Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 23

Question 220

A firewall deny log repeatedly records connection attempts from an internal host to a blocked remote IP. Which investigation action is most appropriate?

  1. Assume every blocked packet proves malware execution
  2. Suppress that source from every future alert indefinitely
  3. Delete the deny rule immediately without investigating
  4. Correlate source host activity with destination intelligence and policy intent

Explanation

Correct Answer

D:

Repeated denies may be benign misconfiguration or malicious callbacks; endpoint and threat data help determine the root cause.

Incorrect Answers

A:

Logs show policy enforcement, not automatically the intent or compromise status of the sending process.

B:

Permanent suppression hides potential evolution from a blocked attempt into a different successful communication path.

C:

The block may be preventing unsafe traffic, so removing it prematurely can reenable an attack path.

Question 221

DNS query logs show one endpoint using a previously unseen algorithmically patterned set of hostnames. Which additional evidence would best strengthen the finding?

  1. Correlate query timing, domain reputation, and endpoint process activity
  2. Disable resolver request logging before collecting host artifacts
  3. Treat all generated-looking names as malicious without examining initiator context
  4. Treat any syntactically valid domain as benign

Explanation

Correct Answer

A:

Combining DNS patterns with host context helps differentiate generated command-and-control lookups from legitimate dynamic services.

Incorrect Answers

B:

Removing visibility may destroy the timeline required to identify the process driving suspicious lookups.

C:

Legitimate dynamic services may generate many hostnames, so behavioral correlation is needed to establish suspicious origin.

D:

Attack infrastructure can use legitimate DNS syntax, so validity alone cannot establish trustworthiness.

Question 222

Log events from routers and servers disagree by seven minutes, making an intrusion timeline difficult to reconstruct. Which foundational service should be checked?

  1. A common DNS suffix configured on all monitored devices
  2. Network Time Protocol synchronization and reliable time sources
  3. Compression settings on archived PCAP files
  4. A wider DHCP lease duration on branch workstations

Explanation

Correct Answer

B:

Consistent timestamps are essential for cross-system correlation, and time drift can create false sequence interpretations.

Incorrect Answers

A:

Resolver suffix consistency does not correct independent host clocks or restore cross-system event ordering.

C:

Compression changes file size but does not correct the clocks used to timestamp original system events.

D:

Lease duration controls address assignment timing and does not synchronize timestamps emitted by multiple logging systems.

Question 223

A SOC receives authentication events from VPN, cloud identity, and endpoints and wants to flag one account failing everywhere before succeeding from a new region. Which tool capability is central?

  1. A standalone router interface counter with no identity fields
  2. SIEM correlation across normalized identities and event times
  3. A standalone set of VPN summaries without common identity normalization
  4. Per-endpoint log deletion on successful login

Explanation

Correct Answer

B:

Cross-source normalization and rules can join signals into one account-level pattern that isolated device alerts might miss.

Incorrect Answers

A:

Interface counters reveal traffic volumes and errors but do not link authentication events across distinct identity services.

C:

One log source cannot reliably join endpoint and cloud identity failures into the account-level sequence the SOC needs.

D:

Removing history destroys the sequence needed to understand prior failures and the subsequent anomalous success.

Question 224

Investigators worry an attacker will modify central log files after collection. Which preservation property should be prioritized?

  1. Tamper-evident or immutable log storage with controlled write permissions
  2. World-writable archives that every analyst may overwrite
  3. Deleting raw logs as soon as a dashboard refreshes
  4. Relying on filename extensions to prove log authenticity

Explanation

Correct Answer

A:

Integrity controls and restricted changes make unauthorized edits more detectable and preserve reliable incident evidence.

Incorrect Answers

B:

Broad modifications make it easy to rewrite evidence and difficult to distinguish legitimate edits from malicious tampering.

C:

Dashboards may summarize events but are not a reliable substitute for preserved original evidence with provenance.

D:

Extensions are user-controlled text and do not attest to record integrity, custody, or authorization.

Question 225

The company centralizes full HTTP logs containing user identifiers. What should its retention and access policy consider?

  1. Data minimization, purpose, legal obligations, access roles, and deletion schedules
  2. Remove all authentication from the log repository to simplify SOC access
  3. Retain every event forever without review
  4. Unlimited public access because logs are only metadata

Explanation

Correct Answer

A:

Security logs can themselves contain sensitive data, so retention must balance investigation utility with privacy and exposure risks.

Incorrect Answers

B:

Unauthenticated access permits unauthorized viewing or alteration of personal and security-sensitive telemetry.

C:

Indefinite storage may exceed business and legal needs and increases the impact of a log repository compromise.

D:

URLs, IPs, and identifiers can be sensitive, so treating them as harmless public records is inappropriate.

Question 226

A suspicious alert points to one endpoint contacting a known malicious host, but the alert could also match an approved test. What should the responder do first?

  1. Publicly announce full organizational compromise at once
  2. Reimage every workstation immediately
  3. Ignore all matching events until another month passes
  4. Triage the alert against host context, asset criticality, and corroborating events

Explanation

Correct Answer

D:

Early validation distinguishes false alarms from actual threats and sets priorities before disruptive containment measures.

Incorrect Answers

A:

External declarations should follow established escalation and evidence review, not an unvalidated single alert.

B:

Fleet-wide destructive action is disproportionate to one uncertain observation and can erase useful evidence.

C:

Delayed evaluation can let a real infection progress; a quick evidence-based triage is preferable.

Question 227

Several compromised endpoints share one credential, but no evidence shows impact to servers. Which response task establishes the actual incident boundary?

  1. Scope affected accounts, systems, and reachable resources using telemetry
  2. Assume the entire environment is unaffected beyond the first machine
  3. Destroy the only network-flow archive
  4. Limit the report to the first host discovered

Explanation

Correct Answer

A:

Scoping traces compromise breadth and access paths, allowing containment decisions proportionate to what the attacker could reach.

Incorrect Answers

B:

Unsupported assumptions may overlook the shared credential's lateral-access capability.

C:

Flow history could reveal connections to other hosts; deletion would impede the needed spread analysis.

D:

An initial infected host may not represent all impacted identities or systems, leaving the incident's true boundaries unknown.

Question 228

A ransomware process is active on a workstation, and the incident team wants to stop spread while preserving evidence where feasible. Which immediate action is most appropriate?

  1. Keep the host fully connected so the malware finishes
  2. Share the host administrator password with every team member
  3. Isolate the endpoint from production networks through an approved containment method
  4. Delete all logs before changing any network setting

Explanation

Correct Answer

C:

Network isolation can halt additional lateral traffic while responders preserve relevant volatile and persistent artifacts according to procedure.

Incorrect Answers

A:

Leaving ongoing malicious activity unrestricted risks further encryption, credential theft, and movement to other systems.

B:

Broad distribution of powerful credentials adds exposure during an already sensitive incident.

D:

Evidence destruction impairs attribution and does not reduce the ransomware's opportunity to spread.

Question 229

Responders plan to power off a compromised server, but memory-resident malware and encryption keys may be volatile. What evidence action deserves consideration first?

  1. Assume disk images always contain every running process secret
  2. Acquire authorized volatile memory and runtime state where safe
  3. Reset all clocks to a convenient timestamp
  4. Execute untrusted tools from a public file share as root

Explanation

Correct Answer

B:

Memory capture can preserve processes, connections, and ephemeral secrets that disappear on shutdown, though safety and containment priorities govern order.

Incorrect Answers

A:

Disk acquisition cannot reliably recover all volatile memory artifacts after the host has lost power.

C:

Altering time can damage event correlation and should not precede preservation of the original incident state.

D:

Unknown binaries can contaminate evidence and introduce additional compromise during acquisition.

Question 230

An examiner copies a disk image and must later demonstrate that the evidence remained unchanged. Which procedure supports this?

  1. Disable custody documentation once the hash is saved
  2. Change the original disk content to make the image easier to read
  3. Calculate and record cryptographic hashes at acquisition and verification
  4. Record only the source disk model and advertised capacity

Explanation

Correct Answer

C:

Matching strong digests provide evidence that the image content is identical at compared stages, together with controlled evidence handling.

Incorrect Answers

A:

A hash does not identify who handled or accessed evidence, so a continuous custody record remains important.

B:

Modifying original media can contaminate evidence and undermine the fidelity of forensic reconstruction.

D:

Hardware metadata identifies media but cannot verify whether the acquired image bytes were preserved without modification.

Certified Network Defender (312-38) Practice Tests