[Oct 04, 2021] Get Free Updates Up to 365 days On Developing 312-38 Braindumps
Best Quality EC-COUNCIL 312-38 Exam Questions
NEW QUESTION 52
Which of the following is also known as stateful firewall?
- A. Stateless firewall
- B. PIX firewall
- C. Dynamic packet-filtering firewall
- D. DMZ
Answer: C
NEW QUESTION 53
Which of the following tools is used for wireless LANs detection?
- A. Airopeek
- B. NetStumbler
- C. Sniffer
- D. Fort Knox
Answer: B
NEW QUESTION 54
Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency, or state of affairs?
- A. Disaster recovery plan
- B. Business continuity plan
- C. Continuity of Operations Plan
- D. Contingency plan
Answer: D
Explanation:
A contingency plan is a plan devised for a specific situation when things could go wrong. Contingency plans are often devised by governments or businesses who want to be prepared for anything that could happen.
Contingency plans include specific strategies and actions to deal with specific variances to assumptions resulting in a particular problem, emergency, or state of affairs. They also include a monitoring process and
"triggers" for initiating planned actions. They are required to help governments, businesses, or individuals to recover from serious incidents in the minimum time with minimum cost and disruption.
Answer option D is incorrect. It includes the plans and procedures documented that ensure the continuity of critical operations during any period where normal operations are impossible.
Answer option B is incorrect. Disaster recovery planning is a subset of a larger process known as business continuity planning and should include planning for resumption of applications, data, hardware, communications (such as networking), and other IT infrastructure. A business continuity plan (BCP) includes planning for non-IT related aspects such as key personnel, facilities, crisis communication, and reputation protection, and should refer to the disaster recovery plan (DRP) for IT-related infrastructure recovery/continuity.
Answer option C is incorrect. Business continuity planning (BCP) is the creation and validation of a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical plan is called a business continuity plan. The BCP lifecycle is as follows:
NEW QUESTION 55
Which of the following is a digital telephone/telecommunication network that carries voice, data, and video over
an existing telephone network infrastructure?
- A. Frame relay
- B. X.25
- C. ISDN
- D. PPP
Answer: C
Explanation:
Integrated Services Digital Network (ISDN) is a digital telephone/telecommunication network that carries voice,
data, and video over an existing telephone network infrastructure. It requires an ISDN modem at both the ends
of a transmission. ISDN is designed to provide a single interface for hooking up a telephone, fax machine,
computer, etc.
ISDN has two levels of service, i.e., Basic Rate Interface (BRI) and Primary Rate Interface (PRI).
Answer option A is incorrect. The Point-to-Point Protocol, or PPP, is a data link protocol commonly used to
establish a direct connection between two networking nodes. It can provide connection authentication,
transmission encryption privacy, and compression. PPP is commonly used as a data link layer protocol for
connection over synchronous and asynchronous circuits, where it has largely superseded the older, non-
standard Serial Line Internet Protocol (SLIP) and telephone company mandated standards (such as Link
Access Protocol, Balanced (LAPB) in the X.25 protocol suite). PPP was designed to work with numerous
network layer protocols, including Internet Protocol (IP), Novell's Internetwork Packet Exchange (IPX), NBF,
and AppleTalk.
Answer option D is incorrect. The X.25 protocol, adopted as a standard by the Consultative Committee for
International Telegraph and Telephone (CCITT), is a commonly-used network protocol. The X.25 protocol
allows computers on different public networks (such as CompuServe, Tymnet, or a TCP/IP network) to
communicate through an intermediary computer at the network layer level. X.25's protocols correspond closely
to the data-link and physical-layer protocols defined in the Open Systems Interconnection (OSI) communication
model.
Answer option B is incorrect. Frame relay is a telecommunication service designed for cost-efficient data
transmission for intermittent traffic between local area networks (LANs) and between end-points in a wide area
network (WAN). Frame relay puts data in a variable-size unit called a frame. It checks for lesser errors as
compared to other traditional forms of packet switching and hence speeds up data transmission.
When an error is detected in a frame, it is simply dropped. The end points are responsible for detecting and
retransmitting dropped frames.
NEW QUESTION 56
FILL BLANK
Fill in the blank with the appropriate term. A ______________ is a set of tools that take Administrative control
of a computer system without authorization by the computer owners and/or legitimate managers.
Answer:
Explanation:
rootkit
Explanation:
A rootkit is a set of tools that take Administrative control of a computer system without authorization by the
computer owners and/or legitimate managers. A rootkit requires root access to be installed in the Linux
operating system, but once installed, the attacker can get root access at any time. Rootkits have the following
features:
They allow an attacker to run packet sniffers secretly to capture passwords.
They allow an attacker to set a Trojan into the operating system and thus open a backdoor for anytime access.
They allow an attacker to replace utility programs that can be used to detect the attacker's activity.
They provide utilities for installing Trojans with the same attributes as legitimate programs.
NEW QUESTION 57
CORRECT TEXT
Fill in the blank with the appropriate term. ______________is a powerful and low-interaction open source honeypot.
Answer:
Explanation:
Honeyd
Explanation:
Honeyd is a powerful and low-interaction open source honeypot. It was released by Niels Provos in 2002. It was written in C and designed for Unix platforms. It introduced a variety of new concepts, including the ability to monitor millions of unused IPs, IP stack spoofing, etc. It can also simulate hundreds of operating systems and monitor all UDP and TCP-based ports.
NEW QUESTION 58
Which of the following protocols is used for routing of voice conversation over the Internet?
- A. IP
- B. DNS
- C. VoIP
- D. DHCP
Answer: C
NEW QUESTION 59
Which of the following are the six different phases of the Incident handling process? Each correct answer represents a complete solution. Choose all that apply.
- A. Eradication
- B. Lessons learned
- C. Post mortem review
- D. Containment
- E. Identification
- F. Recovery
- G. Preparation
Answer: A,B,D,E,F,G
Explanation:
Following are the six different phases of the Incident handling process: 1.Preparation: Preparation is the first step in the incident handling process. It includes processes like backing up copies of all key data on a regular basis, monitoring and updating software on a regular basis, and creating and implementing a documented security policy. To apply this step a documented security policy is formulated that outlines the responses to various incidents, as a reliable set of instructions during the time of an incident. The following list contains items that the incident handler should maintain in the preparation phase i.e. before an incident occurs: Establish applicable policies Build relationships with key players Build response kit Create incident checklists Establish communication plan Perform threat modeling Build an incident response team Practice the demo incidents 2.Identification: The Identification phase of the Incident handling process is the stage at which the Incident handler evaluates the critical level of an incident for an enterprise or system. It is an important stage where the distinction between an event and an incident is determined, measured and tested. 3.Containment: The Containment phase of the Incident handling process supports and builds up the incident combating process. It helps in ensuring the stability of the system and also confirms that the incident does not get any worse. 4.Eradication: The Eradication phase of the Incident handling process involves the cleaning-up of the identified harmful incidents from the system. It includes the analyzing of the information that has been gathered for determining how the attack was committed. To prevent the incident from happening again, it is vital to recognize how it was conceded out so that a prevention technique is applied. 5.Recovery: Recovery is the fifth step of the incident handling process. In this phase, the Incident Handler places the system back into the working environment. In the recovery phase the Incident Handler also works with the questions to validate that the system recovery is successful. This involves testing the system to make sure that all the processes and functions are working normal. The Incident Handler also monitors the system to make sure that the systems are not compromised again. It looks for additional signs of attack. 6.Lessons learned: Lessons learned is the sixth and the final step of incident handling process. The Incident Handler utilizes the knowledge and experience he learned during the handling of the incident to enhance and improve the incident-handling process. This is the most ignorant step of all incident handling processes. Many times the Incident Handlers are relieved to have systems back to normal and get busy trying to catch up other unfinished work. The Incident Handler should make documents related to the incident or look for ways to improve the process. Answer option C is incorrect. The post mortem review is one of the phases of the Incident response process.
NEW QUESTION 60
What is the name of the authority that verifies the certificate authority in digital certificates?
- A. Certificate authority
- B. Certificate Management system
- C. Directory management system
- D. Registration authority
Answer: B
NEW QUESTION 61
With which of the following flag sets does the Xmas tree scan send a TCP frame to a remote device? Each correct answer represents a part of the solution. Choose all that apply.
- A. PUSH
- B. FIN
- C. RST
- D. URG
Answer: A,B,D
Explanation:
With the URG, PUSH, and FIN flag sets, the Xmas tree scan sends a TCP frame to a remote device. The Xmas tree scan is called an Xmas tree scan because the alternating bits are turned on and off in the flags byte (00101001), much like the lights of a Christmas tree. Answer option B is incorrect. The RST flag is not set when the Xmas tree scan sends a TCP frame to a remote device.
NEW QUESTION 62
CORRECT TEXT
Fill in the blank with the appropriate term. In the ______________method, a device or computer that transmits data needs to first listen to the channel for an amount of time to check for any activity on the channel.
Answer:
Explanation:
CSMA
/CA
Explanation:
Carrier Sense Multiple Access/Collision Avoidance (CSMA/CA) is an access method used by wireless networks (IEEE 802.11). In this method, a device or computer that transmits data needs to first listen to the channel for an amount of time to check for any activity on the channel. If the channel is sensed as idle, the device is allowed to transmit data. If the channel is busy, the device postpones its transmission. Once the channel is clear, the device sends a signal telling all other devices not to transmit data, and then sends its packets. In Ethernet (IEEE 802.3) networks that use CSMA/CD, the device or computer continues to wait for a time and checks if the channel is still free. If the channel is free, the device transmits packets and waits for an acknowledgment signal indicating that the packets were received.
NEW QUESTION 63
You work as the network administrator for uCertify Inc. The company has planned to add the support for IPv6 addressing. The initial phase deployment of IPv6 requires support from some IPv6-only devices. These devices need to access servers that support only IPv4. Which of the following tools would be suitable to use?
- A. NAT-PT
- B. Native IPv6
- C. Point-to-point tunnels
- D. Multipoint tunnels
Answer: A
Explanation:
NAT-PT (Network address translation-Protocol Translation) is useful when an IPv4-only host needs to communicate with an IPv4-only host. NAT-PT (Network Address Translation-Protocol Translation) is an implementation of RFC 2766 as specified by the IETF. NAT-PT was designed so that it can be run on low-end, commodity hardware. NAT-PT runs in user space, capturing and translating packets between the IPv6 and IPv4 networks (and vice-versa). NAT-PT uses the Address Resolution Protocol (ARP) and Neighbor Discovery (ND) on the IPv4 and IPv6 network systems, respectively.
NAT-Protocol Translation can be used to translate both the source and destination IP addresses. Answer option D is incorrect. Native IPv6 is of use when the IPv6 deployment is pervasive, with heavy traffic loads. Answer option C is incorrect. Point-to-point tunnels work well when IPv6 is needed only in a subset of sites. These point-to-point tunnels act as virtual point-to-point serial link. These are
useful when the traffic is of very high volume.
Answer option A is incorrect. The multipoint tunnels are used for IPv6 deployment even when IPv6
is needed in a subset of sites and is suitable when the traffic is infrequent and of less predictable
volume.
NEW QUESTION 64
Fred is a network technician working for Johnson Services, a temporary employment agency in Boston.
Johnson Services has three remote offices in New England and the headquarters in Boston where Fred works.
The company relies on a number of customized applications to perform daily tasks and unfortunately these applications require users to be local administrators. Because of this, Fred's supervisor wants to implement tighter security measures in other areas to compensate for the inherent risks in making those users local admins. Fred's boss wants a solution that will be placed on all computers throughout the company and monitored by Fred. This solution will gather information on all network traffic to and from the local computers without actually affecting the traffic. What type of solution does Fred's boss want to implement?
- A. Fred's boss wants a NIDS implementation.
- B. Fred's boss wants to implement a HIPS solution.
- C. Fred's boss wants Fred to monitor a NIPS system.
- D. Fred's boss wants to implement a HIDS solution.
Answer: D
NEW QUESTION 65
Which of the following IEEE standards defines the demand priority access method?
- A. 802.11
- B. 802.15
- C. 802.12
- D. 802.3
Answer: C
NEW QUESTION 66
CORRECT TEXT
Fill in the blank with the appropriate term. ______________________ is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed.
Answer:
Explanation:
Network reconnaissance
Explanation:
Network reconnaissance is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed. Network reconnaissance is increasingly used to exploit network standards and automated communication methods. The aim is to determine what types of computers are present, along with additional information about those computers such as the type and version of the operating system. This information can be analyzed for known or recently discovered vulnerabilities that can be exploited to gain access to secure networks and computers. Network reconnaissance is possibly one of the most common applications of passive data analysis. Early generation techniques, such as TCP/IP passive fingerprinting, have accuracy issues that tended to make it ineffective. Today, numerous tools exist to make reconnaissance easier and more effective.
NEW QUESTION 67
Which of the following IP class addresses are not allotted to hosts?Each correct answer represents a complete solution. Choose all that apply.
- A. Class A
- B. Class E
- C. Class C
- D. Class B
- E. Class D
Answer: B,E
Explanation:
Class addresses D and E are not allotted to hosts. Class D addresses are reserved for multicasting, and their address range can extend from 224 to 239. Class E addresses are reserved for experimental purposes. Their addresses range from 240 to 254. Answer option A is incorrect. Class A addresses are specified for large networks. It consists of up to 16,777,214 client devices (hosts), and their address range can extend from 1 to 126. Answer option B is incorrect. Class B addresses are specified for medium size networks. It consists of up to 65,534 client devices, and their address range can extend from 128 to 191. Answer option E is incorrect. Class C addresses are specified for small local area networks (LANs). It consists of up to 245 client devices, and their address range can extend from 192 to
223.
NEW QUESTION 68
Harry has successfully completed the vulnerability scanning process and found serious vulnerabilities exist in the organization's network. Identify the vulnerability management phases through which he will proceed to ensure all the detected vulnerabilities are addressed and eradicated. (Select all that apply)
- A. Remediation
- B. Assessment
- C. Mitigation
- D. Verification
Answer: A,C,D
NEW QUESTION 69
Which of the following steps are required in an idle scan of a closed port?
Each correct answer represents a part of the solution. Choose all that apply.
- A. The zombie's IP ID increases by only 1.
- B. The zombie ignores the unsolicited RST, and the IP ID remains unchanged.
- C. The attacker sends a SYN/ACK to the zombie.
- D. In response to the SYN, the target sends a RST.
- E. The zombie's IP ID increases by 2.
Answer: A,B,C,D
Explanation:
Following are the steps required in an idle scan of a closed port:
1.Probe the zombie's IP ID: The attacker sends a SYN/ACK to the zombie. The zombie, unaware
of the SYN/ACK, sends back a RST, thus disclosing its IP ID.
2.Forge a SYN packet from the zombie: In response to the SYN, the target sends a RST. The zombie ignores the unsolicited RST, and the IP ID remains unchanged.
3.Probe the zombie's IP ID again: The zombie's IP ID has increased by only 1 since step 1. So the port is closed.
NEW QUESTION 70
Which of the following is a distributed application architecture that partitions tasks or work loads between service providers and service requesters?Each correct answer represents a complete solution. Choose all that apply.
- A. Peer-to-peer networking
- B. Client-server networking
- C. Client-server computing
- D. Peer-to-peer (P2P) computing
Answer: B,C
Explanation:
Client-server networking is also known as client-server computing. It is a distributed application architecture that partitions tasks or work loads between service providers (servers) and service requesters, called clients. Often clients and servers operate over a computer network on separate hardware. A server machine is a high-performance host that is running one or more server programs which share its resources with clients. A client does not share any of its resources, but requests a server's content or service function. Clients therefore initiate communication sessions with servers which await (listen to) incoming requests. Answer options D and B are incorrect. Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers. Peers are equally privileged, equipotent participants in the application. They are said to form a peer-to-peer network of nodes. Peer-to-peer networking (also known simply as peer networking) differs from client-server networking, where certain devices have the responsibility to provide or "serve" data, and other devices consume or otherwise act as "clients" of those servers.
NEW QUESTION 71
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
- A. Download folder
- B. Cookies folder
- C. History folder
- D. Temporary Internet Folder
Answer: B,C,D
Explanation:
Online e-mail systems such as Hotmail and Yahoo leave files containing e-mail message information on the local computer. These files are stored in a number of folders, which are as follows: Cookies folder Temp folder History folder Cache folder Temporary Internet Folder Forensic tools can recover these folders for the respective e-mail clients. When folders are retrieved, e-mail files can be accessed. If the data is not readable, various tools are available to decrypt the information such as a cookie reader used with cookies. Answer option D is incorrect. Download folder does not contain any e-mail message information.
NEW QUESTION 72
DRAG DROP
George works as a Network Administrator for Blue Soft Inc. The company uses Windows Vista operating system. The network of the company is continuously connected to the Internet. What will George use to protect the network of the company from intrusion?
ECCouncil 312-38 Exam
Answer:
Explanation:
Explanation:
A firewall is a set of related programs configured to protect private networks connected to the Internet from intrusion. It is used to regulate the network traffic between different computer networks. It permits or denies the transmission of a network packet to its destination based on a set of rules. A firewall is often installed on a separate computer so that an incoming packet does not get into the network directly.
NEW QUESTION 73
The GMT enterprise is working on their internet and web usage policies. GMT would like to control internet bandwidth consumption by employees. Which group of policies would this belong to?
- A. System Specific Security Policy
- B. Issue Specific Security Policy
- C. Enterprise Information Security Policy
- D. Network Services Specific Security Policy
Answer: B
NEW QUESTION 74
Which of the following is an intrusion detection system that monitors and analyzes the internals of a computing system rather than the network packets on its external interfaces?
- A. IPS
- B. HIDS
- C. NIDS
- D. DMZ
Answer: B
Explanation:
A host-based intrusion detection system (HIDS) produces a false alarm because of the abnormal behavior of users and the network. A host-based intrusion detection system (HIDS) is an intrusion detection system that monitors and analyses the internals of a computing system rather than the network packets on its external interfaces. A host-based Intrusion Detection System (HIDS) monitors all or parts of the dynamic behavior and the state of a computer system. HIDS looks at the state of a system, its stored information, whether in RAM, in the file system, log files or elsewhere; and checks that the contents of these appear as expected.
Answer option D is incorrect. A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. A NIDS reads all the incoming packets and tries to find suspicious patterns known as signatures or rules. It also tries to detect incoming shell codes in the same manner that an ordinary intrusion detection system does.
Answer option A is incorrect. IPS (Intrusion Prevention Systems), also known as Intrusion Detection and Prevention Systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of "intrusion prevention systems" are to identify malicious activity, log information about said activity, attempt to block/stop activity, and report activity. An IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/or blocking the traffic from the offending IP address. An IPS can also correct CRC, unfragment packet streams, prevent TCP sequencing issues, and clean up unwanted transport and network layer options.
Answer option C is incorrect. DMZ, or demilitarized zone, is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by IT professionals. It is sometimes referred to as a Perimeter Network. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ rather than any other part of the network.
NEW QUESTION 75
......
EC-COUNCIL Exam Practice Test To Gain Brilliante Result: https://www.vce4plus.com/EC-COUNCIL/312-38-valid-vce-dumps.html
Tested Material Used To 312-38: https://drive.google.com/open?id=10mCwqd9nLM9FlOcpH-5vmMAqLtCuG6FC