel. What does a matching digest establish?

  1. Confidentiality of the file contents
  2. Proof that the file is free of malicious code
  3. Integrity of the received bytes relative to the trusted digest
  4. Automatic recovery of missing file blocks

Explanation

Correct Answer

C:

A collision-resistant hash comparison detects file changes, although publisher authenticity depends on the protected digest channel.

Incorrect Answers

A:

A hash does not encrypt the file, so anyone who can access its plaintext can still read it.

B:

A hash can match perfectly for an intentionally malicious file; it only establishes correspondence with the trusted value.

D:

A digest reports mismatch but does not reconstruct corrupted sectors or replace a reliable backup.

Question 138

Data stored on removable backup drives must remain unreadable if a drive is stolen. Which protection should be applied?

  1. Compress backup archives without encryption
  2. Encryption at rest with separately protected recovery keys
  3. Rename every backup file to a random identifier
  4. Enable only access-control lists on the live backup server

Explanation

Correct Answer

B:

Volume encryption protects backup content offsite when keys are secured outside the stolen medium and recovery is tested.

Incorrect Answers

A:

Compression reduces space but does not make stored data confidential to an attacker possessing the archive.

C:

Unpredictable filenames hide labels but do not prevent reading the underlying unencrypted bytes.

D:

Server ACLs may not be enforced when the removed drive is examined directly by an attacker.

Question 139

A browser displays a certificate warning when visiting an HTTPS customer portal. Which requirement must be satisfied for normal trusted TLS authentication?

  1. A valid certificate chain matching the requested hostname
  2. A successful ICMP ping to the portal IP address
  3. The use of port 443 even when identity validation fails
  4. An arbitrary self-signed certificate accepted without verification
  5. A current TLS cipher suite with validation explicitly disabled

Explanation

Correct Answer

A:

Browser validation binds the secure connection to the intended server identity, reducing risk of adversary-controlled endpoints.

Incorrect Answers

B:

Reachability does not verify control of the hostname or authenticity of a cryptographic server identity.

C:

The port number is conventional but cannot establish authenticity of the endpoint presenting the certificate.

D:

A certificate not anchored in trusted policy does not independently authenticate the purported website to ordinary clients.

E:

Strong encryption algorithms cannot compensate for the inability to authenticate the real portal when the server certificate is not checked.

Question 140

A microservice must verify the identity of an internal database proxy, and the proxy must verify the calling workload. Which TLS design meets both needs?

  1. Disabling certificate revocation checks without replacement controls
  2. Mutual TLS with validated client and server certificates
  3. Plain TCP over a private network without authentication
  4. Server-only TLS plus anonymous workload access

Explanation

Correct Answer

B:

mTLS authenticates both ends of the connection and encrypts traffic, allowing policy to bind a workload identity to database access.

Incorrect Answers

A:

Avoiding revocation awareness weakens management of compromised identities and does not add client authentication.

C:

Private addresses do not prevent interception or compromised internal processes from impersonating callers.

D:

Server authentication secures destination identity but does not by itself authenticate individual calling microservices.

Certified Network Defender (312-38) Practice Tests