312-38 Practice Questions

The strategy Jason has set up is known as a Default Deny policy. This approach to network security is

designed to block all access by default, only allowing services that are explicitly permitted. This is a

more secure posture compared to the Default Allow policy, which allows all traffic unless it is

specifically blocked. The Default Deny strategy aligns with the principle of least privilege, ensuring

that only the minimum necessary access is granted, thereby reducing the attack surface and

potential for unauthorized access.

Reference: The concept of Default Deny is a fundamental security posture that is widely recognized

and implemented in various cybersecurity frameworks and guidelines. It is also a key feature of the

Zero Trust security model, which does not inherently trust any user or device inside or outside the

network perimeter and requires continuous verification and authorization for any access attempt.

The IEEE 802.16 is a series of wireless broadband standards, also known as WirelessMAN, that are

designed for Metropolitan Area Networks (MANs). This standard specifies the air interface, including

the medium access control layer (MAC) and physical layer (PHY), of combined fixed and mobile point-

to-multipoint broadband wireless access systems. It supports multiple services and enables the

deployment of interoperable multivendor broadband wireless access products.

Reference: The information is based on the IEEE Standard for Local and metropolitan area networks

Part 16: Air Interface for Broadband Wireless Access Systems, which is detailed in the IEEE 802.16-

2009 document1. Additionally, the Wikipedia page for IEEE 802.16 provides an overview of the

standard’s purpose for broadband wireless metropolitan area networks2.

The attack surface of a system refers to the sum of all potential points where an unauthorized user

can try to enter or extract data from that system. It encompasses all the vulnerabilities, including

software flaws, unsecured network ports, and unprotected system endpoints. Therefore, when

vulnerabilities are decreased, the attack surface is reduced because there are fewer opportunities for

an attacker to exploit. This is a fundamental concept in network security, as reducing the attack

surface is a critical step in protecting systems against unauthorized access and potential breaches.

Reference: The explanation aligns with the definitions and concepts of attack surfaces as described in

network security literature and the Certified Network Defender (CND) course, which emphasizes the

importance of minimizing vulnerabilities to reduce the overall attack surface123.

Disaster Recovery (DR) is a subset of business continuity planning which focuses on the IT systems

and operations of a business after a disaster. It’s a comprehensive approach that ensures all critical

business functions can be resumed quickly and effectively in the event of a crisis. DR is not just about

data or security; it encompasses all aspects of the business that are necessary to continue operations

and protect the interests of stakeholders.

Reference: The explanation aligns with the objectives and documents of the EC-Council’s Certified

Network Defender (CND) program, which emphasizes the importance of business continuity and

disaster recovery as part of a defense-in-depth security strategy. This includes protecting endpoints,

data, and networks, as well as continuous threat monitoring and response12345.

Application whitelisting is a security approach that allows only pre-approved applications to execute

within a system or network. This method operates on a ‘default deny’ principle, meaning if an

application is not explicitly listed as approved, it will not be allowed to run. This is in contrast to

application blacklisting, which operates on a ‘default allow’ principle where all applications are

allowed to run unless they have been specifically identified as malicious or undesirable and added to

a blacklist. Whitelisting is generally considered more secure because it prevents any unapproved

applications from running, which can include new or unknown threats. However, it can be more

challenging to maintain as it requires a comprehensive understanding of all the necessary

applications for business operations.

Reference: The concept of application whitelisting and its differentiation from blacklisting is well-

documented in cybersecurity literature and aligns with the guidelines provided by the EC-Council’s

Certified Network Defender (CND) program. It is also supported by various cybersecurity frameworks

and best practices, including those from authoritative sources such as the National Institute of

Standards and Technology (NIST).

The tool that can help in identifying Indicators of Exposure (IoEs) to evaluate the human attack

surface is the Social-Engineer Toolkit (SET). SET is designed for social engineering penetration tests

and is effective in simulating phishing attacks, which are a common method to evaluate the human

aspect of security. It helps in identifying the potential human vulnerabilities that could be exploited

in an organization.

Reference: The EC-Council’s Certified Network Defender (CND) program includes discussions on

various tools and methods for assessing and improving the security of an organization, including the

human attack surface and the use of tools like SET for this purpose12.

Packet filtering firewalls operate at the Network Layer of the OSI model. This layer is responsible for

the transmission of data packets across network boundaries, which is a fundamental function of

packet filtering firewalls. They analyze incoming and outgoing packets and make decisions based on

set rules, such as IP addresses, protocols, and ports, to allow or block traffic. This is crucial for

protecting the network from unauthorized access and potential threats.

Reference: The information aligns with standard networking principles and the functionalities of

packet filtering firewalls as they are commonly understood in the field of network security123.

The correct sequence for a black hat operation follows a structured approach that begins

with Reconnaissance, where the attacker gathers preliminary data or intelligence on the target. Next

is Scanning, where the attacker uses technical tools to understand the network and system

vulnerabilities. Gaining Access is the phase where the vulnerabilities are exploited to enter the

system or network. Maintaining Access involves establishing a persistent presence within the system,

often for data exfiltration or additional exploitation. Finally, Covering Tracks is the phase where the

attacker erases evidence of the intrusion to avoid detection.

Reference: This answer aligns with the objectives and documents of the EC-Council’s Certified

Network Defender (CND) program, which outlines the phases of cyber attacks in the context of

network security and defense strategies.

In Debian-based Linux distributions, such as Ubuntu, the update-rc.d command is used to add and

remove services from the startup sequence. To disable a service, the -f option (which stands for

‘force’) is used along with the remove parameter to remove the service from the startup sequence.

This prevents the service from starting automatically during the system boot.

Reference: The use of update-rc.d for disabling services is documented in various Linux guides and

resources. For example, Tecmint’s guide on “How to Stop and Disable Unwanted Services from Linux

System” provides a practical example of using update-rc.d -f apache2 remove to disable the Apache

service at system startup1. Additionally, the Linux Consultant website also mentions the use

of systemctl followed by the disable argument for fully disabling services2.

The mobile-use approach that allows an organization’s employees to use devices they are

comfortable with and that best fit their p

and work purposes is Bring Your Own Device

(BYOD). This approach offers the most flexibility for employees, as they can bring and use their

personal devices for work-related activities. It is a popular choice for companies that wish to provide

a flexible work environment and cater to the diverse preferences of their employees123.

Reference: The concept of BYOD and its implications on workplace flexibility and employee

preferences are well-documented in enterprise mobility management literature and align with the

Certified Network Defender (CND) course’s objectives regarding understanding and managing mobile

device security within an organization123.