Practice 312-38 Questions With Certification guide Q&A from Training Expert TestInsides
Free EC-COUNCIL 312-38 Test Practice Test Questions Exam Dumps
NEW QUESTION # 201
Which of the following creates passwords for individual administrator accounts and stores them in Windows AD?
- A. SRM
- B. SAM
- C. LAPS
- D. LSASS
Answer: C
Explanation:
The Local Administrator Password Solution (LAPS) is a Microsoft tool that provides a solution for managing the local administrator password on domain-joined computers. Its primary function is to generate a unique password for each local administrator account and then securely store this password in the Active Directory (AD). When LAPS is implemented, it enhances security by ensuring that local administrator accounts have unique passwords, which reduces the risk of Pass-the-Hash attacks and other similar credential theft techniques.
References: This information aligns with the objectives and documentation of the ECCouncil's Certified Network Defender (CND) program, which emphasizes the importance of securing credentials and managing privileged accounts in a Windows AD environment12.
NEW QUESTION # 202
Which of the following is a type of computer security that deals with protection against spurious signals emitted
by electrical equipment in the system?
- A. Physical security
- B. Hardware security
- C. Emanation Security
- D. Communication Security
Answer: C
Explanation:
Emanation security is one of the types of computer security that deals with protection against spurious signals
emitted by electrical equipment in the system, such as electromagnetic emission (from displays), visible
emission (displays may be visible through windows), and audio emission (sounds from printers, etc). Answer
option D is incorrect. Hardware security helps in dealing with the vulnerabilities in the handling of hardware.
Answer option B is incorrect. Physical security helps in dealing with protection of computer hardware and
associated equipment.
Answer option A is incorrect. Communication security helps in dealing with the protection of data and
information during transmission.
NEW QUESTION # 203
Justine has been tasked by her supervisor to ensure that the company's physical security is on the same level as their logical security measures. She installs video cameras at all entrances and exits and installs badge access points for all doors. The last item she wants to install is a method to prevent unauthorized people piggybacking employees. What should she install to prevent piggybacking?
- A. She should install a Thompson Trapdoor.
- B. She should install a mantrap
- C. Justine needs to install a biometrics station at each entrance
- D. Justine will need to install a revolving security door
Answer: B
Explanation:
A mantrap is a physical security system designed to control access to a secure area through a small space that can only fit one person at a time. This space typically has two sets of interlocking doors. The first set of doors must close before the second set opens, preventing tailgating or piggybacking, where an unauthorized person follows an authorized person into a restricted area. Mantraps can be equipped with biometric verification systems to ensure that the person in the mantrap is authorized to enter the secure area.
References: The concept of a mantrap as a security measure aligns with the Certified Network Defender (CND) objectives which include understanding and implementing physical security controls for network security. The use of mantraps is a recognized method to prevent unauthorized access and is mentioned in various security frameworks and guidelines as an effective physical security measure123.
NEW QUESTION # 204
The risk assessment team in Southern California has estimated that the probability of an incident that has potential to impact almost 80% of the bank's business is very high. How should this risk be categorized in the risk matrix?
- A. High
- B. Medium
- C. Low
- D. Extreme
Answer: D
Explanation:
In the context of risk assessment, an incident that has a very high probability of occurring and the potential to impact almost 80% of a business is considered an extreme risk. This categorization is based on the severity of the impact and the likelihood of the event. The risk matrix, a tool used in risk assessment, helps in the classification of risks by considering both the impact and the probability of potential incidents. An event that affects such a significant portion of the business would typically necessitate immediate attention and the implementation of mitigation strategies to prevent substantial loss or damage.
References: The Certified Network Defender (CND) curriculum includes principles of risk assessment and the use of risk matrices to categorize and prioritize risks. It outlines that risks with high impact and high probability should be classified as extreme, requiring urgent action12.
NEW QUESTION # 205
Which of the following is an example of MAC model?
- A. Chinese Waterfall model
- B. Bell-LaPadula model
- C. Clark-Beason integrity model
- D. Access control matrix model
Answer: B
Explanation:
The Bell-LaPadula model is an example of a Mandatory Access Control (MAC) model. It is designed to maintain the confidentiality of information by enforcing access controls based on security classification levels. This model ensures that subjects (users) with a certain clearance level cannot read data at a higher classification level (no read-up) and cannot write data to a lower classification level (no write-down), thus preventing unauthorized access and information flow not permitted by the policy.
NEW QUESTION # 206
Which of the following is a credit card-sized device used to securely store personal information and used in conjunction with a PIN number to authenticate users?
- A. Proximity card
- B. Smart card
- C. Java card
- D. SD card
Answer: B
Explanation:
A smart card is a credit card-sized device used to securely store personal information such as certificates, public and private keys, passwords, etc. It is used in conjunction with a PIN number to authenticate users. In Windows, smart cards are used to enable certificate-based authentication. To use smart cards, Extensible Authentication Protocol (EAP) must be configured in Windows. Answer option B is incorrect. Java Card is a technology that allows Java-based applications to be run securely on smart cards and small memory footprint devices. Java Card gives a user the ability to program devices and make them application specific. It is widely used in SIM cards and ATM cards. Java Card products are based on the Java Card Platform specifications developed by Sun Microsystems, a supplementary of Oracle Corporation. Many Java card products also rely on the global platform specifications for the secure management of applications on the card. The main goals of the Java Card technology are portability and security. Answer option A is incorrect. Proximity card (or Prox Card) is a generic name for contactless integrated circuit devices used for security access or payment systems. It can refer to the older 125 kHz devices or the newer 13.56 MHz contactless RFID cards, most commonly known as contactless smartcards.Modern proximity cards are covered by the ISO/IEC 14443 (Proximity Card) standard. There is also a related ISO/IEC 15693 (Vicinity Card) standard. Proximity cards are powered by resonant energy transfer and have a range of 0-3 inches in most instances. The user will usually be able to leave the card inside a wallet or purse. The price of the cards is also low, usually US$2-$5, allowing them to be used in applications such as identification cards, keycards, payment cards and public transit fare cards. Answer option C is incorrect. Secure Digital (SD) card is a non-volatile memory card format used in portable devices such as mobile phones, digital cameras, and handheld computers. SD cards are based on the older MultiMediaCard (MMC) format, but they are a little thicker than MMC cards. Generally an SD card offers a write-protect switch on its side. SD cards generally measure 32 mm x 24 mm x 2.1 mm, but they can be as thin as 1.4 mm. The devices that have SD card slots can use the thinner MMC cards, but the standard SD cards will not fit into the thinner MMC slots. Some SD cards are also available with a USB connector. SD card readers allow SD cards to be accessed via many connectivity ports such as USB, FireWire, and the common parallel port.
NEW QUESTION # 207
Which of the following topologies is a type of physical network design where each computer in the network is connected to a central device through an unshielded twisted-pair (UTP) wire?
- A. Star topology
- B. Mesh topology
- C. Ring topology
- D. Bus topology
Answer: A
Explanation:
Star topology is a type of physical network design where each computer in the network is connected to a central device, called hub, through an unshielded twisted-pair (UTP) wire. Signals from the sending computer go to the hub and are then transmitted to all the computers in the network. Since each workstation has a separate connection to the hub, it is easy to troubleshoot. Currently, it is the most popular topology used for networks.
Star Topology:
Answer option A is incorrect. Mesh network topology is a type of physical network design where all devices in a network are connected to each other with many redundant connections. It provides multiple paths for the data traveling on the network to reach its destination. Mesh topology also provides redundancy in the network. It employs the full mesh and partial mesh methods to connect devices. In a full mesh topology network, each computer is connected to all the other computers. In a partial mesh topology network, some of the computers are connected to all the computers, whereas some are connected to only those computers with which they frequently exchange data.
Mesh Topology:
Answer option D is incorrect. Bus topology is a type of physical network design where all computers in the network are connected through a single coaxial cable known as bus. This topology uses minimum cabling and is therefore, the simplest and least expensive topology for small networks. In this topology, 50 ohm terminators terminate both ends of the network. A Bus topology network is difficult to troubleshoot, as a break or problem at any point along the cable can cause the entire network to go down.
Bus Topology:
Answer option C is incorrect. Ring topology is a type of physical network design where all computers in the network are connected in a closed loop. Each computer or device in a Ring topology network acts as a repeater. It transmits data by passing a token around the network in order to prevent the collision of data between two computers that want to send messages at the same time. If a token is free, the computer waiting to send data takes it, attaches the data and destination address to the token, and sends it. When the token reaches its destination computer, the data is copied. Then, the token gets back to the originator. The originator finds that the message has been copied and received and removes the message from the token. Now, the token is free and can be used by the other computers in the network to send data. In this topology, if one computer fails, the entire network goes down.
Ring Topology:
NEW QUESTION # 208
Peter, a malicious hacker, obtains e-mail addresses by harvesting them from postings, blogs, DNS listings, and Web pages. He then sends a large number of unsolicited commercial e-mail (UCE) messages to these addresses. Which of the following e-mail crimes is Peter committing?
- A. E-mail spoofing
- B. E-mail storm
- C. E-mail spam
- D. E-mail bombing
Answer: C
Explanation:
Peter is performing spamming activity. Spam is a term that refers to the unsolicited e-mails sent to a large number of e-mail users. The number of such e-mails is increasing day by day, as most companies now prefer to use e-mails for promoting their products. Because of these unsolicited e-mails, legitimate e-mails take a much longer time to deliver to their destination. The attachments sent through spam may also contain viruses. However, spam can be stopped by implementing spam filters on servers and e-mail clients. Answer option C is incorrect. Mail bombing is an attack that is used to overwhelm mail servers and clients by sending a large number of unwanted e-mails. The aim of this type of attack is to completely fill the recipient's hard disk with immense, useless files, causing at best irritation, and at worst total computer failure. E-mail filtering and properly configuring email relay functionality on mail servers can be helpful for protection against this type of attack. Answer option B is incorrect. An e-mail storm is a sudden spike of Reply All messages on an e-mail distribution list, usually caused by a controversial or misdirected message. Such storms start when multiple members of the distribution list reply to the entire list at the same time in response to an instigating message. Other members soon respond, usually adding vitriol to the discussion, asking to be removed from the list, or pleading for the cessation of messages. If enough members reply to these unwanted messages, this triggers a chain reaction of e-mail messages. The sheer load of traffic generated by these storms can render the e-mail servers carrying them inoperative, similar to a DDoS attack. Some e-mail viruses also have the capacity to create e-mail storms, by sending copies of themselves to an infected user's contacts, including distribution lists, infecting the contacts in turn. Answer option D is incorrect. E-mail spoofing is a term used to describe e-mail activity in which the sender address and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source. E-mail spoofing is a technique commonly used for spam e-mail and phishing to hide the origin of an e-mail message. By changing certain properties of the e-mail, such as the From, Return-Path, and Reply-To fields (which can be found in the message header), ill-intentioned users can make the e-mail appear to be from someone other than the actual sender. The result is that, although the e-mail appears to come from the address indicated in the From field, it actually comes from another source.
NEW QUESTION # 209
Which of the following network devices operate at the network layer of the OSI model? Each correct answer represents a complete solution. Choose all that apply.
- A. Bridge
- B. Repeater
- C. Router
- D. Gateway
Answer: C,D
Explanation:
A router is a device that routes data packets between computers in different networks. It is used to connect multiple networks, and it determines the path to be taken by each data packet to its destination computer. A router maintains a routing table of the available routes and their conditions. By using this information, along with distance and cost algorithms, the router determines the best path to be taken by the data packets to the destination computer. A router can connect dissimilar networks, such as Ethernet, FDDI, and Token Ring, and route data packets among them. Routers operate at the network layer (layer 3) of the Open Systems Interconnection (OSI) model. A gateway is a network point that acts as an entrance to another network. On the Internet, a node or stopping point can be either a gateway node or a host (end-point) node. Both the computers of Internet users and the computers that serve pages to users are host nodes. The computers that control traffic within a company's network or at a local Internet service provider (ISP) are gateway nodes. In the network for an enterprise, a computer server acting as a gateway node is often also acting as a proxy server and a firewall server. A gateway is often associated with both a router, which knows where to direct a given packet of data that arrives at the gateway, and a switch, which furnishes the actual path in and out of the gateway for a given packet. Most of the gateways operate at the application layer, but can operate at the network or session layer of the OSI model. Answer option C is incorrect. A repeater operates only at the physical layer of the OSI model. Answer option B is incorrect. A bridge operates at the data link layer of the OSI model.
NEW QUESTION # 210
Which type of antenna is based on the principle of a satellite dish and can pick up Wi-Fi signals from a distance of ten miles of more?
- A. Yagi antenna
- B. Directional antenna
- C. Parabolic Grid antenna
- D. Omnidirectional antenna
Answer: C
Explanation:
The Parabolic Grid antenna is designed based on the principle of a satellite dish. This type of antenna can focus the radio waves onto a particular direction and is capable of picking up Wi-Fi signals from very long distances, often ten miles or more, depending on the specific design and conditions. It is highly directional and has a narrow focus, making it ideal for point-to-point communication in long-range Wi-Fi networks.
NEW QUESTION # 211
Which of the following protocols uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets?
- A. LWAPP
- B. PPTP
- C. SSTP
- D. ESP
Answer: B
NEW QUESTION # 212
CORRECT TEXT
Fill in the blanks with the appropriate terms. In L2TP ______________ tunnel mode, the ISP must support L2TP, whereas in L2TP tunnel mode, the ISP does not need to support L2TP.
Answer:
Explanation:
compulsory
Explanation:
The Layer 2 Tunnel Protocol is one of the tunneling protocols that is used in a virtual private network. It contains the functionality of Cisco's Layer 2 Forwarding (L2F) protocol and Microsoft's Point-to-Point Tunneling Protocol (PPTP). This protocol is vendor interoperable and supports multihopping.L2TP supports two tunnel modes: Compulsory tunnel: In L2TP compulsory tunnel mode, a remote host initiates a connection to its Internet Service Provider (ISP). An L2TP connection is established between the remote user and the corporate network by the ISP. With a compulsory tunnel, the ISP must support L2TP. Voluntary tunnel: In L2TP voluntary tunnel mode, the connection is created by the remote user, typically by using an L2TP tunneling client. Then, the remote user sends L2TP packets to its ISP in order to forward them on to the corporate network. With a voluntary tunnel, the ISP does not need to support L2TP.
NEW QUESTION # 213
George was conducting a recovery drill test as a part of his network operation. Recovery drill tests are conducted on the______________.
- A. Archived data
- B. Deleted data
- C. Backup data
- D. Data in transit
Answer: C
Explanation:
Recovery drill tests are an essential part of disaster recovery planning. They are conducted on backup data to ensure that the data can be successfully restored in the event of a disaster. During these drills, the backup systems are tested to verify that they function correctly and that the data is intact and recoverable. This process helps organizations prepare for actual disaster scenarios and ensures that their backup solutions are effective and reliable.
References: The practice of conducting recovery drill tests on backup data is a standard procedure in disaster recovery and business continuity planning, as outlined in various IT and network security resources123.
NEW QUESTION # 214
An administrator wants to monitor and inspect large amounts of traffic and detect unauthorized attempts from inside the organization, with the help of an IDS. They are not able to recognize the exact location to deploy the IDS sensor. Can you help him spot the location where the IDS sensor should be placed?
- A. Location 1
- B. Location 2
- C. Location 3
- D. Location 4
Answer: B
NEW QUESTION # 215
Which of the following representatives in the incident response process are included in the incident response team? Each correct answer represents a complete solution. Choose all that apply.
- A. Human resources
- B. Information security representative
- C. Lead investigator
- D. Legal representative
- E. Technical representative
- F. Sales representative
Answer: A,B,C,D,E
Explanation:
Incident response is a process that detects a problem, determines the cause of an issue, minimizes the damages, resolves the problem, and documents each step of process for future reference. To perform all these roles, an incident response team is needed. The incident response team includes the following representatives who are involved in the incident response process: Lead investigator: The lead investigator is the manager of an incident response team. He is always involved in the creation of an incident response plan. The duties of a lead investigator are as follows:Keep the management updated.Ensure that the incident response moves smoothly and efficiently.Interview and interrogate the suspects and witnesses. Information security representative: The information security representative is a member of the incident response team who alerts the team about possible security safeguards that can impact their ability to respond to an incident. Legal representative: The legal representative is a member of the incident response team who ensures that the process follows all the laws during the response to an incident. Technical representative: Technical representative is a representative of the incident response team. More than one technician can be deployed to an incident. The duties of a technical representative are as follows:Perform forensic backups of the systems that are involved in an incident. Provide more information about the configuration of the network or system. Human resources: Human resources personnel ensure that the policies of the organization are enforced during the incident response process. They suspend access to a suspect if it is needed. Human resources personnel are closely related with the legal representatives and cover up the organization's legal responsibility.
NEW QUESTION # 216
Which of the following types of RAID offers no protection for the parity disk?
- A. RAID 3
- B. RAID 2
- C. RAID 1
- D. RAID 5
Answer: A
NEW QUESTION # 217
Which of the following connects the SDN controller and SDN networking devices and relays information from network services to network devices such as switches and routers?
- A. Southbound API
- B. Eastbound API
- C. Northbound API
- D. Westbound API
Answer: A
Explanation:
In Software Defined Networking (SDN), APIs are used to manage the communication between different components of the network. The Southbound API connects the SDN controller to the networking devices such as switches and routers, enabling the controller to send instructions to the network devices and gather data from them. This API is essential for the controller to enforce policies and ensure the proper functioning of the network infrastructure.
The other APIs are:
* Northbound API: Interfaces between the SDN controller and the applications running on the network.
* Eastbound API and Westbound API: Generally used for communication between different SDN controllers or other similar systems.
References:
* EC-Council Certified Network Defender (CND) Study Guide
* SDN architecture documentation
NEW QUESTION # 218
James was inspecting ARP packets in his organization's network traffic with the help of Wireshark. He is checking the volume of traffic containing ARP requests as well as the source IP address from which they are originating. Which type of attack is James analyzing?
- A. ARP Poisioning
- B. ARP misconfiguration
- C. ARP spoofinq
- D. ARP Sweep
Answer: D
NEW QUESTION # 219
An IT company has just been hit with a severe external security breach. To enhance the company's security posture, the network admin has decided to first block all the services and then individually enable only the necessary services. What is such an Internet access policy called?
- A. Permissive Policy
- B. Promiscuous Policy
- C. Paranoid Policy
- D. Prudent Policy
Answer: C
Explanation:
The Paranoid Policy is a type of Internet access policy that is characterized by initially blocking all services and then selectively enabling only those that are necessary. This approach is often taken as a security measure following a severe external breach, as it allows the network administrator to ensure that only essential and secure services are accessible, minimizing potential vulnerabilities.
NEW QUESTION # 220
Fred is a network technician working for Johnson Services, a temporary employment agency in Boston. Johnson Services has three remote offices in New England and the headquarters in Boston where Fred works.
The company relies on a number of customized applications to perform daily tasks and unfortunately these applications require users to be local administrators. Because of this, Fred's supervisor wants to implement tighter security measures in other areas to compensate for the inherent risks in making those users local admins. Fred's boss wants a solution that will be placed on all computers throughout the company and monitored by Fred. This solution will gather information on all network traffic to and from the local computers without actually affecting the traffic. What type of solution does Fred's boss want to implement?
- A. Fred's boss wants a NIDS implementation.
- B. Fred's boss wants Fred to monitor a NIPS system.
- C. Fred's boss wants to implement a HIDS solution.
- D. Fred's boss wants to implement a HIPS solution.
Answer: C
NEW QUESTION # 221
What represents the ability of an organization to respond under emergency in order to minimize the damage to its brand name, business operation, and profit?
- A. Emergency management
- B. Disaster recovery
- C. Incident management
- D. Crisis management
Answer: D
NEW QUESTION # 222
Which of the following commands is used for port scanning?
- A. nc -z
- B. nc -t
- C. nc -v
- D. nc -d
Answer: A
Explanation:
Explanation
NEW QUESTION # 223
Which of the following is a firewall that keeps track of the state of network connections traveling across it?
- A. Stateful firewall
- B. Stateless packet filter firewall
- C. Circuit-level proxy firewall
- D. Application gateway firewall
Answer: A
Explanation:
A stateful firewall is a firewall that keeps track of the state of network connections (such as TCP streams, UDP communication) traveling across it. The firewall is programmed to distinguish legitimate packets for different types of connections. Only packets matching a known connection state will be allowed by the firewall; others will be rejected. Answer option B is incorrect. A stateless packet filter firewall allows direct connections from the external network to hosts on the internal network and is included with router configuration software or with Open Source operating systems.
Answer option C is incorrect. It applies security mechanisms when a TCP or UDP connection is established.
Answer option D is incorrect. An application gateway firewall applies security mechanisms to specific applications, such as FTP and Telnet servers.
NEW QUESTION # 224
Which of the following types of RAID is also known as disk striping?
- A. RAID 3
- B. RAID 2
- C. RAID 1
- D. RAID 0
Answer: D
NEW QUESTION # 225
......
Prepare Top EC-COUNCIL 312-38 Exam Audio Study Guide Practice Questions Edition: https://www.testinsides.top/312-38-dumps-review.html
Dumps Practice Exam Questions Study Guide for the 312-38 Exam: https://drive.google.com/open?id=1ndgWmA4Wac_zU2OZ5v6tTRGdOVwjYNzp