Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 21

Question 200

A PCAP shows SYN, SYN-ACK, and then ACK before application data begins. What does this sequence represent?

  1. A completed TCP three-way handshake
  2. An ARP request and response pair
  3. An incomplete DNS recursive lookup
  4. A TLS certificate chain validation event

Explanation

Correct Answer

A:

The exchange establishes synchronized sequence numbers and connection state before ordinary bidirectional application data transfer.

Incorrect Answers

B:

ARP uses link-layer address mapping messages, not TCP SYN and ACK flags that establish transport sessions.

C:

DNS resolution uses query/response messages and does not inherently contain this TCP flag exchange.

D:

TLS identity validation occurs above the transport layer and does not itself produce the TCP three-packet opening pattern.

Question 201

A service logs connections that start with SYN but repeatedly retransmit before receiving any SYN-ACK. What should the analyst investigate first?

  1. A successful remote database transaction commit
  2. Reachability, filtering, or unresponsive service along the path
  3. A completed TLS handshake followed by certificate expiry
  4. A failed client-side HTTP cookie validation

Explanation

Correct Answer

B:

No SYN-ACK suggests the connection attempt is not being completed; packet loss, ACL drops, or a nonlistening endpoint are plausible causes.

Incorrect Answers

A:

Application transactions occur after the transport has opened and do not account for initial SYN retries.

C:

TLS negotiation cannot finish before the underlying TCP connection has been established.

D:

HTTP cookies are exchanged after a successful transport connection and cannot explain the absence of the SYN-ACK itself.

Question 202

DNS telemetry shows a workstation making hundreds of long, unique subdomain queries to one unfamiliar domain with small responses. Which investigation is most relevant?

  1. Examine possible DNS tunneling or data exfiltration
  2. Ignore the activity because DNS is a standard protocol
  3. Classify the queries as normal CDN cache busting without validation
  4. Delete all local event logs before reviewing DNS activity

Explanation

Correct Answer

A:

High-entropy unique labels at unusual volume can encode information in DNS requests, although benign telemetry must be ruled out.

Incorrect Answers

B:

Legitimate protocols can carry covert channels, so unusual patterns require comparison with known client behavior.

C:

Some benign software uses unique labels, but this explanation requires evidence from the initiating process and destination domain.

D:

Destroying evidence would make correlation and scoping harder without determining why these queries occurred.

Question 203

A capture from a user LAN shows two MAC addresses claiming the same default-gateway IP through frequent ARP announcements. What should be investigated?

  1. Normal IPv6 neighbor discovery only
  2. Guaranteed TLS certificate renewal failure
  3. Potential ARP spoofing or duplicate gateway configuration
  4. A user exceeding an email attachment quota

Explanation

Correct Answer

C:

Conflicting IP-to-MAC claims can indicate malicious interception or a configuration fault; switch bindings and topology help distinguish them.

Incorrect Answers

A:

ARP is an IPv4 address-resolution protocol, so those frames are not ordinary ICMPv6 Neighbor Discovery.

B:

ARP announcements are independent of certificate expiration and do not prove a cryptographic PKI problem.

D:

Mail quotas have no direct relationship to local network devices advertising gateway IP ownership.

Question 204

A SOC sees substantial HTTPS uploads to an unfamiliar external server after business hours, but the application payload cannot be decrypted. Which finding is the strongest metadata-based lead for data exfiltration?

  1. The connection negotiates a currently supported TLS version
  2. The destination certificate validates to a publicly trusted issuing authority
  3. Outbound byte volume is far above the host baseline while inbound replies remain small
  4. A DNS lookup resolves the hostname shortly before the connection begins

Explanation

Correct Answer

C:

An unusually asymmetric, sustained outbound transfer to a new destination can warrant exfiltration investigation even without payload decryption. Confirm with process and business context.

Incorrect Answers

A:

Modern TLS is used by both legitimate services and intrusions; protocol version by itself does not distinguish suspicious outbound data transfer.

B:

Valid certificates authenticate a TLS server name under a trust chain, but malicious infrastructure can also use valid public certificates.

D:

Resolving a destination is normal for network services and does not establish unusual transfer volume or intent without behavioral and host context.

Question 205

An application sends TCP reset packets immediately after receiving connections to a particular destination port. What is a likely interpretation?

  1. Ethernet duplex negotiation succeeded
  2. The application definitely completed a reliable data transfer
  3. The endpoint or intervening device is actively refusing or terminating sessions
  4. DNSSEC validated a record successfully

Explanation

Correct Answer

C:

TCP RST signals connection refusal or teardown, though the exact source must be confirmed with addresses, timing, and policy logs.

Incorrect Answers

A:

Link settings are a different layer and cannot be inferred solely from application-port TCP reset responses.

B:

An immediate RST often prevents normal exchange; it is not proof that data was successfully delivered.

D:

DNS validation is unrelated to why a TCP endpoint emits reset flags during connection attempts.

Question 206

A UDP scan receives ICMP Destination Unreachable, Port Unreachable from the target. What does this generally indicate?

  1. A TLS certificate was rejected
  2. The destination has granted administrative access
  3. The probed UDP port is closed or not accepting the datagram
  4. A successful UDP application handshake occurred

Explanation

Correct Answer

C:

ICMP type 3 code 3 commonly signals no receiving process for the specified UDP destination, though filtering and middleboxes complicate interpretation.

Incorrect Answers

A:

TLS certificate validation is a separate application security process, not the ordinary meaning of this ICMP error.

B:

A network error message cannot authenticate the scanner or authorize privileged access to a host.

D:

UDP lacks TCP's connection handshake, and a port-unreachable response does not establish application connectivity.

Question 207

Network flow records are available but no full packet payload capture exists. Which information can NetFlow/IPFIX typically provide?

  1. Every typed administrator password inside an SSH session
  2. A packet-by-packet copy of the TLS-encrypted application body
  3. Packet-level TCP retransmission sequences and payloads for every connection
  4. Complete HTTP response bodies for all encrypted sessions
  5. Flow endpoints, ports, protocol, timestamps, and volume summaries

Explanation

Correct Answer

E:

Flow telemetry supports traffic-pattern investigation without preserving every application payload byte from observed connections.

Incorrect Answers

A:

SSH encryption and flow-summary formats prevent ordinary flow records from revealing such application secrets.

B:

Flow records summarize connection attributes, and they neither preserve complete packets nor decrypt their encrypted payloads.

C:

Flow summaries may aggregate counts and endpoints, but they do not retain the individual packets required to reconstruct TCP retransmission sequences.

D:

Flow exporters do not inherently decrypt and store the bodies of protected web transactions.

Question 208

A branch link graph shows traffic spikes every night during a scheduled replication job. What method prevents labeling this expected load as a network intrusion automatically?

  1. Build a time-aware baseline that incorporates known job schedules
  2. Delete replication logs before measuring network traffic
  3. Disable all capacity graphs after midnight
  4. Treat any packet count above yesterday's average as malicious

Explanation

Correct Answer

A:

Normal behavior varies by hour and workload; comparing against appropriate windows reduces false anomaly alerts.

Incorrect Answers

B:

Erasing evidence does not improve discrimination between expected backups and unauthorized data movement.

C:

Removing visibility prevents understanding both scheduled replication and genuinely unexpected after-hours activity.

D:

One fixed historical average ignores predictable demand patterns and creates false alarms during routine transfers.

Question 209

A network team sees intermittent packet loss while interface utilization and queue discards rise near link capacity. Which conclusion best fits the combined evidence?

  1. A certificate-authority compromise is proven
  2. Congestion and queue overflow are plausible causes
  3. All packets are being silently modified by a man-in-the-middle
  4. Password spraying is certainly occurring

Explanation

Correct Answer

B:

High utilization with discard counters supports capacity pressure, which should be examined before attributing loss to a cyberattack.

Incorrect Answers

A:

Certificate trust failures cannot be inferred from interface queue drops and throughput saturation alone.

C:

Drops are not evidence of payload alteration; additional captures and path data would be required.

D:

Authentication abuse requires identity or protocol evidence; queue discards do not identify a login-guessing technique.

Question 210

An internal workstation communicates to many peer servers over SMB even though its baseline normally shows only access to one file server. Which TWO observations would make lateral-movement investigation stronger? Choose TWO.

  1. Endpoint evidence of unexpected remote service creation
  2. A single normal nightly backup transfer is scheduled
  3. One routine SMB file-copy event during an approved maintenance window
  4. Unusual new destination breadth in east-west flow records
  5. The site's DNS resolver has a larger cache than yesterday

Explanation

Correct Answers

A:

Correlated remote-service activity can support a lateral-execution hypothesis beyond unusual but benign file sharing.

D:

A sudden fan-out of SMB connections beyond normal duties can indicate discovery or movement among internal hosts.

Incorrect Answers

B:

A documented expected job can explain traffic and must not be mistaken automatically for adversary movement.

C:

An isolated authorized operation does not substantiate an unexpected broad SMB fan-out or remote service execution pattern.

E:

Cache size alone does not prove lateral movement from a specific workstation over SMB.

Certified Network Defender (312-38) Practice Tests