Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 29

Question 280

A red team wants to assess an outside-facing application and claims verbal approval from an employee. What must defenders verify before permitting active tests?

  1. Written authorization defining targets, time windows, methods, and safeguards
  2. The tester's claimed job title alone
  3. That the organization has public DNS records
  4. A broad enterprise security-policy statement with no approved test scope
  5. A generic message saying the Internet is public

Explanation

Correct Answer

A:

Explicit scope protects operations and establishes legal authority and escalation paths for controlled security testing.

Incorrect Answers

B:

A title does not establish permission to probe production assets or override agreed operational restrictions.

C:

Public reachability is not consent for intrusive tests or proof of an authorized assessment.

D:

General policy support for testing is not permission to run unspecified active probes against identified production targets.

E:

Internet availability does not remove ownership or authorization requirements for security tests.

Question 281

A blue team and an authorized red team jointly replay selected tactics to improve detection rules. What collaboration model is this?

  1. Purple-team exercise
  2. A routine compliance document review without technique emulation
  3. A penetration test performed without defender participation or rule feedback
  4. Unapproved production penetration testing

Explanation

Correct Answer

A:

Combining adversary emulation with defender observation helps validate controls and refine alerts against relevant techniques.

Incorrect Answers

B:

A paperwork review cannot directly show whether deployed controls detect adversary tactics during controlled exercises.

C:

An isolated red-team report may identify weaknesses, but does not itself deliver the collaborative detection-tuning exercise described.

D:

Authorized, scoped collaboration differs from uncontrolled attempts that could interrupt business services.

Question 282

Security engineers repeatedly run safe, controlled attack simulations to check whether defenses still stop common techniques after configuration changes. Which practice fits?

  1. Perform destructive malware experiments on business-critical production systems
  2. Breach and attack simulation with documented safety limits
  3. Remove all endpoint telemetry before each simulation
  4. Treat old security design documents as evidence of present detection

Explanation

Correct Answer

B:

Automated simulations can continuously test selected defensive controls and identify drift when detections or prevention no longer trigger.

Incorrect Answers

A:

Uncontrolled destructive testing risks service interruption and violates the stated need for safe repeatability.

C:

Disabling evidence collection defeats the purpose of verifying whether defenses observe the chosen behavior.

D:

Design intent cannot establish that operational policies still detect simulated threats after ongoing environment changes.

Question 283

An attack-surface analyst suspects a retired administrative API route remains callable even though it is absent from the published API specification. Which TWO pieces of evidence would best establish that the legacy route is still externally exposed? Choose TWO.

  1. A current API specification that lists only the replacement route
  2. An authorized external test that successfully invokes the legacy route through the public hostname
  3. A legacy API handler present only in an archived source-code branch
  4. Reverse-proxy and application logs that confirm public requests to the retired path reach the active handler
  5. A vulnerability scan showing a different internal service is reachable from its private VLAN

Explanation

Correct Answers

B:

A successful out-of-network request to the exact retired API path demonstrates practical external reachability under the tested identity and conditions.

D:

Correlated live request logs can establish that the supposedly retired route is still processed on the production application path.

Incorrect Answers

A:

Documentation is not an authoritative record of all deployed handlers, so omitting an older path cannot prove it is unreachable.

C:

Archived code may never run in the live environment. Source history alone cannot show that a public endpoint is currently deployed.

E:

An unrelated private endpoint does not validate the specific legacy administrative API path from the external attack surface.

Question 284

A software vendor's update mechanism includes many third-party libraries. How can an asset owner better evaluate exposure when a dependency is newly found vulnerable?

  1. Treat a marketing product name as a complete dependency list
  2. Map the software bill of materials to deployed components and versions
  3. Assume every signed vendor product contains no vulnerable open-source code
  4. Disable all future supplier notifications

Explanation

Correct Answer

B:

Dependency-level inventory links a new advisory to affected shipped products and enables focused patching or supplier escalation.

Incorrect Answers

A:

Branding does not enumerate libraries or build components needed to determine exposure to specific third-party flaws.

C:

Package provenance does not guarantee that embedded dependencies have no defects or future advisories.

D:

Losing vendor advisories delays awareness of affected versions and remediation guidance for downstream customers.

Question 285

Attack surface review identifies unused admin services and forgotten test accounts on production servers. Which TWO changes directly shrink exploitable exposure? Choose TWO.

  1. Add new public ports for diagnostic convenience
  2. Revoke stale accounts and unused privileges
  3. Disable or remove unnecessary listening services
  4. Turn off host inventory updates after cleanup
  5. Keep unused accounts active indefinitely in case they are needed

Explanation

Correct Answers

B:

Removing obsolete identities and authorizations reduces opportunities for credential abuse and unauthorized management access.

C:

Closing unused listeners removes potential network entry points and reduces the code reachable by attackers.

Incorrect Answers

A:

More exposed listeners expand reachable functionality and increase the work needed to protect the service.

D:

Future changes can reintroduce exposure, so inventory and monitoring should continue after a reduction exercise.

E:

Dormant credentials can be stolen or abused, and their owners may no longer monitor associated access.

Question 286

Senior leaders want to understand multi-year cyber trends and how they could influence the company's investment priorities. Which intelligence level is most relevant?

  1. A raw switch port utilization snapshot
  2. A single failed user login event
  3. Strategic threat intelligence
  4. A single unsourced malware file hash

Explanation

Correct Answer

C:

Strategic reporting addresses business-level trends, motivations, and risk implications rather than individual packet indicators.

Incorrect Answers

A:

Network performance telemetry does not describe the broader threat landscape driving executive security planning.

B:

One authentication failure lacks the context needed for leadership decisions about changing adversary campaigns.

D:

A technical indicator is useful for blocking or investigation but cannot alone explain long-term investment implications.

Question 287

Detection engineers need information about adversary TTPs and common credential-access methods to improve analytic coverage. Which intelligence type should they seek?

  1. Tactical intelligence on techniques and behavior patterns
  2. A raw list of suspicious IP addresses without behavioral context
  3. A strategic board report about changing cybercrime economics
  4. Only macroeconomic industry forecasts

Explanation

Correct Answer

A:

Tactical material explains how adversaries operate, allowing teams to map controls and detections to repeatable methods.

Incorrect Answers

B:

IP indicators aid enrichment, but do not describe repeatable credential-access methods for technique-focused detection engineering.

C:

Business-level threat trends may guide budgets, but do not map concrete credential-access techniques to detection rules.

D:

Economic outlooks may support strategy but do not identify actionable adversary behaviors or detection gaps.

Question 288

An intelligence bulletin describes an imminent campaign targeting a specific industry, including expected timing and likely objectives. Which intelligence level does it primarily represent?

  1. Technical intelligence limited to isolated file hashes
  2. An internal vulnerability ranking with no campaign timeline
  3. Operational threat intelligence
  4. Business impact analysis of an internal service

Explanation

Correct Answer

C:

Operational reporting provides campaign context, likely targets, and timing that can guide near-term defensive coordination.

Incorrect Answers

A:

Raw indicators may support blocking but do not alone summarize a campaign's expected timing and strategic objective.

B:

Patch rankings show technical exposure but cannot alone identify the intended targets and timing of a pending adversary operation.

D:

A BIA evaluates consequences of downtime, not the operational details of a predicted adversary campaign.

Question 289

A SOC receives validated malicious IP addresses, domain names, and file hashes for immediate enrichment. Which intelligence category is this?

  1. A software asset depreciation schedule
  2. A disaster recovery staffing roster
  3. Technical threat intelligence
  4. Strategic intelligence solely for board planning

Explanation

Correct Answer

C:

Machine-consumable indicators support searches and rules against specific observables, although quality and expiry must be assessed.

Incorrect Answers

A:

Financial asset accounting cannot directly match malicious domains or hashes against operational telemetry.

B:

Personnel assignments support recovery planning, not threat observables for endpoint and network correlation.

D:

High-level trend analysis does not usually consist of individual IPs and hashes for immediate detection pipelines.

Question 290

A network defender observes a file hash seen in known malware and separately sees the behavior of suspicious credential dumping. Which distinction is accurate?

  1. A file hash always proves the attacker's identity
  2. Attack behaviors never matter once an IoC is available
  3. The hash is an IoC; the credential-dumping behavior is an IoA
  4. Both observations are only business continuity metrics

Explanation

Correct Answer

C:

A compromise indicator is an artifact associated with malicious activity, while an attack indicator reflects actions or techniques as they unfold.

Incorrect Answers

A:

A hash may identify content but normally cannot uniquely attribute the actor operating or distributing it.

B:

File hashes can change easily, so behavior-based indicators often improve resilience against modified malware samples.

D:

Neither an executable hash nor credential dumping measures restoration objectives or outage duration.

Certified Network Defender (312-38) Practice Tests