EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 601:

  Which of the Windows security component is responsible for controlling access of a user to Windows resources?

  A. Network Logon Service (Netlogon)
  B. Security Accounts Manager (SAM)
  C. Security Reference Monitor (SRM)
  D. Local Security Authority Subsystem (LSASS)
  D. Local Security Authority Subsystem (LSASS)

• Question 602:

  Which of the following standards is a change in the original IEEE 802.11 and defines the security mechanisms for wireless networks?

  A. 802.11b
  B. 802.11a
  C. None
  D. 802.11e
  E. 802.11i
  E. 802.11i

• Question 603:

  The network administrator wants to strengthen physical security in the organization. Specifically, to implement a solution stopping people from entering certain restricted zones without proper credentials. Which of following physical security measures should the administrator use?

  A. Mantrap
  B. Bollards
  C. Video surveillance
  D. Fence
  A. Mantrap

• Question 604:

  DRAG DROP

  George works as a Network Administrator for Blue Soft Inc. The company uses Windows Vista operating system. The network of the company is continuously connected to the Internet. What will George use to protect the network of the company from intrusion?

  Select and Place:

  

  

  ---

  Explanation/Reference:

  A firewall is a set of related programs configured to protect private networks connected to the Internet from intrusion. It is used to regulate the network traffic between different computer networks. It permits or denies the transmission of a network packet to its destination based on a set of rules. A firewall is often installed on a separate computer so that an incoming packet does not get into the network directly.

• Question 605:

  Which of the following representatives in the incident response process are included in the incident response team? Each correct answer represents a complete solution. Choose all that apply.

  A. Information security representative
  B. Legal representative
  C. Technical representative
  D. Lead investigator
  E. Human resources
  F. Sales representative
  A. Information security representative
  B. Legal representative
  C. Technical representative
  D. Lead investigator
  E. Human resources

  ---

  Explanation/Reference:

  Incident response is a process that detects a problem, determines the cause of an issue, minimizes the damages, resolves the problem, and documents each step of process for future reference. To perform all these roles, an incident response team is needed. The incident response team includes the following representatives who are involved in the incident response process: Lead investigator: The lead investigator is the manager of an incident response team. He is always involved in the creation of an incident response plan. The duties of a lead investigator are as follows: Keep the management updated. Ensure that the incident response moves smoothly and efficiently. Interview and interrogate the suspects and witnesses. Information security representative: The information security representative is a member of the incident response team who alerts the team about possible security safeguards that can impact their ability to respond to an incident. Legal representative: The legal representative is a member of the incident response team who ensures that the process follows all the laws during the response to an incident. Technical representative: Technical representative is a representative of the incident response team. More than one technician can be deployed to an incident. The duties of a technical representative are as follows: Perform forensic backups of the systems that are involved in an incident. Provide more information about the configuration of the network or system. Human resources: Human resources personnel ensure that the policies of the organization are enforced during the incident response process. They suspend access to a suspect if it is needed. Human resources personnel are closely related with the legal representatives and cover up the organization's legal responsibility.

• Question 606:

  Which of the following protocols is used for E-mail?

  A. TELNET
  B. MIME
  C. SSH
  D. SMTP
  D. SMTP

• Question 607:

  John is working as a network defender at a well-reputed multinational company. He wanted to implement security that can help him identify any future attacks that can be targeted toward his organization and take appropriate security measures and actions beforehand to defend against them. Which one of the following security defense techniques should be implement?

  A. Reactive security approach
  B. Retrospective security approach
  C. Proactive security approach
  D. Preventive security approach
  C. Proactive security approach

• Question 608:

  Which firewall technology can filler application-specific commands such as CET and POST requests?

  A. Circuit-level gateways
  B. Application-level gateways
  C. Application proxy
  D. Stateful multi-layer inspection
  C. Application proxy

• Question 609:

  Which of the following protocols uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets?

  A. PPTP
  B. ESP
  C. LWAPP
  D. SSTP
  A. PPTP

  ---

  Explanation/Reference:

  The Point-to-Point Tunneling Protocol (PPTP) is a method for implementing virtual private networks. PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets. The PPTP specification does not describe encryption or authentication features and relies on the PPP protocol being tunneled to implement security functionality. However, the most common PPTP implementation, shipping with the Microsoft Windows product families, implements various levels of authentication and encryption natively as standard features of the Windows PPTP stack. The intended use of this protocol is to provide similar levels of security and remote access as typical VPN products. Answer option B is incorrect. Encapsulating Security Payload (ESP) is an IPSec protocol that provides confidentiality, in addition to authentication, integrity, and anti-replay. ESP can be used alone or in combination with Authentication Header (AH). It can also be nested with the Layer Two Tunneling Protocol (L2TP). ESP does not sign the entire packet unless it is being tunneled. Usually, only the data payload is protected, not the IP header. Answer option D is incorrect. Secure Socket Tunneling Protocol (SSTP) is a form of VPN tunnel that provides a mechanism to transport PPP or L2TP traffic through an SSL 3.0 channel. SSL provides transport-level security with key- negotiation, encryption, and traffic integrity checking. The use of SSL over TCP port 443 allows SSTP to pass through virtually all firewalls and proxy servers. SSTP servers must be authenticated during the SSL phase. SSTP clients can optionally be authenticated during the SSL phase, and must be authenticated in the PPP phase. The use of PPP allows support for common authentication methods, such as EAP-TLS and MS-CHAP. SSTP is available in Windows Server 2008, Windows Vista SP1, and later operating systems. It is fully integrated with the RRAS architecture in these operating systems, allowing its use with Winlogon or smart card authentication, remote access policies, and the Windows VPN client. Answer option C is incorrect. LWAPP (Lightweight Access Point Protocol) is a protocol used to control multiple Wi-Fi wireless access points at once. This can reduce the amount of time spent on configuring, monitoring, or troubleshooting a large network. This also allows network administrators to closely analyze the network.

• Question 610:

  The company has implemented a backup plan. James is working as a network administrator for the company and is taking full backups of the data every time a backup is initiated. Alex who is a senior security manager

  talks to him about using a differential backup instead and asks him to implement this once a full backup of the data is completed.

  What is/are the reason(s) Alex is suggesting that James use a differential backup? (Select all that apply)

  A. Less storage space is required
  B. Father restoration
  C. Slower than a full backup
  D. Faster than a full backup
  E. Less expensive than full backup
  A. Less storage space is required
  D. Faster than a full backup