Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 2

Question 10

A compromised software vendor signs and distributes a trojanized update using its normal distribution channel. Which defensive activity most reduces blast radius after an update is installed?

  1. Pin the updater to a release version while granting it broad system rights
  2. Treat any valid digital signature as proof of harmless code
  3. Allow vendor-updater child processes to bypass endpoint monitoring
  4. Constrain the updater's execution privileges and monitor new behavior

Explanation

Correct Answer

D:

Even a vendor-signed package can be malicious; restricted rights and behavioral controls limit impact beyond distribution trust.

Incorrect Answers

A:

Version pinning can aid reproducibility, but a compromised authorized release may still execute with excessive privileges.

B:

Signatures attest to a signer and package integrity, not the good intent of the signer or absence of a compromise.

C:

Disabling behavioral telemetry creates blind spots after a compromised supply chain has delivered apparently trusted software.

Question 11

A defender wants to map observed lateral movement and credential access to a common catalog of adversary behaviors. Which framework is most appropriate?

  1. MITRE D3FEND
  2. The NIST Cybersecurity Framework functions
  3. MITRE ATT&CK
  4. CVSS base scoring

Explanation

Correct Answer

C:

ATT&CK organizes adversary tactics and techniques, making detected behavior easier to compare with threat intelligence and detection coverage.

Incorrect Answers

A:

D3FEND catalogs defensive techniques and countermeasures, not primarily the adversary tactic-and-technique mappings sought for observed movement.

B:

The CSF organizes governance and security outcomes but is not the granular catalog of adversary behaviors used for technique-level mapping.

D:

CVSS rates vulnerability characteristics; it does not serve as a catalog mapping observed attack behavior across tactics.

Question 12

During a tabletop, analysts distinguish the reconnaissance, delivery, exploitation, and actions-on-objectives stages of an intrusion. Which model are they applying?

  1. A cyber kill chain
  2. A risk heat map
  3. MITRE ATT&CK tactics and techniques
  4. The incident response lifecycle

Explanation

Correct Answer

A:

A kill-chain model describes phases of an intrusion and helps defenders plan opportunities to interrupt the sequence at different stages.

Incorrect Answers

B:

A heat map places risks by likelihood and impact, rather than representing successive operational phases of an attack.

C:

ATT&CK categorizes attacker objectives and methods; it is not ordinarily a linear intrusion-stage narrative with delivery and exploitation phases.

D:

Incident response phases guide defenders' handling process, whereas the named reconnaissance-to-objectives sequence describes attacker progression.

Question 13

A company uses endpoint controls, segmentation, monitoring, and tested recovery rather than trusting one perimeter firewall. What principle does this design demonstrate?

  1. Implicit trust for internal traffic
  2. Single point of enforcement
  3. Security through obscurity alone
  4. Defense in depth

Explanation

Correct Answer

D:

Distinct layers reduce the likelihood that failure or bypass of one control exposes every resource, while preserving detection and recovery options.

Incorrect Answers

A:

Assuming every internal actor is safe defeats segmentation and device-level checks, weakening the layered architecture.

B:

Centralizing all protection into one device contradicts the stated use of complementary safeguards at different layers.

C:

Concealing implementation details cannot replace independent preventive, detective, and recovery controls across trust boundaries.

Question 14

A security program continuously incorporates new exposure data, detection outcomes, and attacker behavior to change controls. Which strategy is being practiced?

  1. Permanent acceptance of all residual risk
  2. Fixed allow rules without review
  3. Adaptive and continual network defense
  4. One-time compliance attestation

Explanation

Correct Answer

C:

Feedback from changing conditions is used to update protection and detection rather than retaining one static configuration indefinitely.

Incorrect Answers

A:

Accepting exposure without reassessment conflicts with using new intelligence and incidents to improve defensive decisions.

B:

Frozen rules become stale when services and attackers change, which is the opposite of adjusting security based on evidence.

D:

A periodic attestation may provide evidence at a point in time, but it does not dynamically respond to fresh observations.

Question 15

A wireless user joins an access point impersonating the company's SSID and enters credentials on a forged captive page. What was the attacker's essential initial technique?

  1. Evil-twin access point impersonation
  2. A rogue access point attached to an internal switch but using a different SSID
  3. A wireless deauthentication flood against legitimate access points
  4. A DNS response-spoofing attack against a correctly joined WLAN

Explanation

Correct Answer

A:

The adversary advertises a lookalike wireless network to attract clients and capture traffic or credentials under a trusted name.

Incorrect Answers

B:

A rogue network device is unauthorized, but the reported lookalike SSID and fraudulent client lure specifically indicate evil-twin impersonation.

C:

A deauthentication flood disconnects clients and may accompany a lure, but it does not itself provide the impostor SSID and captive page.

D:

Forged DNS answers could redirect web traffic, but the case explicitly begins with association to an access point impersonating the trusted SSID.

Question 16

An organization has no reliable record of which servers run customer-facing applications. Which first administrative control best supports ownership and vulnerability response?

  1. Maintain an authoritative asset inventory with accountable owners
  2. Maintain network diagrams but no record of server applications or custodians
  3. Create a vulnerability list without associating findings to asset custodians
  4. Perform a one-time network discovery scan without ownership mapping

Explanation

Correct Answer

A:

A maintained inventory links assets to functions and custodians, enabling patch prioritization, incident scope, and lifecycle decisions.

Incorrect Answers

B:

Topology views reveal connections, not the authoritative asset-to-service ownership information needed for prioritization.

C:

Unowned findings may be difficult to remediate because teams cannot determine which service manager must approve changes.

D:

Discovery can find many hosts, but an inventory without responsible owners and service context will not support sustained lifecycle or remediation decisions.

Question 17

A policy document says all privileged accounts must use MFA; a supporting document lists the mandatory authenticator configuration parameters. What is that supporting document?

  1. A business continuity plan
  2. A post-incident review
  3. A risk appetite statement
  4. An MFA enrollment help-desk runbook
  5. A security standard

Explanation

Correct Answer

E:

Standards specify enforceable, measurable requirements implementing a policy, such as approved methods and technical settings.

Incorrect Answers

A:

A continuity plan coordinates critical functions through disruption, unlike a technical identity-control specification.

B:

A review records lessons and corrective tasks from an event; it is not normally the baseline specification for authenticators.

C:

Risk appetite defines how much risk leaders are willing to accept; it does not enumerate mandatory MFA settings.

D:

A runbook defines operational steps, but the artifact requiring approved authenticator settings across the organization is a technical standard.

Question 18

Administrators need repeatable steps for revoking an employee's access within two hours of termination. Which governance artifact is most useful?

  1. An onboarding checklist reused without termination-specific revocation steps
  2. A documented offboarding procedure with assigned responsibilities
  3. A security standard setting a two-hour deadline without actionable steps
  4. A general confidentiality policy without workflow details

Explanation

Correct Answer

B:

Procedures turn a control requirement into ordered actions, ownership, evidence capture, and time-bound execution.

Incorrect Answers

A:

Onboarding may grant access, but an offboarding workflow must enumerate the accounts and tokens to disable and how to verify completion.

C:

A standard can state the mandatory timeframe, but the team still needs ordered offboarding tasks and owners to execute it.

D:

Policy establishes expectations, but an operational team still needs who-to-do-what steps to meet the deadline reliably.

Question 19

The same employee can create a new vendor and approve payment to that vendor. Which administrative control most directly addresses the fraud path?

  1. Automatic trust for internal finance requests
  2. Separation of duties
  3. Relaxed approval thresholds
  4. Shared administrator credentials

Explanation

Correct Answer

B:

Splitting vendor creation from payment approval reduces an individual's ability to complete a fraudulent transaction alone.

Incorrect Answers

A:

Implicit trust removes the independent scrutiny required when one actor could manipulate an entire transaction.

C:

Raising or removing scrutiny can increase fraud exposure; it does not prevent one employee from exercising incompatible duties.

D:

Shared credentials erode accountability and make fraudulent actions harder to attribute rather than separating responsibilities.

Question 20

A small retailer stores cardholder data in an internally managed payment application. Which compliance standard primarily governs protection of that cardholder environment?

  1. ISO 22301 exclusively
  2. PCI Data Security Standard (PCI DSS)
  3. A generic ISO 27001 risk treatment plan without payment-card control mapping
  4. SOC 2 reporting criteria alone
  5. A generic ISO 27001 management-system certificate alone

Explanation

Correct Answer

B:

PCI DSS addresses security controls for environments that store, process, or transmit payment-card data, subject to applicable scope.

Incorrect Answers

A:

This standard focuses on business-continuity management rather than specific payment-card data security requirements.

C:

A management-system plan may improve security, but cardholder-data requirements still need applicable PCI DSS scope and controls.

D:

A SOC 2 report can describe control assurance but is not the payment card industry's direct security standard.

E:

An ISO 27001 certification may be valuable, but it does not replace cardholder-data-specific obligations or determine PCI DSS scope automatically.

Certified Network Defender (312-38) Practice Tests