Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 22

Question 210

An internal workstation communicates to many peer servers over SMB even though its baseline normally shows only access to one file server. Which TWO observations would make lateral-movement investigation stronger? Choose TWO.

  1. Endpoint evidence of unexpected remote service creation
  2. A single normal nightly backup transfer is scheduled
  3. One routine SMB file-copy event during an approved maintenance window
  4. Unusual new destination breadth in east-west flow records
  5. The site's DNS resolver has a larger cache than yesterday

Explanation

Correct Answers

A:

Correlated remote-service activity can support a lateral-execution hypothesis beyond unusual but benign file sharing.

D:

A sudden fan-out of SMB connections beyond normal duties can indicate discovery or movement among internal hosts.

Incorrect Answers

B:

A documented expected job can explain traffic and must not be mistaken automatically for adversary movement.

C:

An isolated authorized operation does not substantiate an unexpected broad SMB fan-out or remote service execution pattern.

E:

Cache size alone does not prove lateral movement from a specific workstation over SMB.

Question 211

A router forwards Syslog messages over UDP to a collector. During network congestion, some events are absent. What protocol property explains this possibility?

  1. A larger DNS zone automatically repairs missing events
  2. UDP preserves ordered delivery during congestion
  3. Syslog over UDP requires Kerberos tickets for delivery
  4. UDP delivery has no built-in acknowledgement or retransmission guarantee

Explanation

Correct Answer

D:

Datagrams may be dropped without the sender learning which logs were lost; buffering and reliable transport choices improve assurance.

Incorrect Answers

A:

DNS management does not reconstruct datagrams that were dropped between the router and collector.

B:

Datagram delivery is not inherently ordered or reliable, so senders cannot assume every syslog event reached the collector.

C:

Standard UDP syslog does not use Kerberos as an inherent message transport requirement.

Question 212

A syslog collector receives a router message beginning with the priority field <134>. Under RFC 5424, which facility and severity does that PRI value encode?

  1. Facility local0 (16) and severity informational (6)
  2. Facility local0 (16) and severity warning (4)
  3. Facility local1 (17) and severity informational (6)
  4. Facility local0 (16) and severity debugging (7)

Explanation

Correct Answer

A:

Syslog encodes PRI as facility multiplied by eight plus severity. The value 134 equals 16 x 8 + 6, mapping to local0 and informational severity.

Incorrect Answers

B:

Facility 16 with warning severity 4 would produce PRI 132 rather than 134; the remainder after division by eight must equal six.

C:

Facility 17 with informational severity 6 yields PRI 142. The observed 134 has facility sixteen, not seventeen.

D:

Debugging severity uses numeric seven, which would produce PRI 135 for facility sixteen; 134 indicates informational severity six.

Question 213

A domain controller must alert when someone adds a user account to a security-enabled global group, such as Domain Admins. Which Windows Security event should the rule inspect when appropriate auditing is enabled?

  1. Event ID 4729
  2. Event ID 4732
  3. Event ID 4728
  4. Event ID 4625
  5. Event ID 4688

Explanation

Correct Answer

C:

Windows audit event 4728 records an addition to a security-enabled global group. The group, added member, actor, and domain controller context support escalation detection.

Incorrect Answers

A:

A 4729 record is generated when a member is removed from a security-enabled global group, not when membership is expanded.

B:

A 4732 record concerns adding a member to a security-enabled local group. The stem specifies a security-enabled global group.

D:

A 4625 event records a failed logon attempt. It is relevant to account access monitoring but does not document group membership additions.

E:

When auditing is enabled, a 4688 event reports process creation rather than a change to a security group's membership.

Question 214

Investigators need to know which executable was launched by a Windows user and the command line, where supported auditing is enabled. What telemetry should they seek?

  1. Process creation event 4688 with command-line auditing configured
  2. An identity provider's total request counter without process context
  3. A DHCP server's address-lease list
  4. A network firewall's connection summary without host process attribution
  5. Only a successful login event without process data

Explanation

Correct Answer

A:

The event can record process identity and launch parameters when appropriate audit policy and command-line capture are enabled.

Incorrect Answers

B:

Aggregate service counters cannot show which Windows executable ran or the command line used for a particular launch.

C:

Lease records can link an address to a client, but do not identify which local executable that client started.

D:

A firewall can show when a host connected but usually does not reveal the initiating Windows process command line on that machine.

E:

An authenticated session does not reveal all commands subsequently run under that identity.

Question 215

A Windows host may have executed encoded PowerShell commands. Which logging capability can capture script content useful for detection when enabled?

  1. Disabling PowerShell event collection to avoid noise
  2. Reading only basic process-start event 4688 without script content
  3. DNSSEC resolver validation logs alone
  4. PowerShell Script Block Logging, commonly event 4104

Explanation

Correct Answer

D:

Script block events can expose executed PowerShell content, improving visibility beyond generic process-start information.

Incorrect Answers

A:

Suppressing relevant events removes evidence of suspicious commands instead of improving confidence about execution.

B:

Process creation may show the PowerShell command line, but script block logging adds visibility into executed script content.

C:

DNS signature results may assist separate investigations but do not reveal local PowerShell script blocks.

Question 216

An SSH server's Linux auth logs show failures for dozens of usernames from one IP over a short period. What pattern should be assessed?

  1. A normal filesystem permission bit change
  2. Password spraying or account enumeration activity
  3. Guaranteed successful root compromise
  4. A standard system clock adjustment

Explanation

Correct Answer

B:

Broad username coverage and repeated failed authentication can indicate credential attacks, subject to checking authorized automation and logs.

Incorrect Answers

A:

chmod operations alter local access modes and are not equivalent to repeated SSH login attempts.

C:

Failure logs alone do not establish that any account authenticated or that root privileges were obtained.

D:

Time synchronization changes timestamps; it does not naturally produce login failures across many account names.

Question 217

Linux audit rules report execution of an unexpected binary by a service account. Which field set is most useful for attribution?

  1. Only the final exit status of the service account's login shell
  2. Only the owning service account's username with no process details
  3. The executable name without initiating UID, parent process, or timestamp
  4. Executable path, user identity, process context, and timestamp

Explanation

Correct Answer

D:

Combined execution details support correlation to the service, its parent activity, and related files or network events.

Incorrect Answers

A:

An exit code may describe success or failure but cannot reconstruct the executed binary, calling process, and event time.

B:

Account identity alone cannot identify the executable or its parent context when many actions run under one service identity.

C:

An executable name is a useful clue but is not enough to attribute a specific invocation to the service account and determine how and when it executed.

Question 218

A public web server receives many rapid requests for nonexistent admin paths, returning HTTP 404. What is a useful initial hypothesis?

  1. A successful password login has certainly occurred
  2. Automated web path discovery or vulnerability scanning
  3. The TLS certificate private key was necessarily stolen
  4. The server has completed a database backup

Explanation

Correct Answer

B:

High-volume probes for common nonexistent management endpoints can represent reconnaissance, though legitimate tests should be correlated.

Incorrect Answers

A:

A 404 for absent paths provides no evidence that authentication succeeded or an account was accessed.

C:

No certificate-key compromise can be inferred solely from requests for unknown web paths.

D:

Backup completion is unrelated to repeated URL enumeration visible as 404 responses in access logs.

Question 219

An application suddenly returns widespread HTTP 500 responses after a deployment. Which logs are most useful for determining the immediate failure reason?

  1. Application error logs correlated with deployment and reverse-proxy timestamps
  2. Only the website's valid TLS certificate expiration date
  3. Only interface-level traffic volume counters
  4. Only the reverse proxy's average response latency
  5. Only HTTP status codes without correlated application exceptions

Explanation

Correct Answer

A:

Server-side exceptions and related request identifiers can reveal which new code path failed and when the failures began.

Incorrect Answers

B:

Certificate lifecycle is worth checking for TLS errors, but it does not explain internal server exceptions after deployment.

C:

Traffic volume may indicate increased load but lacks the application stack trace or deployment event needed to explain failures.

D:

Latency can identify degradation but does not reveal the backend exception that produced application HTTP 500 responses.

E:

Five-hundred responses signal server failure, but the codes alone do not reveal the underlying exception or recent code change.

Question 220

A firewall deny log repeatedly records connection attempts from an internal host to a blocked remote IP. Which investigation action is most appropriate?

  1. Assume every blocked packet proves malware execution
  2. Suppress that source from every future alert indefinitely
  3. Delete the deny rule immediately without investigating
  4. Correlate source host activity with destination intelligence and policy intent

Explanation

Correct Answer

D:

Repeated denies may be benign misconfiguration or malicious callbacks; endpoint and threat data help determine the root cause.

Incorrect Answers

A:

Logs show policy enforcement, not automatically the intent or compromise status of the sending process.

B:

Permanent suppression hides potential evolution from a blocked attempt into a different successful communication path.

C:

The block may be preventing unsafe traffic, so removing it prematurely can reenable an attack path.

Certified Network Defender (312-38) Practice Tests