EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 51:

  Which command is used to change the permissions of a file or directory?

  A. rmdir
  B. systemctl
  C. kill
  D. chmod
  D. chmod

• Question 52:

  Which of the following policies is used to add additional information about the overall security posture and serves to protect employees and organizations from inefficiency or ambiguity?

  A. User policy
  B. IT policy
  C. Issue-Specific Security Policy
  D. Group policy
  C. Issue-Specific Security Policy

  ---

  Explanation/Reference:

  The Issue-Specific Security Policy (ISSP) is used to add additional information about the overall security posture. It helps in providing detailed, targeted guidance for instructing organizations in the secure use of tech systems. This policy serves to protect employees and organizations from inefficiency or ambiguity. Answer option A is incorrect. A user policy helps in defining what users can and should do to use network and organization's computer equipment. It also defines what limitations are put on users for maintaining the network secure such as whether users can install programs on their workstations, types of programs users are using, and how users can access data. Answer option B is incorrect. IT policy includes general policies for the IT department. These policies are intended to keep the network secure and stable. It includes the following: Virus incident and security incident Backup policy Client update policies Server configuration, patch update, and modification policies (security) Firewall policies Dmz policy, email retention, and auto forwarded email policy Answer option D is incorrect. A group policy specifies how programs, network resources, and the operating system work for users and computers in an organization.

• Question 53:

  You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below: What is the IP address of the sender of this email?

  

  A. 209.191.91.180
  B. 141.1.1.1
  C. 172.16.10.90
  D. 216.168.54.25
  D. 216.168.54.25

  ---

  Explanation/Reference:

  The IP address of the sender of this email is 216.168.54.25. According to the scenario, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. Once you start to analyze the email header, you get an entry entitled as X-Originating-IP. You know that in Yahoo, the X-Originating-IP is the IP address of the email sender and in this case, the required IP address is 216.168.54.25. Answer options A, C, and B are incorrect. All these are the IP addresses of the Yahoo and Wetpaint servers.

• Question 54:

  The IP addresses reserved for multicasting belong to which of the following classes?

  A. Class B
  B. Class E
  C. Class C
  D. Class D
  D. Class D

• Question 55:

  Which of the following is a malicious program that looks like a normal program?

  A. Impersonation
  B. Worm
  C. Virus
  D. Trojan horse
  D. Trojan horse

• Question 56:

  Network security is the specialist area, which consists of the provisions and policies adopted by the Network Administrator to prevent and monitor unauthorized access, misuse, modification, or denial of the computer network and network-accessible resources. For which of the following reasons is network security needed? Each correct answer represents a complete solution. Choose all that apply.

  A. To protect information from loss and deliver it to its destination properly
  B. To protect information from unwanted editing, accidentally or intentionally by unauthorized users
  C. To protect private information on the Internet
  D. To prevent a user from sending a message to another user with the name of a third person
  A. To protect information from loss and deliver it to its destination properly
  B. To protect information from unwanted editing, accidentally or intentionally by unauthorized users
  C. To protect private information on the Internet
  D. To prevent a user from sending a message to another user with the name of a third person

  ---

  Explanation/Reference:

  Network security is needed for the following reasons: To protect private information on the Internet To protect information from unwanted editing, accidentally or intentionally by unauthorized users To protect information from loss and deliver it to its destination properly To prevent a user from sending a message to another user with the name of a third person

• Question 57:

  Which of the following provides enhanced password protection, secured loT connections, and encompasses stronger encryption techniques?

  A. WPA3
  B. WEP
  C. WPA
  D. WPA2
  A. WPA3

• Question 58:

  Which of the following statements is not true about the FAT16 file system? Each correct answer represents a complete solution. Choose all that apply.

  A. It supports task compression files.
  B. It works well with large disk, because the cluster size increases as the disk partition size increases.
  C. It does not support file protection.
  D. It supports the Linux operating system.
  A. It supports task compression files.
  B. It works well with large disk, because the cluster size increases as the disk partition size increases.

• Question 59:

  Which of the following tools is an open source network intrusion prevention and detection system that operates as a network sniffer and logs activities of the network that is matched with the predefined signatures?

  A. Dsniff
  B. KisMAC
  C. Snort
  D. Kismet
  C. Snort

  ---

  Explanation/Reference:

  Snort is an open source network intrusion prevention and detection system that operates as a network sniffer. It logs activities of the network that is matched with the predefined signatures. Signatures can be designed for a wide range of traffic, including Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). The three main modes in which Snort can be configured are as follows: Sniffer mode: It reads the packets of the network and displays them in a continuous stream on the console. Packet logger mode: It logs the packets to the disk. Network intrusion detection mode: It is the most complex and configurable configuration, allowing Snort to analyze network traffic for matches against a user-defined rule set. Answer option A is incorrect. Dsniff is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of the tools of Dsniff include dsniff, arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. Dsniff is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP, etc. Answer option D is incorrect. Kismet is a Linux-based 802.11 wireless network sniffer and intrusion detection system. It can work with any wireless card that supports raw monitoring (rfmon) mode. Kismet can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet can be used for the following tasks: To identify networks by passively collecting packets To detect standard named networks To detect masked networks To collect the presence of non-beaconing networks via data traffic Answer option B is incorrect. KisMAC is a wireless network discovery tool for Mac OS X. It has a wide range of features, similar to those of Kismet, its Linux/BSD namesake and far exceeding those of NetStumbler, its closest equivalent on Windows. The program is geared towards the network security professionals, and is not as novice-friendly as the similar applications. KisMAC will scan for networks passively on supported cards, including Apple's AirPort, AirPort Extreme, and many third-party cards. It will scan for networks actively on any card supported by Mac OS X itself. Cracking of WEP and WPA keys, both by brute force, and exploiting flaws, such as weak scheduling and badly generated keys is supported when a card capable of monitor mode is used, and when packet reinsertion can be done with a supported card. The GPS mapping can be performed when an NMEA compatible GPS receiver is attached. Data can also be saved in pcap format and loaded into programs, such as Wireshark.

• Question 60:

  Which of the following IEEE standards defines the demand priority access method?

  A. 802.15
  B. 802.3
  C. 802.12
  D. 802.11
  C. 802.12