EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 421:

  Which of the following key features is used by TCP in order to regulate the amount of data sent by a host to another host on the network?

  A. Sequence number
  B. TCP timestamp
  C. Congestion control
  D. Flow control
  D. Flow control

  ---

  Explanation/Reference:

  Flow control is the process of regulating the amount of data sent by a host to another host on the network. The flow control mechanism controls packet flow so that a sender does not transmit more packets than a receiver can process. TCP

  uses a sliding window flow control protocol. In each TCP segment, the receiver specifies in the receive window field the amount of additional received data (in bytes) that it is willing to buffer for the connection. The sending host can send only

  up to that amount of data before it must wait for an acknowledgment and window update from the receiving host.

  Answer option A is incorrect. TCP uses a sequence number for identifying each byte of data.

  Answer option B is incorrect. TCP timestamp helps TCP to compute the round-trip time between the sender and receiver.

  Answer option C is incorrect. Congestion control concerns controlling traffic entry into a telecommunications network, so as to avoid congestive collapse by attempting to avoid oversubscription of any of the processing or link capabilities of the

  intermediate nodes and networks and taking resource reducing steps, such as reducing the rate of sending packets. It should not be confused with flow control, which prevents the sender from overwhelming the receiver.

• Question 422:

  Which of the following help in estimating and totaling up the equivalent money value of the benefits and costs to the community of projects for establishing whether they are worthwhile? Each correct answer represents a complete solution. Choose all that apply.

  A. Business Continuity Planning
  B. Benefit-Cost Analysis
  C. Disaster recovery
  D. Cost-benefit analysis
  B. Benefit-Cost Analysis
  D. Cost-benefit analysis

  ---

  Explanation/Reference:

  Cost-benefit analysis is a process by which business decisions are analyzed. It is used to estimate and total up the equivalent money value of the benefits and costs to the community of projects for establishing whether they are worthwhile. It is a term that refers both to: helping to appraise, or assess, the case for a project, program, or policy proposal; an approach to making economic decisions of any kind. Under both definitions, the process involves, whether explicitly or implicitly, weighing the total expected costs against the total expected benefits of one or more actions in order to choose the best or most profitable option. The formal process is often referred to as either CBA (Cost-Benefit Analysis) or BCA (Benefit-Cost Analysis). Answer option A is incorrect. Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan that defines how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption. The logistical plan is called a Business Continuity Plan. Answer option C is incorrect. Disaster recovery is the process, policies, and procedures related to preparing for recovery or continuation of technology infrastructure critical to an organization after a natural or human-induced disaster. Disaster recovery planning is a subset of a larger process known as business continuity planning and should include planning for resumption of applications, data, hardware, communications (such as networking) and other IT infrastructure. A business continuity plan (BCP) includes planning for non-IT related aspects such as key personnel, facilities, crisis communication and reputation protection, and should refer to the disaster recovery plan (DRP) for IT related infrastructure recovery / continuity.

• Question 423:

  Identity the correct order for a successful black hat operation.

  A. Reconnaissance. Scanning, Gaining Access. Maintaining Access, and Covering Tracks
  B. Scanning, Reconnaissance, Gaining Access. Maintaining Access and Covering Tracks
  C. Reconnaissance. Gaming Access, Scanning. Maintaining Access, and Covering Tracks
  D. Reconnaissance, Scanning, Gaining Access, Covering Tracks, and Maintaining Access
  A. Reconnaissance. Scanning, Gaining Access. Maintaining Access, and Covering Tracks

• Question 424:

  Fill in the blank with the appropriate term. is a prime example of a high-interaction honeypot.

  Honeynet

  Explanation/Reference:

  Honeynet is a prime example of a high-interaction honeypot. Two or more honeypots on a network form a honeynet. Typically, a honeynet is used for monitoring a larger and/or more diverse network in which one honeypot may not be sufficient. Honeynets and honeypots are usually implemented as parts of larger network intrusion-detection systems. A honeyfarm is a centralized collection of honeypots and analysis tools.

• Question 425:

  Fill in the blanks with the appropriate terms. In L2TP tunnel mode, the ISP must support L2TP, whereas in L2TP tunnel mode, the ISP does not need to support L2TP.

  compulsory

  Explanation/Reference:

  The Layer 2 Tunnel Protocol is one of the tunneling protocols that is used in a virtual private network. It contains the functionality of Cisco's Layer 2 Forwarding (L2F) protocol and Microsoft's Point-to-Point Tunneling Protocol (PPTP). This protocol is vendor interoperable and supports multihopping. L2TP supports two tunnel modes: Compulsory tunnel: In L2TP compulsory tunnel mode, a remote host initiates a connection to its Internet Service Provider (ISP). An L2TP connection is established between the remote user and the corporate network by the ISP. With a compulsory tunnel, the ISP must support L2TP. Voluntary tunnel: In L2TP voluntary tunnel mode, the connection is created by the remote user, typically by using an L2TP tunneling client. Then, the remote user sends L2TP packets to its ISP in order to forward them on to the corporate network. With a voluntary tunnel, the ISP does not need to support L2TP.

• Question 426:

  Individuals in the organization using system resources in a way that violates acceptable usage policies indicates which of the following security incident(s):

  A. Unauthorized Access
  B. Improper Usage
  C. Denial-of-Service (DoS)
  D. Malicious Code
  B. Improper Usage

• Question 427:

  What is the range for registered ports?

  A. 1024 through 49151
  B. 0 through 1023
  C. Above 65535
  D. 49152 through 65535
  A. 1024 through 49151

• Question 428:

  The IR team and the network administrator have successfully handled a malware incident on the network. The team is now preparing countermeasure guideline to avoid a future occurrence of the malware incident.

  Which of the following countermeasure(s) should be added to deal with future malware incidents? (Select all that apply)

  A. Complying with the company's security policies
  B. Implementing strong authentication schemes
  C. Implementing a strong password policy
  D. Install antivirus software
  D. Install antivirus software

• Question 429:

  In which of the following transmission modes is data sent and received alternatively?

  A. Simplex mode
  B. Bridge mode
  C. Half-duplex mode
  D. Full-duplex mode
  C. Half-duplex mode

• Question 430:

  Which of the following is a centralized collection of honeypots and analysis tools?

  A. Production honeypot
  B. Honeynet
  C. Research honeypot
  D. Honeyfarm
  D. Honeyfarm