EC-Council 312-38 Practice Exam

• A. Tagging each purchased device with a barcode label at delivery
• B. Network admission control that blocks devices missing from the inventory Correct answer
• C. Monthly vulnerability scans of the documented server and desktop subnets
• D. A yearly physical audit of the equipment in the server room

Option B is correct because network admission control checks each connecting device against the inventory and refuses those that are not listed, so an unrecorded server cannot join. Barcode labels, scans of documented subnets and yearly physical audits only record or find assets after the fact and do not stop an unknown device from connecting.

• A. Paranoid
• B. Promiscuous
• C. Permissive Correct answer
• D. Prudent

Option C is correct because a permissive policy starts with everything allowed and blocks only the services and attacks known to be dangerous. A paranoid policy blocks everything, a prudent policy blocks all and then permits only safe services, and a promiscuous policy has no restrictions at all.

• A. A level that senior management accepts Correct answer
• B. The lowest level the current budget allows
• C. Zero residual risk
• D. The level a cyber insurance carrier requires

Option A is correct because risk can never be eliminated, so network defense reduces risk to a level that senior management formally accepts. Option C is wrong since zero residual risk is unattainable. Options B and D are wrong because a budget limit or an insurer's requirement may influence the target but does not define it.

• A. A packet-filtering router, with the bastion host behind it
• B. A single firewall, with the DMZ on a third interface
• C. A dual-homed host, with routing between its NICs disabled
• D. A pair of back-to-back firewalls, with the DMZ between them Correct answer

Option D is correct because back-to-back firewalls place the DMZ between an outer and an inner firewall, so compromising or misconfiguring one firewall does not directly expose the internal LAN. A packet-filtering router with a bastion host, a dual-homed host and a single firewall with a third interface each depend on one device to protect the inside.

• A. The application port is opened to the internet for approved source addresses
• B. Traffic is tunneled to the data center and inspected by the perimeter firewall
• C. Remote users receive addresses on the internal subnet once they log in
• D. Each session is authorized per application after user and device checks Correct answer

Option D is correct because a software-defined perimeter authorizes each session to a specific application only after user and device checks, instead of granting network-level access. Opening ports, tunneling everything to the data center and handing out internal addresses all keep the broad network-level trust that a VPN gives.

• A. Reference monitor
• B. Object
• C. Access control list
• D. Subject Correct answer

Option D, Subject, is correct because in access control terminology the subject is the active entity (a user, process or device) that requests access. Option B, Object, is the resource being accessed, Option A, Reference monitor, is the mechanism that mediates each request, and Option C, Access control list, is a list of permissions attached to an object, so none of them is the requester.

• A. Share one local administrator account across the workstations, and rotate its password every ninety days
• B. Keep one domain admin account for all tasks, and enforce lockout after five failed sign-ins
• C. Run support tasks under a service account, and add that account to the Domain Admins group
• D. Use a standard account for daily work, and a separate admin account on dedicated admin hosts Correct answer

Option D is correct because separating a standard daily account from an admin account used only on dedicated admin hosts keeps domain admin credentials from being cached on ordinary workstations where they can be stolen. Shared local admin accounts, one domain admin for all tasks, and adding a service account to Domain Admins all increase exposure.

• A. NIST National Vulnerability Database
• B. MITRE ATT&CK for ICS
• C. OWASP Internet of Things Project Correct answer
• D. CIS Controls project

Option C is correct because the OWASP Internet of Things Project publishes the IoT Top 10 list of common weaknesses. The NVD is a vulnerability database, MITRE ATT&CK for ICS catalogs adversary techniques against industrial systems, and the CIS Controls are a general security control set.

• A. Move them to an isolated VLAN, and allow only recorder traffic Correct answer
• B. Change the default passwords, and disable the unused web management interface
• C. Block their outbound internet access, and keep them on the user VLAN
• D. Schedule weekly vulnerability scans, and record the findings in the risk register

Option A is correct because devices that can no longer be patched are best contained by network isolation, with a VLAN that allows only the traffic the recorder needs. Changing passwords, blocking outbound access while leaving them on the user VLAN, or scanning weekly leaves the unpatchable flaws within reach of the corporate LAN.

• A. Cloud DLP
• B. Storage DLP
• C. Network DLP
• D. Endpoint DLP Correct answer

Option D is correct because an agent installed on laptops that blocks copying files to USB is Endpoint DLP, which controls data at the device. Network DLP inspects traffic in transit, Storage DLP scans data at rest on servers and repositories, and Cloud DLP protects data in cloud services.

• A. Require HTTPS for all of the public website pages that customers visit
• B. Enable full-disk encryption on the drives inside the web server hardware
• C. Enable transparent data encryption for the main database data and log files
• D. Require TLS on the connection from the web server to the database Correct answer

Option D is correct because the capture shows queries crossing the network in cleartext, and requiring TLS on the web server to database connection encrypts that traffic. HTTPS on the public site protects a different link, and full-disk encryption or transparent data encryption protect data at rest, not data in transit.

• A. 500
• B. 1701
• C. 1812
• D. 4500 Correct answer

Option D (4500) is correct because IPsec NAT traversal wraps ESP packets in UDP port 4500 so they can pass through NAT devices. Option A (500) carries the initial IKE negotiation but not the encapsulated traffic, Option B (1701) is L2TP, and Option C (1812) is RADIUS authentication.

• A. Capabilities
• B. Control groups Correct answer
• C. Namespaces
• D. seccomp profiles

Option B is correct because control groups (cgroups) limit and account for the CPU, memory and other resources a container may use. Namespaces isolate what a container can see, capabilities split root privileges, and seccomp profiles filter system calls, so none of them cap resource consumption.

• A. Enable port security with MAC limits on the access-layer switch ports
• B. Restrict each application to least-privilege permissions on the northbound API Correct answer
• C. Encrypt the southbound channel between controller and switches with TLS
• D. Restrict switch management access to a dedicated out-of-band VLAN

Option B is correct because restricting each application to least-privilege permissions on the northbound API limits what a compromised application can change through the controller. Port security, TLS on the southbound channel and an out-of-band management VLAN protect other parts of the architecture but do not limit what the application can push.

• A. The SPAN port is dropping packets under heavy load
• B. The baseline does not reflect normal business traffic levels Correct answer
• C. The monitoring server's clock is out of sync with the network devices
• D. The signature database on the sensors is out of date

Option B is correct because a baseline taken during a quiet holiday week understates normal load, so ordinary business traffic looks anomalous and triggers many alerts once staff return. Packet drops, clock drift and outdated signatures would not produce a flood of alerts that starts exactly when normal traffic resumes.

• A. Automatic repair of misconfigured devices
• B. Lower bandwidth use on busy links
• C. Early detection of abnormal activity Correct answer
• D. Replacement of the incident response plan

Option C is correct because continuous monitoring watches traffic around the clock, so unusual behavior such as scans, beaconing or large transfers is spotted early, before it grows into a major incident. Monitoring observes traffic and does not repair devices (A), it adds some overhead rather than lowering bandwidth use (B), and it supports the incident response plan instead of replacing it (D).

• A. Record the system's state, and notify the incident response team Correct answer
• B. Run a full antivirus scan, and delete any files it detects
• C. Interview the user, and decide whether escalation is needed
• D. Reimage the workstation, and return it to the user

Option A is correct because a first responder should preserve the system's state and notify the incident response team before anything changes the evidence. Running a scan and deleting files, reimaging, or deciding alone whether to escalate can destroy evidence or delay the response.

• A. Limiting detection to endpoint devices
• B. Outsourcing monitoring to the vendor's analysts
• C. Using only the vendor's own sensors and agents
• D. Ingesting telemetry from third-party security tools Correct answer

Option D is correct because an open XDR platform ingests telemetry from third-party security tools, while a native XDR platform relies on the vendor's own products. Option C describes native XDR, Option A describes EDR rather than XDR, and Option B describes a managed service, which is not what separates open from native.

• A. Indicators of Exposure
• B. Indicators of Compromise Correct answer
• C. Threat actor attributions
• D. Indicators of Attack

Option B is correct because file hashes and IP addresses observed in a past breach are Indicators of Compromise, evidence that a system was compromised. Indicators of Attack describe adversary behavior in progress, and attributions name the actor rather than listing artifacts.

• A. Brief executives on the group's motives and sponsors, and track its targeting trends over time
• B. Buy a commercial feed with fresher indicators for this group, and import it into the SIEM
• C. Hunt for Office applications spawning command shells, and for remote service creation on endpoints Correct answer
• D. Block the listed IP addresses at the perimeter firewall, and the file hashes in the EDR console

Option C is correct because the group's tactics, such as Office applications spawning command shells and remote service creation, stay useful for detection even when the group rotates its infrastructure. The two-month-old IP addresses and hashes are likely stale, and executive briefings or a new feed do not improve endpoint detection first.