Free 2022 Certified Ethical Hacker 312-38 dumps are available on Google Drive shared by PassReview
Welcome to download the newest PassReview 312-38 PDF dumps: https://www.passreview.com/312-38_exam-braindumps.html ( 171 Q&As)
Understanding functional and technical aspects of Certified Network Defender Business Principles and Practices
The following will be discussed in ECCOUNCIL EC 312-38 exam dumps:
- Identify RF disruption from 802.11 wireless devices including contention vs. interference and causes/sources of both including co-channel contention (CCC), overlapping channels, and 802.11 wireless device proximity
- Locate and identify sources of RF interference (CHAPTER 12)
- Perform application testing to validate WLAN performance (CHAPTER 12)
- Network and service availability
- Understand interference mitigation options including removal of interference source or change of wireless channel usage
- Protocol and spectrum analyzers
- Best practices in secure management protocols (e.g. encrypted management HTTPS, SNMPv3, SSH2, VPN and password management)
NEW QUESTION 56
Which of the following is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients? Each correct answer represents a complete solution. Choose all that apply.
- A. Email spoofing
- B. Junk mail
- C. Email jamming
- D. E-mail spam
Answer: B,D
Explanation:
E-mail spam, also known as unsolicited bulk email (UBE), junk mail, or unsolicited commercial email (UCE), is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients. Answer option C is incorrect. Email spoofing is a fraudulent email activity in which the sender address and other parts of the email header are altered to appear as though the email originated from a different source. Email spoofing is a technique commonly used in spam and phishing emails to hide the origin of the email message. By changing certain properties of the email, such as the From, Return-Path and Reply-To fields (which can be found in the message header), ill-intentioned users can make the email appear to be from someone other than the actual sender. The result is that, although the email appears to come from the address indicated in the From field (found in the email headers), it actually comes from another source. Answer option D is incorrect. Email jamming is the use of sensitive words in e-mails to jam the authorities that listen in on them by providing a form of a red herring and an intentional annoyance. In this attack, an attacker deliberately includes "sensitive" words and phrases in otherwise innocuous emails to ensure that these are picked up by the monitoring systems. As a result the senders of these emails will eventually be added to a "harmless" list and their emails will be no longer intercepted, hence it will allow them to regain some privacy.
NEW QUESTION 57
FILL BLANK
Fill in the blank with the appropriate term. The ___________ protocol is a feature of packet-based data
transmission protocols. It is used to keep a record of the frame sequences sent and their respective
acknowledgements received by both the users.
Answer:
Explanation:
Sliding Window
Explanation:
The Sliding Window protocol is a feature of packet-based data transmission protocols. It is used in the data link
layer (OSI model) as well as in TCP (transport layer of the OSI model). It is used to keep a record of the frame
sequences sent, and their respective acknowledgements received, by both the users. Its additional feature
over a simpler protocol is that can allow multiple packets to be "in transmission" simultaneously, rather than
waiting for each packet to be acknowledged before sending the next.In transmit flow control, sliding window is
a variable-duration window that allows a sender to transmit a specified number of data units before an
acknowledgment is received or before a specified event occurs.An example of a sliding window is one in
which, after the sender fails to receive an acknowledgment for the first transmitted frame, the sender "slides"
the window, i.e., resets the window, and sends a second frame. This process is repeated for the specified
number of times before the sender interrupts transmission. Sliding window is sometimes called
acknowledgment delay period.
NEW QUESTION 58
You are monitoring your network traffic with the Wireshark utility and noticed that your network is experiencing a large amount of traffic from a certain region. You suspect a DoS incident on the network. What will be your first reaction as a first responder?
- A. Avoid Fear, Uncertainty and Doubt
- B. Disable Virus Protection
- C. Communicate the incident
- D. Make an initial assessment
Answer: A
NEW QUESTION 59
Which of the following is a software tool used in passive attacks for capturing network traffic?
- A. Sniffer
- B. Intrusion prevention system
- C. Intrusion detection system
- D. Warchalking
Answer: A
Explanation:
A sniffer is a software tool that is used to capture any network traffic. Since a sniffer changes the NIC of the LAN card into promiscuous mode, the NIC begins to record incoming and outgoing data traffic across the network. A sniffer attack is a passive attack because the attacker does not directly connect with the target host.
This attack is most often used to grab logins and passwords from network traffic. Tools such as Ethereal, Snort, Windump, EtherPeek, Dsniff are some good examples of sniffers. These tools provide many facilities to users such as graphical user interface, traffic statistics graph, multiple sessions tracking, etc.
Answer option A is incorrect. An intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass.
Answer option B is incorrect. An IDS (Intrusion Detection System) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators.
Answer option C is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
NEW QUESTION 60
Which of the following are provided by digital signatures?
- A. Integrity and validation
- B. Identification and validation
- C. Authentication and identification
- D. Security and integrity
Answer: C
NEW QUESTION 61
Which of the following are the various methods that a device can use for logging information on a Cisco router?
Each correct answer represents a complete solution. Choose all that apply.
- A. Terminal logging
- B. Buffered logging
- C. SNMP logging
- D. NTP logging
- E. Syslog logging
- F. Console logging
Answer: A,B,C,E,F
Explanation:
There are different methods that a device can use for logging information on a Cisco router:
Terminal logging: In this method, log messages are sent to the VTY session.
Console logging: In this method, log messages are sent directly to the console port.
Buffered logging: In this method, log messages are kept in the RAM on the router. As the buffer fills, the older messages are overwritten by the newer messages.
Syslog logging: In this method, log messages are sent to an external syslog server where they are stored and sorted.
SNMP logging: In this method, log messages are sent to an SNMP server in the network.
Answer option C is incorrect. This is an invalid option.
NEW QUESTION 62
Which of the following are the six different phases of the Incident handling process? Each correct answer represents a complete solution. Choose all that apply.
- A. Eradication
- B. Recovery
- C. Preparation
- D. Containment
- E. Lessons learned
- F. Post mortem review
- G. Identification
Answer: A,B,C,D,E,G
Explanation:
Following are the six different phases of the Incident handling process: 1.Preparation: Preparation is the first step in the incident handling process. It includes processes like backing up copies of all key data on a regular basis, monitoring and updating software on a regular basis, and creating and implementing a documented security policy. To apply this step a documented security policy is formulated that outlines the responses to various incidents, as a reliable set of instructions during the time of an incident. The following list contains items that the incident handler should maintain in the preparation phase i.e. before an incident occurs: Establish applicable policies Build relationships with key players Build response kit Create incident checklists Establish communication plan Perform threat modeling Build an incident response team Practice the demo incidents 2.Identification: The Identification phase of the Incident handling process is the stage at which the Incident handler evaluates the critical level of an incident for an enterprise or system. It is an important stage where the distinction between an event and an incident is determined, measured and tested. 3.Containment: The Containment phase of the Incident handling process supports and builds up the incident combating process. It helps in ensuring the stability of the system and also confirms that the incident does not get any worse. 4.Eradication: The Eradication phase of the Incident handling process involves the cleaning-up of the identified harmful incidents from the system. It includes the analyzing of the information that has been gathered for determining how the attack was committed. To prevent the incident from happening again, it is vital to recognize how it was conceded out so that a prevention technique is applied. 5.Recovery: Recovery is the fifth step of the incident handling process. In this phase, the Incident Handler places the system back into the working environment. In the recovery phase the Incident Handler also works with the questions to validate that the system recovery is successful. This involves testing the system to make sure that all the processes and functions are working normal. The Incident Handler also monitors the system to make sure that the systems are not compromised again. It looks for additional signs of attack. 6.Lessons learned: Lessons learned is the sixth and the final step of incident handling process. The Incident Handler utilizes the knowledge and experience he learned during the handling of the incident to enhance and improve the incident-handling process. This is the most ignorant step of all incident handling processes. Many times the Incident Handlers are relieved to have systems back to normal and get busy trying to catch up other unfinished work. The Incident Handler should make documents related to the incident or look for ways to improve the process. Answer option C is incorrect. The post mortem review is one of the phases of the Incident response process.
NEW QUESTION 63
You are taking over the security of an existing network. You discover a machine that is not being used as such, but has software on it that emulates the activity of a sensitive database server. What is this?
- A. A reactive IDS.
- B. A Virus
- C. A Honey Pot
- D. A Polymorphic Virus
Answer: C
Explanation:
A honey pot is a device specifically designed to emulate a high value target such as a database server or entire sub section of your network. It is designed to attract the hacker's attention.
NEW QUESTION 64
Which of the following are the various methods that a device can use for logging information on a Cisco router? Each correct answer represents a complete solution. Choose all that apply.
- A. Terminal logging
- B. Buffered logging
- C. SNMP logging
- D. NTP logging
- E. Syslog logging
- F. Console logging
Answer: A,B,C,E,F
Explanation:
There are different methods that a device can use for logging information on a Cisco router:
Terminal logging: In this method, log messages are sent to the VTY session.
Console logging: In this method, log messages are sent directly to the console port.
Buffered logging: In this method, log messages are kept in the RAM on the router. As the buffer
fills, the older messages are overwritten by the newer messages.
Syslog logging: In this method, log messages are sent to an external syslog server where they are
stored and sorted.
SNMP logging: In this method, log messages are sent to an SNMP server in the network.
Answer option C is incorrect. This is an invalid option.
NEW QUESTION 65
Which of the following statements are true about a wireless network?
Each correct answer represents a complete solution. Choose all that apply.
- A. It provides mobility to users to access a network.
- B. It is easy to connect.
- C. Data can be transmitted in different ways by using Cellular Networks, Mobitex, DataTAC, etc.
- D. Data can be shared easily between wireless devices.
Answer: A,B,C,D
Explanation:
The advantages of a wireless network are as follows:
It provides mobility to users to access a network.
It is easy to connect.
The initial cost to set up a wireless network is low as compared to that of manual cable
network.Data can be transmitted in different ways by using Cellular Networks, Mobitex, DataTAC,
etc.Data can be shared easily between the wireless devices.
NEW QUESTION 66
Cindy is the network security administrator for her company. She just got back from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. She is worried about the current security state of her company's network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established, she sends RST packets to those hosts to stop the session. She has done this to see how her intrusion detection system will log the traffic. What type of scan is Cindy attempting here?
- A. She is utilizing a RST scan to find live hosts that are listening on her network.
- B. The type of scan she is usinq is called a NULL scan.
- C. Cindy is using a half-open scan to find live hosts on her network.
- D. Cindy is attempting to find live hosts on her company's network by using a XMAS scan.
Answer: C
NEW QUESTION 67
Which of the following is a mechanism that helps to ensure that only the intended and authorized recipients are able to read the data?
- A. authentication
- B. access to information
- C. confidence
- D. integrity
- E. none
Answer: C
NEW QUESTION 68
Which of the following is a type of VPN that involves a single VPN gateway?
- A. Remote-access VPN
- B. Extranet-based VPN
- C. Intranet-based VPN
- D. PPTP VPN
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION 69
Which of the following is a software tool used in passive attacks for capturing network traffic?
- A. Sniffer
- B. Intrusion prevention system
- C. Intrusion detection system
- D. Warchalking
Answer: A
Explanation:
A sniffer is a software tool that is used to capture any network traffic. Since a sniffer changes the NIC of the LAN card into promiscuous mode, the NIC begins to record incoming and outgoing data traffic across the network. A sniffer attack is a passive attack because the attacker does not directly connect with the target host. This attack is most often used to grab logins and passwords from network traffic. Tools such as Ethereal, Snort, Windump, EtherPeek, Dsniff are some good examples of sniffers. These tools provide many facilities to users such as graphical user interface, traffic statistics graph, multiple sessions tracking, etc. Answer option A is incorrect. An intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass. Answer option B is incorrect. An IDS (Intrusion Detection System) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. Answer option C is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
NEW QUESTION 70
Which of the following wireless networks provides connectivity over distance up to 20 feet?
- A. WLAN
- B. WPAN
- C. WMAN
- D. WWAN
Answer: B
NEW QUESTION 71
Disaster Recovery is a _________.
- A. Security-centric strategy
- B. Business-centric strategy
- C. Data-centric strategy
- D. Operation-centric strategy
Answer: C
NEW QUESTION 72
Which VPN QoS model guarantees the traffic from one customer edge (CE) to another?
- A. Hub-and-Spoke VPN model
- B. Pipe Model
- C. AAA model
- D. Hose mode
Answer: B
NEW QUESTION 73
Which of the following attacks combines dictionary and brute force attacks?
- A. Hybrid attack
- B. Phishing attack
- C. Replay attack
- D. Man-in-the-middle attack
Answer: A
NEW QUESTION 74
Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago.
He has focused primarily on securing network devices, firewalls, and traffic traversing in and out of the network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets. What is this type of server called?
- A. Edge transport server
- B. Bastion host
- C. Session layer firewall
- D. SOCKS hsot
Answer: B
NEW QUESTION 75
......
Topics of Certified Network Defender
Competitors should know the test themes before they start arrangement. Since it will help them in hitting the center. ECCOUNCIL EC 312-38 exam dumps pdf will incorporate the accompanying themes:
- Incident Response
- Network Perimeter Protection
- Incident Detection
- Network Defense Management
- Enterprise Virtual, Cloud, and Wireless Network Protection
- Incident Prediction
- Application and Data Protection
Prerequisites
The potential candidates must fulfill one of two options of eligibility criteria for this certification exam. The first thing is to complete the official training course, which can be taken as instructor-led training, academic learning, or online live training. The second variant is to opt for self-study. However, those who want to consider this option must have a minimum of two years of practical work experience in the domain of Information Technology. They should also have educational background that indicates a specialization in this area. To demonstrate this, they must submit a filled eligibility application form and pay the non-refundable application fee of $100.
Before you start the registration process, you should check if you qualify as one of the target audiences for this path. The intended candidates for EC-Council 312-38 are the security operators, network administrators, security analysts, network defense technicians, network security engineers, network security administrators, as well as any professionals who work with network operations.
Tested Material Used To 312-38: https://www.passreview.com/312-38_exam-braindumps.html
Following are some new 312-38 Real Exam Questions!: https://drive.google.com/open?id=1mTe5vGMzC4tacJsuhcaev0Pu0cr6Urzd