20+ practice questions focused on Network Attacks And Defense Strategies — one of the most tested topics on the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Network Attacks And Defense Strategies PracticeAn enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?
Explanation: Port Security on access switch ports with a maximum MAC address limit of one and sticky learning prevents port-stealing attacks by ensuring that only the first learned (or statically configured) MAC address can communicate on that port. If an attacker spoofs an authenticated client's MAC on a different port, that port already has a different MAC bound or will exceed the limit, triggering a violation and blocking the spoofed traffic.
A network administrator observes continuous SYN flooding targeting a primary public-facing web server on a Cisco ASA 5500-X firewall. To mitigate this attack without disrupting legitimate traffic, which specific feature should the administrator enable globally via the command-line interface?
Explanation: TCP synproxy on the Cisco ASA makes the firewall complete the TCP three-way handshake with the client on behalf of the protected server, only forwarding the connection once the handshake succeeds. This absorbs SYN floods because half-open connections never reach the web server, and legitimate clients still complete their connections normally.
An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?
Explanation: Kerberoasting exploits weak service account passwords by requesting a TGS ticket encrypted with the service account's NTLM hash, which can be cracked offline. Group Managed Service Accounts (gMSAs) automatically rotate complex passwords (120 characters by default) and eliminate manual password management, making offline cracking infeasible. Enforcing strong, complex passwords (minimum 25 characters) further increases the computational cost for attackers.
An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?
Explanation: The NTP monlist command (mode 6, opcode 0x1A) returns a list of up to 600 recent clients that have communicated with the server, and because the request is small (a single UDP packet) while the response is large, it is a classic amplification vector with ratios exceeding 200x. Disabling monlist (via 'disable monitor' or 'noquery' in ntp.conf, or upgrading to NTP 4.2.7p26+ where monlist is disabled by default) and restricting queries with 'restrict default noquery nomodify notrap' prevents the server from being abused as a reflector.
An enterprise wireless network uses WPA2-Enterprise for authentication. A security administrator wants to upgrade the security posture to protect against offline dictionary attacks on handshakes and provide enhanced cryptographic cipher suites. Which standard should be implemented?
Explanation: WPA3 replaces the vulnerable 4-way handshake of WPA2 with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks even if weak passwords are chosen.
+15 more Network Attacks And Defense Strategies questions available
Practice all Network Attacks And Defense Strategies questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Network Attacks And Defense Strategies. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Network Attacks And Defense Strategies questions on the CND frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Network Attacks And Defense Strategies is tested as part of the EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) blueprint. Practicing with targeted Network Attacks And Defense Strategies questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CND practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Network Attacks And Defense Strategies is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Network Attacks And Defense Strategies practice session with instant scoring and detailed explanations.
Start Network Attacks And Defense Strategies Practice →