EC-COUNCIL 312-38 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-38 Online Questions & Answers

• Question 61:

  Syslog and SNMP are the two main _______ protocols through which log records are transferred.

  A. Pull-based
  B. Push-based
  C. Host-based
  D. Network-based
  B. Push-based

• Question 62:

  Which type of attack is used to hack an IoT device and direct large amounts of network traffic toward a web server, resulting in overloading the server with connections and preventing any new connections?

  A. XSS
  B. DDoS
  C. XCRF
  D. Sniffing
  B. DDoS

• Question 63:

  Which of the following IEEE standards is also called Fast Basic Service Set Transition?

  A. 802.11r
  B. 802.11e
  C. 802.11a
  D. 802.11b
  A. 802.11r

• Question 64:

  The SOC manager is reviewing logs in AlienVault USM to investigate an intrusion on the network. Which CND approach is being used?

  A. Retrospective
  B. Reactive
  C. Deterrent D. Preventive
  A. Retrospective

• Question 65:

  Which of the following is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic?

  A. Nmap
  B. Hping
  C. NetRanger
  D. PSAD
  D. PSAD

  ---

  Explanation/Reference:

  PSAD is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic. It includes many signatures from the IDS to detect probes for various backdoor programs such as EvilFTP, GirlFriend, SubSeven, DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS). If it is combined with fwsnort and the Netfilter string match extension, it detects most of the attacks described in the Snort rule set that involve application layer data. Answer option C is incorrect. NetRanger is the complete network configuration and information toolkit that includes the following tools: Ping tool, Trace Route tool, Host Lookup tool, Internet time synchronizer, Whois tool, Finger Unix hosts tool, Host and port scanning tool, check multiple POP3 mail accounts tool, manage dialup connections tool, Quote of the day tool, and monitor Network Settings tool. These tools are integrated in order to use an application interface with full online help. NetRanger is designed for both new and experienced users. This tool is used to help diagnose network problems and to get information about users, hosts, and networks on the Internet or on a user computer network. NetRanger uses multi-threaded and multi-connection technologies in order to be very fast and efficient. Answer option B is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol. Hping is one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping, hping3, is scriptable using the Tcl language and implements an engine for string based, human readable description of TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both system administrators and crackers (or script kiddies). Answer option A is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.

• Question 66:

  Fill in the blank with the appropriate term. The model is a description framework for computer network protocols and is sometimes called the Internet Model or the DoD Model.

  TCP/IP

  Explanation/Reference:

  The TCP/IP model is a description framework for computer network protocols. It describes a set of general design guidelines and implementations of specific networking protocols to enable computers to communicate over a network. TCP/IP provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination. Protocols exist for a variety of different types of communication services between computers. The TCP/ IP Model is sometimes called the Internet Model or the DoD Model. The TCP/IP model has four unique layers as shown in the image. This layer architecture is often compared with the seven-layer OSI Reference Model. The TCP/IP model and related protocols are maintained by the Internet Engineering Task Force (IETF).

  

• Question 67:

  Adam, a malicious hacker, is sniffing an unprotected Wi-FI network located in a local store with Wireshark to capture hotmail e-mail traffic. He knows that lots of people are using their laptops for browsing the Web in the store. Adam wants to sniff their e-mail messages traversing the unprotected Wi-Fi network. Which of the following Wireshark filters will Adam configure to display only the packets with hotmail email messages?

  A. (http = "login.pass.com") andand (http contains "SMTP")
  B. (http contains "email") andand (http contains "hotmail")
  C. (http contains "hotmail") andand (http contains "Reply-To")
  D. (http = "login.passport.com") andand (http contains "POP3")
  C. (http contains "hotmail") andand (http contains "Reply-To")

  ---

  Explanation/Reference:

  Adam will use (http contains "hotmail") andand (http contains "Reply-To") filter to display only the packets with hotmail email messages. Each Hotmail message contains the tag Reply-To: and "xxxx-xxx- xxx.xxxx.hotmail.com" in the received tag.

  Wireshark is a free packet sniffer computer application. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is very similar to tcpdump, but it has a graphical front-end,

  and many more information sorting and filtering options. It allows the user to see all traffic being passed over the network (usually an Ethernet network but support is being added for others) by putting the network interface into promiscuous

  mode. Wireshark uses pcap to capture packets, so it can only capture the packets on the networks supported by pcap. It has the following features: Data can be captured "from the wire" from a live network connection or read from a file that

  records the already-captured packets. Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP, and loopback. Captured network data can be browsed via a GUI, or via the terminal (command line)

  version of the utility, tshark. Captured files can be programmatically edited or converted via command-line switches to the "editcap" program. Data display can be refined using a display filter. Plugins can be created for dissecting new

  protocols.

  Answer options B, A, and D are incorrect. These are invalid tags.

• Question 68:

  Which of the following encryption techniques do digital signatures use?

  A. MD5
  B. RSA
  C. Blowfish
  D. IDEA
  A. MD5

• Question 69:

  Which of the following statements are true about an IPv6 network? Each correct answer represents a complete solution. Choose all that apply.

  A. For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.
  B. It increases the number of available IP addresses.
  C. It uses longer subnet masks than those used in IPv4.
  D. It provides improved authentication and security.
  E. It uses 128-bit addresses.
  A. For interoperability, IPv4 addresses use the last 32 bits of IPv6 addresses.
  B. It increases the number of available IP addresses.
  D. It provides improved authentication and security.
  E. It uses 128-bit addresses.

  ---

  Explanation/Reference:

  IP addressing version 6 (IPv6) is the latest version of IP addressing. IPv6 is designed to solve many of the problems that were faced by IPv4, such as address depletion, security, auto-configuration, and extensibility. With the fast increasing

  number of networks and the expansion of the World Wide Web, the allotted IP addresses are depleting rapidly, and the need for more network addresses is arising. IPv6 solves this problem, as it uses a 128-bit address that can produce a lot

  more IP addresses. These addresses are hexadecimal numbers, made up of eight octet pairs. An example of an IPv6 address is 45CF: 6D53: 12CD: AFC7: E654: BB32: 543C: FACE.

  Answer option C is incorrect. The subnet masks used in IPv6 addresses are of the same length as those used in IPv4 addresses.

• Question 70:

  Andrew would like to configure IPsec in a manner that provides confidentiality for the content of packets. What component of IPsec provides this capability?

  A. IKE
  B. ESP
  C. AH
  D. ISAKMP
  B. ESP