EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 151:

  Fill in the blank with the appropriate term. is a prime example of a high-interaction honeypot.

  Honeynet

  Explanation/Reference:

  Honeynet is a prime example of a high-interaction honeypot. Two or more honeypots on a network form a honeynet. Typically, a honeynet is used for monitoring a larger and/or more diverse network in which one honeypot may not be sufficient. Honeynets and honeypots are usually implemented as parts of larger network intrusion-detection systems. A honeyfarm is a centralized collection of honeypots and analysis tools.

• Question 152:

  Which of the following is a computer network that covers a broad area?

  A. SAN
  B. PAN
  C. CAN
  D. WAN
  D. WAN

• Question 153:

  You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.

  A. History folder
  B. Temporary Internet Folder
  C. Cookies folder
  D. Download folder
  A. History folder
  B. Temporary Internet Folder
  C. Cookies folder

  ---

  Explanation/Reference:

  Online e-mail systems such as Hotmail and Yahoo leave files containing e-mail message information on the local computer. These files are stored in a number of folders, which are as follows: Cookies folder Temp folder History folder Cache folder Temporary Internet Folder Forensic tools can recover these folders for the respective e-mail clients. When folders are retrieved, e-mail files can be accessed. If the data is not readable, various tools are available to decrypt the information such as a cookie reader used with cookies. Answer option D is incorrect. Download folder does not contain any e-mail message information.

• Question 154:

  Which of the following type of UPS is used to supply power above 10kVA and provides an ideal electric output presentation, and its constant wear on the power components reduces the dependability?

  A. Line Interactive
  B. Double conversion on-line
  C. Stand by Ferro
  D. Stand by On-line hybrid
  B. Double conversion on-line

• Question 155:

  Which of the following is a standard-based protocol that provides the highest level of VPN security?

  A. IPSec
  B. IP
  C. PPP
  D. L2TP
  A. IPSec

  ---

  Explanation/Reference:

  Internet Protocol Security (IPSec) is a standard-based protocol that provides the highest level of VPN security. IPSec can encrypt virtually everything above the networking layer. It is used for VPN connections that use the L2TP protocol. It secures both data and password. IPSec cannot be used with Point-to-Point Tunneling Protocol (PPTP). Answer option B is incorrect. The Internet Protocol (IP) is a protocol used for communicating data across a packet-switched inter-network using the Internet Protocol Suite, also referred to as TCP/IP. IP is the primary protocol in the Internet Layer of the Internet Protocol Suite and has the task of delivering distinguished protocol datagrams (packets) from the source host to the destination host solely based on their addresses. For this purpose, the Internet Protocol defines addressing methods and structures for datagram encapsulation. The first major version of addressing structure, now referred to as Internet Protocol Version 4 (IPv4), is still the dominant protocol of the Internet, although the successor, Internet Protocol Version 6 (IPv6), is being deployed actively worldwide. Answer option C is incorrect. Point-to-Point Protocol (PPP) is a remote access protocol commonly used to connect to the Internet. It supports compression and encryption and can be used to connect to a variety of networks. It can connect to a network running on the IPX, TCP/IP, or NetBEUI protocol. It supports multi-protocol and dynamic IP assignments. It is the default protocol for the Microsoft Dial-Up adapter. Answer option D is incorrect. Layer 2 Tunneling Protocol (L2TP) is a more secure version of Point-to-Point Tunneling Protocol (PPTP). It provides tunneling, address assignment, and authentication. It allows the transfer of Point-to-Point Protocol (PPP) traffic between different networks. L2TP combines with IPSec to provide tunneling and security for Internet Protocol (IP), Internetwork Packet Exchange (IPX), and other protocol packets across IP networks.

• Question 156:

  Which of the following is a worldwide organization that aims to establish, refine, and promote Internet security standards?

  A. ANSI
  B. WASC
  C. IEEE
  D. ITU
  B. WASC

  ---

  Explanation/Reference:

  Web Application Security Consortium (WASC) is a worldwide organization that aims to establish, refine, and promote Internet security standards. WASC is vendor-neutral, although members may belong to corporations involved in the

  research, development, design, and distribution of Web security-related products.

  Answer option A is incorrect. ANSI (American National Standards Institute) is the primary organization for fostering the development of technology standards in the United States. ANSI works with industry groups and is the U.S. member of the

  International Organization for Standardization (ISO) and the International Electro-technical Commission (IEC). Long-established computer standards from ANSI include the American Standard Code for Information Interchange (ASCII) and the

  Small Computer System Interface (SCSI).

  Answer option D is incorrect. The International Telecommunication Union (ITU) is an organization established to standardize and regulate international radio and telecommunications. Its main tasks include standardization, allocation of the

  radio spectrum, and organizing interconnection arrangements between different countries to allow international phone calls. ITU sets standards for global telecom networks. The ITU's telecommunications division (ITU-T) produces more than

  200 standard recommendations each year in the converging areas of telecommunications, information technology, consumer electronics, broadcasting and multimedia communications. ITU was streamlined into the following three sectors:

  ITU-D (Telecommunication Development)

  ITU-R (Radio communication)

  ITU-T (Telecommunication Standardization)

  Answer option C is incorrect. The Institute of Electrical and Electronic Engineers (IEEE) is a society of technical professionals. It promotes the development and application of electro-technology and allied sciences. IEEE develops

  communications and network standards, among other activities. The organization publishes number of journals, has many local chapters, and societies in specialized areas.

• Question 157:

  Which of the following is a computer network protocol used by the hosts to apply for the tasks the IP address and other configuration information?

  A. DHCP
  B. ARP
  C. Telnet
  D. None
  E. SNMP
  A. DHCP

• Question 158:

  Which of the following types of cyberstalking damages the reputation of their victim and turns other people against them by setting up their own Websites, blogs, or user pages for this purpose?

  A. False accusation
  B. Attempts to gather information about the victim
  C. Encouraging others to harass the victim
  D. False victimization
  A. False accusation

  ---

  Explanation/Reference:

  In false accusations, many cyberstalkers try to damage the reputation of their victim and turn other people against them. They post false information about them on Websites. They may set up their own Websites, blogs, or user pages for this

  purpose. They post allegations about the victim to newsgroups, chat rooms, or other sites that allow public contributions.

  Answer option D is incorrect. In false victimization, the cyberstalker claims that the victim is harassing him/her.

  Answer option C is incorrect. In this type of cyberstalking, many cyberstalkers try to involve third parties in the harassment. They claim that the victim has harmed the stalker in some way, or may post the victim's name and telephone number

  in order to encourage others to join the pursuit.

  Answer option B is incorrect. In an attempt to gather information, cyberstalkers may approach their victim's friends, family, and work colleagues to obtain personal information. They may advertise for information on the Internet. They often will

  monitor the victim's online activities and attempt to trace their IP address in an effort to gather more information about their victims.

• Question 159:

  Fill in the blank with the appropriate term. is an enumeration technique used to glean information about computer systems on a network and the services running its open ports.

  Banner grabbing

  Explanation/Reference:

  Banner grabbing is an enumeration technique used to glean information about computer systems on a network and the services running its open ports. Administrators can use this to take inventory of the systems and services on their network. An intruder however can use banner grabbing in order to find network hosts that are running versions of applications and operating systems with known exploits. Some examples of service ports used for banner grabbing are those used by Hyper Text Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP); ports 80, 21, and 25 respectively. Tools commonly used to perform banner grabbing are Telnet, which is included with most operating systems, and Netcat. For example, one could establish a connection to a target host running a Web service with netcat, then send a bad html request in order to get information about the service on the host: [root@prober] nc www.targethost.com 80 HEAD / HTTP/1.1 HTTP/1.1 200 OK Date: Mon, 11 May 2009 22:10:40 EST Server: Apache/2.0.46 (Unix) (Red Hat/Linux) Last-Modified: Thu, 16 Apr 2009 11:20:14 PST ETag: "1986-69b-123a4bc6" Accept-Ranges: bytes Content-Length: 1110 Connection: close Content-Type: text/html The administrator can now catalog this system or an intruder now knows what version of Apache to look for exploits.

• Question 160:

  Which of the following refers to a potential occurrence of an undesired event that can eventually damage and interrupt the operational and functional activities of an organization?

  A. Attack
  B. Risk
  C. Threat
  D. Vulnerability
  C. Threat