Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 24

Question 230

An examiner copies a disk image and must later demonstrate that the evidence remained unchanged. Which procedure supports this?

  1. Disable custody documentation once the hash is saved
  2. Change the original disk content to make the image easier to read
  3. Calculate and record cryptographic hashes at acquisition and verification
  4. Record only the source disk model and advertised capacity

Explanation

Correct Answer

C:

Matching strong digests provide evidence that the image content is identical at compared stages, together with controlled evidence handling.

Incorrect Answers

A:

A hash does not identify who handled or accessed evidence, so a continuous custody record remains important.

B:

Modifying original media can contaminate evidence and undermine the fidelity of forensic reconstruction.

D:

Hardware metadata identifies media but cannot verify whether the acquired image bytes were preserved without modification.

Question 231

Several people move an acquired storage device between the SOC and a forensic lab. Which evidence practice creates accountability for those transfers?

  1. Use a different unexplained identifier at each transfer
  2. Allow informal handoffs with no timestamps
  3. Delete prior handler names after each transfer
  4. Maintain a chain-of-custody record for each handler and transfer

Explanation

Correct Answer

D:

Documenting possession, dates, purpose, and condition helps demonstrate controlled evidence handling across individuals and locations.

Incorrect Answers

A:

Inconsistent identifiers increase the chance of misattributing exhibits and weaken traceability across the investigation.

B:

Undocumented movement obscures who had access and can compromise confidence in evidence provenance.

C:

Removing history breaks the continuity needed to reconstruct the evidence's custodial path.

Question 232

Analysts identify a persistence mechanism after containing malware but before returning the host to service. Which next task is part of eradication?

  1. Suppress all endpoint detection alerts permanently
  2. Remove a suspicious shortcut while leaving the scheduled task intact
  3. Remove the malicious persistence and close the exploited entry path
  4. Restore unrestricted access while the malicious service remains
  5. Rotate compromised credentials while leaving the malicious scheduled task

Explanation

Correct Answer

C:

Eradication targets the attacker foothold and root cause rather than simply restoring traffic to an infected system.

Incorrect Answers

A:

Disabling detection does not remove malware and impairs validation that the foothold was eliminated.

B:

Cosmetic cleanup of one visible artifact is insufficient when a persistence mechanism continues to launch malicious code.

D:

Reconnection before removing active threats may permit reinfection or renewed adversary control.

E:

Credential rotation helps close one path but persistence can relaunch code, so the foothold must also be eradicated.

Question 233

A compromised finance server is ready for production restoration. What should recovery verification emphasize?

  1. Discard incident indicators before services restart
  2. Restore trusted state, verify functionality, and monitor for recurrence
  3. Return the server without validating data integrity
  4. Reuse stolen credentials without rotation

Explanation

Correct Answer

B:

Recovery includes validation of restored services and heightened telemetry so residual footholds or reinfection can be detected.

Incorrect Answers

A:

Losing indicators deprives monitoring of evidence that could reveal recurrent malicious activity after recovery.

C:

An unverified restore may retain corrupted records or malicious persistence despite appearing available.

D:

Compromised secrets can allow an attacker to reenter the restored system even after binaries are replaced.

Question 234

After containment and recovery, the team wants to reduce recurrence of the same intrusion. Which formal activity should follow?

  1. Delete the incident record to avoid revisiting mistakes
  2. Conduct a lessons-learned review and track corrective actions
  3. Stop all security training because the case is closed
  4. Assume recovery means the vulnerability is permanently gone

Explanation

Correct Answer

B:

A structured review identifies control, detection, and process gaps and assigns owners and deadlines for measurable improvements.

Incorrect Answers

A:

Removing records loses evidence of root causes and prevents tracking whether agreed controls were improved.

C:

Past closure does not negate ongoing education needs, especially when the incident involved a repeatable human workflow.

D:

Restoring service does not automatically verify patching, credential handling, or process improvements across related systems.

Question 235

A SOAR workflow is configured to disable accounts automatically on severe detections. Which safeguard best prevents a noisy rule from locking out legitimate users at scale?

  1. Remove action logs from the playbook
  2. Permit every low-confidence alert to disable any account
  3. Add validated enrichment, confidence thresholds, and approval for high-impact actions
  4. Give the automation identity unrestricted domain-wide privileges

Explanation

Correct Answer

C:

Orchestrated containment should be proportional and guarded against false positives, with auditable conditions for irreversible operations.

Incorrect Answers

A:

Eliminating accountability makes it harder to diagnose erroneous actions and restore accounts safely.

B:

Unchecked automation amplifies classification errors and can cause a widespread availability incident.

D:

Excessive rights increase impact of workflow errors or compromise beyond its necessary response tasks.

Question 236

Security operations require endpoint process trees, persistence clues, and remote isolation for laptops. Which tool class directly provides these endpoint capabilities?

  1. A standalone authoritative DNS server
  2. A network intrusion detection sensor without endpoint telemetry
  3. Endpoint detection and response (EDR)
  4. A simple NTP service alone

Explanation

Correct Answer

C:

EDR collects endpoint security telemetry and can support investigation and containment actions on managed hosts.

Incorrect Answers

A:

DNS infrastructure maps names to addresses but is not an endpoint process investigation and isolation platform.

B:

A NIDS observes selected traffic but does not inherently provide the host process trees and remote isolation operations requested.

D:

Time synchronization aids evidence quality but cannot isolate or analyze a compromised laptop.

Question 237

A security team wants to correlate endpoint malware behavior, cloud account misuse, and suspicious email activity under one detection workflow. Which approach fits best?

  1. Disk encryption alone
  2. Endpoint-only antivirus with no other data sources
  3. Extended detection and response (XDR) across integrated telemetry sources
  4. A SIEM with endpoint-only collection and no email or cloud integrations
  5. A passive Ethernet hub without inspection software

Explanation

Correct Answer

C:

XDR correlates multiple security layers to help identify campaigns that would be fragmented across isolated product consoles.

Incorrect Answers

A:

Encryption protects stored data and does not analyze coordinated misuse spanning endpoint and cloud control planes.

B:

Antivirus can inspect local threats but does not inherently correlate identities, email, and cloud events in one cross-domain investigation.

D:

Correlation remains constrained to the onboarded data sources and cannot detect the stated multichannel campaign without integrated coverage.

E:

A hub may repeat frames but supplies no native cloud or email telemetry correlation functionality.

Question 238

An organization lacks an overnight SOC and wants a contracted team to continuously investigate and respond under agreed service procedures. Which operating model is appropriate?

  1. Managed detection and response (MDR)
  2. A one-time vulnerability report with no monitoring
  3. A simple antivirus license without response services
  4. An unmanaged log server with no responders

Explanation

Correct Answer

A:

MDR supplies an externally operated detection and response service with defined responsibilities, escalation, and operational coverage.

Incorrect Answers

B:

Periodic scanning cannot substitute for ongoing analyst triage and response after business hours.

C:

Software protection alone is not equivalent to a managed team performing investigation and coordinated containment.

D:

Retaining events without personnel or workflow does not deliver the incident investigation and escalation service requested.

Question 239

A first responder discovers a breached server and must preserve evidence while escalating to the incident commander. Which TWO actions align with first-response practice? Choose TWO.

  1. Post raw customer logs publicly to request community assistance
  2. Reconfigure all unrelated servers before notifying the incident lead
  3. Document initial observations, times, and actions taken
  4. Reset the affected system without noting volatile state or business effects
  5. Follow authorized containment and evidence-preservation procedures

Explanation

Correct Answers

C:

A contemporaneous activity record preserves context, supporting later reconstruction of decisions and evidence provenance.

E:

Established roles and procedures reduce accidental contamination while allowing urgent safety and spread controls.

Incorrect Answers

A:

Uncontrolled disclosure violates confidentiality and can expose additional victims or credentials during an investigation.

B:

Unapproved broad changes can disrupt services, hide evidence, and exceed the responder's immediate assigned authority.

D:

Impulsive resets may destroy runtime artifacts and obscure the operational impact of the initial response.

Question 240

Two servers show the same malware alert, but one handles life-critical operations and the other is a nonproduction test machine. What should determine incident priority?

  1. Alphabetical order of hostnames
  2. Risk-based severity combining technical confidence, business impact, and exposure
  3. Which host has the larger number of installed applications
  4. The account creation date on the affected endpoints

Explanation

Correct Answer

B:

The same technical signal may demand different urgency when affected services have different safety, availability, and data consequences.

Incorrect Answers

A:

Naming order does not reflect harm potential, operational urgency, or confidence in the compromise evidence.

C:

Software inventory size may inform exposure, but cannot alone outweigh life-critical business impact and incident urgency.

D:

An account's age does not determine how dangerous an ongoing compromise is to a critical operational system.

Certified Network Defender (312-38) Practice Tests