Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 7

Question 60

Remote contractors must reach one approved internal application without obtaining broad routed access to the enterprise LAN. What model best matches?

  1. Flat network-level VPN access to all internal subnets
  2. Software-defined perimeter with identity-based application access
  3. Issuing each contractor an unmonitored shared password
  4. Publicly exposing the application's administrator port

Explanation

Correct Answer

B:

SDP-style access can conceal private applications from unauthenticated users and authorize narrowly scoped connections per identity and context.

Incorrect Answers

A:

Granting every internal route contradicts the need to limit a contractor to one application and reduce lateral movement.

C:

Shared credentials obscure accountability and do not implement application-scoped authorization for individual contractors.

D:

Publishing privileged services increases attack surface rather than selectively authenticating access to the approved workflow.

Question 61

A domain policy must enforce workstation screen-lock settings, but a conflicting policy is linked closer to the computer's OU. Under ordinary Group Policy processing, which policy has precedence?

  1. A policy linked at the forest root without enforcement
  2. Any local GPO regardless of later domain policy
  3. Whichever administrator created their policy first
  4. The policy with the longest display name
  5. The applicable policy processed later at the child OU

Explanation

Correct Answer

E:

Local, site, domain, and OU links are normally processed in sequence, and later applied settings can override conflicting earlier settings.

Incorrect Answers

A:

An earlier policy link does not automatically beat a conflicting later child-OU setting when ordinary processing and inheritance apply.

B:

Local policy usually applies before domain and OU policies, so it does not automatically win a conflicting domain-managed setting.

C:

Creation chronology does not determine which conflicting policy setting becomes effective on a managed computer.

D:

Friendly naming is unrelated to Group Policy precedence; link order, inheritance, enforcement, and filtering govern application.

Question 62

Help-desk staff need to retrieve individual workstation local administrator passwords without assigning a shared fixed password. Which Windows management feature supports this?

  1. Group Policy Preferences with a shared recoverable local administrator password
  2. Periodic manual password changes with no centralized per-host escrow
  3. Windows LAPS
  4. A single password stored in a common spreadsheet

Explanation

Correct Answer

C:

Windows Local Administrator Password Solution manages unique local admin credentials and can control rotation and authorized retrieval.

Incorrect Answers

A:

Legacy common local secrets lack LAPS's per-device rotation and controlled retrieval and increase lateral movement risk.

B:

Manual rotation can be inconsistent and makes audited recovery of unique endpoint credentials harder than managed LAPS.

D:

Shared static secrets increase the impact of one disclosure and undermine unique local administrative identities.

Question 63

A laptop's system drive is protected by BitLocker with TPM-based integrity checks. A firmware change triggers recovery at startup. Which action is appropriate for authorized recovery?

  1. Share the recovery key in a public team chat
  2. Format the drive immediately to clear the TPM mismatch
  3. Disable all security updates across the fleet
  4. Retrieve the escrowed BitLocker recovery key through an approved identity workflow

Explanation

Correct Answer

D:

Recovery verifies the legitimate owner and unlocks a volume whose TPM measurements no longer satisfy normal automatic-unlock conditions.

Incorrect Answers

A:

Recovery material provides sensitive access and must be handled through controlled channels with accountability.

B:

Formatting destroys recoverable data and is unnecessary when a valid recovery key and authorized device access exist.

C:

A single recovery event does not justify reducing patch protection on unrelated devices or bypassing disk encryption governance.

Question 64

An attacker launches a script from a document that tries to spawn a command shell. Which Microsoft Defender capability can specifically restrict this class of behavior?

  1. Attack Surface Reduction rules for risky application behaviors
  2. An application reputation check only at download time
  3. Microsoft Defender Controlled Folder Access alone
  4. Windows time synchronization settings

Explanation

Correct Answer

A:

ASR rules can block defined high-risk process-launch and scripting patterns, depending on policy and enforcement mode.

Incorrect Answers

B:

File reputation may catch suspicious downloads, but it does not directly enforce process-child behavior once a trusted document reader executes.

C:

Folder controls can protect selected writable locations, but they are not the control intended to prevent an Office document from spawning a shell process.

D:

Time services make timestamps reliable but do not prevent an Office-launched script from starting a prohibited child process.

Question 65

A laptop moves between corporate, private home, and public Wi-Fi networks. Which Windows control allows different host firewall settings for these contexts?

  1. A Windows Firewall rule with no applicable network-profile scope
  2. One inbound allow rule applied regardless of network location
  3. A universal DNS search suffix list
  4. Windows Defender Firewall network profiles

Explanation

Correct Answer

D:

Domain, private, and public profiles permit different inbound and outbound enforcement based on the network's classified context.

Incorrect Answers

A:

A rule that does not distinguish active profiles will not provide the targeted profile-specific behavior required by the policy.

B:

A universal allow rule lacks the distinct restrictions required for public, private, and domain contexts.

C:

Name-resolution suffixes assist lookup but do not create independently enforceable packet-filter policies for public and domain networks.

Question 66

An administrator must allow Remote Desktop only from a management subnet and require authentication before creating the desktop session. What pairing fits?

  1. RDP Network Level Authentication plus a restricted firewall scope
  2. Network Level Authentication without any source-address restriction
  3. Open TCP 3389 to the Internet and rely on port secrecy
  4. Anonymous RDP combined with a wider network ACL

Explanation

Correct Answer

A:

NLA authenticates early in connection establishment, while host firewall rules constrain which source networks can reach RDP.

Incorrect Answers

B:

NLA improves authentication but still leaves RDP network reachability too broad if the firewall accepts all source networks.

C:

Public exposure increases password-attack risk, and the port number is not an access-control substitute.

D:

Anonymous access loses the requested identity check; opening broader paths also expands exposed remote-administration surfaces.

Question 67

After migrating an IIS application to a new domain service account, clients obtain Kerberos tickets but the web service reports KRB_AP_ERR_MODIFIED when accepting them. Which configuration should be investigated first?

  1. Verify the HTTP service principal name mapping and that the service can decrypt tickets with the correct account key
  2. Extend every user Kerberos ticket lifetime without inspecting service-account changes
  3. Increase the maximum accepted client clock skew across the entire domain
  4. Disable mutual authentication and permit unauthenticated HTTP fallback for the application

Explanation

Correct Answer

A:

Kerberos service tickets are encrypted for the account that owns the requested SPN. A stale or duplicate mapping, mismatched key, or incorrect service-account identity can stop the target from decrypting a valid ticket.

Incorrect Answers

B:

Ticket validity length does not correct a ticket encrypted for the wrong service identity. An account migration requires investigating SPNs and keys rather than broad lifetime changes.

C:

Clock drift has its own Kerberos error patterns and does not explain a service account that cannot decrypt a ticket after an identity migration.

D:

Weakening the application authentication model masks the failure rather than fixing the service principal and key mismatch, and creates an avoidable security gap.

Question 68

A legacy application uses NTLM when Kerberos would normally be available. Which defensive investigation should precede disabling NTLM outright?

  1. Audit NTLM usage and identify dependent applications and authentication paths
  2. Delete all service accounts without discovery
  3. Disable domain controllers' event logs
  4. Force Kerberos only without first examining legacy service dependencies
  5. Increase the maximum Kerberos ticket lifetime

Explanation

Correct Answer

A:

Measuring actual dependencies lets administrators plan safe remediation before enforcing restrictions that could break needed legacy workflows.

Incorrect Answers

B:

Sudden deletion can create outages and fails to determine whether NTLM fallback is due to service names or legacy clients.

C:

Removing authentication evidence conceals usage and makes it harder to locate affected applications before changing protocol policy.

D:

Immediate enforcement may interrupt systems that currently require NTLM, so an audit and remediation plan should precede restrictions.

E:

Extending ticket duration does not determine which applications are invoking NTLM or solve the compatibility issue.

Question 69

An organization wants to make theft of credentials from the Windows authentication subsystem harder. Which hardening option is relevant?

  1. Store service passwords in startup batch files
  2. Let ordinary users debug all protected system processes
  3. Disable endpoint security to improve logon speed
  4. Protect the LSASS process and enable supported credential-isolation protections

Explanation

Correct Answer

D:

LSASS protection and related isolation features increase barriers to unauthorized memory access, though platform compatibility must be tested.

Incorrect Answers

A:

Hard-coded secrets on endpoints increase theft opportunities and do not harden credential memory handling.

B:

Broad debugging rights make sensitive process memory easier to access, defeating the desired credential-protection boundary.

C:

Turning off detection increases exposure without addressing the privileged-memory access pathway described.

Question 70

A zero-day patch might interrupt a critical line-of-business client. Which deployment method best balances urgency with operational assurance?

  1. Install immediately on every device without rollback planning
  2. Ignore the flaw until the next major OS release
  3. Pilot on representative endpoints, monitor compatibility, then stage broad deployment
  4. Remove application telemetry until updates finish

Explanation

Correct Answer

C:

Ring-based rollout reduces widespread failure risk while still enabling a time-bound response to a high-priority vulnerability.

Incorrect Answers

A:

Uncontrolled fleet-wide release can cause an outage that staged testing and recovery options could reduce.

B:

An exposed critical defect may require timely action; indefinite delay is not a credible patch-risk strategy.

D:

Suppressing telemetry hides compatibility failures and security regressions during the very period they should be detected.

Certified Network Defender (312-38) Practice Tests