EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 21:

  The risk assessment team in Southern California has estimated that the probability of an incident that has potential to impact almost 80% of the bank's business is very high. How should this risk be categorized in the risk matrix?

  A. High
  B. Medium
  C. Extreme
  D. Low
  C. Extreme

• Question 22:

  Which protocol could choose the network administrator for the wireless network design, if he need to satisfied the minimum requirement of 2.4 GHz, 22 MHz of bandwidth, 2 Mbits/s stream for data rate and use DSSS for modulation.

  A. 802.11n
  B. 802.11g
  C. 802.11b
  D. 802.11a
  C. 802.11b

• Question 23:

  If a network is at risk from unskilled individuals, what type of threat is this?

  A. External Threats
  B. Structured Threats
  C. Unstructured Threats
  D. Internal Threats
  C. Unstructured Threats

• Question 24:

  Which of the following is the full form of SAINT?

  A. System Automated Integrated Network Tool
  B. Security Admin Integrated Network Tool
  C. System Admin Integrated Network Tool
  D. System Administrators Integrated Network Tool
  D. System Administrators Integrated Network Tool

• Question 25:

  Which of the following attacks are computer threats that try to exploit computer application vulnerabilities that are unknown to others or undisclosed to the software developer? Each correct answer represents a complete solution. Choose all that apply.

  A. Buffer overflow
  B. Zero-day
  C. Spoofing
  D. Zero-hour
  B. Zero-day
  D. Zero-hour

  ---

  Explanation/Reference:

  A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability. User awareness training is the most effective technique to mitigate such attacks. Answer option C is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the responses to be misdirected. Answer option A is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. This usually occurs due to programming errors in the application. Buffer overflow can terminate or crash the application.

• Question 26:

  John works as an Incident manager for TechWorld Inc. His task is to set up a wireless network for his organization. For this, he needs to decide the appropriate devices and policies required to set up the network. Which of the following phases of the incident handling process will help him accomplish the task?

  A. Containment
  B. Recovery
  C. Preparation
  D. Eradication
  C. Preparation

  ---

  Explanation/Reference:

  Preparation is the first step in the incident handling process. It includes processes like backing up copies of all key data on a regular basis, monitoring and updating software on a regular basis, and creating and implementing a documented security policy. To apply this step a documented security policy is formulated that outlines the responses to various incidents, as a reliable set of instructions during the time of an incident. The following list contains items that the incident handler should maintain in the preparation phase i.e. before an incident occurs: Establish applicable policies Build relationships with key players Build response kit Create incident checklists Establish communication plan Perform threat modeling Build an incident response team Practice the demo incidents Answer option A is incorrect. The Containment phase of the Incident handling process is responsible for supporting and building up the incident combating process. It ensures the stability of the system and also confirms that the incident does not get any worse. The Containment phase includes the process of preventing further contamination of the system or network, and preserving the evidence of the contamination. Answer option D is incorrect. The Eradication phase of the Incident handling process involves the cleaning-up of the identified harmful incidents from the system. It includes the analyzing of the information that has been gathered for determining how the attack was committed. To prevent the incident from happening again, it is vital to recognize how it was conceded out so that a prevention technique is applied. Answer option B is incorrect. Recovery is the fifth step of the incident handling process. In this phase, the Incident Handler places the system back into the working environment. In the recovery phase the Incident Handler also works with the questions to validate that the system recovery is successful. This involves testing the system to make sure that all the processes and functions are working normal. The Incident Handler also monitors the system to make sure that the systems are not compromised again. It looks for additional signs of attack.

• Question 27:

  An administrator wants to monitor and inspect large amounts of traffic and detect unauthorized attempts from inside the organization, with the help of an IDS. They are not able to recognize the exact location to deploy the IDS sensor. Can you help him spot the location where the IDS sensor should be placed?

  

  A. Location 1
  B. Location 2
  C. Location 3
  D. Location 4
  A. Location 1

• Question 28:

  Which OSI layer does a Network Interface Card (NIC) work on?

  A. Physical layer
  B. Presentation layer
  C. Network layer
  D. Session layer
  A. Physical layer

• Question 29:

  Which of the following fields in the IPv6 header is decremented by 1 for each router that forwards the packet?

  A. Flow label
  B. Next header
  C. Traffic class
  D. Hop limit
  D. Hop limit

  ---

  Explanation/Reference:

  The hop limit field in the IPv6 header is decremented by 1 for each router that forwards a packet. The packet is discarded when the hop limit field reaches zero.

  Answer option B is incorrect. Next header is an 8-bit field that specifies the next encapsulated protocol.

  Answer option A is incorrect. Flow label is a 20-bit field that is used for specifying special router handling from source to destination for a sequence of packets.

  Answer option C is incorrect. Traffic class is an 8-bit field that specifies the Internet traffic priority delivery value.

• Question 30:

  Which of the following key features limits the rate a sender transfers data to guarantee reliable delivery?

  A. Ordered data transfer
  B. Error-free data transfer
  C. Flow control
  D. Congestion control
  C. Flow control