Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 28

Question 270

A formal risk program has implemented controls and needs to ensure exposure remains acceptable as business systems change. Which TWO activities support continuous monitoring? Choose TWO.

  1. Review emerging threats, control performance, and material environment changes
  2. Freeze every assessment score permanently after initial approval
  3. Remove all residual risks from management reporting
  4. Treat a completed audit as proof that no future threats can emerge
  5. Report deviations and treatment progress to accountable risk owners

Explanation

Correct Answers

A:

Risk changes with vulnerabilities, architecture, and attacker behavior, making periodic reassessment necessary.

E:

Governance needs evidence that controls work and exceptions or remediation deadlines are handled appropriately.

Incorrect Answers

B:

Static scores become outdated when systems, dependencies, and threat conditions change.

C:

Unreported exposure cannot be evaluated against business tolerance or revisited by authorized decision makers.

D:

An audit represents limited evidence at a point in time and cannot guarantee enduring immunity from new attack paths.

Question 271

A company manages known production servers but wants to discover public IPs, DNS names, and applications an attacker could find outside its network. What capability should it develop?

  1. Existing firewall rules without a public asset inventory
  2. An identity access review with no domain or external asset discovery
  3. External attack surface management (EASM)
  4. A one-time internal vulnerability scan of known server IPs

Explanation

Correct Answer

C:

EASM continuously maps Internet-visible assets and exposed services, including resources missing from internal inventories.

Incorrect Answers

A:

Firewall policies constrain known paths but do not reveal all externally accessible services or unexpected resource ownership.

B:

Access review helps govern users but cannot enumerate unknown public endpoints or DNS names used by attackers.

D:

Internal scanning may identify weaknesses on known systems but can miss untracked Internet-facing resources.

Question 272

An external scan finds a marketing microsite that is not listed in the central asset inventory. What governance problem has likely occurred?

  1. Automatic confirmation of an insider data breach
  2. Evidence that all inventory tools are permanently unusable
  3. Normal certificate key rotation
  4. Shadow IT or untracked asset deployment

Explanation

Correct Answer

D:

Resources provisioned outside approved inventory processes create ownership, patching, and monitoring gaps that attackers can exploit.

Incorrect Answers

A:

Untracked ownership raises risk but does not alone prove unauthorized extraction of business information.

B:

One missing system shows a gap requiring reconciliation, not proof that every tool is beyond repair.

C:

Key rotation changes cryptographic lifecycle state and does not explain an undocumented website deployment.

Question 273

A company sends public web traffic through a managed WAF, but external recon discovers that its application origin server also accepts direct HTTP requests on a public IP address. What attack-surface weakness does this create?

  1. A legitimate private health check from the WAF to its backend
  2. An origin-bypass route around intended WAF inspection
  3. An HTTPS certificate trust error between the client and the WAF
  4. A WAF policy that permits one unwanted HTTP method

Explanation

Correct Answer

B:

Direct reachability lets adversaries address the backend without necessarily traversing the Layer 7 security policies at the public WAF.

Incorrect Answers

A:

Controlled health checks from known gateway addresses are normal; arbitrary public access to the origin exposes a separate attack path.

C:

Client trust problems affect TLS verification and do not explain how an attacker can reach the origin without using the protected entry point.

D:

An overly permissive method rule weakens inspection for traffic that does pass through the WAF, whereas the finding identifies a different public path.

Question 274

A decommissioned cloud application leaves a DNS CNAME pointing to a third-party service name that no longer belongs to the organization. What attack should defenders assess?

  1. An abandoned CNAME that still targets a resource permanently reserved to the same tenant
  2. Intentional DNSSEC key rollover
  3. Mandatory ARP spoofing across the Internet
  4. Potential subdomain takeover through a dangling DNS record
  5. Guaranteed compromise of domain registrar credentials

Explanation

Correct Answer

D:

If a provider lets another tenant claim the abandoned resource, attackers may serve content from the organization's trusted hostname.

Incorrect Answers

A:

Stale records create risk, but takeover requires a claimable target; active verified ownership would change the exploitation condition.

B:

Proper DNS key rotation concerns signed-zone trust and does not itself create an unclaimed external service target.

C:

ARP poisoning depends on local link-layer paths and is not the mechanism for reclaiming a stale SaaS hostname binding.

E:

A dangling CNAME can be abused without the attacker necessarily changing the organization's registrar account.

Question 275

A company wants early notice when new public TLS certificates are issued for its owned domains. Which data source can aid discovery?

  1. Only existing HTTPS listener logs from known servers
  2. Only internal DNS query caching statistics
  3. Local Windows pagefile statistics
  4. Certificate Transparency logs

Explanation

Correct Answer

D:

Public issuance records can reveal unexpected hostnames or certificate activity, subject to log coverage and validation of actual ownership.

Incorrect Answers

A:

Application logs cover inventoried hosts but cannot independently reveal new certificate issuance for forgotten subdomains.

B:

Internal resolver counts do not reliably expose newly issued public certificates for an organization's hostnames.

C:

Memory paging records do not show Internet certificate issuance for organization-controlled hostnames.

Question 276

Employees deploy unreviewed SaaS tools using corporate credentials, creating unknown external data destinations. What inventory effort most directly reduces this exposure?

  1. Discover and govern SaaS application use and identity integrations
  2. Disable identity-provider audit logs
  3. Expand all on-premises server subnets without recording changes
  4. Block every software update regardless of origin

Explanation

Correct Answer

A:

SaaS visibility links third-party applications to accounts, permissions, and data flows so access can be reviewed and revoked.

Incorrect Answers

B:

Removing authentication and consent evidence conceals unmanaged SaaS activity instead of helping assess it.

C:

More internal address capacity does not identify third-party tenants or risky OAuth permissions granted by staff.

D:

Indiscriminate update blocking introduces new vulnerabilities and does not provide governance over external SaaS application use.

Question 277

A team inventories external assets using only IPs in a spreadsheet, but cloud addresses and ephemeral services change weekly. What is needed?

  1. A static inventory of on-premises hardware without cloud resource discovery
  2. A one-time static IP report printed annually
  3. A DNS resolver reset once per year
  4. Continuous discovery with ownership and cloud API reconciliation

Explanation

Correct Answer

D:

Automated scanning and provider inventory connections reduce gaps created by elastic addresses and frequently changing endpoints.

Incorrect Answers

A:

Traditional equipment inventories cannot account for rapidly provisioned cloud endpoints and managed platform services.

B:

A yearly snapshot cannot reliably represent dynamically created or retired cloud instances over the intervening months.

C:

Cache invalidation affects lookup behavior and does not track cloud asset provisioning over time.

Question 278

A cloud project exposes a managed database to all Internet addresses despite an internal-only design requirement. What should attack surface analysis recommend?

  1. Expand the database's public CIDR allowance for convenience
  2. Disable cloud configuration audits until after launch
  3. Keep public exposure and merely obscure the database hostname
  4. Remove public network exposure and use controlled private connectivity

Explanation

Correct Answer

D:

Reducing the reachable path is more robust than relying solely on credentials when the service has no public access requirement.

Incorrect Answers

A:

Broader ingress makes more clients able to reach the sensitive listener and increases the surface under assessment.

B:

Missing audits hides whether the exposure persists and makes later drift harder to detect.

C:

Names can be discovered, and public reachability remains a source of exploitation and password-guessing opportunities.

Question 279

An attack surface report lists an exposed admin interface, but no telemetry shows successful exploitation. What category best describes the exposed condition?

  1. Proven incident containment
  2. Verified exfiltration of secrets
  3. Indicator of exposure (IoE)
  4. Confirmed indicator of compromise (IoC)

Explanation

Correct Answer

C:

An IoE points to a risky reachable configuration or weakness before any confirmed compromise, supporting preventive remediation.

Incorrect Answers

A:

Discovery of exposure is not evidence that affected systems are isolated or the risky configuration has been corrected.

B:

Unrestricted reachability cannot establish that information was transferred out of the environment.

D:

IoCs represent signs associated with compromise; an exposed interface alone does not prove an attacker used it.

Question 280

A red team wants to assess an outside-facing application and claims verbal approval from an employee. What must defenders verify before permitting active tests?

  1. Written authorization defining targets, time windows, methods, and safeguards
  2. The tester's claimed job title alone
  3. That the organization has public DNS records
  4. A broad enterprise security-policy statement with no approved test scope
  5. A generic message saying the Internet is public

Explanation

Correct Answer

A:

Explicit scope protects operations and establishes legal authority and escalation paths for controlled security testing.

Incorrect Answers

B:

A title does not establish permission to probe production assets or override agreed operational restrictions.

C:

Public reachability is not consent for intrusive tests or proof of an authorized assessment.

D:

General policy support for testing is not permission to run unspecified active probes against identified production targets.

E:

Internet availability does not remove ownership or authorization requirements for security tests.

Certified Network Defender (312-38) Practice Tests