Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 19

Question 180

A cloud build pipeline must sign release manifests, but security policy forbids exporting the long-lived private signing key to CI runners. The signing operation must remain auditably hardware protected. Which design fits?

  1. Put an encrypted private-key archive in the CI image and decrypt it at job startup
  2. Use a managed HSM-backed signing key with scoped API permission for the pipeline
  3. Publish only the public verification key in the build repository
  4. Enable TLS between CI agents and the source-code repository while keeping local signing files

Explanation

Correct Answer

B:

An HSM-backed signing service can perform cryptographic signing without releasing the private key to build jobs. Scope sign permissions and record the requests for investigation and review.

Incorrect Answers

A:

Even if an archive is encrypted at rest, the runner must eventually handle the decrypted private key, violating the requirement to keep private material outside the pipeline.

C:

Distributing a public key enables independent signature verification, but it does not provide the protected operation that generates a signature with a private key.

D:

TLS protects code transfer but does not prevent a compromised runner from reading signing key material that has been stored or decrypted locally.

Question 181

A WPA2-Personal network uses a weak shared passphrase, and an attacker has captured a valid handshake. Which WPA3-Personal feature most directly limits offline password guessing?

  1. A longer wireless SSID broadcast interval
  2. MAC address filtering at the access point
  3. Static WEP shared keys
  4. Simultaneous Authentication of Equals (SAE)

Explanation

Correct Answer

D:

WPA3-Personal uses SAE password-authenticated key exchange, which resists the offline dictionary-checking workflow common with captured WPA2-PSK handshakes.

Incorrect Answers

A:

Beacon timing does not change how an adversary can evaluate weak password guesses against a captured handshake.

B:

MAC addresses can be observed and spoofed, and this setting does not strengthen WPA2 key derivation against dictionary attacks.

C:

WEP is cryptographically obsolete and does not provide the modern password-authenticated exchange required to address offline guessing.

Question 182

An enterprise WLAN authenticates employees individually through a RADIUS-backed identity service rather than distributing one shared password. Which deployment mode fits?

  1. WEP with a manually rotated shared key
  2. An open SSID with no EAP authentication
  3. WPA2-Personal with one passphrase on a poster
  4. WPA2-Enterprise or WPA3-Enterprise with 802.1X

Explanation

Correct Answer

D:

Enterprise mode uses EAP-based authentication and can provide distinct per-user or per-device credentials and centralized revocation.

Incorrect Answers

A:

Legacy WEP has fundamental weaknesses and lacks the required centrally managed 802.1X identity exchange.

B:

Open association provides no enterprise access authentication for each connecting user or device.

C:

A shared PSK cannot reliably distinguish employee identities and exposes the entire WLAN if the common key leaks.

Question 183

Administrators want wireless clients to validate the authentication server and authenticate with managed certificates instead of reusable passwords. Which EAP method best meets this design?

  1. Open-system authentication without encryption
  2. EAP-MD5 as a stand-alone enterprise solution
  3. A captive portal login page alone
  4. EAP-TLS with mutual certificate validation

Explanation

Correct Answer

D:

EAP-TLS can authenticate the supplicant and server through certificates, reducing shared-password exposure when the PKI is correctly deployed.

Incorrect Answers

A:

Open association verifies neither the backend service nor a managed client certificate identity.

B:

EAP-MD5 lacks the mutual authentication and protected tunnel properties desired for modern secure enterprise wireless access.

C:

Portal credentials can govern application access but are not a substitute for strong 802.1X mutual authentication at association.

Question 184

A campus wants to mitigate forged disassociation and deauthentication management frames on compatible devices. Which wireless control is relevant?

  1. Increasing the Internet uplink bandwidth
  2. Protected Management Frames (802.11w/PMF)
  3. Wireless SSID hiding alone
  4. DHCP lease reservations
  5. MAC filtering applied only after the deauthentication is received

Explanation

Correct Answer

B:

PMF protects specified robust management frames, reducing common spoofed-disconnect attacks when required by the selected WLAN security mode.

Incorrect Answers

A:

More uplink capacity does not prevent spoofed radio management frames from disrupting station associations.

C:

Suppressing beacon names does not cryptographically authenticate management frames and does not stop forged deauthentication traffic.

D:

Reservations control address assignment, not integrity of 802.11 management exchanges between station and access point.

E:

A station MAC allowlist cannot cryptographically protect management frames from an adversary capable of spoofing radio identities.

Question 185

A small office access point has WPS PIN enrollment enabled despite strong WPA2 credentials. What is the main additional risk?

  1. Some WPS PIN designs facilitate online guessing of enrollment credentials
  2. WPS prevents legitimate devices from roaming
  3. WPS automatically disables every radio encryption mode
  4. A WPS PIN changes public DNS answers

Explanation

Correct Answer

A:

A weak enrollment channel can allow an attacker to join without knowing the otherwise strong Wi-Fi passphrase.

Incorrect Answers

B:

WPS PIN authentication is not the mechanism governing 802.11 roaming decisions among access points.

C:

WPS is a provisioning mechanism; it does not inherently remove all WLAN encryption as the attack scenario states.

D:

Wireless onboarding does not rewrite DNS records or cause domain-wide cache poisoning by itself.

Question 186

Wireless sensors report an unauthorized access point broadcasting the enterprise SSID from a nearby office. What should incident handlers determine first?

  1. Remove every legitimate AP without collecting identifiers
  2. Whether the device is an authorized AP, a rogue on the LAN, or an external impersonator
  3. Treat the SSID text itself as proof of device authenticity
  4. Ignore the observation because encryption is enabled

Explanation

Correct Answer

B:

Proper classification establishes the exposure and containment path rather than assuming all SSID duplicates are physically connected to corporate switching.

Incorrect Answers

A:

Broad removal disrupts service and loses a chance to distinguish authorized radios from the suspicious transmitter.

C:

Attackers can advertise an arbitrary SSID; radio identity and infrastructure association require additional evidence.

D:

A lookalike AP can still attract clients, collect credentials through lures, or exploit insecure client validation.

Question 187

Staff are tricked into joining a stronger-signal SSID with the same name as the company network, then see a bogus sign-in page. What should endpoint configuration emphasize?

  1. Trust the strongest available radio signal as an identity factor
  2. Validate enterprise authentication server certificates and approved SSID profiles
  3. Disable all 802.1X authentication for convenience
  4. Automatically accept any certificate when the SSID matches

Explanation

Correct Answer

B:

Correct certificate and profile validation reduces automatic trust in lookalike access points and counterfeit login workflows.

Incorrect Answers

A:

Signal strength indicates proximity or transmission conditions, not a cryptographically verified enterprise access point.

C:

Open association weakens assurance and may expose clients to the very evil-twin attack being investigated.

D:

A duplicated network name is easily forged, so accepting arbitrary servers enables impersonation despite an identical SSID.

Question 188

A museum offers password-free visitor Wi-Fi and wants to reduce passive radio eavesdropping while accurately describing the remaining trust limits. Which TWO statements are correct? Choose TWO.

  1. Wi-Fi Enhanced Open (OWE) can provide encryption on compatible password-free WLANs
  2. The HTTPS captive portal encrypts all radio frames before visitors accept the terms
  3. An OWE connection does not authenticate the access point to the visitor
  4. WPA2-Enterprise works with no EAP exchange, client identity, or managed authentication service
  5. A published shared WPA2 passphrase provides the same individualized unauthenticated encryption model as OWE

Explanation

Correct Answers

A:

Opportunistic Wireless Encryption establishes unique link encryption without requiring a shared user password. It is a useful improvement over traditional open Wi-Fi.

C:

Enhanced Open protects the local radio path from passive observers but lacks the AP identity assurance of authenticated enterprise WLAN access; visitors still need end-to-end TLS.

Incorrect Answers

B:

HTTPS protects the portal session, not necessarily every wireless frame used by a client on a traditional open network.

D:

Enterprise WLAN modes use an EAP-based access authentication arrangement, so they do not provide the specified open, password-free admission experience by default.

E:

A common shared password is a different credential model and does not provide the same opportunistic encryption design for completely password-free association.

Question 189

Guest devices must obtain Internet connectivity but should not initiate connections to internal finance systems. Which wireless design is most appropriate?

  1. Dedicated guest SSID mapped to isolated policy-controlled network resources
  2. Bridge guests directly into the finance workstation VLAN
  3. Allow unrestricted LAN routing after captive portal acceptance
  4. Share domain-administrator Wi-Fi credentials with visitors

Explanation

Correct Answer

A:

Separate client paths with egress-only authorization limit exposure to internal services and simplify guest lifecycle administration.

Incorrect Answers

B:

Co-residency grants unnecessary lateral reachability and defeats the isolation objective.

C:

Portal admission alone does not impose the required destination segmentation for guest-to-finance traffic.

D:

Privileged identity sharing creates serious accountability and authorization risk beyond ordinary guest Internet access.

Question 190

A café offers an open hotspot with a landing page. Why is a captive portal not sufficient protection for confidential customer traffic?

  1. A portal eliminates the need for valid HTTPS certificates
  2. Captive portals guarantee WPA3-Enterprise authentication
  3. A client-isolation rule with no application-layer encryption
  4. Captive portals make all client devices invisible to local attackers
  5. Portal acknowledgement does not necessarily encrypt the radio data path

Explanation

Correct Answer

E:

A sign-in or terms page is not equivalent to authenticated WLAN link encryption or end-to-end application TLS.

Incorrect Answers

A:

Web applications must still authenticate their server endpoints and protect traffic regardless of hotspot admission.

B:

Portals can operate on open networks and do not inherently deploy 802.1X certificate-based access authentication.

C:

Isolation can limit peer-to-peer attacks but does not supply end-to-end confidentiality or server authentication for web sessions.

D:

Open wireless conditions can still allow traffic observation or local attacks depending on segmentation and application protections.

Certified Network Defender (312-38) Practice Tests