EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 541:

  Which characteristic of an antenna refers to how directional an antennas radiation pattern is?

  A. Radiation pattern
  B. Polarization
  C. Directivity
  D. Typical gain
  A. Radiation pattern

• Question 542:

  Daniel is giving training on designing and implementing a security policy in the organization. He is explaining the hierarchy of the security policy which demonstrates how policies are drafted, designed and implemented. What is the correct hierarchy for a security policy implementation?

  A. Procedures, Policies, Laws, Standards and Regulations
  B. Laws, Regulations, Policies, Standards and Procedures
  C. Regulations, Policies, Laws, Standards and Procedures
  D. Laws, Policies, Regulations, Procedures and Standards
  B. Laws, Regulations, Policies, Standards and Procedures

• Question 543:

  A company has the right to monitor the activities of their employees on different information systems according to the _______ policy.

  A. Information system
  B. User access control
  C. Internet usage
  D. Confidential data
  B. User access control

• Question 544:

  Damian is the chief security officer of Enigma Electronics. To block intruders and prevent any environmental accidents, he needs to set a two-factor authenticated keypad lock at the entrance, rig a fire suppression system, and link any video cameras at various corridors to view the feeds in the surveillance room. What layer of network defense-in-depth strategy is he trying to follow?

  A. Physical
  B. Perimeter
  C. Policies and procedures
  D. Host
  A. Physical

• Question 545:

  Which of the following network scanning tools is a TCP/UDP port scanner that works as a ping sweeper and hostname resolver?

  A. Hping
  B. SuperScan
  C. Netstat
  D. Nmap
  B. SuperScan

  ---

  Explanation/Reference:

  SuperScan is a TCP/UDP port scanner. It also works as a ping sweeper and hostname resolver. It can ping a given range of IP addresses and resolve the host name of the remote system.

  The features of SuperScan are as follows:

  It scans any port range from a built-in list or any given range.

  It performs ping scans and port scans using any IP range.

  It modifies the port list and port descriptions using the built in editor.

  It connects to any discovered open port using user-specified "helper" applications.

  It has the transmission speed control utility.

  Answer option D is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple

  port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a

  service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc. Answer option C is incorrect. Netstat

  (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface statistics. It is available on Unix, Unix-like, and Windows NT-based operating

  systems. It is used to find problems on the network and to determine the amount of traffic on the network as a performance measurement. Answer option A is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol.

  Hping is one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping, hping3, is scriptable using the Tcl language and implements an engine for string based, human readable description of

  TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both system administrators and crackers

  (or script kiddies).

• Question 546:

  Which of the following transmission modes of communication is one-way?

  A. Half duplex
  B. full-duplex mode
  C. #NAME?
  D. root mode
  E. None
  A. Half duplex

• Question 547:

  Which of the following tools are NOT used for logging network activities in the Linux operating system? Each correct answer represents a complete solution. Choose all that apply.

  A. PsLoggedOn
  B. PsGetSid
  C. Timbersee
  D. Swatch
  A. PsLoggedOn
  B. PsGetSid

  ---

  Explanation/Reference:

  PsLoggedOn and PsGetSid are not logging tools. They are command-line utilities used in the Windows operating system.

  PsLoggedOn is an applet that displays both the local and remote logged on users. If an attacker specifies a user name instead of a computer, PsLoggedOn searches the computers in the network and tells whether the user is currently logged

  on or not. The command syntax for PsLoggedOn is as follows:

  psloggedon [- ] [-l] [-x] [\\computername | username]

  PsGetSid is a tool that is used to query SIDs remotely. Using PsGetSid, the attacker can access the SIDs of user accounts and translate an SID into the user name. The command syntax for PsGetSid is as follows:

  psgetsid [\\computer[,computer[,...] | @file] [-u username [-p password]]] [account|SID]

  Answer options C and D are incorrect. Timbersee and Swatch are tools used for logging network activities in the Linux operating system.

• Question 548:

  Which of the following are the responsibilities of the disaster recovery team? Each correct answer represents a complete solution. Choose all that apply.

  A. To monitor the execution of the disaster recovery plan and assess the results
  B. To modify and update the disaster recovery plan according to the lessons learned from previous disaster recovery efforts
  C. To notify management, affected personnel, and third parties about the disaster
  D. To initiate the execution of the disaster recovery procedures
  A. To monitor the execution of the disaster recovery plan and assess the results
  B. To modify and update the disaster recovery plan according to the lessons learned from previous disaster recovery efforts
  C. To notify management, affected personnel, and third parties about the disaster
  D. To initiate the execution of the disaster recovery procedures

  ---

  Explanation/Reference:

  The responsibilities of the disaster recovery team are as follows: To develop, deploy, and monitor the implementation of appropriate disaster recovery plans after analysis of business objectives and threats to organizations To notify management, affected personnel, and third parties about the disaster To initiate the execution of the disaster recovery procedures To monitor the execution of the disaster recovery plan and assess the results To return operations to normal conditions To modify and update the disaster recovery plan according to the lessons learned from previous disaster recovery efforts To increase the level of the organization's disaster recovery preparedness by conducting mock drills, regular DR systems testing, and threat analysis to create awareness among various stakeholders of the organization by conducting training and awareness sessions

• Question 549:

  Which of the following is an example of MAC model?

  A. Chinese Waterfall model
  B. Clark-Beason integrity model
  C. Access control matrix model
  D. Bell-LaPadula model
  A. Chinese Waterfall model

• Question 550:

  Which of the following examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations?

  A. Network Behavior Analysis
  B. Network-based Intrusion Prevention
  C. Wireless Intrusion Prevention System
  D. Host-based Intrusion Prevention
  A. Network Behavior Analysis

  ---

  Explanation/Reference:

  Network Behavior Analysis examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations. Answer option B is incorrect. Network-based Intrusion Prevention (NIPS) monitors the entire network for suspicious traffic by analyzing protocol activity. Answer option C is incorrect. Wireless Intrusion Prevention System (WIPS) monitors a wireless network for suspicious traffic by analyzing wireless networking protocols. Answer option D is incorrect. Host-based Intrusion Prevention (HIPS) is an installed software package that monitors a single host for suspicious activity by analyzing events occurring within that host.