EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 391:

  You are an IT security consultant working on a contract for a large manufacturing company to audit their entire network. After performing all the tests and building your report, you present a number of recommendations to the company and what they should implement to become more secure. One recommendation is to install a network-based device that notifies IT employees whenever malicious or questionable traffic is found. From your talks with the company, you know that they do not want a device that actually drops traffic completely, they only want notification. What type of device are you suggesting?

  A. A NIDS device would work best for the company.
  B. A HIPS device would best suite this company.
  C. The best solution to cover the needs of this company would be a HIDS device.
  D. You are suggesting a NIPS device.
  A. A NIDS device would work best for the company.

• Question 392:

  Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?

  A. Application sandboxing
  B. Deployment of WAFS
  C. Application whitelisting
  D. Application blacklisting
  A. Application sandboxing

• Question 393:

  Which of the following policy to add additional information to public safety posture and aims to protect workers and the organizations of inefficiency or confusion?

  A. user policy
  B. IT policy
  C. None
  D. Group policy
  E. Subject-specific security
  E. Subject-specific security

• Question 394:

  Smith is an IT technician that has been appointed to his company's network vulnerability assessment team. He is the only IT employee on the team. The other team members include employees from Accounting, Management, Shipping, and Marketing. Smith and the team members are having their first meeting to discuss how they will proceed. What is the first step they should do to create the network vulnerability assessment plan?

  A. Their first step is the acquisition of required documents, reviewing of security policies and compliance.
  B. Their first step is to create an initial Executive report to show the management team.
  C. Their first step is to make a hypothesis of what their final findings will be.
  D. Their first step is to analyze the data they have currently gathered from the company or interviews.
  A. Their first step is the acquisition of required documents, reviewing of security policies and compliance.

• Question 395:

  Which firewall technology can be implemented in all (application, session, transport, network, and presentation) layers of the OSl model?

  A. Circuit-level gateway
  B. Network address translation
  C. VPN
  D. Packet filtering
  A. Circuit-level gateway

• Question 396:

  Which of the following is a method of authentication that uses physical characteristics?

  A. COMSEC
  B. ACL
  C. Honeypot
  D. Biometrics
  D. Biometrics

• Question 397:

  Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved. Which step should Malone list as the last step in the incident response methodology?

  A. Malone should list a follow-up as the last step in the methodology
  B. Recovery would be the correct choice for the last step in the incident response methodology
  C. He should assign eradication to the last step.
  D. Containment should be listed on Malone's plan for incident response.
  B. Recovery would be the correct choice for the last step in the incident response methodology

• Question 398:

  Which of the following is an IPSec protocol that can be used alone in combination with Authentication Header (AH)?

  A. L2TP
  B. PPTP
  C. ESP
  D. PPP
  C. ESP

• Question 399:

  Frank installed Wireshark at all ingress points in the network. Looking at the logs he notices an odd packet source. The odd source has an address of 1080:0:FF:0:8:800:200C:4171 and is using port 21. What does this source address signify?

  A. This address means that the source is using an IPv6 address and is spoofed and signifies an IPv4 address of 127.0.0.1.
  B. This source address is IPv6 and translates as 13.1.68.3
  C. This source address signifies that the originator is using 802dot1x to try and penetrate into Frank's network
  D. This means that the source is using IPv4
  D. This means that the source is using IPv4

• Question 400:

  Which of the following plans are documented and organized emergency backup operations and recovery operations maintained as part of the security program to ensure the availability of critical resources and facilitate the continuity of operations in case of emergency?

  A. Business Continuity Plan
  B. The emergency plan
  C. None
  D. disaster survival plan
  B. The emergency plan