Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 16

Question 150

An encryption service needs to replace a compromised data-encryption key without placing master keys in application source code. Which architecture best supports controlled rotation?

  1. Envelope encryption using centrally managed key-encryption keys
  2. Replace encryption with reversible text encoding
  3. Publish recovery keys in a common configuration repository
  4. Hard-code one shared plaintext key into every application binary

Explanation

Correct Answer

A:

Separating data keys from managed wrapping keys reduces direct master-key exposure and supports rotation with auditable key management.

Incorrect Answers

B:

Encoding does not provide confidentiality and can be undone by any reader familiar with the transformation.

C:

Broad key distribution increases unauthorized decryption risk instead of restricting sensitive key material.

D:

Embedded long-lived secrets are difficult to rotate safely and can expose all data when one program artifact leaks.

Question 151

A security architect wants virtual machines isolated from one another even when their host's general-purpose operating system is not trusted. Which hypervisor architecture best minimizes that OS dependency?

  1. A Type 2 hypervisor installed over an ordinary desktop OS
  2. Type 1 bare-metal hypervisor
  3. A web browser running multiple tabs
  4. A shared file server without process isolation

Explanation

Correct Answer

B:

A Type 1 hypervisor runs directly on hardware and generally avoids relying on a host desktop OS as the virtualization foundation.

Incorrect Answers

A:

Hosted virtualization depends more directly on the underlying general-purpose OS and its attack surface.

C:

Browser processes are not separate guest operating systems with a hypervisor-enforced virtual-machine boundary.

D:

File sharing does not supply the guest-kernel separation and hardware abstraction required of a hypervisor.

Question 152

A virtual network administrator is asked to prevent a guest from capturing frames addressed to unrelated tenants on the same virtual switch. Which setting matters?

  1. Restrict promiscuous mode and unauthorized port mirroring
  2. Separate each VM into a distinct management folder only
  3. Disable all time synchronization between guests
  4. Permit all guests to alter switch uplink configuration

Explanation

Correct Answer

A:

Limiting frame reception and mirroring reduces a guest's ability to observe traffic beyond its assigned virtual interface.

Incorrect Answers

B:

Administrative folders help organize inventory, but they do not determine which Ethernet frames reach a guest virtual NIC.

C:

Time settings affect logs and protocol tolerance, not frame delivery rules on the virtual switching layer.

D:

Wide administration would magnify cross-tenant risk rather than isolate virtual network observations.

Question 153

A VM carrying sensitive in-memory data migrates between hosts over a dedicated network. Which additional control protects that migration from interception?

  1. Authenticate and encrypt the live-migration transport
  2. Disable hypervisor audit logging during migration
  3. Copy plaintext memory to a general file share before migration
  4. Trust the link only because it uses an RFC 1918 address

Explanation

Correct Answer

A:

Migration traffic may include memory and state, so protected host-to-host channels and isolated pathways reduce exposure to eavesdropping.

Incorrect Answers

B:

Suppressing records reduces traceability and does nothing to prevent an on-path observer from capturing state.

C:

A broad share introduces more accessible sensitive copies without securing the host-to-host migration channel.

D:

Private addressing alone does not cryptographically protect highly sensitive memory pages traveling between hosts.

Question 154

An administrator claims that taking a VM snapshot every evening replaces the organization's independent backup program. What is the key flaw?

  1. Snapshots often share the same storage and failure domain as the VM
  2. Replication of the production datastore into the same storage administrator domain
  3. VM export files stored only on the host's boot volume
  4. Snapshots can never contain application state
  5. A snapshot is always stored in a separate geographic region
  6. Snapshots necessarily encrypt every byte with a distinct key

Explanation

Correct Answer

A:

Point-in-time snapshots are useful for rollback, but they may disappear with datastore loss or ransomware affecting the underlying platform.

Incorrect Answers

B:

Replicas improve availability but can copy corruption and remain reachable to the same attacker credentials as primary storage.

C:

Exports may aid migration, but a single local disk failure or host compromise can destroy them alongside the affected virtual machine.

D:

Some snapshot technologies can capture disk and memory state, though consistency handling still requires planning.

E:

Snapshot placement is product and configuration dependent; local snapshots often remain on the same storage infrastructure.

F:

Encryption is not an inherent backup guarantee and does not give snapshots independent availability under shared storage failures.

Question 155

A hypervisor management server has known remote-access vulnerabilities. Which action best reduces privileged infrastructure exposure?

  1. Grant all VM users host-admin rights to ease maintenance
  2. Permit management login from every Internet address
  3. Apply supported patches and isolate the hypervisor management plane
  4. Disable host security auditing permanently

Explanation

Correct Answer

C:

Administrative interfaces govern many guests, so timely updates and restricted operator paths reduce the risk of widespread host compromise.

Incorrect Answers

A:

Tenant-level users should not control host resources or other guests, and broad rights increase the blast radius.

B:

Broad accessibility creates unnecessary opportunities to exploit vulnerabilities or guess privileged credentials.

D:

Losing audit evidence impedes detection and accountability while leaving the vulnerable management component exposed.

Question 156

A malicious guest attempts to cross a hypervisor isolation boundary and run code on the physical host. What type of exploit is this?

  1. Graceful guest shutdown
  2. Privilege escalation confined to the same guest OS
  3. VLAN route summarization
  4. Virtual machine escape

Explanation

Correct Answer

D:

A VM escape abuses a virtualization boundary weakness to influence or execute in the host or another protected context.

Incorrect Answers

A:

A normal shutdown is an authorized virtual-machine lifecycle action, not unauthorized execution beyond a guest boundary.

B:

Elevated rights inside one guest are dangerous, but do not necessarily cross the isolation boundary into the physical host.

C:

Routing summaries affect advertised IP prefixes and cannot account for a guest obtaining host execution authority.

Question 157

A software-defined network controller is compromised. Why can this affect many otherwise isolated flows?

  1. An SDN controller stores only cosmetic network labels
  2. Control-plane compromise can never impact data-plane policy
  3. The controller programs forwarding policy across multiple devices
  4. Every switch automatically becomes a certificate authority

Explanation

Correct Answer

C:

Centralized control-plane authority can change network behavior widely, so controller identity, APIs, and availability need strong safeguards.

Incorrect Answers

A:

Controllers can manage actual route or flow rules, which makes their administrative compromise operationally significant.

B:

Although planes are distinct, authorized controller actions are specifically intended to reconfigure forwarding behavior.

D:

SDN does not convert forwarding devices into trusted identity issuers; the danger is centralized network policy control.

Question 158

A provider chains virtualized firewall and intrusion-prevention functions for several tenants. Which security control is most important for this NFV arrangement?

  1. Isolate tenant service chains and secure VNF orchestration permissions
  2. Permit all tenants to edit common VNF templates in production
  3. Replace all service-chain policies with a flat internal route
  4. Eliminate traffic logging across every virtual function

Explanation

Correct Answer

A:

NFV resources share compute and networks; authenticated orchestration and tenant separation prevent cross-chain reconfiguration or exposure.

Incorrect Answers

B:

Shared unrestricted templates let one tenant alter protection for others and undermine service isolation.

C:

A flat route bypasses the chained enforcement design and widens reachability among separated customer workloads.

D:

Removing telemetry conceals service-chain failures and unauthorized configuration changes without protecting orchestrator rights.

Question 159

Two containers share the host kernel but have distinct process and network views. Which Linux mechanism primarily creates those separate views?

  1. A shared administrator password
  2. DNS round-robin records
  3. Namespaces
  4. Full hardware emulation in every process

Explanation

Correct Answer

C:

Namespaces isolate visible process IDs, mounts, network interfaces, and other resources, while all containers still rely on the same kernel.

Incorrect Answers

A:

Authentication reuse cannot create kernel-enforced resource namespaces between competing applications.

B:

DNS balancing chooses addresses but does not isolate process trees or filesystem mount views.

D:

Ordinary containers do not require separate virtual hardware and complete guest kernels for each workload.

Question 160

A deployment must ensure every container instance uses an audited image, even if a mutable tag is later moved to different content. What should the deployment pin?

  1. Only the image's human-readable latest tag
  2. A public description in a registry listing
  3. An immutable container image digest
  4. The container's display name
  5. Pinning an image's repository name while omitting version and digest

Explanation

Correct Answer

C:

A content-addressed digest identifies the expected image bytes and avoids silently accepting a newly retargeted tag.

Incorrect Answers

A:

Tags can be reassigned, making the underlying artifact change without the manifest text visibly changing.

B:

Registry metadata is not an immutable reference to the exact executable layers used at deployment.

D:

Runtime names label instances and do not attest to which image content was pulled and executed.

E:

A repository name identifies a source namespace but permits whichever current artifact is selected by mutable tags or defaults.

Certified Network Defender (312-38) Practice Tests