EC-COUNCIL EC-COUNCIL Certifications 312-38 Questions & Answers

• Question 571:

  Fill in the blank with the appropriate term. The layer establishes, manages, and terminates the connections between the local and remote application.

  Correct Answer: session

  The session layer of the OSI/RM controls the dialogues (connections) between computers. It establishes, manages and terminates the connections between the local and remote application. It provides for full-duplex, half-duplex, or simplex operation, and establishes checkpointing, adjournment, termination, and restart procedures. The OSI model made this layer responsible for graceful close of sessions, which is a property of the Transmission Control Protocol, and also for session check pointing and recovery, which is not usually used in the Internet Protocol Suite. The Session Layer is commonly implemented explicitly in application environments that use remote procedure calls.

• Question 572:

  Fill in the blanks with the appropriate terms. In L2TP tunnel mode, the ISP must support L2TP, whereas in L2TP tunnel mode, the ISP does not need to support L2TP.

  Correct Answer: compulsory

  The Layer 2 Tunnel Protocol is one of the tunneling protocols that is used in a virtual private network. It contains the functionality of Cisco's Layer 2 Forwarding (L2F) protocol and Microsoft's Point-to-Point Tunneling Protocol (PPTP). This protocol is vendor interoperable and supports multihopping. L2TP supports two tunnel modes: Compulsory tunnel: In L2TP compulsory tunnel mode, a remote host initiates a connection to its Internet Service Provider (ISP). An L2TP connection is established between the remote user and the corporate network by the ISP. With a compulsory tunnel, the ISP must support L2TP. Voluntary tunnel: In L2TP voluntary tunnel mode, the connection is created by the remote user, typically by using an L2TP tunneling client. Then, the remote user sends L2TP packets to its ISP in order to forward them on to the corporate network. With a voluntary tunnel, the ISP does not need to support L2TP.

• Question 573:

  Fill in the blank with the appropriate term. A is a physical or logical subnetwork that adds an additional layer of security to an organization's Local Area Network (LAN).

  Correct Answer: demilitarized zone

• Question 574:

  Fill in the blank with the appropriate term. is the use of sensitive words in e-mails to jam the authorities that listen in on them by providing a form of a red herring and an intentional annoyance.

  Correct Answer: Email jamming

  Email jamming is the use of sensitive words in e-mails to jam the authorities that listen in on them by providing a form of a red herring and an intentional annoyance. In this attack, an attacker deliberately includes "sensitive" words and phrases in otherwise innocuous emails to ensure that these are picked up by the monitoring systems. As a result the senders of these emails will eventually be added to a "harmless" list and their emails will be no longer intercepted, hence it will allow them to regain some privacy.

• Question 575:

  Fill in the blank with the appropriate word. A policy is defined as the document that describes the scope of an organization's security requirements.

  Correct Answer: security

  A security policy is defined as the document that describes the scope of an organization's security requirements. Information security policies are usually documented in one or more information security policy documents. The policy includes the assets that are to be protected. It also provides security solutions to provide necessary protection against the security threats.

• Question 576:

  Fill in the blank with the appropriate term. is a codename referring to investigations and studies of compromising emission (CE).

  Correct Answer: TEMPEST

  TEMPEST is a codename referring to investigations and studies of compromising emission (CE). Compromising emanations are defined as unintentional intelligence-bearing signals which, if intercepted and analyzed, may disclose the information transmitted, received, handled, or otherwise processed by any information-processing equipment. Tempest stands for Transient ElectroMagnetic Pulse Emanations Standard according to Certified Information Systems Security Professional training. TEMPEST was the name of a U.S. government project to study the effects of electric or electromagnetic radiation emanations from electronic equipment.

• Question 577:

  Fill in the blank with the appropriate term. is a prime example of a high-interaction honeypot.

  Correct Answer: Honeynet

  Honeynet is a prime example of a high-interaction honeypot. Two or more honeypots on a network form a honeynet. Typically, a honeynet is used for monitoring a larger and/or more diverse network in which one honeypot may not be sufficient. Honeynets and honeypots are usually implemented as parts of larger network intrusion-detection systems. A honeyfarm is a centralized collection of honeypots and analysis tools.

• Question 578:

  Fill in the blank with the appropriate term. is an enumeration technique used to glean information about computer systems on a network and the services running its open ports.

  Correct Answer: Banner grabbing

  Banner grabbing is an enumeration technique used to glean information about computer systems on a network and the services running its open ports. Administrators can use this to take inventory of the systems and services on their network. An intruder however can use banner grabbing in order to find network hosts that are running versions of applications and operating systems with known exploits. Some examples of service ports used for banner grabbing are those used by Hyper Text Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP); ports 80, 21, and 25 respectively. Tools commonly used to perform banner grabbing are Telnet, which is included with most operating systems, and Netcat. For example, one could establish a connection to a target host running a Web service with netcat, then send a bad html request in order to get information about the service on the host: [root@prober] nc www.targethost.com 80 HEAD / HTTP/1.1 HTTP/1.1 200 OK Date: Mon, 11 May 2009 22:10:40 EST Server: Apache/2.0.46 (Unix) (Red Hat/Linux) Last-Modified: Thu, 16 Apr 2009 11:20:14 PST ETag: "1986-69b-123a4bc6" Accept-Ranges: bytes Content-Length: 1110 Connection: close Content-Type: text/html The administrator can now catalog this system or an intruder now knows what version of Apache to look for exploits.

• Question 579:

  Fill in the blank with the appropriate term.

  A is a term in computer terminology used for a trap that is set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems.

  Correct Answer: honeypot

  A honeypot is a term in computer terminology used for a trap that is set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated, and monitored, and which seems to contain information or a resource of value to attackers.

• Question 580:

  Fill in the blank with the appropriate term. is a prime example of a high-interaction honeypot.

  Correct Answer: Honeynet

  Honeynet is a prime example of a high-interaction honeypot. Two or more honeypots on a network form a honeynet. Typically, a honeynet is used for monitoring a larger and/or more diverse network in which one honeypot may not be sufficient. Honeynets and honeypots are usually implemented as parts of larger network intrusion-detection systems. A honeyfarm is a centralized collection of honeypots and analysis tools.