Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 20

Question 190

A café offers an open hotspot with a landing page. Why is a captive portal not sufficient protection for confidential customer traffic?

  1. A portal eliminates the need for valid HTTPS certificates
  2. Captive portals guarantee WPA3-Enterprise authentication
  3. A client-isolation rule with no application-layer encryption
  4. Captive portals make all client devices invisible to local attackers
  5. Portal acknowledgement does not necessarily encrypt the radio data path

Explanation

Correct Answer

E:

A sign-in or terms page is not equivalent to authenticated WLAN link encryption or end-to-end application TLS.

Incorrect Answers

A:

Web applications must still authenticate their server endpoints and protect traffic regardless of hotspot admission.

B:

Portals can operate on open networks and do not inherently deploy 802.1X certificate-based access authentication.

C:

Isolation can limit peer-to-peer attacks but does not supply end-to-end confidentiality or server authentication for web sessions.

D:

Open wireless conditions can still allow traffic observation or local attacks depending on segmentation and application protections.

Question 191

A hospital wants fast authenticated roaming across many managed APs while preserving enterprise security. Which 802.11 enhancement is relevant?

  1. A longer DHCP lease on its own
  2. IEEE 802.11r fast BSS transition where supported
  3. IEEE 802.3af power over Ethernet exclusively
  4. IEEE 802.1Q trunk tagging alone

Explanation

Correct Answer

B:

Fast transition reduces reauthentication disruption during roaming, subject to compatible clients and carefully configured wireless security.

Incorrect Answers

A:

Lease duration can reduce address churn but does not directly implement fast BSS authentication transitions.

C:

PoE supplies electrical power to network devices but is not a cryptographic fast-roaming protocol.

D:

VLAN tags can carry client traffic but do not accelerate authenticated movement between wireless access points.

Question 192

Wireless clients experience high retries during lunch hours, yet spectrum analysis shows neighboring nonmalicious APs sharing channels. What is the most likely issue?

  1. An automatic DNSSEC signature failure
  2. A compromised root certificate authority
  3. Guaranteed wireless denial-of-service by an attacker
  4. Co-channel contention and RF congestion

Explanation

Correct Answer

D:

Overlapping active networks share airtime, increasing wait and retry behavior without requiring an attacker to jam the medium.

Incorrect Answers

A:

DNS signatures affect name resolution trust, not the radio channel occupancy reported by the spectrum tools.

B:

CA compromise concerns trust validation and has no direct link to observed adjacent-channel airtime competition.

C:

Heavy traffic can arise from ordinary competing APs; evidence does not yet identify an intentional interference source.

Question 193

An unauthorized access point briefly appears and disappears in an office. Which combination of evidence best supports an investigation?

  1. Wireless controller client association totals without BSSID or physical attachment data
  2. WIDS observations correlated with switch port and controller logs
  3. A snapshot of the wired switch MAC table taken after the suspicious AP disappears
  4. Only the SSID names shown in client connection histories

Explanation

Correct Answer

B:

RF detection and wired infrastructure records can help map physical radio activity to network attachments and administrative actions.

Incorrect Answers

A:

Client counts alone may indicate nearby radios but do not tie a transient unauthorized transmitter to a particular BSSID, infrastructure port, or activity window.

C:

A later MAC table snapshot may miss an ephemeral device and cannot by itself reconstruct RF observations or associate the transmitter with a physical attachment.

D:

SSID names are easily copied and cannot on their own map a transmitting BSSID to a switch port or controller identity.

Question 194

An office deployment has dead zones and neighboring network interference. Which TWO planning actions should occur before repositioning APs? Choose TWO.

  1. Enable maximum transmit power on every AP without assessment
  2. Review client density and expected application capacity by area
  3. Use the same channel on adjacent APs regardless of RF conditions
  4. Disable wireless monitoring during deployment
  5. Perform an RF site survey with channel and signal measurements

Explanation

Correct Answers

B:

User concentration and traffic demands influence placement and channel plans beyond the reach of a single radio signal.

E:

Measurements reveal coverage gaps, contention, and building effects so changes follow evidence instead of guesswork.

Incorrect Answers

A:

Excessive power can worsen interference and roaming decisions rather than solving a complex coverage problem.

C:

Arbitrary channel reuse can increase contention where overlapping cells serve active clients.

D:

Losing telemetry obscures the impact of changes and prevents comparing new coverage to the baseline.

Question 195

A medical IoT device supports only WPA2-Personal and cannot use modern 802.1X profiles. What compensating control best reduces its enterprise impact?

  1. Put it on an isolated device WLAN with narrowly permitted gateway traffic
  2. Give the IoT device unfiltered access to all clinical databases
  3. Connect it with the same shared key used for all employee laptops
  4. Disable WPA2 encryption because the device lacks WPA3

Explanation

Correct Answer

A:

Network segmentation limits lateral paths while replacement and firmware support are evaluated for a weaker legacy client.

Incorrect Answers

B:

Broad access magnifies compromise impact and is unnecessary for a narrowly defined medical sensor function.

C:

Reusing a broad credential increases exposure across unrelated devices rather than containing a legacy endpoint.

D:

Removing its available link protection makes interception easier and does not compensate for missing enterprise authentication.

Question 196

An analyst must monitor packets entering and leaving a server without inserting a forwarding device into the production traffic path. Which setup is suitable?

  1. A DHCP pool expansion
  2. An on-host packet capture agent installed on the server itself
  3. A DNS conditional forwarder
  4. A correctly configured SPAN or mirror port
  5. An inline IPS with no fail-open planning

Explanation

Correct Answer

D:

Switch mirroring copies selected frames to a passive sensor, providing visibility without requiring the sensor to forward production traffic.

Incorrect Answers

A:

More available addresses does not duplicate packets to a network security sensor for inspection.

B:

Host capture can work, but it changes the observed server and may not meet a requirement for passive out-of-band network monitoring.

C:

Conditional DNS forwarding routes name queries but does not supply copies of all server traffic.

E:

Inline inspection participates in forwarding and can become an operational chokepoint, contrary to the nonintrusive constraint.

Question 197

A switch SPAN session loses packets during peak utilization, causing incomplete captures. Which monitoring design is more appropriate for high-fidelity collection?

  1. An appropriately sized network TAP and capture infrastructure
  2. Add a display filter in the packet analyzer
  3. Disable sensor timestamps to save a few bytes
  4. Set the switch monitoring port to half duplex

Explanation

Correct Answer

A:

A TAP can offer predictable physical traffic copies, but downstream interfaces and storage must still handle the observed line rate.

Incorrect Answers

B:

A display filter reduces what analysts see after capture but does not recover packets lost before the SPAN destination can receive them.

C:

Timing metadata aids analysis; dropping it cannot repair a packet path that cannot sustain observed rates.

D:

Duplex mismatch and capacity reductions are likely to worsen loss instead of preserving peak-rate traffic fidelity.

Question 198

An investigator needs to capture only DNS packets while recording traffic, rather than filtering a large stored capture afterward. Which Wireshark feature fits?

  1. A packet comment field
  2. A display filter alone after collection
  3. A capture filter such as udp port 53 for the relevant traffic
  4. Capture filtering applied after frames have already been saved

Explanation

Correct Answer

C:

Capture filters apply before packets are stored and reduce collection to selected conversations, subject to protocol variants and interfaces.

Incorrect Answers

A:

Comments annotate captured frames but cannot control which packets enter the capture file.

B:

Display filters change which recorded frames are shown; they do not reduce which frames were initially written to the capture.

D:

Capture-stage filtering changes acquisition, whereas an existing full archive should be narrowed non-destructively with a display filter.

Question 199

An analyst has a full packet capture and wants to view only TLS handshake messages without discarding other recorded packets. Which approach is appropriate?

  1. Reconfigure the switch's SPAN destination retrospectively
  2. Delete every non-TLS packet from the archive immediately
  3. Apply a Wireshark display filter targeting TLS handshake fields
  4. Change the file's extension to .tls

Explanation

Correct Answer

C:

Display filters operate on captured content and can isolate handshake exchanges while preserving the original pcap for broader review.

Incorrect Answers

A:

Changing future mirroring cannot alter which previously recorded frames are displayed or retained in the existing pcap.

B:

Deletion destroys potentially relevant context and is unnecessary for a reversible visual filter.

D:

A filename extension does not parse protocols or narrow which frames Wireshark presents.

Question 200

A PCAP shows SYN, SYN-ACK, and then ACK before application data begins. What does this sequence represent?

  1. A completed TCP three-way handshake
  2. An ARP request and response pair
  3. An incomplete DNS recursive lookup
  4. A TLS certificate chain validation event

Explanation

Correct Answer

A:

The exchange establishes synchronized sequence numbers and connection state before ordinary bidirectional application data transfer.

Incorrect Answers

B:

ARP uses link-layer address mapping messages, not TCP SYN and ACK flags that establish transport sessions.

C:

DNS resolution uses query/response messages and does not inherently contain this TCP flag exchange.

D:

TLS identity validation occurs above the transport layer and does not itself produce the TCP three-packet opening pattern.

Certified Network Defender (312-38) Practice Tests