EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 611:

  Fill in the blank with the appropriate term. is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed.

  Network reconnaissance

  Explanation/Reference:

  Network reconnaissance is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed. Network reconnaissance is increasingly used to exploit network standards and automated communication methods. The aim is to determine what types of computers are present, along with additional information about those computers such as the type and version of the operating system. This information can be analyzed for known or recently discovered vulnerabilities that can be exploited to gain access to secure networks and computers. Network reconnaissance is possibly one of the most common applications of passive data analysis. Early generation techniques, such as TCP/IP passive fingerprinting, have accuracy issues that tended to make it ineffective. Today, numerous tools exist to make reconnaissance easier and more effective.

• Question 612:

  Which subdirectory in /var/log directory stores information related to Apache web server?

  A. /var/log/maillog/
  B. /var/log/httpd/
  C. /var/log/apachelog/
  D. /var/log/lighttpd/
  B. /var/log/httpd/

• Question 613:

  Which of the following protocols are used to exchange routing information between the two gateways network of autonomous systems?

  A. None
  B. IGMP
  C. EGP
  D. ICMP
  E. OSPF
  C. EGP

• Question 614:

  Which of the following systems is formed by a group of honeypots?

  A. Research honeypot
  B. Honeyfarm
  C. Honeynet
  D. Production honeypot
  C. Honeynet

• Question 615:

  Larry is a network administrator working for a manufacturing company in Detroit. Larry is responsible for the entire company's network which consists of 300 workstations and 25 servers. After using a hosted email service for a year, the company wants to cut back on costs and bring the email control internal. Larry likes this idea because it will give him more control over email. Larry wants to purchase a server for email but he does not want the server to be on the internal network because this might cause security risks. He decides to place the email server on the outside of the company's internal firewall. There is another firewall connected directly to the Internet that will protect some traffic from accessing the email server; the server will essentially be place between the two firewalls. What logical area is Larry going to place the new email server into?

  A. He is going to place the server in a Demilitarized Zone (DMZ).
  B. He will put the email server in an IPSec zone.
  C. For security reasons, Larry is going to place the email server in the company's Logical Buffer Zone (LBZ).
  D. Larry is going to put the email server in a hot-server zone.
  A. He is going to place the server in a Demilitarized Zone (DMZ).

• Question 616:

  Which of the following is an intrusion detection system that reads all incoming packets and tries to find suspicious patterns known as signatures or rules?

  A. HIDS
  B. IPS
  C. DMZ
  D. NIDS
  D. NIDS

  ---

  Explanation/Reference:

  A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. A NIDS reads all the incoming packets and tries to find suspicious patterns known as signatures or rules. It also tries to detect incoming shell codes in the same manner that an ordinary intrusion detection system does. Answer option A is incorrect. A host-based intrusion detection system (HIDS) produces a false alarm because of the abnormal behavior of users and the network. A host-based intrusion detection system (HIDS) is an intrusion detection system that monitors and analyses the internals of a computing system rather than the network packets on its external interfaces. A host-based Intrusion Detection System (HIDS) monitors all or parts of the dynamic behavior and the state of a computer system. HIDS looks at the state of a system, its stored information, whether in RAM, in the file system, log files or elsewhere; and checks that the contents of these appear as expected. Answer option B is incorrect. An intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass. Answer option C is incorrect. A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external networks, while an intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network such as the Internet.

• Question 617:

  Which of the following statements are TRUE about Demilitarized zone (DMZ)? Each correct answer represents a complete solution. Choose all that apply.

  A. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network like the Internet.
  B. Demilitarized zone is a physical or logical sub-network that contains and exposes external services of an organization to a larger un-trusted network.
  C. The purpose of a DMZ is to add an additional layer of security to the Local Area Network of an organization.
  D. Hosts in the DMZ have full connectivity to specific hosts in the internal network.
  A. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network like the Internet.
  B. Demilitarized zone is a physical or logical sub-network that contains and exposes external services of an organization to a larger un-trusted network.
  C. The purpose of a DMZ is to add an additional layer of security to the Local Area Network of an organization.

  ---

  Explanation/Reference:

  A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external networks, while an intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network such as the Internet.

• Question 618:

  Phishing-like attempts that present users a fake usage bill of the cloud provider is an example of a:

  A. Cloud to service attack surface
  B. User to service attack surface
  C. User to cloud attack surface
  D. Cloud to user attack surface
  D. Cloud to user attack surface

• Question 619:

  What is the technique used in the cost estimates for the project during the design phase of the following? Each correct answer represents a complete solution. Choose all that apply.

  A. expert assessment
  B. The Delphi technique
  C. Function point analysis
  D. Program Evaluation Technique (PERT)
  A. expert assessment
  B. The Delphi technique
  C. Function point analysis

• Question 620:

  -----------is a group of broadband wireless communications standards for Metropolitan Area Networks (MANs)

  A. 802.15.4
  B. 802.15
  C. 802.12
  D. 802.16
  D. 802.16