Chapter 1 of 8 · EC-Council 312-38

Network Defense Management

Attacks, hacking frameworks, defense strategy, compliance, policies, training and asset management.

  • 5topics
  • 24 minfast track
  • 2diagrams and exhibits
  • 10%of the exam
Start with Attack Terminology and Network, Host and Application Attacks

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Attack Terminology and Network, Host and Application AttacksLearn core attack terms such as threat, vulnerability and exploit, then recognize network, host and application level attacks and…5 min
  2. 2Human, Email, Mobile, Cloud, Wireless and Supply Chain AttacksRecognize social engineering, email, mobile, cloud, wireless and supply chain attacks and the defense that matches each, as CND…5 min
  3. 3Attacker Methodologies and Defense StrategiesLearn the Cyber Kill Chain, MITRE ATT&CK and hacking phases, then the goals of network defense, adaptive security and the layers…Diagram5 min
  4. 4Compliance, Regulations and Security PoliciesKnow the key laws and standards (PCI DSS, HIPAA, SOX, GLBA, GDPR, ISO 27001) and how to design security policies, including the…4 min
  5. 5Awareness, Administrative Controls, Asset Management and Threat AwarenessPlan awareness training, use controls like separation of duties, manage IT assets through their lifecycle and track CVE, CVSS and…5 min

About this chapter

What this chapter covers

Network Defense Management is 10% of the EC-Council CND 312-38 exam. It covers the vocabulary of network attacks, the common attack techniques by layer and target, the frameworks attackers follow, and the management side of defense: strategies, laws, policies, training, asset control and staying current.

Questions are single-answer multiple choice, often "Which of the following" or a short named scenario. You are asked to name an attack, pick the defense strategy that fits, or match a law to its purpose.

It has twenty-one outline topics, grouped into five pages.

How the topics fit together

The chapter starts with what defenders face, then moves to how they organize themselves against it.

Attack terms and techniquesnetwork, host, application, humanAttacker frameworkskill chain, ATT&CKDefense strategyprotect, detect, respond, predictCompliance and policylaws, rulesPeople and assetstraining, inventory, awareness
  • Attack pages give you the names and the symptoms of each technique.
  • Strategy page explains why defense is layered and continual.
  • Compliance and policy pages show how rules turn into daily practice.
  • People and assets page covers training, administrative controls and keeping up with threats.
Exam tip

Learn each attack by its one line signature, such as "intercepts traffic between two parties" for man in the middle. Most attack questions are answered by matching that line.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with tables and a worked example.
  • What to remember for the exam: the facts to memorize.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Try to answer each short scenario before reading the answer. The exam often describes symptoms and asks for the attack name or the best control.

Ready for more practice?

The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.