Certified Network Defender (CND) practice questions

1. Question 1 of 25

   What is the range for registered ports?

   • A1024 through 49151
   • B0 through 1023
   • CAbove 65535
   • D49152 through 65535

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Ports with numbers 0–1023 are called system or well-known ports; ports with numbers 1024-49151 are called user or registered ports, and ports with numbers 49152-65535 are called dynamic, private or ephemeral ports.

   Adapted from community discussion by ethacker · 2024-10-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. E

      ethacker

      2024-10-22

      Selected A2 upvotes

      Ports with numbers 0–1023 are called system or well-known ports; ports with numbers 1024-49151 are called user or registered ports, and ports with numbers 49152-65535 are called dynamic, private or ephemeral ports.

   2. S

      Sirmeysam

      2023-09-25

      2 upvotes

      but page 1760 says: Port numbers have the following assigned ranges:  Numbers below 1024 are considered well-known port numbers.  Numbers above 1024 are dynamically assigned port numbers.  Registered port numbers are those registered for vendor-specific applications; most of these are above 1024.

   3. S

      Sirmeysam

      2023-09-25

      1 upvote

      B Page 1749 CND book by EC-Council The well-known ports are assigned by IANA and can only be used by the system (or root) processes or by programs executed by privileged users on most systems. The registered ports are listed by IANA and can be used by ordinary user processes or programs executed by ordinary users on most systems. IANA registers the uses of these ports for convenience. The range of assigned ports managed by the IANA is 0–1023.

   4. S

      sadsad

      2024-06-21

      Selected A1 upvote

      Registered ports are in the range 1024 to 49151. Dynamic ports are in the range 49152 to 65535. most new port assignments are in the range from 1024 to 49151

2. Question 2 of 25

   How many layers are present in the TCP/IP model?

   • A10
   • B5
   • C4
   • D7

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   correct is 4 layers TCP/IP Layers TCP/IP is a four-layered protocol developed by the Department of Defense (DOD). Each layer in this model performs a different function, and data flow occurs from layer 4 to 1 (from the sending machine) and from layer 1 to 4 (in the destination machine).

   Adapted from community discussion by alvaroestebancta · 2023-03-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. R

      Ripley522

      2021-12-19

      5 upvotes

      In the official EC-Council e-book, Page 5, it mentioned that there are 4 layers under the TCP/IP model. Kindly confirm. TY.

   2. A

      alvaroestebancta

      2023-03-15

      4 upvotes

      correct is 4 layers TCP/IP Layers TCP/IP is a four-layered protocol developed by the Department of Defense (DOD). Each layer in this model performs a different function, and data flow occurs from layer 4 to 1 (from the sending machine) and from layer 1 to 4 (in the destination machine).

   3. C

      Chairman10

      2023-06-21

      Selected C3 upvotes

      TCP/IP is a four-layered protocol developed by the Department of Defense (DOD)

3. Question 3 of 25

   In which of the following transmission modes is communication uni-directional?

   • ARoot mode
   • BFull-duplex mode
   • CHalf-duplex mode
   • DSimplex mode

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   C and D are both correct. Simplex communication is a communication channel that sends information in one direction only. The International Telecommunication Union definition is a communications channel that operates in one direction at a time, but that may be reversible; this is termed half duplex in other contexts

   Adapted from community discussion by Chairman10 · 2024-06-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. C

      Chairman10

      2024-06-21

      Selected C2 upvotes

      C and D are both correct. Simplex communication is a communication channel that sends information in one direction only. The International Telecommunication Union definition is a communications channel that operates in one direction at a time, but that may be reversible; this is termed half duplex in other contexts

   2. P

      Pax123

      2024-06-27

      3 upvotes

      Simlex - Communication is unidirectional. Half-duplex-Communication is two-directional but, one at a time.

4. Question 4 of 25

   Which of the following layers of the OSI model provides physical addressing?

   • AApplication layer
   • BNetwork layer
   • CPhysical layer
   • DData link layer

   Show answer

   Correct answer: D

   How others answered

   • D67%
   • C33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   D is correct. Physical addressing: After creating frames, the Data link layer adds physical addresses (MAC address) of the sender and/or receiver in the header of each frame.

   Adapted from community discussion by Prem1um · 2024-07-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. P

      Pax123

      2024-06-27

      3 upvotes

      D is correct. Physical addressing for network connections exists at the data link layer. The data link layer combines data bits into entities called frames.

   2. P

      Prem1um

      2024-07-18

      Selected D2 upvotes

      D is correct. Physical addressing: After creating frames, the Data link layer adds physical addresses (MAC address) of the sender and/or receiver in the header of each frame.

5. Question 5 of 25

   Token Ring is standardized by which of the following IEEE standards?

   • A802.2
   • B802.4
   • C802.3
   • D802.1

   Show answer

   Correct answer: B

   Explanation

   Referring to Q207 on Bus Topology, Q215 on Ring Topology, I thought the answer for this question should be 802.5 - Ring Topology as well. But there is no such answer. Kindly clarify please.

   Adapted from community discussion by Ripley522 · 2021-12-19 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. R

      Ripley522

      2021-12-19

      6 upvotes

      Referring to Q207 on Bus Topology, Q215 on Ring Topology, I thought the answer for this question should be 802.5 - Ring Topology as well. But there is no such answer. Kindly clarify please.

   2. T

      thetha

      2024-09-25

      1 upvote

      Token Ring is standardized by the IEEE 802.5 standard, which specifies the Medium Access Control (MAC) layer for token ring networks. The IEEE 802.2 standard, on the other hand, specifies the Logical Link Control (LLC) layer, which is a common sublayer used by different MAC layer protocols in the IEEE 802 family. The IEEE 802.4 standard specifies the MAC layer for token bus networks, which are similar to token ring networks in that they use a token-passing scheme to control access to the network. The IEEE 802.3 standard, also known as Ethernet, specifies the MAC layer for wired LANs using a CSMA/CD access method. The IEEE 802.1 standard specifies protocols and services related to network management, including VLANs, link aggregation, and network security.

   3. C

      Chairman10

      2023-06-21

      2 upvotes

      Token ring (IEEE 802.5) is a communication protocol in a local area network (LAN) where all stations are connected in a ring topology and pass one or more tokens for channel acquisition.

   4. S

      Sirmeysam

      2023-09-25

      1 upvote

      Wrong, the answer should be 802.5 https://ecomputernotes.com/computernetworkingnotes/communication-networks/what-is-ieee-8025-protocol

6. Question 6 of 25

   Which of the following is a presentation layer protocol?

   • ATCP
   • BRPC
   • CBGP
   • DLWAPP

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   The presentation layer is the layer 6 of the OSI model, which is responsible for data representation, encryption, and compression. Among the given options, RPC (Remote Procedure Call) is a presentation layer protocol.

   Adapted from community discussion by thetha · 2024-03-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. T

      thetha

      2024-03-25

      Selected B5 upvotes

      The presentation layer is the layer 6 of the OSI model, which is responsible for data representation, encryption, and compression. Among the given options, RPC (Remote Procedure Call) is a presentation layer protocol.

   2. K

      keno_

      2023-05-09

      2 upvotes

      Here it says LWAPP is a layer 2, 3 or 4 protocol. not layer 6. https://en.wikipedia.org/wiki/Lightweight_Access_Point_Protocol

   3. S

      santosmiguel

      2024-11-18

      Selected B1 upvote

      RPC (Remote Procedure Call) is a presentation layer protocol.

7. Question 7 of 25

   Which of the following is a session layer protocol?

   • ARPC
   • BSLP
   • CRDP
   • DICMP

   Show answer

   Correct answer: A

   Explanation

   The correct answer is B. SLP. SLP (Service Location Protocol) is a session layer protocol used to allow network services to advertise their existence to other network devices. It is used to locate network services such as printers, file servers, and directory services in a network. SLP allows clients to dynamically discover services and servers in a network and is used in conjunction with other protocols such as LDAP (Lightweight Directory Access Protocol) and DNS (Domain Name System). RPC (Remote Procedure Call) is a presentation layer protocol used for communication between applications running on different computers. RDP (Remote Desktop Protocol) is a presentation layer protocol used for remote desktop connections. ICMP (Internet Control Message Protocol) is a network layer protocol used for error reporting and network diagnostics.

   Adapted from community discussion by ethacker · 2024-10-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. E

      ethacker

      2024-10-28

      2 upvotes

      The correct answer is B. SLP. SLP (Service Location Protocol) is a session layer protocol used to allow network services to advertise their existence to other network devices. It is used to locate network services such as printers, file servers, and directory services in a network. SLP allows clients to dynamically discover services and servers in a network and is used in conjunction with other protocols such as LDAP (Lightweight Directory Access Protocol) and DNS (Domain Name System). RPC (Remote Procedure Call) is a presentation layer protocol used for communication between applications running on different computers. RDP (Remote Desktop Protocol) is a presentation layer protocol used for remote desktop connections. ICMP (Internet Control Message Protocol) is a network layer protocol used for error reporting and network diagnostics.

   2. E

      ethacker

      2024-11-05

      2 upvotes

      The Remote Desktop Protocol (RDP) is a session layer protocol used to provide a graphical interface to a user to connect to another computer over a network connection.

   3. S

      sadsad

      2024-06-21

      1 upvote

      Session-layer services are commonly used in application environments that make use of remote procedure calls (RPCs).

8. Question 8 of 25

   Which of the following is a term to describe the use of inert gases and chemical agents to extinguish a fire?

   • AGaseous fire suppression
   • BFire alarm system
   • CFire sprinkler
   • DFire suppression system

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   The term used to describe the use of inert gases and chemical agents to extinguish a fire is "fire suppression". Fire suppression systems are designed to detect and extinguish fires in their early stages, before they can spread and cause significant damage. These systems can use a variety of methods to suppress fires, including the use of water, foam, and chemicals, as well as the use of inert gases such as carbon dioxide, nitrogen, and argon, which can displace oxygen and prevent the fire from spreading. Fire suppression systems are commonly used in commercial and industrial settings, such as data centers, laboratories, and manufacturing facilities, where the risk of fire is high and the potential damage from a fire can be significant.

   Adapted from community discussion by thetha · 2024-09-25 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. T

      thetha

      2024-09-25

      Selected D2 upvotes

      The term used to describe the use of inert gases and chemical agents to extinguish a fire is "fire suppression". Fire suppression systems are designed to detect and extinguish fires in their early stages, before they can spread and cause significant damage. These systems can use a variety of methods to suppress fires, including the use of water, foam, and chemicals, as well as the use of inert gases such as carbon dioxide, nitrogen, and argon, which can displace oxygen and prevent the fire from spreading. Fire suppression systems are commonly used in commercial and industrial settings, such as data centers, laboratories, and manufacturing facilities, where the risk of fire is high and the potential damage from a fire can be significant.

   2. C

      castro_siya

      2024-10-05

      2 upvotes

      Gaseous fire suppression, also called clean agent fire suppression, is a term to describe the use of inert gases and chemical agents to extinguish a fire.

9. Question 9 of 25

   Which of the following is a mandatory password-based and key-exchange authentication protocol?

   • APPP
   • BCHAP
   • CVRRP
   • DDH-CHAP

   Show answer

   Correct answer: D

   Explanation

   It's a tricky question for me, DH-CHAP is the same as CHAP but applied to fiber switches: http://www.sansecurity.com/faq/dh-chap.shtml I think that the question should be multi selection, both are mandatory password-based and key-exchange authentication protocols

   Adapted from community discussion by ethacker · 2023-11-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

   1. E

      ethacker

      2023-11-16

      2 upvotes

      It's a tricky question for me, DH-CHAP is the same as CHAP but applied to fiber switches: http://www.sansecurity.com/faq/dh-chap.shtml I think that the question should be multi selection, both are mandatory password-based and key-exchange authentication protocols

   2. C

      castro_siya

      2023-09-08

      1 upvote

      DHCHAP is a mandatory password-based, key-exchange authentication protocol that supports both switch-to-switch and host-to-switch authentication https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwizk6Hqhc39AhWUScAKHdS6D6MQFnoECA4QAw&url=https%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fdocs%2Fstorage%2Fsan_switches%2Fmds9000%2Fsw%2Frel_2_x%2Fsan-os%2Fconfiguration%2Fguide%2Ffcspdh.pdf&usg=AOvVaw2zVMGzZqRkjeu_hsVzy8j9

   3. I

      ICPS

      2023-09-09

      1 upvote

      Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates. Which of the following protocols is used by Bella?

   4. I

      I_know_everything

      2024-09-06

      1 upvote

      DH in DH-CHAP means "Difffe-Hellman" - thus implying a key exchange. CHAP relies on a previously shared secret. SO in this case, its DH-CHAP.

10. Question 10 of 25

    Which of the following types of RAID offers no protection for the parity disk?

    • ARAID 2
    • BRAID 1
    • CRAID 5
    • DRAID 3

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • B25%
    • C25%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The only RAID that don't have parity protection but uses a parity disk is RAID3, RAID 1 don't use parity disk and RAID5 writes parity in all disks except one, so if a disk fails the parity is rebuilt, therefore has a protection. The only answer that uses parity but is not protected is RAID3, if parity disk fails there's no protection to recover parity bits. Can't find on the CND book a mention to this, let me know if I'm wrong

    Adapted from community discussion by ethacker · 2024-05-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. E

       ethacker

       2024-05-06

       Selected D2 upvotes

       The only RAID that don't have parity protection but uses a parity disk is RAID3, RAID 1 don't use parity disk and RAID5 writes parity in all disks except one, so if a disk fails the parity is rebuilt, therefore has a protection. The only answer that uses parity but is not protected is RAID3, if parity disk fails there's no protection to recover parity bits. Can't find on the CND book a mention to this, let me know if I'm wrong

    2. A

       alvaroestebancta

       2022-09-15

       3 upvotes

       i think is RAID1, not use parity because both disk have same data

    3. B

       bitbizarrs

       2023-03-12

       1 upvote

       RAID 1 i think, but the question is a litle confuse.... "RAID level 3 is disk striping with parity. It uses striping and parity as its main features to store data. This RAID level dedicates one drive to store the parity information"

11. Question 11 of 25

    Adam works as a Professional Penetration Tester. A project has been assigned to him to test the vulnerabilities of the CISCO Router of Umbrella Inc. Adam finds out that HTTP Configuration Arbitrary Administrative Access Vulnerability exists in the router. By applying different password cracking tools, Adam gains access to the router. He analyzes the router config file and notices the following lines: logging buffered errors logging history critical logging trap warnings logging 10.0.1.103 By analyzing the above lines, Adam concludes that this router is logging at log level 4 to the syslog server 10.0.1.103. He decides to change the log level from 4 to 0. Which of the following is the most likely reason of changing the log level?

    • AChanging the log level from 4 to 0 will result in the logging of only emergencies. This way the modification in the router is not sent to the syslog server.
    • BBy changing the log level, Adam can easily perform a SQL injection attack.
    • CChanging the log level grants access to the router as an Administrator.
    • DChanging the log level from 4 to 0 will result in the termination of logging. This way the modification in the router is not sent to the syslog server.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The Router Log Level directive is used by the sys log server to specify the level of severity of the log. This directive is used to control the types of errors that are sent to the error log by constraining the severity level. Eight different levels are present in the Log Level directive, which are shown below in order of their descending significance: Number Level Description - 0emergEmergencies - system is unusable 1alertAction must be taken immediately 2critCritical Conditions 3errorError conditions 4warnWarning conditions 5notice Normal but significant condition 6infoInformational 7debug Debug-level messages Note: When a certain level is specified, the messages from all other levels of higher significance will also be reported. For example, when Log Level crit is specified, then messages with log levels of alert and emerg will also be reported.

    Adapted from community discussion by ethacker · 2024-11-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation

    View community discussion1

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. E

       ethacker

       2024-11-17

       Selected A2 upvotes

       Router messages 0 Emergencies System shutting down due to missing fan tray 1 Alerts Temperature limit exceeded 2 Critical Memory allocation failures 3 Errors Interface Up/Down messages 4 Warnings Configuration file written to server, via SNMP request 5 Notifications Line protocol Up/Down 6 Information Access-list violation logging 7 Debugging Debug messages Referencies: https://community.cisco.com/t5/networking-knowledge-base/how-to-configure-logging-in-cisco-ios/ta-p/3132434

12. Question 12 of 25

    Which of the following tools is an open source network intrusion prevention and detection system that works network sniffer and record the operation of the network, which is coordinated pre-signatures?

    • Adsniff
    • Bkismet
    • CNone
    • DKisMAC
    • Ebridle

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The tool that is an open-source network intrusion prevention and detection system that works as a network sniffer and records the operation of the network with coordinated pre-signatures is "dsniff".

    Adapted from community discussion by thetha · 2023-03-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. T

       thetha

       2023-03-26

       Selected A3 upvotes

       The tool that is an open-source network intrusion prevention and detection system that works as a network sniffer and records the operation of the network with coordinated pre-signatures is "dsniff".

    2. 5

       5ed93df

       2024-08-24

       2 upvotes

       answer is C. None Kismet\KisMac can act as IDS dsniff is a set of tool for reviewing network traffic

13. Question 13 of 25

    Select 2

    Which of the following firewalls are used to monitor the status of active connections, and configure the network packets to pass through the firewall? Each correct answer represents a complete solution. Choose all that apply.

    • AFarm owner
    • BProxy server
    • CDynamic packet filtering
    • DThe circuit gateway

    Show answer

    Correct answer: C, D

    How others answered

    • CD100%

    Explanation

    The firewalls that are used to monitor the status of active connections and configure the network packets to pass through the firewall are: Dynamic packet filtering Circuit gateway Dynamic packet filtering is a type of firewall that monitors the status of active connections and allows only authorized traffic to pass through the firewall based on predefined rules. Circuit gateway, also known as circuit-level gateway, operates at the session layer of the OSI model and monitors the status of active connections to ensure that only authorized traffic is allowed to pass through the firewall. Farm owner and proxy server are not firewalls. A farm owner is a person who owns a farm, while a proxy server is a server that acts as an intermediary between clients and other servers, forwarding requests from clients to servers and returning responses from servers to clients.

    Adapted from community discussion by thetha · 2024-09-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. T

       thetha

       2024-09-26

       Selected C, D4 upvotes

       The firewalls that are used to monitor the status of active connections and configure the network packets to pass through the firewall are: Dynamic packet filtering Circuit gateway Dynamic packet filtering is a type of firewall that monitors the status of active connections and allows only authorized traffic to pass through the firewall based on predefined rules. Circuit gateway, also known as circuit-level gateway, operates at the session layer of the OSI model and monitors the status of active connections to ensure that only authorized traffic is allowed to pass through the firewall. Farm owner and proxy server are not firewalls. A farm owner is a person who owns a farm, while a proxy server is a server that acts as an intermediary between clients and other servers, forwarding requests from clients to servers and returning responses from servers to clients.

    2. E

       ethacker

       2024-11-17

       Selected C, D2 upvotes

       I'm with Thetha, "Farm owner" has no sense. I think aswers are C and D

14. Question 14 of 25

    Which of the following is a distance vector routing protocols? Each correct answer represents a complete solution. Choose all that apply.

    • AOSPF
    • BIGRP
    • CIS-IS
    • DREST IN PEACE

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    The distance vector routing protocols are: B. IGRP: Interior Gateway Routing Protocol (IGRP) is a proprietary distance vector routing protocol used by Cisco routers. D. RIP: Routing Information Protocol (RIP) is a distance vector routing protocol that uses hop count as the metric for path selection. OSPF and IS-IS are both link-state routing protocols, which use more complex algorithms to calculate the best path to a destination. REST IN PEACE is not a routing protocol, but rather a phrase used to express condolences upon someone's death. In conclusion, the distance vector routing protocols are IGRP and RIP.

    Adapted from community discussion by thetha · 2024-09-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. T

       thetha

       2024-09-26

       Selected B3 upvotes

       The distance vector routing protocols are: B. IGRP: Interior Gateway Routing Protocol (IGRP) is a proprietary distance vector routing protocol used by Cisco routers. D. RIP: Routing Information Protocol (RIP) is a distance vector routing protocol that uses hop count as the metric for path selection. OSPF and IS-IS are both link-state routing protocols, which use more complex algorithms to calculate the best path to a destination. REST IN PEACE is not a routing protocol, but rather a phrase used to express condolences upon someone's death. In conclusion, the distance vector routing protocols are IGRP and RIP.

    2. L

       l3087

       2024-01-24

       3 upvotes

       D) should be Routing Information Protocol (RIP) not Rest in peace :D :) :)

    3. S

       sadsad

       2024-06-29

       2 upvotes

       Routing Information Protocol (RIP) for IP and Cisco's Internet Gateway Routing Protocol (IGRP)

15. Question 15 of 25

    Which of the following interfaces uses hot plugging technique to replace computer components without the need to shut down the system?

    • ASATA
    • BSCSI
    • CIDE
    • DSDRAM

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    correct is SATA SATA: Serial ATA deals with hot plugging and serial connectivity. The hot plugging technique may be used to replace computer components without shutting down the system. SATA enables only one connection per connector, and is not flexible for industrial purposes. SCSI: Small computer system interface (SCSI) allows multiple devices to be connected to a single port at the same time. SCSI uses a parallel cable for attaching internal and external devices.

    Adapted from community discussion by alvaroestebancta · 2023-03-14 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. A

       alvaroestebancta

       2023-03-14

       4 upvotes

       correct is SATA SATA: Serial ATA deals with hot plugging and serial connectivity. The hot plugging technique may be used to replace computer components without shutting down the system. SATA enables only one connection per connector, and is not flexible for industrial purposes. SCSI: Small computer system interface (SCSI) allows multiple devices to be connected to a single port at the same time. SCSI uses a parallel cable for attaching internal and external devices.

    2. U

       ui

       2022-09-25

       4 upvotes

       SATA : Serial ATA deals with hot plugging and serial connectivity. The hot plugging technique may be used to replace computer components without shutting down the system. SATA enables only one connection per connector, and is not flexible for industrial purposes.

    3. E

       ethacker

       2024-10-23

       Selected A2 upvotes

       Answer is A, CND Book P. 1278: SATA: Serial ATA deals with hot plugging and serial connectivity. The hot plugging technique may be used to replace computer components without shutting down the system. SATA enables only one connection per connector, and is not flexible for industrial purposes.

16. Question 16 of 25

    Your company is planning to use an uninterruptible power supply (UPS) to avoid damage from power fluctuations. As a network administrator, you need to suggest an appropriate UPS solution suitable for specific resources or conditions. Match the type of UPS with the use and advantage:

    

    • A1-i,2-iv,3-ii,4-v
    • B1-v,2-iii,3-i,4-ii
    • C1-ii,2-iv,3-iii,4-i
    • D1-iii,2-iv,3-v,4-iv

    Show answer

    Correct answer: C

    How others answered

    • C67%
    • B33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Line Interactive: Most commonly used for small business, web, and departmental server Standby-Ferro: No longer commonly used because it becomes unstable when operating a modern computer power supply load Double Conversion On-Line: Generally used in environments where electrical isolation is necessary Delta Conversion On-Line: Can be useful where complete isolation and/or direct connectivity is required p.3182

    Adapted from community discussion by ahmetzimba · 2025-01-31 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. A

       ahmetzimba

       2025-01-31

       Selected C2 upvotes

       Line Interactive: Most commonly used for small business, web, and departmental server Standby-Ferro: No longer commonly used because it becomes unstable when operating a modern computer power supply load Double Conversion On-Line: Generally used in environments where electrical isolation is necessary Delta Conversion On-Line: Can be useful where complete isolation and/or direct connectivity is required p.3182

    2. M

       maaax

       2023-09-02

       1 upvote

       according to ECCouncil study material Different types of UPS systems (UPS Topologies): Standby: Most commonly used for personal computers Line Interactive: Most commonly used for small business, web, and departmental servers Standby on-line hybrid: Most commonly used for server rooms Standby-Ferro: No longer commonly used because it becomes unstable when operating a modern computer power supply load Double Conversion On-Line: Generally used in environments where electrical isolation is necessary Delta Conversion On-Line: Can be useful where complete isolation and/or direct connectivity is required

    3. U

       ui

       2022-10-26

       1 upvote

       Line Interactive: Most commonly used for small business, web, and departmental servers Double Conversion On-Line: Generally used in environments where electrical isolation is necessary Delta Conversion On-Line: Can be useful where complete isolation and/or direct connectivity is required Standby-Ferro: No longer commonly used because it becomes unstable when operating a modern computer power supply load

17. Question 17 of 25

    During the recovery process, RTO and RPO should be the main parameters of your disaster recovery plan. What does RPO refer to?

    • AThe encryption feature, acting as add-on security to the data
    • BThe hot plugging technique used to replace computer components
    • CThe duration required to restore the data
    • DThe interval after which the data quality is lost

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    The Answer is D: A recovery point objective (RPO) is the maximum time frame for which an organization loses data after a major IT outage. It determines the acceptable amount of data loss an enterprise can suffer in case of a disruption.

    Adapted from community discussion by maaax · 2022-03-01 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. M

       maaax

       2022-03-01

       6 upvotes

       The Answer is D: A recovery point objective (RPO) is the maximum time frame for which an organization loses data after a major IT outage. It determines the acceptable amount of data loss an enterprise can suffer in case of a disruption.

    2. A

       alvaroestebancta

       2021-09-17

       4 upvotes

       i think is D. The interval after which the data quality is lost

    3. C

       castro_siya

       2023-04-04

       2 upvotes

       RPO is Recovery Point Objective and is the interval that passes before data quality is lost.

    4. S

       sadsad

       2022-12-23

       1 upvote

       RTO (the Recovery Time Objective), is a metric that defines the time to recover your IT infrastructure and services following a disaster to ensure business continuity.

18. Question 18 of 25

    Which of the following layers of TCP/IP model is used to move packets between the Internet Layer interfaces of two different hosts on the same link?

    • AApplication layer
    • BInternet layer
    • CLink layer
    • DTransport Layer
    • ENone

    Show answer

    Correct answer: C

    Explanation

    The Link Layer of TCP/IP model is the networking scope of the local network connection to which a host is attached. This is the lowest component layer of the Internet protocols, as TCP/IP is designed to be hardware independent. As a result, TCP/IP has been implemented on top of virtually any hardware networking technology in existence. The Link Layer is used to move packets between the Internet Layer interfaces of two different hosts on the same link. The processes of transmitting and receiving packets on a given link can be controlled both in the software device driver for the network card, as well as on firmware or specialized chipsets. Answer option B is incorrect. The Internet Layer of the TCP/IP model solves the problem of sending packets across one or more networks. Internetworking requires sending data from the source network to the destination network. This process is called routing. IP can carry data for a number of different upper layer protocols. Answer option D is incorrect. The Transport Layer of TCP/IP model is responsible for end-to-end message transfer capabilities independent of the underlying network, along with error control, segmentation, flow control, congestion control, and application addressing (port numbers). End to end message transmission or connecting applications at the transport layer can be categorized as either connection-oriented, implemented in Transmission Control Protocol (TCP), or connectionless, implemented in User Datagram Protocol (UDP). Answer option is incorrect. The Application Layer of TCP/IP model refers to the higher-level protocols used by most applications for network communication. Examples of application layer protocols include the File Transfer Protocol (FTP) and the Simple Mail Transfer Protocol (SMTP). Data coded according to application layer protocols are then encapsulated into one or more transport layer protocols, which in turn use lower layer protocols to affect actual data transfer.

    Adapted from community discussion by sumntingwong · 2023-02-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. S

       sumntingwong

       2023-02-09

       2 upvotes

       It said the TCP/IP model there is no specific link layer in the TCP/IP model it's just 4 layers Network-> Internet -> Transport -> Application each condensing the OSI model from 7 layers

    2. E

       ethacker

       2024-10-25

       1 upvote

       Should be Network Layer, as said on CND Book P.2503. It handles data flow to the Internet layer between two hosts in the same network.

    3. E

       exampass999

       2023-09-09

       1 upvote

       Perhaps the meaning of "C. Link Layer" is "Network Interface Layer".

19. Question 19 of 25

    Justine has been tasked by her supervisor to ensure that the company's physical security is on the same level as their logical security measures. She installs video cameras at all entrances and exits and installs badge access points for all doors. The last item she wants to install is a method to prevent unauthorized people piggybacking employees. What should she install to prevent piggybacking?

    • AJustine needs to install a biometrics station at each entrance.
    • BShe should install a mantrap.
    • CShe should install a Thompson Trapdoor.
    • DJustine will need to install a revolving security door.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    D. Mantrap cannot prevent piggybacking since the authorised person can still let the unauthorised person through both interlocking doors. A revolving security door only allows one person at a time, so will prevent piggybacking.

    Adapted from community discussion by Peduk70 · 2022-06-06 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. P

       Peduk70

       2022-06-06

       6 upvotes

       D. Mantrap cannot prevent piggybacking since the authorised person can still let the unauthorised person through both interlocking doors. A revolving security door only allows one person at a time, so will prevent piggybacking.

    2. U

       ui

       2022-04-25

       1 upvote

       Mantrap is another type of physical access security control which is used for catching trespassers. It is most widely used to separate non-secure areas from secure areas and prevents unauthorized access. It is a mechanical locking mechanism comprised of a small space with two sets of interlocking doors. The first set of doors must close before the second set opens. User authentication at mantrap doors is performed using smart cards, keypad/PIN or biometric verification. The closing and opening of doors is handled automatically or through security guards.

    3. L

       leefreedom

       2024-07-31

       Selected B1 upvote

       Mantrap is the best answer.There hasn't any description about revolving security door in cnd book.

    4. U

       ui

       2022-04-25

       1 upvote

       Piggybacking An authorized person allows (intentionally or unintentionally) an unauthorized person to pass through a secure door

20. Question 20 of 25

    Chris is a senior network administrator. Chris wants to measure the Key Risk Indicator (KRI) to assess the organization. Why is Chris calculating the KRI for his organization? It helps Chris to:

    • AIdentifies adverse events
    • BFacilitates backward viewing
    • CNotifies when risk has reached threshold levels
    • DFacilitates post incident management

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Answer is C according to ECCcouncil CND study material Role of KRIs  Identify current risk exposure and emerging risk trends in order to provide an early warning and proactive action  Event impact identification  Threshold level notifications  Backward looking view on risk events, enabling learning lessons from the past events  Highlight weaknesses of the existing controls and allow strengthening of poor controls  Facilitate the risk-reporting and escalation process  Provide an indication that the risk appetite and tolerance are reached  Provide real-time actionable intelligence to decision-makers and risk managers

    Adapted from community discussion by maaax · 2022-03-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. M

       maaax

       2022-03-01

       3 upvotes

       Answer is C according to ECCcouncil CND study material Role of KRIs  Identify current risk exposure and emerging risk trends in order to provide an early warning and proactive action  Event impact identification  Threshold level notifications  Backward looking view on risk events, enabling learning lessons from the past events  Highlight weaknesses of the existing controls and allow strengthening of poor controls  Facilitate the risk-reporting and escalation process  Provide an indication that the risk appetite and tolerance are reached  Provide real-time actionable intelligence to decision-makers and risk managers

    2. 5

       5ed93df

       2024-08-24

       1 upvote

       Identifying the adverse effect of an event Notifying on threshold levels of the risk Backward looking view on risk events

    3. A

       AnMarunti

       2024-01-07

       1 upvote

       Coul be B the correct Answer. KRI does not notify nor Identifies Adverse Events but Event Impact

21. Question 21 of 25

    Which among the following tools can help in identifying IoEs to evaluate human attack surface?

    • AsecuriCAD
    • BAmass
    • CSkybox
    • DSET

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    B. Amass Network Attack Surface: Identifying IoEs using amass — Automated Attack Surface Mapping Source: https://github.com/OWASP/Amass The OWASP Amass Project is a cybersecurity tool for gathering information on the attack surface of targets in multiple dimensions. It allows performing network mapping of the attack surface and also performs external asset discovery by collecting open-source information and using reconnaissance techniques (OSINT Reconnaissance).

    Adapted from community discussion by timothybrown7 · 2024-05-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. E

       eden_lee

       2024-12-04

       Selected D3 upvotes

       D. SET CND-pg 2296 evaluate a human attack surface. Social-Engineer Toolkit (SET)

    2. T

       timothybrown7

       2024-05-15

       2 upvotes

       B. Amass Network Attack Surface: Identifying IoEs using amass — Automated Attack Surface Mapping Source: https://github.com/OWASP/Amass The OWASP Amass Project is a cybersecurity tool for gathering information on the attack surface of targets in multiple dimensions. It allows performing network mapping of the attack surface and also performs external asset discovery by collecting open-source information and using reconnaissance techniques (OSINT Reconnaissance).

    3. E

       ethacker

       2023-12-04

       3 upvotes

       I think the correct answer is D. SET. Social-Engineer Toolkit (SET) is used to identified IoEs for human attack surface. Cnd book page 2313.

22. Question 22 of 25

    Kelly is taking backups of the organization's data. Currently, she is taking backups of only those files that are created or modified after the last backup. What type of backup is Kelly using?

    • AFull backup
    • BIncremental backup
    • CNormal backup
    • DDifferential backup

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    it should be B, according to CND book page 1312 "Incremental backup: Backs up only the data that has changed since the last backup"

    Adapted from community discussion by Cyber_bunny · 2024-06-02 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. C

       Cyber_bunny

       2024-06-02

       Selected B8 upvotes

       it should be B, according to CND book page 1312 "Incremental backup: Backs up only the data that has changed since the last backup"

    2. E

       ethacker

       2024-10-17

       Selected B2 upvotes

       Incremental: Only backup files that have been changed or created after the last backup are copied to the backup media. Page 1312 CND book

    3. C

       castro_siya

       2024-09-21

       Selected B1 upvote

       An Incremental backup strategy involves taking backups of only those files that are created or modified after the last backup, regardless of whether the previous backup was a full, incremental or differential backup. In this strategy, only the changes made to the files since the last backup are backed up, which reduces the backup time and storage requirements.

23. Question 23 of 25

    Which type of modulation technique is used in local area wireless networks (LAWNs)?

    • AFHSS
    • BDSSS
    • CMIMO-OFDM
    • DOFDM

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    CND Page 1827 Frequency-hopping Spread Spectrum A local area wireless network (LAWN) uses the frequency-hopping spread spectrum (FHSS) modulation technique. The transmission hop in FHSS occurs several times per second, allowing devices in a short range to work efficiently. Large systems using the same frequency do not affect the working of small devices.

    Adapted from community discussion by YanaC · 2024-12-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. Y

       YanaC

       2024-12-05

       Selected A2 upvotes

       CND Page 1827 Frequency-hopping Spread Spectrum A local area wireless network (LAWN) uses the frequency-hopping spread spectrum (FHSS) modulation technique. The transmission hop in FHSS occurs several times per second, allowing devices in a short range to work efficiently. Large systems using the same frequency do not affect the working of small devices.

    2. E

       ethacker

       2024-05-27

       3 upvotes

       A local area wireless network (LAWN) uses the frequency-hopping spread spectrum (FHSS) modulation technique. cnd book page 1827

    3. J

       jeffrey2890

       2024-07-02

       Selected A1 upvote

       A local area wireless network (LAWN) uses the frequency-hopping spread spectrum (FHSS) modulation technique

24. Question 24 of 25

    Select 2

    In which of the following conditions does the system enter ROM monitor mode? Each correct answer represents a complete solution. Choose all that apply.

    • AThe router does not have a configuration file.
    • BThere is a need to set operating parameters.
    • CThe user interrupts the boot sequence.
    • DThe router does not find a valid operating system image.

    Show answer

    Correct answer: C, D

    Explanation

    The system enters ROM monitor mode if the router does not find a valid operating system image, or if a user interrupts the boot sequence. From ROM monitor mode, a user can boot the device or perform diagnostic tests. Answer option A is incorrect. If the router does not have a configuration file, it will automatically enter Setup mode when the user switches it on. Setup mode creates an initial configuration. Answer option B is incorrect. Privileged EXEC is used for setting operating parameters.

    Supporting references

    • Cisco documentation

    View community discussion1

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. T

       TrendMicroDLPSSucks

       2024-09-23

       4 upvotes

       https://www.cisco.com/c/en/us/td/docs/routers/access/1900/software/configuration/guide/Software_Configuration/appendixCrommon.html

25. Question 25 of 25

    What defines the maximum time period an organization is willing to lose data during a major IT outage event?

    • ARPO
    • BBC
    • CRTO
    • DDR

    Show answer

    Correct answer: A

    How others answered

    • A58%
    • C42%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I have to go with A. RPO as correct: "RPO is the maximum time frame for which an organization loses data after a major IT outage." CND eBook page 2185 vs "RTO is the maximum tolerable length of time that a computer, system, network, or application can be down after a failure or a disaster." CND eBook page 2184

    Adapted from community discussion by rich84 · 2023-07-06 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-38 or CertExamHQ.

    1. R

       rich84

       2023-07-06

       Selected A6 upvotes

       I have to go with A. RPO as correct: "RPO is the maximum time frame for which an organization loses data after a major IT outage." CND eBook page 2185 vs "RTO is the maximum tolerable length of time that a computer, system, network, or application can be down after a failure or a disaster." CND eBook page 2184

    2. S

       Sovik07

       2025-02-12

       Selected A1 upvote

       Recovery point objective (RPO) is the maximum time frame for which an organization loses data after a major IT outage

    3. E

       Evreni

       2024-01-24

       1 upvote

       Answer is A RPO is the maximum time frame for which an organization loses data after a major IT outage

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-38 practice, question 1 of 25