Easily To Pass New EC-COUNCIL 312-38 Dumps with 171 Questions [Q35-Q53]

312-38 EC-COUNCIL

admin -

August 30, 2022

4/5 - (1 vote)

Easily To Pass New EC-COUNCIL 312-38 Dumps with 171 Questions

Latest 312-38 Study Guides 2022 – With Test Engine PDF

Related Certification Path: CND

The EC-Council Certified Network Defender designation is designed to validate the technical skills of network administrators who are constantly involved in managing network threats. Such individuals should be well versed with a wide range of concepts around this field including network topology, security policy, traffic, performance & utilization, and network components just to mention a few. As a Certified Network Defender, you will be expected to demonstrate your ability to apply network security controls, configure firewall and VPN, and analyze network vulnerabilities. As continuity and resilience of operations matter in today’s IT world, this is the best validation that IT specialists, companies, and hiring managers should turn to. In a nutshell, the CND certification path is designed to validate the following individuals:

Network Security Engineers.
Network Defense Technicians;
Network Administrators;

QUESTION 35
Which of the following is a session layer protocol?

RPC

SLP

RDP

ICMP

QUESTION 36
In MacOS, how can the user implement disk encryption?

By enabling BitLocker feature

By executing dm-crypt command

By turning on Device Encryption feature

By enabling FileVault feature

QUESTION 37
Mark is monitoring the network traffic on his organization’s network. He wants to detect a TCP and UDP ping sweep on his network. Which type of filter will be used to detect this on the network?

Tcp.srcport==7 and udp.srcport==7

Tcp.srcport==7 and udp.dstport==7

Tcp.dstport==7 and udp.srcport==7

Tcp.dstport==7 and udp.dstport==7

QUESTION 38
Which of the following OSI layers is sometimes called the syntax layer?

Presentation layer

Application layer

Physical layer

Data link layer

QUESTION 39
Which of the following is a network analysis tool that sends packets with nontraditional IP stack parameters?

Nessus

COPS

SAINT

HPing

QUESTION 40
Which of the following incident handling stage removes the root cause of the incident?

Eradication

Recovery

Detection

Containment

QUESTION 41
Which of the following systems monitors the operating system detecting inappropriate activity, writing to log files, and triggering alarms?

Signature-Based ID system

Host-based ID system

Network-based ID system

Behavior-based ID system

QUESTION 42
In which of the following transmission modes is data sent and received alternatively?

Simplex mode

Bridge mode

Half-duplex mode

Full-duplex mode

QUESTION 43
Which of the following tools is an open source network intrusion prevention and detection system that operates
as a network sniffer and logs activities of the network that is matched with the predefined signatures?

Dsniff

KisMAC

Snort

Kismet

Snort is an open source network intrusion prevention and detection system that operates as a network sniffer.
It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for
a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram
Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be
configured are as follows:
Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console.
Packet logger mode: It logs the packets to the disk.
Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to
analyze network traffic for matches against a user-defined rule set.
Answer option A is incorrect. Dsniff is a set of tools that are used for sniffing passwords, e-mail, and HTTP
traffic. Some of the tools of Dsniff include dsniff, arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf.
Dsniff is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools
for switching across switched networks. It can also be used to capture authentication information for FTP,
telnet, SMTP, HTTP, POP, NNTP, IMAP, etc.
Answer option D is incorrect. Kismet is a Linux-based 802.11 wireless network sniffer and intrusion detection
system. It can work with any wireless card that supports raw monitoring (rfmon) mode. Kismet can sniff
802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet can be used for the following tasks:
To identify networks by passively collecting packets
To detect standard named networks
To detect masked networks
To collect the presence of non-beaconing networks via data traffic
Answer option B is incorrect. KisMAC is a wireless network discovery tool for Mac OS
X. It has a wide range of
features, similar to those of Kismet, its Linux/BSD namesake and far exceeding those of NetStumbler, its
closest equivalent on Windows. The program is geared towards the network security professionals, and is not
as novice-friendly as the similar applications. KisMAC will scan for networks passively on supported cards,
including Apple’s AirPort, AirPort Extreme, and many third-party cards. It will scan for networks actively on any
card supported by Mac OS X itself.
Cracking of WEP and WPA keys, both by brute force, and exploiting flaws, such as weak scheduling and badly
generated keys is supported when a card capable of monitor mode is used, and when packet reinsertion can
be done with a supported card. The GPS mapping can be performed when an NMEA compatible GPS receiver
is attached. Data can also be saved in pcap format and loaded into programs, such as Wireshark.

QUESTION 44
Which of the following techniques is also called access point mapping?

War dialing

Wire tapping

War flying

War driving

QUESTION 45
Which of the following statements are true about volatile memory? Each correct answer represents a complete
solution. Choose all that apply.

Read-Only Memory (ROM) is an example of volatile memory.

The content is stored permanently, and even the power supply is switched off.

The volatile storage device is faster in reading and writing data.

It is computer memory that requires power to maintain the stored information.

Volatile memory, also known as volatile storage, is computer memory that requires power to maintain the
stored information, unlike non-volatile memory which does not require a maintained power supply. It has been
less popularly known as temporary memory. Most forms of modern random access memory (RAM) are volatile
storage, including dynamic random access memory (DRAM) and static random access memory (SRAM). A
volatile storage device is faster in reading and writing data. Answer options B and A are incorrect. Non-volatile
memory, nonvolatile memory, NVM, or non-volatile storage, in the most basic sense, is computer memory that
can retain the stored information even when not powered. Examples of non-volatile memory include read-only
memory, flash memory, most types of magnetic computer storage devices (e.g. hard disks, floppy disks, and
magnetic tape), optical discs, and early computer storage methods such as paper tape and punched cards.

QUESTION 46
A war dialer is a tool that is used to scan thousands of telephone numbers to detect vulnerable modems. It provides an attacker unauthorized access to a computer. Which of the following tools can an attacker use to perform war dialing? Each correct answer represents a complete solution. Choose all that apply.

ToneLoc

Wingate

THC-Scan

NetStumbler

THC-Scan and ToneLoc are tools used for war dialing. A war dialer is a tool that is used to scan thousands of telephone numbers to detect vulnerable modems. It provides the attacker unauthorized access to a computer.
Answer option D is incorrect. NetStumbler is a Windows-based tool that is used for the detection of wireless LANs using the IEEE 802.11a, 802.11b, and 802.11g standards. It detects wireless networks and marks their relative position with a GPS. It uses an 802.11 Probe Request that has been sent to the broadcast destination address.
Answer option B is incorrect. Wingate is a proxy server.

QUESTION 47
The IP addresses reserved for experimental purposes belong to which of the following classes?

Class E

Class C

Class A

Class D

QUESTION 48
Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer and logs activities of the network that is matched with the predefined signatures?

Dsniff

KisMAC

Snort

Kismet

Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be configured are as follows: Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console. Packet logger mode: It logs the packets to the disk. Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for matches against a user-defined rule set. Answer option A is incorrect. Dsniff is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of the tools of Dsniff include dsniff, arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. Dsniff is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc. Answer option D is incorrect. Kismet is a Linux-based 802.11 wireless network sniffer and intrusion detection system. It can work with any wireless card that supports raw monitoring (rfmon) mode. Kismet can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet can be used for the following tasks: To identify networks by passively collecting packets To detect standard named networks To detect masked networks To collect the presence of non-beaconing networks via data traffic Answer option B is incorrect. KisMAC is a wireless network discovery tool for Mac OS X.
It has a wide range of features, similar to those of Kismet, its Linux/BSD namesake and far exceeding those of NetStumbler, its closest equivalent on Windows. The program is geared towards the network security professionals, and is not as novice-friendly as the similar applications. KisMAC will scan for networks passively on supported cards, including Apple’s AirPort, AirPort Extreme, and many third-party cards. It will scan for networks actively on any card supported by Mac OS X itself. Cracking of WEP and WPA keys, both by brute force, and exploiting flaws, such as weak scheduling and badly generated keys is supported when a card capable of monitor mode is used, and when packet reinsertion can be done with a supported card. The GPS mapping can be performed when an NMEA compatible GPS receiver is attached. Data can also be saved in pcap format and loaded into programs, such as Wireshark.

QUESTION 49
Network security is the specialist area, which consists of the provisions and policies adopted by the Network Administrator to prevent and monitor unauthorized access, misuse, modification, or denial of the computer network and network-accessible resources. For which of the following reasons is network security needed?
Each correct answer represents a complete solution. Choose all that apply.

To protect information from loss and deliver it to its destination properly

To protect information from unwanted editing, accidentally or intentionally by unauthorized users

To protect private information on the Internet

To prevent a user from sending a message to another user with the name of a third person

Explanation
Explanation:
Network security is needed for the following reasons:
To protect private information on the Internet
To protect information from unwanted editing, accidentally or intentionally by unauthorized users To protect information from loss and deliver it to its destination properly To prevent a user from sending a message to another user with the name of a third person

QUESTION 50
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He is using a tool to crack the wireless encryption keys. The description of the tool is as follows:

Which of the following tools is John using to crack the wireless encryption keys?

PsPasswd

Kismet

AirSnort

Cain

AirSnort is a Linux-based WLAN WEP cracking tool that recovers encryption keys. AirSnort operates by passively monitoring transmissions. It uses Ciphertext Only Attack and captures approximately 5 to 10 million packets to decrypt the WEP keys. Answer option B is incorrect. Kismet is a Linux-based 802.11 wireless network sniffer and intrusion detection system. It can work with any wireless card that supports raw monitoring (rfmon) mode. Kismet can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet can be used for the following tasks: To identify networks by passively collecting packets To detect standard named networks To detect masked networks To collect the presence of non-beaconing networks via data traffic Answer option D is incorrect. Cain is a multipurpose tool that can be used to perform many tasks such as Windows password cracking, Windows enumeration, and VoIP session sniffing. This password cracking program can perform the following types of password cracking attacks: Dictionary attack Brute force attack Rainbow attack Hybrid attack Answer option A is incorrect. PsPasswd is a tool that helps Network Administrators change an account password on the local or remote system. The command syntax of PsPasswd is as follows: pspasswd [\\computer[,computer[,..] | @file [-u user [-p psswd]] Username [NewPassword]

QUESTION 51
Tom works as a network administrator in a multinational organization having branches across North America and Europe. Tom wants to implement a storage technology that can provide centralized data storage and provide free data backup on the server. He should be able to perform data backup and recovery more efficiently with the selected technology. Which of the following storage technologies best suits Tom’s requirements?

DAS

PAS

RAID

NAS

QUESTION 52
Which of the following security models enable strict identity verification for every user or device attempting to access the network resources?
1. Zero-trust network model
2. Castle-and-Moat model

Both 1 and 2

1 only

2 only

None

QUESTION 53
Which of the following steps will NOT make a server fault tolerant? Each correct answer represents a complete solution. (Choose two.)

Adding a second power supply unit

Performing regular backup of the server

Adding one more same sized disk as mirror on the server

Implementing cluster servers’ facility

Encrypting confidential data stored on the server

Encrypting confidential data stored on the server and performing regular backup will not make the server fault tolerant.
Fault tolerance is the ability to continue work when a hardware failure occurs on a system. A fault-tolerant system is designed from the ground up for reliability by building multiples of all critical components, such as CPUs, memories, disks and power supplies into the same computer. In the event one component fails, another takes over without skipping a beat.
Answer options A, C, and D are incorrect. The following steps will make the server fault tolerant:
Adding a second power supply unit
Adding one more same sized disk as a mirror on the server implementing cluster servers facility

Loading …