Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 6

Question 50

An IDS alerts whenever developers test a legitimate port scanner, wasting analyst time. What metric is the team trying to reduce?

  1. False positives
  2. Mean time to restore
  3. Packet fragmentation rate
  4. False negatives

Explanation

Correct Answer

A:

These are alerts for benign activity classified as malicious, so baselining and tuning can improve alert precision.

Incorrect Answers

B:

Restoration time is a service recovery metric, whereas the case is about incorrect IDS classification.

C:

Fragmentation is a network property that may complicate inspection, but it is not the alarm-classification error described.

D:

A false negative is malicious activity missed by detection, not a benign authorized scan that triggers an alarm.

Question 51

A NIDS misses traffic between two virtual machines on the same hypervisor because its physical tap never observes that path. What should the analyst do?

  1. Configure an additional perimeter IDS at the Internet edge
  2. Add a virtual-network sensor or appropriate virtual switch mirroring
  3. Collect only host-based authentication logs from both VMs
  4. Deploy another physical tap on the same uplink

Explanation

Correct Answer

B:

Local virtual switching may bypass the physical link, so the monitoring point must observe the actual east-west traffic path.

Incorrect Answers

A:

An edge sensor is even farther from a same-host VM-to-VM path and cannot capture the locally switched frames.

C:

Identity logs supply useful context but do not provide the packet-level east-west visibility the NIDS requirement specifies.

D:

Adding another sensor to a link not traversed by local virtual traffic still leaves the monitoring blind spot unaddressed.

Question 52

Two firewall devices process different directions of the same session; policy unexpectedly drops some return packets. What is the likely design issue?

  1. A certificate mismatch in the application handshake
  2. A mismatched TCP MSS setting on the transit links
  3. Asymmetric routing across independent state tables
  4. A mismatch in DNS TTL settings on the two paths

Explanation

Correct Answer

C:

A stateful firewall that sees only a reply may lack the corresponding session state and reject the packet unless synchronization is arranged.

Incorrect Answers

A:

Application-layer certificate validation happens after transport connectivity and does not explain loss of TCP state across diverging firewall paths.

B:

Path MTU and MSS issues may cause stalls or fragmentation, but the scenario attributes stateful denial to two independent devices seeing opposite directions of a session.

D:

DNS cache lifetime can affect which addresses clients select, but it cannot supply the missing connection state to a firewall seeing only a reply.

Question 53

A rule allowing TCP 443 from any source appears above a narrower rule restricting HTTPS to approved IP ranges. Why is the lower rule ineffective on a first-match firewall?

  1. Updating the DNS object referenced by the narrower rule
  2. Every firewall evaluates rules from bottom to top
  3. TLS automatically bypasses all source-address checks
  4. The broader preceding rule shadows the narrower rule

Explanation

Correct Answer

D:

When traffic is permitted by an earlier matching rule, the later restriction is never evaluated for that same flow.

Incorrect Answers

A:

Even if an address object changes, the first broad matching rule would still win before the restrictive rule is evaluated.

B:

Rule order is product-specific, but the scenario defines first-match behavior, making the earlier broad permission decisive.

C:

Encryption protects application data but cannot inherently prevent a firewall from evaluating visible packet addresses.

Question 54

A public web frontend must be reachable from the Internet, while its database must not be directly reachable from external networks. Which design is preferable?

  1. A public load balancer directly forwarding the database listener
  2. DMZ web tier with restricted application-to-database rules
  3. Place the database on the same unrestricted public subnet
  4. Put both tiers behind a single any-any ACL
  5. Use a reverse proxy but allow arbitrary inbound database connections from the Internet

Explanation

Correct Answer

B:

Expose only the required frontend and tightly define back-end flows, avoiding direct publication of database listener ports.

Incorrect Answers

A:

An Internet-facing database listener defeats the requirement to isolate backend data access behind the approved application tier.

C:

Public placement without restrictive controls creates avoidable direct attack exposure to a sensitive data store.

D:

A common permissive rule does not enforce the different reachability needs of web and database functions.

E:

A reverse proxy can protect the web tier, yet it does not secure a database listener that remains independently reachable through broad inbound rules.

Question 55

Workstations are unexpectedly sending SMTP directly to arbitrary Internet hosts. Which control best reduces spam originating from compromised endpoints?

  1. Allow all outbound TCP because inbound traffic is blocked
  2. Publish SPF records for the company's legitimate mail domains
  3. Set outbound mailbox quotas on the approved mail service only
  4. Egress filtering that permits SMTP only through approved mail relays

Explanation

Correct Answer

D:

Restricting outbound destination and port use prevents ordinary hosts from bypassing monitored, authenticated delivery points.

Incorrect Answers

A:

Outbound abuse remains possible despite inbound restrictions, including spam delivery and command-and-control sessions.

B:

SPF supports mail sender authorization but does not prevent infected workstations from making direct SMTP connections.

C:

Quotas can limit authorized mailbox usage, but cannot stop clients that bypass the service and connect to external SMTP hosts directly.

Question 56

An architect claims that assigning private RFC 1918 addresses behind NAT makes servers immune to lateral movement. What is the accurate objection?

  1. NAT authenticates every internal user before any flow
  2. Address translation does not replace segmentation or authorization
  3. NAT guarantees payload encryption for every protocol
  4. Private addresses are always routed directly from the public Internet

Explanation

Correct Answer

B:

NAT changes address mapping; compromised internal hosts may still communicate with reachable services under permissive rules.

Incorrect Answers

A:

Translation devices normally track address and port mappings, not individual application identities and entitlements.

C:

Changing packet addresses does not encrypt application data or prevent interception along permitted paths.

D:

RFC 1918 addresses are not globally routed as ordinary public addresses, though private paths can exist through VPNs.

Question 57

A router's administration interface is reachable from any public IP, despite a secure configuration on data ports. Which improvement has highest priority?

  1. Restrict only ordinary user traffic while leaving management listeners open
  2. Move the management web UI to a nonstandard public port
  3. Restrict the management plane to a trusted administration path
  4. Require SSH keys but leave the management service Internet reachable

Explanation

Correct Answer

C:

Management interfaces should be isolated by network policy and authenticated channels because data-plane filtering alone does not secure device control.

Incorrect Answers

A:

Data-plane rules do not necessarily control access to the router's own administrative services, leaving the core exposure intact.

B:

Port relocation may reduce casual scans, but does not create a trustworthy restricted administrative network path.

D:

Strong authentication helps, but source restriction and management-plane isolation still reduce attack opportunities before login.

Question 58

A switch must prevent an unauthorized host from responding as a DHCP server on a user port. Which control is most direct?

  1. An IP source guard rule without DHCP snooping trust enforcement
  2. Port mirroring to a collector
  3. Dynamic ARP Inspection alone with no DHCP server trust configuration
  4. DHCP snooping with only legitimate uplinks trusted

Explanation

Correct Answer

D:

Snooping filters server-side DHCP messages on untrusted ports and can establish bindings for related Layer 2 protections.

Incorrect Answers

A:

IP source guard may restrict host IP spoofing, but the stated threat is unauthorized DHCP server replies from an access port.

B:

Mirroring helps detect anomalous traffic after observation but cannot itself prevent a rogue offer reaching a client.

C:

DAI checks ARP sender claims; it is not the switch feature specifically designed to reject rogue DHCP offer packets.

Question 59

A network admin wants to stop attackers from spoofing a trusted gateway IP in ARP replies on user-facing switch ports. Which dependency makes Dynamic ARP Inspection effective?

  1. Reliable trusted IP/MAC binding information
  2. An unrestricted any-any ACL
  3. A larger Layer 2 broadcast domain
  4. Disabling switch logs permanently

Explanation

Correct Answer

A:

DAI needs a way to determine legitimate sender claims, commonly using DHCP snooping bindings or configured ARP access control.

Incorrect Answers

B:

A permissive Layer 3 ACL cannot validate ARP sender fields and weakens security beyond the local switching domain.

C:

Expanding the broadcast scope increases ARP exposure instead of supplying authoritative address bindings for inspection.

D:

Losing logs makes troubleshooting harder; it cannot give DAI accurate authorized sender mappings.

Question 60

Remote contractors must reach one approved internal application without obtaining broad routed access to the enterprise LAN. What model best matches?

  1. Flat network-level VPN access to all internal subnets
  2. Software-defined perimeter with identity-based application access
  3. Issuing each contractor an unmonitored shared password
  4. Publicly exposing the application's administrator port

Explanation

Correct Answer

B:

SDP-style access can conceal private applications from unauthenticated users and authorize narrowly scoped connections per identity and context.

Incorrect Answers

A:

Granting every internal route contradicts the need to limit a contractor to one application and reduce lateral movement.

C:

Shared credentials obscure accountability and do not implement application-scoped authorization for individual contractors.

D:

Publishing privileged services increases attack surface rather than selectively authenticating access to the approved workflow.

Certified Network Defender (312-38) Practice Tests