10 free EC-Council 312-38 CND v3 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 718 questions. Work through them, then open each answer to check your reasoning.
Get all 718 questions (US$39) · Download these 10 as a PDF
Question 1
John works as a C programmer. He develops the following C program:
His program is vulnerable to a __________ attack.
Show answer and explanation
Correct answer: C. Buffer overflow
The program declares a fixed-size buffer of 10 characters (buffer1[10]) but uses strcpy() to copy user input from argv[1] into it without any bounds checking. The strcpy() function copies the entire input string regardless of the buffer's capacity, allowing an attacker to supply input longer than 10 characters. This causes the excess data to overflow past the buffer boundary into adjacent memory, corrupting the stack and potentially allowing arbitrary code execution. This is a classic buffer overflow vulnerability.
Why the other options are wrong
- A. SQL injection requires database query construction with user input; this C program has no database operations.
- B. Denial-of-Service attacks aim to crash or overload a service; while this program could crash from buffer overflow, the vulnerability itself is buffer overflow, not DoS.
- D. Cross-site scripting is a web application vulnerability involving malicious scripts in HTML; this is a standalone C program with no web or HTML context.
Question 2
Which of the following analyzes network traffic to trace specific transactions and can intercept and log traffic passing over a digital network? Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: A, C
A. Wireless sniffer C. Protocol analyzer A wireless sniffer captures and analyzes network traffic on wireless networks, intercepting and logging data packets. A protocol analyzer examines network traffic at the protocol level to trace transactions and intercept communications. Both tools perform packet capture and analysis functions. A spectrum analyzer measures signal strength and frequency characteristics but does not intercept application-level traffic or trace transactions. Performance Monitor is a Windows utility for monitoring system resources, not network traffic analysis.
Why the other options are wrong
- B. Spectrum analyzers measure radio frequency signals and frequency distributions, not application transaction data.
- D. Performance Monitor tracks system performance metrics like CPU and memory, not network traffic interception.
Question 3
In which of the following conditions does the system enter ROM monitor mode? Each correct answer represents a complete solution.
Choose all that apply.
Show answer and explanation
Correct answer: C, D
C. The user interrupts the boot sequence. D. The router does not find a valid operating system image. ROM monitor (ROMmon) is the low-level bootstrap environment that runs when the IOS image cannot be loaded or when the operator deliberately stops the boot process. The router drops into ROMmon if it cannot locate or load a valid operating system image from flash, TFTP or other configured boot sources, and it also enters ROMmon when the user sends the break sequence during the first seconds of startup. From ROMmon an administrator can change the configuration register, perform password recovery, or TFTP a new image onto the device.
Why the other options are wrong
- A. A missing or empty startup configuration file causes the router to enter setup mode, not ROM monitor mode, because the operating system has already loaded successfully.
- B. Setting operating parameters is performed in global configuration mode after IOS loads, so it is a task rather than a condition that forces entry into ROM monitor mode.
Question 4
Which of the following protocols is used for exchanging routing information between two gateways in a network of autonomous systems?
Show answer and explanation
Correct answer: C. EGP
The Exterior Gateway Protocol (EGP) is specifically designed for exchanging routing information between autonomous systems. IGMP handles IP multicast group membership, ICMP is used for diagnostic and error reporting, and OSPF is an interior gateway protocol used within autonomous systems. EGP serves the explicit purpose of inter-autonomous system communication.
Why the other options are wrong
- A. IGMP (Internet Group Management Protocol) manages multicast group memberships, not routing between autonomous systems.
- B. ICMP provides network diagnostics and error messages but is not a routing protocol for autonomous systems.
- D. OSPF is an interior gateway protocol for routing within a single autonomous system, not between them.
Question 5
Which of the following is a 16-bit field that identifies the source port number of the application program in the host that is sending the segment?
Show answer and explanation
Correct answer: D. Source Port Address
The Source Port Address is a 16-bit field in the TCP header that identifies the port number of the application program sending the segment. The Sequence Number is a 32-bit field, Header Length is a 4-bit field, and Acknowledgment Number is a 32-bit field. Only the Source Port Address matches the 16-bit size specification.
Why the other options are wrong
- A. Sequence Number is a 32-bit field that tracks the byte order in a stream, not a 16-bit field.
- B. Header Length is a 4-bit field indicating TCP header size in 32-bit words.
- C. Acknowledgment Number is a 32-bit field confirming received bytes, not a 16-bit field.
Question 6
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He is using a tool to crack the wireless encryption keys. The description of the tool is as follows:
`It is a Linux-based WLAN WEP cracking tool that recovers encryption keys. It operates by passively monitoring transmissions. It uses Ciphertext Only Attack and captures approximately 5 to 10 million packets to decrypt the WEP keys.`
Which of the following tools is John using to crack the wireless encryption keys?
Show answer and explanation
Correct answer: C. AirSnort
AirSnort is a Linux-based WLAN WEP cracking tool that recovers encryption keys through passive monitoring of wireless transmissions. It uses ciphertext-only attacks and requires capturing millions of packets (typically 5-10 million) to crack WEP encryption keys. PsPasswd cracks Windows passwords, Kismet is a wireless network detector and analyzer, and Cain is a general-purpose cracking tool for various protocols.
Why the other options are wrong
- A. PsPasswd is used for cracking Windows password hashes, not WEP wireless encryption.
- B. Kismet is a wireless network sniffer and detector, not a WEP key cracking tool.
- D. Cain is a multipurpose cracking tool but is not specifically designed for WEP wireless encryption cracking.
Question 7
Which of the following is a process that detects a problem, determines its cause, minimizes the damages, resolves the problem, and documents each step of response for future reference?
Show answer and explanation
Correct answer: A. Incident response
Incident response is the defined process of detecting a security problem, determining its root cause, minimizing damage, resolving the issue, and documenting each step for future reference and improvement. Incident handling is similar but typically refers to the operational execution of response steps. Incident management is broader organizational oversight, and incident planning refers to preparation before incidents occur.
Why the other options are wrong
- B. Incident handling focuses on executing the response actions rather than the complete cyclical process that includes documentation for future reference.
- C. Incident management is the organizational framework overseeing incidents, not the specific technical process of response.
- D. Incident planning addresses preparation and prevention strategies before incidents occur, not the response process itself.
Question 8
Which of the following is designed to detect the unwanted presence of fire by monitoring environmental changes associated with combustion?
Show answer and explanation
Correct answer: C. Fire alarm system
A fire alarm system is designed to detect the unwanted presence of fire by monitoring environmental changes associated with combustion, such as smoke, heat, and flame. Fire sprinklers are suppression devices that release water after detection. Fire suppression systems actively extinguish fires. Gaseous fire suppression systems use chemicals to suppress flames rather than detect them.
Why the other options are wrong
- A. Fire sprinklers are suppression devices that deploy water, not detection systems.
- B. Fire suppression systems actively extinguish fires rather than detect their presence.
- D. Gaseous fire suppression uses chemical agents to suppress flames, not to detect fires.
Question 9
Which of the following is an intrusion detection system that monitors and analyzes the internals of a computing system rather than the network packets on its external interfaces?
Show answer and explanation
Correct answer: B. HIDS
A Host-Based Intrusion Detection System (HIDS) monitors and analyzes the internals of a computing system, examining system calls, file integrity, log files, and internal processes rather than network traffic. IPS is an intrusion prevention system that blocks threats. DMZ is a network architecture zone, and NIDS is a network-based intrusion detection system that monitors external network packets.
Why the other options are wrong
- A. IPS (Intrusion Prevention System) actively blocks threats and typically operates at the network level, not internal system internals.
- C. DMZ (Demilitarized Zone) is a network architecture concept, not an intrusion detection system.
- D. NIDS (Network-Based Intrusion Detection System) monitors network packets and external interfaces, not internal system operations.
Question 10
Which of the following types of VPN uses the Internet as its main backbone, allowing users, customers, and branch offices to access corporate network resources across various network architectures?
Show answer and explanation
Correct answer: C. Extranet-based VPN
An extranet-based VPN uses the Internet as its backbone to connect corporate network resources with external parties such as customers, partners, and branch offices across various network architectures. This type of VPN extends beyond internal networks (intranet) to encompass external stakeholders while leveraging public Internet infrastructure for connectivity and cost efficiency.
Why the other options are wrong
- A. PPTP VPN is a protocol, not a category describing the architectural use case of Internet-based access for external users.
- B. Remote access VPN typically refers to individual users connecting to corporate networks, not the broader architectural model for customers and branch offices.
- D. Intranet-based VPN connects only internal corporate resources and employees, not external customers or branch offices across the Internet.
That was 10 of 718.
The full EC-Council 312-38 CND v3 pack has all 718 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.