A fully updated 2021 312-38 Exam Dumps exam guide from training expert DumpsValid
Provides complete coverage of every objective on exam and exam preparation 312-38
Understanding functional and technical aspects of Certified Network Defender Security Principles and Practices
The following will be discussed in ECCOUNCIL EC 312-38 dumps:
- Discuss security advantages of organization division strategies
- Discuss IDS/IPS arrangement - Discuss different parts of IDS - Discuss viable organization of organization and host-based IDS
- Redefine Access Control security in Today’s
- Describe the different instances of host-level assault strategies
- Discuss the determination of fitting IDS arrangements
- Learn to plan and foster security approaches
- Discuss firewall execution and sending measure
- Discuss different cryptographic calculations
- Explain protection top to bottom security system
- Distributed and Mobile Computing World
- Conduct security mindfulness preparing
- Describe the different instances of applicationlevel assault strategies
- Obtain consistence with administrative structures
- Describe the different instances of organization level assault strategies
- Discuss different fundamental organization security arrangements
- Understand principal objective, advantages, and difficulties in network protection
- Describe the different instances of remote organization explicit assault methods
- Learn to how to manage bogus positive and bogus negative IDS cautions
- Discuss firewall organization exercises - Understand job, abilities, limits, and worries in IDS arrangement
- Discuss switch and switch safety efforts, proposals, and best practices
- Leverage Zero Trust Model Security utilizing Programming Defined Perimeter (SDP)
- Understand firewall geographies and their use - Distinguish between equipment, programming, have, network, inner, and outer firewalls
- Discuss different Regulatory Frameworks, Laws, and Acts
- Discuss different fundamental organization security conventions
- Explain Continual/Adaptive security procedure
- Discuss suggestions and best practices for secure firewall Implementation and arrangement
- Discuss cryptographic security procedures
- Describe the different instances of email assault methods
- Describe the different instances of cloud-explicit assault methods
- Understand firewall security concerns, abilities, and impediments
- Understand various sorts of firewall advances and their use
- Describe the different instances of cell phone explicit assault methods
- Discuss other regulatory safety efforts
- Discuss different NIDS and HIDS Solutions with their interruption location capacities
- Explain fundamental wordings identified with network security assaults
- Select firewalls dependent on its profound traffic examination ability
- Discuss Identity and Access Management (IAM) ideas
- Discuss access control standards, wordings, and models
- Describe Attacker’s Hacking Methodologies and Frameworks
- Describe the different instances of social designing assault strategies
NEW QUESTION 86
Which of the following protocols is a method of implementing virtual private networks?
- A. IRDP
- B. PPTP
- C. OSPF
- D. DHCP
Answer: B
NEW QUESTION 87
Which of the following protocols is used to share information between routers to transport IP Multicast packets
among networks?
- A. RPC
- B. LWAPP
- C. RSVP
- D. DVMRP
Answer: D
Explanation:
The Distance Vector Multicast Routing Protocol (DVMRP) is used to share information between routers to
transport IP Multicast packets among networks. It uses a reverse path-flooding technique and is used as the
basis for the Internet's multicast backbone (MBONE). In particular, DVMRP is notorious for poor network
scaling, resulting from reflooding, particularly with versions that do not implement pruning. DVMRP's flat
unicast routing mechanism also affects its capability to scale.
Answer option A is incorrect. The Resource Reservation Protocol (RSVP) is a Transport layer protocol
designed to reserve resources across a network for an integrated services Internet. RSVP does not transport
application data but is rather an Internet control protocol, like ICMP, IGMP, or routing protocols. RSVP provides
receiver-initiated setup of resource reservations for multicast or unicast data flows with scaling and robustness.
RSVP can be used by either hosts or routers to request or deliver specific levels of quality of service (QoS) for
application data streams. RSVP defines how applications place reservations and how they can leave the
reserved resources once the need for them has ended. RSVP operation will generally result in resources being
reserved in each node along a path.
Answer option C is incorrect. A remote procedure call (RPC) hides the details of the network by using the
common procedure call mechanism familiar to every programmer. Like any ordinary procedure, RPC is also
synchronous and parameters are passed to it. A process of the client calls a function on a remote server and
remains suspended until it gets back the results.
Answer option D is incorrect. LWAPP (Lightweight Access Point Protocol) is a protocol used to control multiple
Wi-Fi wireless access points at once. This can reduce the amount of time spent on configuring, monitoring, or
troubleshooting a large network. This also allows network administrators to closely analyze the network.
NEW QUESTION 88
Which of the following is a standard protocol for interfacing external application software with an information
server, commonly a Web server?
- A. DHCP
- B. IP
- C. CGI
- D. TCP
Answer: C
Explanation:
The Common Gateway Interface (CGI) is a standard protocol for interfacing external application software with
an information server, commonly a Web server. The task of such an information server is to respond to
requests (in the case of web servers, requests from client web browsers) by returning output. When a user
requests the name of an entry, the server will retrieve the source of that entry's page (if one exists), transform it
into HTML, and send the result.
Answer option A is incorrect. DHCP is a Dynamic Host Configuration Protocol that allocates unique (IP)
addresses dynamically so that they can be used when no longer needed. A DHCP server is set up in a DHCP
environment with the appropriate configuration parameters for the given network. The key parameters include
the range or "pool" of available IP addresses, correct subnet masks, gateway, and name server addresses.
Answer option B is incorrect. The Internet Protocol (IP) is a protocol used for communicating data across a
packet-switched inter-network using the Internet Protocol Suite, also referred to as TCP/IP.IP is the primary
protocol in the Internet Layer of the Internet Protocol Suite and has the task of delivering distinguished protocol
datagrams (packets) from the source host to the destination host solely based on their addresses. For this
purpose, the Internet Protocol defines addressing methods and structures for datagram encapsulation. The
first major version of addressing structure, now referred to as Internet Protocol Version 4 (IPv4), is still the
dominant protocol of the Internet, although the successor, Internet Protocol Version 6 (IPv6), is being deployed
actively worldwide.
Answer option D is incorrect. Transmission Control Protocol (TCP) is a reliable, connection-oriented protocol
operating at the transport layer of the OSI model. It provides a reliable packet delivery service encapsulated
within the Internet Protocol (IP). TCP guarantees the delivery of packets, ensures proper sequencing of data,
and provides a checksum feature that validates both the packet header and its data for accuracy. If the
network corrupts or loses a TCP packet during transmission, TCP is responsible for retransmitting the faulty
packet. It can transmit large amounts of data. Application layer protocols, such as HTTP and FTP, utilize the
services of TCP to transfer files between clients and servers.
NEW QUESTION 89
FILL BLANK
Fill in the blank with the appropriate term. ______________ is the use of sensitive words in e-mails to jam the
authorities that listen in on them by providing a form of a red herring and an intentional annoyance.
Answer:
Explanation:
Email jamming
Explanation: Email jamming is the use of sensitive words in e-mails to jam the authorities that listen in on them
by providing a form of a red herring and an intentional annoyance. In this attack, an attacker deliberately
includes "sensitive" words and phrases in otherwise innocuous emails to ensure that these are picked up by
the monitoring systems. As a result the senders of these emails will eventually be added to a "harmless" list
and their emails will be no longer intercepted, hence it will allow them to regain some privacy.
NEW QUESTION 90
Which of the following is a class of attacks to break through, which depends on a greater probability of collisions between random attack was detected, and try to fixed rate permutations?
- A. phishing attack
- B. birthday attack
- C. replay attack
- D. None
- E. Dictionary attack
Answer: B
NEW QUESTION 91
What is the range for registered ports?
- A. 0 through 1023
- B. 49152 through 65535
- C. 1024 through 49151
- D. Above 65535
Answer: C
NEW QUESTION 92
Nancy is working as a network administrator for a small company. Management wants to implement a RAID storage for their organization. They want to use the appropriate RAID level for their backup plan that will satisfy the following requirements: 1. It has a parity check to store all the information about the data in multiple drives 2. Help reconstruct the data during downtime. 3. Process the data at a good speed. 4. Should not be expensive. The management team asks Nancy to research and suggest the appropriate RAID level that best suits their requirements. What RAID level will she suggest?
- A. RAID 3
- B. RAID 1
- C. RAID 10
- D. RAID 0
Answer: A
NEW QUESTION 93
Which protocol could choose the network administrator for the wireless network design, if he need to satisfied the minimum requirement of 2.4 GHz, 22 MHz of bandwidth, 2 Mbits/s stream for data rate and use DSSS for modulation.
- A. 802.11b
- B. 802.11g
- C. 802.11a
- D. 802.11n
Answer: A
NEW QUESTION 94
Which of the following is an IPSec protocol that can be used alone in combination with Authentication Header (AH)?
- A. L2TP
- B. ESP
- C. PPTP
- D. PPP
Answer: B
NEW QUESTION 95
Which of the following header fields in TCP/IP protocols involves Ping of Death attack?
- A. SMTP header field
- B. TCP header field
- C. UDP header field
- D. IP header field
Answer: B
NEW QUESTION 96
Which of the following is a Unix and Windows tool capable of intercepting traffic on a network segment and capturing username and password?
- A. BackTrack
- B. Ettercap
- C. AirSnort
- D. Aircrack
Answer: B
Explanation:
Ettercap is a Unix and Windows tool for computer network protocol analysis and security auditing. It is capable of intercepting traffic on a network segment, capturing passwords, and conducting active eavesdropping against a number of common protocols. It is a free open source software. Ettercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis.
Answer option C is incorrect. BackTrack is a Linux distribution distributed as a Live CD, which is used for penetration testing. It allows users to include customizable scripts, additional tools and configurable kernels in personalized distributions. It contains various tools, such as Metasploit integration, RFMON injection capable wireless drivers, kismet, autoscan-network (network discovering and managing application), nmap, ettercap, wireshark (formerly known as Ethereal).
Answer option A is incorrect. AirSnort is a Linux-based WLAN WEP cracking tool that recovers encryption keys. AirSnort operates by passively monitoring transmissions. It uses Ciphertext Only Attack and captures approximately 5 to 10 million packets to decrypt the WEP keys. Answer option D is incorrect. Aircrack is the fastest WEP/WPA cracking tool used for 802.11a/b/g WEP and WPA cracking.
NEW QUESTION 97
Which of the following ranges of addresses can be used in the first octet of a Class C network address?
- A. 128-191
- B. 192-223
- C. 0-127
- D. 224-255
Answer: B
NEW QUESTION 98
Which of the following statements are true about security risks? Each correct answer represents a complete solution. (Choose three.)
- A. They can be analyzed and measured by the risk analysis process.
- B. They can be removed completely by taking proper actions.
- C. They are considered an indicator of threats coupled with vulnerability.
- D. They can be mitigated by reviewing and taking responsible actions based on possible risks.
Answer: A,C,D
Explanation:
In information security, security risks are considered an indicator of threats coupled with vulnerability. In other words, security risk is a probabilistic function of a given threat agent exercising a particular vulnerability and the impact of that risk on the organization. Security risks can be mitigated by reviewing and taking responsible actions based on possible risks. These risks can be analyzed and measured by the risk analysis process.
Answer option B is incorrect. Security risks can never be removed completely but can be mitigated by taking proper actions.
NEW QUESTION 99
The IR team and the network administrator have successfully handled a malware incident on the network. The team is now preparing countermeasure guideline to avoid a future occurrence of the malware incident.
Which of the following countermeasure(s) should be added to deal with future malware incidents? (Select all that apply)
- A. Complying with the company's security policies
- B. Install antivirus software
- C. Implementing strong authentication schemes
- D. Implementing a strong password policy
Answer: B
NEW QUESTION 100
CORRECT TEXT
Fill in the blank with the appropriate term.
A ______________ gateway is a type of network gateway that provides the added capability to control devices across the Internet.
Answer:
Explanation:
home automation
Explanation:
A home automation gateway is a type of network gateway that provides the added capability to control devices across the Internet. Most gateways plug in to the home broadband router (and a wall outlet for power). When connected to a router that has Internet connectivity, the automation gateway helps in enabling computers and Web-enabled phones to remotely access automation devices at home.
NEW QUESTION 101
Which of the following protocols sends a jam signal when a collision is detected?
- A. CSMA/CD
- B. ALOHA
- C. CSMA
- D. CSMA/CA
Answer: A
NEW QUESTION 102
Which of the following is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic?
- A. Nmap
- B. PSAD
- C. Hping
- D. NetRanger
Answer: B
Explanation:
PSAD is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic. It includes many signatures from the IDS to detect probes for various backdoor programs such as EvilFTP, GirlFriend, SubSeven, DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS). If it is combined with fwsnort and the Netfilter string match extension, it detects most of the attacks described in the Snort rule set that involve application layer data. Answer option C is incorrect. NetRanger is the complete network configuration and information toolkit that includes the following tools: a Ping tool, Trace Route tool, Host Lookup tool, Internet time synchronizer, Whois tool, Finger Unix hosts tool, Host and port scanning tool, check multiple POP3 mail accounts tool, manage dialup connections tool, Quote of the day tool, and monitor Network Settings tool. These tools are integrated in order to use an application interface with full online help. NetRanger is designed for both new and experienced users. This tool is used to help diagnose network problems and to get information about users, hosts, and networks on the Internet or on a user computer network. NetRanger uses multi-threaded and multi-connection technologies in order to be very fast and efficient. Answer option B is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol. Hping is one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping, hping3, is scriptable using the Tcl language and implements an engine for string based, human readable description of TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both system administrators and crackers (or script kiddies). Answer option A is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.
NEW QUESTION 103
Which of the following is a mandatory password-based and key-exchange authentication protocol?
- A. PPP
- B. CHAP
- C. VRRP
- D. DH-CHAP
Answer: D
NEW QUESTION 104
Which of the following is a mechanism that helps in ensuring that only the intended and authorized recipients
are able to read data?
- A. Data availability
- B. Authentication
- C. Confidentiality
- D. Integrity
Answer: C
Explanation:
Confidentiality is a mechanism that ensures that only the intended and authorized recipients are able to read
data. The data is so encrypted that even if an unauthorized user gets access to it, he will not get any meaning
out of it.
Answer option A is incorrect. In information security, integrity means that data cannot be modified without
authorization. This is not the same thing as referential integrity in databases. Integrity is violated when an
employee accidentally or with malicious intent deletes important data files, when a computer virus infects a
computer, when an employee is able to modify his own salary in a payroll database, when an unauthorized
user vandalizes a web site, when someone is able to cast a very large number of votes in an online poll, and so
on. There are many ways in which integrity could be violated without malicious intent. In the simplest case, a
user on a system could mistype someone's address. On a larger scale, if an automated process is not written
and tested correctly, bulk updates to a database could alter data in an incorrect way, leaving the integrity of the
data compromised. Information security professionals are tasked with finding ways to implement controls that
prevent errors of integrity.
Answer option B is incorrect. Data availability is one of the security principles that ensures that the data and
communication services will be available for use when needed (expected). It is a method of describing
products and services availability by which it is ensured that data continues to be available at a required level of
performance in situations ranging from normal to disastrous. Data availability is achieved through redundancy,
which depends upon where the data is stored and how it can be reached.
Answer option D is incorrect. Authentication is the act of establishing or confirming something (or someone) as
authentic, i.e., the claims made by or about the subject are true ("authentification" is a variant of this word).
NEW QUESTION 105
Which of the following statements are true about volatile memory? Each correct answer represents a complete solution. Choose all that apply.
- A. A volatile storage device is faster in reading and writing data.
- B. The content is stored permanently and even the power supply is switched off.
- C. Read only memory (ROM) is an example of volatile memory.
- D. It is computer memory that requires power to maintain the stored information.
Answer: A,D
Explanation:
Volatile memory, also known as volatile storage, is computer memory that requires power to maintain the stored information, unlike non-volatile memory which does not require a maintained power supply. It has been less popularly known as temporary memory. Most forms of modern random access memory (RAM) are volatile storage, including dynamic random access memory (DRAM) and static random access memory (SRAM). A volatile storage device is faster in reading and writing data. Answer options A and C are incorrect. Non-volatile memory, nonvolatile memory, NVM, or nonvolatile storage, in the most basic sense, is computer memory that can retain the stored information even when not powered. Examples of non-volatile memory include read-only memory, flash memory, most types of magnetic computer storage devices (e.g. hard disks, floppy disks, and magnetic tape), optical discs, and early computer storage methods such as paper tape and punched cards.
NEW QUESTION 106
Which of the following is a technique for gathering information about a remote network protected by a firewall?
- A. Warchalking
- B. Firewalking
- C. Wardialing
- D. Wardriving
Answer: B
Explanation:
Explanation
Explanation:
Fire walking is a technique for gathering information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall. If the firewall allows this crafted packet through, it forwards the packet to the next hop. On the next hop, the packet expires and elicits an ICMP
"TTL expired in transit" message to the attacker. If the firewall does not allow the traffic, there should be no response, or an ICMP "administratively prohibited" message should be returned to the attacker. A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall. The main drawback of this technique is that if an administrator blocks ICMP packets from leaving the network, it is ineffective.
Answer option B is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
Answer option C is incorrect. War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, one needs a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car.
Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources.
Answer option D is incorrect. War dialing or wardialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems, and fax machines. Hackers use the resulting lists for various purposes, hobbyists for exploration, and crackers - hackers that specialize in computer security - for password guessing.
NEW QUESTION 107
Which of the following key features is used by TCP in order to regulate the amount of data sent by a host to another host on the network?
- A. TCP timestamp
- B. Congestion control
- C. Flow control
- D. Sequence number
Answer: C
Explanation:
Flow control is the process of regulating the amount of data sent by a host to another host on the network. The flow control mechanism controls packet flow so that a sender does not transmit more packets than a receiver can process. TCP uses a sliding window flow control protocol. In each TCP segment, the receiver specifies in the receive window field the amount of additional received data (in bytes) that it is willing to buffer for the connection. The sending host can send only up to that amount of data before it must wait for an acknowledgment and window update from the receiving host.
Answer option A is incorrect. TCP uses a sequence number for identifying each byte of data.
Answer option B is incorrect. TCP timestamp helps TCP to compute the round-trip time between the sender and receiver.
Answer option C is incorrect. Congestion control concerns controlling traffic entry into a telecommunications network, so as to avoid congestive collapse by attempting to avoid oversubscription of any of the processing or link capabilities of the intermediate nodes and networks and taking resource reducing steps, such as reducing the rate of sending packets. It should not be confused with flow control, which prevents the sender from overwhelming the receiver.
NEW QUESTION 108
Which of the following is a non-profit organization that oversees the allocation of IP addresses, management of the DNS infrastructure, protocol parameter assignment, and root server system management?
- A. ITU
- B. IEEE
- C. ICANN
- D. ANSI
Answer: C
Explanation:
ICANN stands for Internet Corporation for Assigned Names and Numbers. ICANN is responsible for managing the assignment of domain names and IP addresses. ICANN's tasks include responsibility for IP address space allocation, protocol identifier assignment, top-level domain name system management, and root server system management functions. Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit organization that oversees the allocation of IP addresses, management of the DNS infrastructure, protocol parameter assignment, and root server system management. Answer option B is incorrect. Institute of Electrical and Electronics Engineers (IEEE) is an organization of engineers and electronics professionals who develop standards for hardware and software. Answer option C is incorrect. The International Telecommunication Union is an agency of the United Nations which regulates information and communication technology issues. ITU coordinates the shared global use of the radio spectrum, promotes international cooperation in assigning satellite orbits, works to improve telecommunication infrastructure in the developing world and establishes worldwide standards. ITU is active in areas including broadband Internet, latest-generation wireless technologies, aeronautical and maritime navigation, radio astronomy, satellite-based meteorology, convergence in fixed-mobile phone, Internet access, data, voice, TV broadcasting, and next-generation networks. Answer option A is incorrect. ANSI (American National Standards Institute) is the primary organization for fostering the development of technology standards in the United States. ANSI works with industry groups and is the U.S. member of the International Organization for Standardization (ISO) and the International Electro-technical Commission (IEC). Long-established computer standards from ANSI include the American Standard Code for Information Interchange (ASCII) and the Small Computer System Interface (SCSI).
NEW QUESTION 109
......
Tested Material Used To 312-38: https://www.dumpsvalid.com/312-38-still-valid-exam.html
Steps Necessary To Pass The 312-38 Exam: https://drive.google.com/open?id=1l3wSG_pDiMUsc20qEF_g4ZOY8i4oCu34