EC-Council CND-312-38 Practice Test

CND-312-38 practice test: what's covered

• Network Defense
• Firewalls
• IDS/IPS
• Endpoint Hardening
• Vulnerability Management

Free CND-312-38 sample questions

1. A network defender at a financial institution is establishing a baseline of network traffic for an enterprise subnet. During peak hours, an unexpected surge of outbound UDP traffic on non-standard high ports is observed originating from an HR workstation. What is the FIRST action the network defender should take to investigate and contain the anomaly while following best practices?

   • A. Capture packet data on the host interface and isolate the workstation from the internal VLAN to preserve forensic evidence
   • B. Immediately modify the core edge firewall rules to block all UDP port traffic across the entire enterprise network
   • C. Ignore the traffic if the workstation endpoint antivirus software does not trigger an active signature detection alert
   • D. Reboot the workstation immediately to break volatile active socket connections without preserving network memory logs
   Show answer

   Correct: A. Capturing host packet data and isolating the host stops potential exfiltration while preserving forensic evidence for root cause analysis. Blocking all UDP enterprise-wide disrupts legitimate services like DNS, ignoring unflagged traffic allows zero-day activity to persist, and rebooting the machine destroys volatile RAM logs. Distractor choices (such as 'Immediately modify the core ed...', 'Ignore the traffic if the work...') are incorrect because they either introduce operational disruption, fail to mitigate the specific root cause, or are invalid network defense practices.

2. A network administrator is deploying 802.1X Network Access Control (NAC) with RADIUS authentication across all corporate edge switch ports. Which switch port configuration ensures that unauthorized laptops connected to unassigned Ethernet ports cannot communicate with the internal network?

   • A. Set unauthenticated switch ports to drop non-EAPOL traffic and assign unauthorized endpoints to a restricted guest VLAN
   • B. Configure static ARP tables on all access switches without enabling port-level authentication mechanisms
   • C. Disable MAC address learning on all switch access ports and allow untrusted devices onto the management VLAN
   • D. Enable promiscuous mode on all access switch ports to automatically accept all incoming MAC addresses
   Show answer

   Correct: A. Enforcing 802.1X drops non-EAPOL traffic until authentication completes and places unauthorized devices into an isolated guest VLAN. Static ARP does not block unauthorized port linkage, disabling MAC learning without authentication fails to stop unauthorized access, and promiscuous mode exposes all port traffic.

3. A senior network security architect is implementing a Zero Trust Architecture (ZTA) for a multi-tenant enterprise data center. Which TWO design principles must be enforced to restrict unauthorized lateral movement between micro-segmented server workloads?

   • A. Implement micro-segmentation using host-based software firewalls and hypervisor-level security policies
   • B. Enforce continuous explicit identity authentication and device health checks for every inter-workload connection request
   • C. Trust all internal traffic implicitly once it passes through the perimeter edge firewall appliance
   • D. Place all production application databases and public web servers onto a single unsegmented flat VLAN
   Show answer

   Correct: A and B. Correct options ('Implement micro-segmentation using host-...' and 'Enforce continuous explicit identity aut...') are essential because they directly fulfill the scenario requirements. In contrast, alternative distractor options are incorrect because they fail to address the specific threat vector or introduce unnecessary network disruption.

4. During a network architecture audit, a security team discovers that internal switch trunk links are passing untagged VLAN 1 frames alongside production user traffic. Which network hardening technique prevents double-tagging VLAN hopping attacks across the switch infrastructure?

   • A. Reassign the native VLAN on all switch trunk links to an unused VLAN ID and explicitly tag all native VLAN traffic
   • B. Disable 802.1Q VLAN encapsulation on all switch trunk interfaces connecting distribution switches
   • C. Allow VLAN 1 to traverse all switch trunk links as the default untagged administrative native transport
   • D. Configure switch access ports to automatically negotiate dynamic trunking using DTP auto mode
   Show answer

   Correct: A. Changing the native VLAN from default VLAN 1 to a dedicated unused ID and tagging native traffic prevents double-tagging VLAN hopping attacks. Disabling 802.1Q destroys VLAN trunking capability, allowing default VLAN 1 traffic keeps the vulnerability open, and enabling DTP auto permits rogue trunk negotiation. Distractor choices (such as 'Disable 802.1Q VLAN encapsulat...', 'Allow VLAN 1 to traverse all s...') are incorrect because they either introduce operational disruption, fail to mitigate the specific root cause, or are invalid network defense practices.

5. A SOC analyst detects an attacker attempting an ARP spoofing / man-in-the-middle attack on a local subnet by sending unsolicited gratuitous ARP replies. Which switch-level security feature should be configured to drop these invalid ARP packets?

   • A. Enable Dynamic ARP Inspection (DAI) bound to the DHCP snooping binding database on access switches
   • B. Enable BPDU Guard on all switch trunk links connecting distribution and core switches
   • C. Configure Spanning Tree PortFast on core switch interfaces connected to upstream routers
   • D. Increase the ARP cache timeout on all end-user workstations to 24 hours
   Show answer

   Correct: A. Dynamic ARP Inspection (DAI) validates ARP packets against the trusted DHCP snooping database and drops spoofed ARP replies. BPDU Guard prevents rogue switch additions rather than ARP spoofing, PortFast on core routers risks topology loops, and increasing ARP cache timeouts prolongs poisoning impacts. Distractor choices (such as 'Enable BPDU Guard on all switc...', 'Configure Spanning Tree PortFa...') are incorrect because they either introduce operational disruption, fail to mitigate the specific root cause, or are invalid network defense practices.

Last updated: 2026-10-19

CND-312-38 practice test FAQ

Related practice tests

• CEH 312-50 practice test
• EC-Council 312-49 practice test
• EC-Council CSA-312-39 practice test