Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 4

Question 30

A subsidiary wants to reuse a parent's security policy but operates a different legal environment. What should governance require?

  1. Perform an applicability review and adopt local control addenda
  2. Abandon all enterprise minimum standards immediately
  3. Treat network topology alone as a compliance map
  4. Copy the document unchanged without legal analysis

Explanation

Correct Answer

A:

Enterprise policies offer consistency, but requirements must be reconciled with applicable laws, contracts, and operational conditions.

Incorrect Answers

B:

Local adjustments need not eliminate baseline safeguards that remain useful across the broader organization.

C:

A topology shows connected systems, not all legal duties, data flows, processor roles, or evidence requirements.

D:

A policy written for another jurisdiction may omit required obligations or conflict with local processing constraints.

Question 31

A help-desk technician must reset passwords but must not change firewall ACLs. Which access model most naturally enforces that job boundary?

  1. Attribute-based access control without explicit job-role policy
  2. Discretionary access control owned by each user
  3. Mandatory access control classifications alone
  4. Role-based access control

Explanation

Correct Answer

D:

RBAC groups permissions by defined job responsibilities, allowing password-reset actions without unrelated network-administration rights.

Incorrect Answers

A:

ABAC can encode a role attribute, but a simpler defined help-desk role directly implements the stable task-based division requested.

B:

Owner-selected permissions may suit files but do not inherently enforce organization-wide separation of administrative duties.

C:

Classification-driven MAC governs resource sensitivity labels, but it is not the most natural model for delegating password-reset versus firewall tasks.

Question 32

Security policy grants access only when the device is compliant, the user is in finance, and the request originates from an approved region. Which access model expresses these combined predicates?

  1. A simple static VLAN assignment alone
  2. Role-based access control using only department membership
  3. Attribute-based access control
  4. Network access control based only on source IP subnet

Explanation

Correct Answer

C:

ABAC evaluates subject, resource, action, and environmental attributes at decision time, supporting conditional policy beyond static role membership.

Incorrect Answers

A:

VLAN placement contributes network separation, but it does not evaluate finance membership, endpoint compliance, and region jointly.

B:

A static finance role misses the required device-compliance and geographic conditions unless supplemented with attribute-based decisions.

D:

Source location alone cannot simultaneously check user department and managed-device posture at each decision.

Question 33

Administrators need MFA that resists credential phishing through an attacker-controlled lookalike login page. Which method best fits?

  1. A push notification with number matching but no origin binding
  2. FIDO2/WebAuthn with origin-bound authenticators
  3. Time-based one-time passwords generated on an authenticator app
  4. A reusable SMS one-time code entered into any form
  5. A static password plus a memorable security question
  6. A password sent to administrators by email

Explanation

Correct Answer

B:

WebAuthn binds authentication to the legitimate relying-party origin, preventing a credential from being replayed to a counterfeit site.

Incorrect Answers

A:

Number matching reduces careless prompt approval, yet an adversary-in-the-middle may still relay authentication to an impostor login flow.

C:

TOTP codes resist simple password reuse but can be entered into a reverse-proxy phishing site and forwarded before expiration.

D:

A phishing page can collect and relay an SMS code in real time, so the method is not resistant to adversary-in-the-middle phishing.

E:

Both values can be captured and reused by a convincing impersonation site, with no cryptographic origin binding.

F:

Emailing a password increases credential exposure and does not provide independent, phishing-resistant authentication.

Question 34

A domain administrator needs elevated directory rights for twenty minutes, with recording and approval. Which control is the best match?

  1. A permanent directory role assignment protected by ordinary MFA
  2. Privileged access management with just-in-time elevation
  3. Permanent membership in Domain Admins for every operator
  4. Session recording without just-in-time privilege approval

Explanation

Correct Answer

B:

Time-bound privileged access and session accountability reduce standing authority while retaining the ability to perform an approved task.

Incorrect Answers

A:

MFA improves login security, but standing admin membership fails the time-bound elevation and approval requirements.

C:

Standing broad privilege increases the blast radius of a stolen account and does not meet the requested short approval window.

D:

Recording provides accountability, but it does not remove standing privilege or enforce authorization for a limited elevation window.

Question 35

Multiple vendors' network switches must authenticate administrators centrally and record individual command authorization. Which protocol is especially suited to this device administration use case?

  1. TACACS+
  2. Kerberos authentication without separate command authorization
  3. RADIUS used without supported per-command authorization
  4. LDAP directory queries without a device command policy

Explanation

Correct Answer

A:

TACACS+ commonly separates device-administration authentication, authorization, and accounting, including fine-grained command controls where supported.

Incorrect Answers

B:

Kerberos can authenticate principals, but it does not by itself define per-command accounting for heterogeneous switch administration.

C:

RADIUS handles centralized AAA effectively for many services, but the question emphasizes fine-grained network device command authorization commonly offered by TACACS+.

D:

LDAP can supply identity data, but directory lookup alone does not provide the router-specific command authorization and accounting framework.

Question 36

A campus needs port-based admission control for wired laptops before normal LAN access, using a supplicant and a RADIUS-backed identity service. Which standard defines the access exchange?

  1. IEEE 802.1Q
  2. IEEE 802.1X
  3. IEEE 802.11r fast transition
  4. IEEE 802.3ad link aggregation

Explanation

Correct Answer

B:

The authenticator switch uses 802.1X/EAP to gate port access while an authentication server can validate the supplicant's identity.

Incorrect Answers

A:

802.1Q defines VLAN tagging; VLAN assignment can follow authorization but the standard does not perform user authentication.

C:

Fast transition helps wireless roaming; it is not the wired port admission framework specified in the question.

D:

Link aggregation joins physical interfaces for bandwidth or resilience and does not authenticate endpoint admission to a port.

Question 37

A network designer says devices already inside the office VLAN should automatically reach the payroll application. Which security approach most directly rejects that assumption?

  1. Zero Trust verification for every relevant access request
  2. A trusted-zone rule allowing every internal subnet
  3. A single Internet-edge ACL with no internal checks
  4. MAC address filtering as sole identity proof

Explanation

Correct Answer

A:

Zero Trust avoids implicit trust based solely on network location and uses identity, device, and context to authorize application access.

Incorrect Answers

B:

Blanket internal allow rules extend trust from location and contradict the requirement to verify individual requests.

C:

A perimeter ACL may filter external traffic but leaves east-west access unchecked after an actor reaches the internal network.

D:

MAC addresses can be spoofed and do not establish a strong human or workload identity for sensitive application authorization.

Question 38

A compromised workstation in one department must not initiate connections to database workloads in another department. Which architectural control most directly limits the movement?

  1. A larger DHCP address pool
  2. A single permissive internal route
  3. Microsegmentation enforced at workload boundaries
  4. An Internet proxy used only for web browsing
  5. A policy applied only to Internet-bound traffic

Explanation

Correct Answer

C:

Fine-grained east-west policy restricts specific source-to-destination flows instead of relying on one broadly trusted internal network.

Incorrect Answers

A:

DHCP pool size affects address availability, not whether an infected endpoint may traverse application trust boundaries.

B:

Routing reachability can make lateral movement easier and does not impose the necessary policy on allowed workloads.

D:

An outbound web proxy cannot necessarily govern direct internal client-to-database connections across the LAN.

E:

North-south controls may block external destinations but do not necessarily stop lateral client-to-database sessions inside the organization.

Question 39

Two teams share a switch fabric but must keep broadcasts isolated and route between segments only through monitored policy. What is the appropriate starting design?

  1. Disable routing while keeping all hosts in the same VLAN
  2. Separate VLANs with controlled Layer 3 inter-VLAN routing
  3. Put all endpoints in one unfiltered subnet
  4. Rely only on different SSID display names

Explanation

Correct Answer

B:

VLANs split broadcast domains, while a routed policy point can restrict the traffic that crosses between them.

Incorrect Answers

A:

Disabling routing does not isolate local broadcasts or same-subnet communication among the endpoints.

C:

A shared broadcast and IP domain removes the isolation needed to apply policy at the segment boundary.

D:

A wireless name is not itself a routed security boundary for wired devices on the same switching fabric.

Question 40

An application encrypts stored payment data with a symmetric key and needs integrity protection of ciphertext. Which mode supplies authenticated encryption?

  1. AES-GCM with correctly managed nonces
  2. Bare AES-CBC without a MAC
  3. AES-ECB
  4. A checksum appended without a secret

Explanation

Correct Answer

A:

GCM protects confidentiality and detects ciphertext or associated-data tampering when each nonce is used safely with its key.

Incorrect Answers

B:

CBC can conceal plaintext but lacks built-in integrity; modified ciphertext may pass unless a separate robust authentication mechanism is used.

C:

ECB exposes repeating plaintext block patterns and provides no authentication tag to detect tampering.

D:

An unkeyed checksum catches accidental corruption but can be recomputed by an adversary who changes the ciphertext.

Certified Network Defender (312-38) Practice Tests