Pass 312-38 Exam in First Attempt Guaranteed 100% Cover Real Exam Questions [Nov-2021]
Valid 312-38 test answers & EC-COUNCIL 312-38 exam pdf
How to book the Certified Network Defender
To apply for the Certified Network Defender, You have to follow these steps:
- Step 1: Go to the EC 312-38 Official Site
- Step 2: Read the instruction Carefully
- Step 3: Follow the given steps
- Step 4: Apply for the EC 312-38 Exam
NEW QUESTION 66
In which of the following transmission modes is communication bi-directional?
- A. Root mode
- B. Half-duplex mode
- C. Full-duplex mode
- D. Simplex mode
Answer: C
NEW QUESTION 67
Which of the following network devices operate at the network layer of the OSI model? Each correct answer represents a complete solution. Choose all that apply.
- A. Gateway
- B. Router
- C. Repeater
- D. Bridge
Answer: A,B
Explanation:
A router is a device that routes data packets between computers in different networks. It is used to connect multiple networks, and it determines the path to be taken by each data packet to its destination computer. A router maintains a routing table of the available routes and their conditions. By using this information, along with distance and cost algorithms, the router determines the best path to be taken by the data packets to the destination computer. A router can connect dissimilar networks, such as Ethernet, FDDI, and Token Ring, and route data packets among them. Routers operate at the network layer (layer 3) of the Open Systems Interconnection (OSI) model. A gateway is a network point that acts as an entrance to another network. On the Internet, a node or stopping point can be either a gateway node or a host (end-point) node. Both the computers of Internet users and the computers that serve pages to users are host nodes. The computers that control traffic within a company's network or at a local Internet service provider (ISP) are gateway nodes. In the network for an enterprise, a computer server acting as a gateway node is often also acting as a proxy server and a firewall server. A gateway is often associated with both a router, which knows where to direct a given packet of data that arrives at the gateway, and a switch, which furnishes the actual path in and out of the gateway for a given packet. Most of the gateways operate at the application layer, but can operate at the network or session layer of the OSI model. Answer option C is incorrect. A repeater operates only at the physical layer of the OSI model. Answer option B is incorrect. A bridge operates at the data link layer of the OSI model.
NEW QUESTION 68
Which of the following IEEE standards is an example of a DQDB access method?
- A. 802.6
- B. 802.3
- C. 802.4
- D. 802.5
Answer: A
NEW QUESTION 69
FILL BLANK
Fill in the blank with the appropriate term.
A ______________ is a physical or logical subnetwork that contains and exposes external services of an
organization to a larger network.
Answer:
Explanation:
demilitarized zone
Explanation:
A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of
an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of
security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in
the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in
the internal network, though communication with other hosts in the DMZ and to the external network is allowed.
This allows hosts in the DMZ to provide services to both the internal and external networks, while an
intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ
configuration, most computers on the LAN run behind a firewall connected to a public network such as the
Internet.
NEW QUESTION 70
What is the range for registered ports?
- A. 49152 through 65535
- B. 1024 through 49151
- C. Above 65535
- D. 0 through 1023
Answer: B
NEW QUESTION 71
Which of the following examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations?
- A. Host-based Intrusion Prevention
- B. Network Behavior Analysis
- C. Network-based Intrusion Prevention
- D. Wireless Intrusion Prevention System
Answer: B
Explanation:
Network Behavior Analysis examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations. Answer option B is incorrect. Network-based Intrusion Prevention (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. Answer option C is incorrect. Wireless Intrusion Prevention System (WIPS) monitors a wireless network for suspicious traffic by analyzing wireless networking protocols. Answer option D is incorrect. Host-based Intrusion Prevention (HIPS) is an installed software package that monitors a single host for suspicious activity by analyzing events occurring within that host.
NEW QUESTION 72
Which of the following are the common security problems involved in communications and email?
Each correct answer represents a complete solution. Choose all that apply.
- A. Message modification
- B. Message repudiation
- C. Message digest
- D. Eavesdropping
- E. Message replay
- F. Identity theft
- G. False message
Answer: A,B,D,E,F,G
Explanation:
Following are the common security problems involved in communications and email:
Eavesdropping: It is the act of secretly listening to private information through telephone lines, e-
mail, instant messaging, and any other method of communication considered private.
Identity theft: It is the act of obtaining someone's username and password to access his/her email
servers for reading email and sending false email messages. These credentials can be obtained
by eavesdropping on SMTP, POP, IMAP, or Webmail connections.
Message modification: The person who has system administrator permission on any of the SMTP
servers can visit anyone's message and can delete or change the message before it continues on
to its destination. The recipient has no way of telling that the email message has been altered.
False message: It the act of constructing messages that appear to be sent by someone else.
Message replay: In a message replay, messages are modified, saved, and re-sent later.
Message repudiation: In message repudiation, normal email messages can be forged. There is no
way for the receiver to prove that someone had sent him/her a particular message. This means
that even if someone has sent a message, he/she can successfully deny it.
Answer option B is incorrect. A message digest is a number that is created algorithmically from a
file and represents that file uniquely.
NEW QUESTION 73
Peter, a malicious hacker obtains e-mail addresses by collecting them messages, blogs, DNS lists and Web pages. Then he will send a large number of unsolicited commercial e-mail (UCE) messages to these addresses. What Peter at the following e-mail committing crimes?
- A. E-Mail bombing
- B. E-Mail scam
- C. E-Mail storm
- D. None
- E. spam
Answer: E
NEW QUESTION 74
Which of the following attacks are computer threats that try to exploit computer application vulnerabilities that are unknown to others or undisclosed to the software developer? Each correct answer represents a complete solution. Choose all that apply.
- A. Zero-day
- B. Buffer overflow
- C. Zero-hour
- D. Spoofing
Answer: A,C
Explanation:
A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability. User awareness training is the most effective technique to mitigate such attacks. Answer option C is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the responses to be misdirected. Answer option A is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. This usually occurs due to programming errors in the application. Buffer overflow can terminate or crash the application.
NEW QUESTION 75
You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue. Which of the following is most appropriate for this client?
- A. Cold site
- B. Hot site
- C. Off site
- D. Warm site
Answer: A
Explanation:
A cold site provides an office space, and in some cases basic equipment. However, you will need to restore your data to that equipment in order to use it. This is a much less expensive solution than the hot site. Answer option C is incorrect. A hot site has equipment installed, configured and ready to use. This may make disaster recovery much faster, but will also be more expensive. And a school district can afford to be down for several hours before resuming IT operations, so the less expensive option is more appropriate. Answer option A is incorrect. A warm site is between a hot and cold site. It has some equipment ready and connectivity ready. However, it is still significantly more expensive than a cold site, and not necessary for this scenario. Answer option D is incorrect. Off site is not any type of backup site terminology.
NEW QUESTION 76
Which of the following is a type of VPN that involves a single VPN gateway?
- A. Intranet-based VPN
- B. Extranet-based VPN
- C. Remote-access VPN
- D. PPTP VPN
Answer: B
NEW QUESTION 77
Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?
- A. Graph-Based Approach
- B. Rule-Based Approach
- C. Field-Based Approach
- D. Automated Field Correlation
Answer: D
NEW QUESTION 78
John wants to implement a packet filtering firewall in his organization's network. What TCP/IP layer does a packet filtering firewall work on?
- A. IP layer
- B. Network Interface layer
- C. Application layer
- D. TCP layer
Answer: A
NEW QUESTION 79
Which of the following processes helps the business units to understand the impact of a disruptive event?
- A. Business impact assessment
- B. Scope and plan initiation
- C. Business continuity plan development
- D. Plan approval and implementation
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 80
Which of the following steps of the OPSEC process examines each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then compare those indicators with the adversary's intelligence collection capabilities identified in the previous action?
- A. Application of Appropriate OPSEC Measures
- B. Identification of Critical Information
- C. Analysis of Threats
- D. Assessment of Risk
- E. Analysis of Vulnerabilities
Answer: E
Explanation:
OPSEC is a 5-step process that helps in developing protection mechanisms in order to safeguard sensitive information and preserve essential secrecy. The OPSEC process has five steps, which are as follows: 1.Identification of Critical Information: This step includes identifying information vitally needed by an adversary, which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to protect all classified or sensitive unclassified information. 2.Analysis of Threats: This step includes the research and analysis of intelligence, counterintelligence, and open source information to identify likely adversaries to a planned operation. 3.Analysis of Vulnerabilities: It includes examining each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then comparing those indicators with the adversary's intelligence collection capabilities identified in the previous action. 4.Assessment of Risk: Firstly, planners analyze the vulnerabilities identified in the previous action and identify possible OPSEC measures for each vulnerability. Secondly, specific OPSEC measures are selected for execution based upon a risk assessment done by the commander and staff. 5.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in the assessment of risk action or, in the case of planned future operations and activities, includes the measures in specific OPSEC plans.
NEW QUESTION 81
Which of the following is a technique for gathering information about a remote network protected by a firewall?
- A. Wardriving
- B. Firewalking
- C. Warchalking
- D. Wardialing
Answer: B
Explanation:
Fire walking is a technique for gathering information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall. If the firewall allows this crafted packet through, it forwards the packet to the next hop. On the next hop, the packet expires and elicits an ICMP
"TTL expired in transit" message to the attacker. If the firewall does not allow the traffic, there should be no response, or an ICMP "administratively prohibited" message should be returned to the attacker. A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall. The main drawback of this technique is that if an administrator blocks ICMP packets from leaving the network, it is ineffective.
Answer option B is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
Answer option C is incorrect. War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, one needs a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car.
Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources.
Answer option D is incorrect. War dialing or wardialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems, and fax machines. Hackers use the resulting lists for various purposes, hobbyists for exploration, and crackers - hackers that specialize in computer security - for password guessing.
NEW QUESTION 82
Tom works as a network administrator in a multinational organization having branches across North America and Europe. Tom wants to implement a storage technology that can provide centralized data storage and provide free data backup on the server. He should be able to perform data backup and recovery more efficiently with the selected technology. Which of the following storage technologies best suits Tom's requirements?
- A. NAS
- B. RAID
- C. DAS
- D. PAS
Answer: A
NEW QUESTION 83
Which of the following techniques uses a modem in order to automatically scan a list of telephone numbers?
- A. Warkitting
- B. War driving
- C. War dialing
- D. Warchalking
Answer: C
Explanation:
War dialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, BBS systems, and fax machines. Hackers use the resulting lists for various purposes, hobbyists for exploration, and crackers (hackers that specialize in computer security) for password guessing.
Answer option C is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
Answer option A is incorrect. War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, one needs a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car.
Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources.
Answer option D is incorrect. Warkitting is a combination of wardriving and rootkitting. In a warkitting attack, a hacker replaces the firmware of an attacked router. This allows them to control all traffic for the victim, and could even permit them to disable SSL by replacing HTML content as it is being downloaded. Warkitting was identified by Tsow, Jakobsson, Yang, and Wetzel in 2006. Their discovery indicated that 10% of the wireless routers were susceptible to WAPjacking (malicious configuring of the firmware settings, but making no modification on the firmware itself) and 4.4% of wireless routers were vulnerable to WAPkitting (subverting the router firmware). Their analysis showed that the volume of credential theft possible through Warkitting exceeded the estimates of credential theft due to phishing.
NEW QUESTION 84
What is the range for well known ports?
- A. 49152 through 65535
- B. Above 65535
- C. 1024 through 49151
- D. 0 through 1023
Answer: D
NEW QUESTION 85
Which of the following is a session layer protocol?
- A. RDP
- B. ICMP
- C. SLP
- D. RPC
Answer: D
NEW QUESTION 86
Which of the following is a type of computer security that deals with protection against spurious signals emitted by electrical equipment in the system?
- A. Physical security
- B. Emanation Security
- C. Hardware security
- D. Communication Security
Answer: B
Explanation:
Explanation
Explanation:
Emanation security is one of the types of computer security that deals with protection against spurious signals emitted by electrical equipment in the system, such as electromagnetic emission (from displays), visible emission (displays may be visible through windows), and audio emission (sounds from printers, etc). Answer option D is incorrect. Hardware security helps in dealing with the vulnerabilities in the handling of hardware.
Answer option B is incorrect. Physical security helps in dealing with protection of computer hardware and associated equipment.
Answer option A is incorrect. Communication security helps in dealing with the protection of data and information during transmission.
NEW QUESTION 87
Which of the following IEEE standards is also called Fast Basic Service Set Transition?
- A. 802.11r
- B. 802.11b
- C. 802.11e
- D. 802.11a
Answer: A
NEW QUESTION 88
Which of the following is a physical security device designed to entrap a person on purpose?
- A. War Flying
- B. Mantrap
- C. War Chalking
- D. Trap
Answer: B
NEW QUESTION 89
Adam, a malicious hacker, is sniffing an unprotected Wi-FI network located in a local store with Wireshark to capture hotmail e-mail traffic. He knows that lots of people are using their laptops for browsing the Web in the store. Adam wants to sniff their e-mail messages traversing the unprotected Wi-Fi network. Which of the following Wireshark filters will Adam configure to display only the packets with hotmail email messages?
- A. (http = "login.pass.com") && (http contains "SMTP")
- B. (http = "login.passport.com") && (http contains "POP3")
- C. (http contains "email") && (http contains "hotmail")
- D. (http contains "hotmail") && (http contains "Reply-To")
Answer: D
Explanation:
Adam will use (http contains "hotmail") && (http contains "Reply-To") filter to display only the packets with hotmail email messages. Each Hotmail message contains the tag Reply-To: and "xxxx-xxx- xxx.xxxx.hotmail.com" in the received tag. Wireshark is a free packet sniffer computer application. It is used for network troubleshooting, analysis, software and communications protocol development, and education.
Wireshark is very similar to tcpdump, but it has a graphical front-end, and many more information sorting and filtering options. It allows the user to see all traffic being passed over the network (usually an Ethernet network but support is being added for others) by putting the network interface into promiscuous mode. Wireshark uses pcap to capture packets, so it can only capture the packets on the networks supported by pcap. It has the following features: Data can be captured "from the wire" from a live network connection or read from a file that records the already-captured packets. Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback. Captured network data can be browsed via a GUI, or via the terminal (command line) version of the utility, tshark. Captured files can be programmatically edited or converted via command-line switches to the "editcap" program. Data display can be refined using a display filter. Plugins can be created for dissecting new protocols.
Answer options B, A, and D are incorrect. These are invalid tags.
NEW QUESTION 90
......
312-38 Exam Questions – Valid 312-38 Dumps Pdf: https://www.actual4dumps.com/312-38-study-material.html
Verified 312-38 dumps Q&As - Pass Guarantee: https://drive.google.com/open?id=1LKCJ3u0MMLdteljC0Re_1oTqM4yGjKNq