EC-COUNCIL ECCouncil Certification 412-79V8 Questions & Answers

• Question 11:

  Which one of the following components of standard Solaris Syslog is a UNIX command that is used to add single-line entries to the system log?

  A. "Logger"

  B. "/etc/syslog.conf"

  C. "Syslogd"

  D. "Syslogd.conf"

  Correct Answer: A

• Question 12:

  Which one of the following is false about Wireshark? (Select all that apply)

  A. Wireshark offers some options to analyze the WEP-decrypted data

  B. It does not support decrypting the TKIP or CCMP packets

  C. In order for Wireshark to decrypt the contents of the WEP-encrypted packets, it must be given the appropriate WEP key for the network

  D. Packet Sniffer Mode

  Correct Answer: A

• Question 13:

  Logs are the record of the system and network activities. Syslog protocol is used for delivering log information across an IP network. Syslog messages can be sent via which one of the following?

  A. UDP and TCP

  B. TCP and SMTP

  C. SMTP

  D. UDP and SMTP

  Correct Answer: A

• Question 14:

  The SnortMain () function begins by associating a set of handlers for the signals, Snort receives. It does this using the signal () function. Which one of the following functions is used as a programspecific signal and the handler for this calls the DropStats() function to output the current Snort statistics?

  A. SIGUSR1

  B. SIGTERM

  C. SIGINT

  D. SIGHUP

  Correct Answer: A

• Question 15:

  Output modules allow Snort to be much more flexible in the formatting and presentation of output to its users. Snort has 9 output plug-ins that push out data in different formats. Which one of the following output plug-ins allows alert data to be written in a format easily importable to a database?

  A. unified

  B. csv

  C. alert_unixsock

  D. alert_fast

  Correct Answer: B

• Question 16:

  Variables are used to define parameters for detection, specifically those of your local network and/or specific servers or ports for inclusion or exclusion in rules. These are simple substitution variables set with the var keyword. Which one of the following operator is used to define meta- variables?

  A. "$"

  B. "#"

  C. "*"

  D. "?"

  Correct Answer: A

• Question 17:

  Which one of the following Snort logger mode commands is associated to run a binary log file through Snort in sniffer mode to dump the packets to the screen?

  A. ./snort -dvr packet.log icmp

  B. ./snort -dev -l ./log

  C. ./snort -dv -r packet.log

  D. ./snort -l ./log b

  Correct Answer: C

• Question 18:

  Snort, an open source network-based intrusion detection sensor, is the most widely installed NIDS in the world. It can be configured to run in the four modes. Which one of the following modes reads the packets off the network and displays them in a continuous stream on the console (screen)?

  A. Packet Sniffer Mode

  B. Packet Logger Mode

  C. Network Intrusion Detection System Mode

  D. Inline Mode

  Correct Answer: A

• Question 19:

  Which one of the following architectures has the drawback of internally considering the hosted services individually?

  A. Weak Screened Subnet Architecture

  B. "Inside Versus Outside" Architecture

  C. "Three-Homed Firewall" DMZ Architecture

  D. Strong Screened-Subnet Architecture

  Correct Answer: C

• Question 20:

  Firewall and DMZ architectures are characterized according to its design. Which one of the following architectures is used when routers have better high-bandwidth data stream handling capacity?

  A. Weak Screened Subnet Architecture

  B. "Inside Versus Outside" Architecture

  C. "Three-Homed Firewall" DMZ Architecture

  D. Strong Screened-Subnet Architecture

  Correct Answer: A