Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 25

Question 240

Two servers show the same malware alert, but one handles life-critical operations and the other is a nonproduction test machine. What should determine incident priority?

  1. Alphabetical order of hostnames
  2. Risk-based severity combining technical confidence, business impact, and exposure
  3. Which host has the larger number of installed applications
  4. The account creation date on the affected endpoints

Explanation

Correct Answer

B:

The same technical signal may demand different urgency when affected services have different safety, availability, and data consequences.

Incorrect Answers

A:

Naming order does not reflect harm potential, operational urgency, or confidence in the compromise evidence.

C:

Software inventory size may inform exposure, but cannot alone outweigh life-critical business impact and incident urgency.

D:

An account's age does not determine how dangerous an ongoing compromise is to a critical operational system.

Question 241

A bank cannot tolerate the same amount of downtime for payroll batch processing and real-time card authorization. Which activity formally identifies each process's criticality and dependencies?

  1. A generic server uptime report without process mapping
  2. An ordinary vulnerability severity ranking alone
  3. Business impact analysis (BIA)
  4. A general port scan of all hosts

Explanation

Correct Answer

C:

A BIA assesses consequences of disruption over time and informs recovery priorities, resources, and acceptable interruption thresholds.

Incorrect Answers

A:

Uptime indicates device availability but does not identify which business activities incur the highest losses during disruption.

B:

Vulnerability rankings characterize technical exposure, not the business consequences of losing distinct operational services.

D:

Port scans reveal reachable services but do not quantify the financial and operational impact of process downtime.

Question 242

An online ordering service must resume within two hours of a declared disruption. Which continuity metric represents this maximum targeted interruption?

  1. Mean time between failures (MTBF)
  2. Recovery point objective (RPO)
  3. Mean time to repair measured from component hardware failures
  4. Maximum transmission unit (MTU)
  5. Recovery time objective (RTO)

Explanation

Correct Answer

E:

RTO expresses the targeted interval for restoring a business service after a disruption, guiding capacity and recovery architecture decisions.

Incorrect Answers

A:

MTBF estimates reliability between failures and does not specify how quickly operations should resume after one occurs.

B:

RPO describes tolerable data loss measured in time, not how long the business function may remain unavailable.

C:

MTTR describes observed repair durations, while an RTO is the organization's defined maximum targeted service restoration window.

D:

MTU sets a packet size boundary and is unrelated to business service restoration deadlines.

Question 243

A ledger application can tolerate at most fifteen minutes of lost transactions following a disaster. Which objective is being specified?

  1. Recovery point objective (RPO)
  2. Annualized loss expectancy
  3. Recovery time objective (RTO)
  4. Service mean response time

Explanation

Correct Answer

A:

RPO defines the maximum acceptable age of recovered data, shaping replication frequency and backup strategies.

Incorrect Answers

B:

ALE estimates financial risk exposure and does not define a specific allowable recovery-data gap.

C:

RTO concerns time to bring the application back online; it does not by itself limit the age of restored records.

D:

Normal transaction latency measures performance during operation, not historical data that may be lost during recovery.

Question 244

A disaster site has powered servers, synchronized data, and ready network paths, allowing rapid takeover. What type of recovery location does it resemble?

  1. A backup appliance at the primary site with no alternate compute
  2. Hot site
  3. An archive-only offsite box store
  4. Cold site

Explanation

Correct Answer

B:

A hot site maintains extensive prepared infrastructure and may support relatively rapid failover compared with less provisioned alternatives.

Incorrect Answers

A:

A backup appliance may retain data but does not constitute ready alternate processing infrastructure after the site is lost.

C:

An archive store may preserve records but does not contain a prepared functioning application stack for immediate takeover.

D:

A cold site has limited ready equipment and generally requires substantial installation or restoration before supporting production.

Question 245

An organization has access to an alternate building with power and network connectivity but would need to bring in servers and restore data after a disaster. Which site classification is most appropriate?

  1. Fully synchronized hot site
  2. Automatically failing over warm site
  3. Active-active production region
  4. Cold site

Explanation

Correct Answer

D:

A cold site provides basic facilities but has little operational compute ready, resulting in longer restoration and setup activities.

Incorrect Answers

A:

A hot site contains ready systems and current data, unlike the described minimally provisioned location.

B:

A warm site has more preinstalled resources than the bare facility described, though readiness varies by implementation.

C:

Active-active architecture serves production traffic concurrently and is not simply an empty alternate facility.

Question 246

Before performing a risky full failover, a disaster recovery team wants to check roles, contact trees, and assumptions in a meeting. Which TWO activities are appropriate? Choose TWO.

  1. Document findings and assign owners for plan revisions
  2. Facilitate a structured tabletop exercise with realistic disruption injects
  3. Shut down every production data center without business approval
  4. Pretend exercise observations are evidence of a completed failover test
  5. Destroy prior continuity documents before the exercise

Explanation

Correct Answers

A:

Identified gaps need tracked corrective action so the exercise improves actual readiness rather than only participation counts.

B:

Discussion-based simulation reveals decision and communication gaps without requiring live cutover of production systems.

Incorrect Answers

C:

Unplanned live shutdown creates unnecessary service risk and exceeds the intended discussion-based practice.

D:

A tabletop validates decisions and roles, but cannot prove actual application recovery performance under load.

E:

Removing current plans prevents participants from using and improving the approved procedures they are meant to evaluate.

Question 247

Backup reports show daily success, but the latest restore test produces unreadable database files. What is the most important gap?

  1. A checksum generated only for the unreadable backup archive
  2. The nominal storage capacity allocated for backup retention
  3. The offsite backup location name without a restore test
  4. Recovery verification and application-consistent restore testing
  5. The count of successful backup jobs without restore validation

Explanation

Correct Answer

D:

Job completion is not evidence of usable data; planned restoration tests must verify consistency and functionality against recovery objectives.

Incorrect Answers

A:

A checksum may show an archive stayed unchanged, but it cannot establish that database transactions were captured consistently.

B:

Allocated space does not prove that the latest backup contains a recoverable, transactionally consistent database.

C:

An archive's storage location does not itself establish integrity of the recovered database contents.

E:

A job-success metric cannot establish that restored database files are consistent or readable by the target application.

Question 248

A regional flood renders the primary site unavailable for days. Who should invoke the formal disaster recovery plan according to established criteria?

  1. An external social-media account with no delegated role
  2. The designated authority under documented disaster declaration thresholds
  3. Whichever technician logs in first
  4. Any user who sees one failed ping

Explanation

Correct Answer

B:

Clear decision rights and triggers prevent confusion about when alternate site recovery begins and who coordinates it.

Incorrect Answers

A:

Public commentary cannot replace internal evidence, escalation, and authorized continuity governance decisions.

C:

Arrival order provides no accountability or established authority for invoking costly business-wide recovery actions.

D:

A single reachability failure may be transient and does not necessarily satisfy business-level disaster declaration criteria.

Question 249

A payment application relies on DNS, identity services, a message queue, and a third-party gateway. What must its recovery design account for?

  1. A standalone database restore without integration checks
  2. Restoration order and availability of critical dependencies
  3. Ignoring external providers because they are not on the company LAN
  4. Restore only the payment application VM, without planning dependent service recovery

Explanation

Correct Answer

B:

Recovering application binaries alone is ineffective if required authentication, naming, messaging, or external services are still unavailable.

Incorrect Answers

A:

Restored records may be necessary but are insufficient if other required runtime dependencies remain down.

C:

Third-party systems can be essential dependencies and require contractual and technical recovery coordination.

D:

A VM may boot successfully while its DNS resolution, authentication, message queue, or gateway dependency is still unavailable. Dependency mapping drives restoration order.

Question 250

A campuswide outage disables the usual messaging service. Which continuity action best supports incident coordination?

  1. Rely only on an unmaintained contact list from years ago
  2. Prearranged out-of-band communications with tested contact details
  3. Share confidential incident details in public social posts
  4. Require all responders to use the failed messaging platform

Explanation

Correct Answer

B:

Alternate channels let leaders and recovery teams coordinate when the primary network or messaging environment is unavailable.

Incorrect Answers

A:

Outdated contact details undermine the ability to reach responsible personnel and supplier escalation contacts.

C:

Public disclosure can expose victims and investigations while failing to establish controlled responder communication.

D:

A single unavailable channel creates a coordination dead end during precisely the event that requires communication.

Certified Network Defender (312-38) Practice Tests