Free Certified Ethical Hacker 312-38 Ultimate Study Guide (Updated 359 Questions)
Get to the Top with 312-38 Practice Exam Questions
The EC-Council Certified Network Defender (CND) certification exam is designed to test the skills and knowledge of network administrators and security professionals. EC-Council Certified Network Defender CND certification is recognized worldwide as a symbol of expertise in network defense, and is highly sought after by employers. EC-Council Certified Network Defender CND certification exam covers a wide range of topics, including network defense fundamentals, network perimeter defense, network security threats, and network security solutions.
The EC-Council 312-38 is a mandatory exam for all candidates pursuing the EC-Council Certified Network Defender (CND) certification. This is a skill-based learning path that aims to create competent network administrators who can protect, detect, and respond to rampant security threats on computer networks.
NEW QUESTION # 95
Token Ring is standardized by which of the following IEEE standards?
- A. 802.1
- B. 802.3
- C. 802.2
- D. 802.4
Answer: D
NEW QUESTION # 96
Which of the following is a network point that acts as an entrance to another network?
- A. Gateway
- B. Receiver
- C. Hub
- D. Bridge
Answer: A
NEW QUESTION # 97
Which scan attempt can penetrate through a router and a firewall that filter incoming packets with particular flags set and is not supported by Windows?
- A. TCP full connect scan attempt
- B. PINC sweep attempt
- C. ARP scan attempt
- D. TCP null scan attempt
Answer: D
Explanation:
A TCP null scan attempt is a technique used in network scanning where the TCP packet sent has no flags set. This type of scan can sometimes penetrate through routers and firewalls that filter incoming packets based on certain flags because the absence of flags can prevent the packet from being filtered out. The TCP null scan is particularly useful for identifying open ports on a target system. If a port is open, the target system will not respond to the null scan, but if the port is closed, the system will send a TCP RST packet in response. This scanning method is not supported by Windows because Windows systems typically respond with a RST packet regardless of whether the port is open or closed, making it ineffective for distinguishing between the two states on those systems.
NEW QUESTION # 98
Which of the following honeypots provides an attacker access to the real operating system without any
restriction and collects a vast amount of information about the attacker?
- A. Low-interaction honeypot
- B. Honeyd
- C. High-interaction honeypot
- D. Medium-interaction honeypot
Answer: C
Explanation:
A high-interaction honeypot offers a vast amount of information about attackers. It provides an attacker access
to the real operating system without any restriction. A high-interaction honeypot is a powerful weapon that
provides opportunities to discover new tools, to identify new vulnerabilities in the operating system, and to learn
how blackhats communicate with one another.
Answer option D is incorrect. A low-interaction honeypot captures limited amounts of information that are
mainly transactional data and some limited interactive information. Because of simple design and basic
functionality, low-interaction honeypots are easy to install, deploy, maintain, and configure. A low-interaction
honeypot detects unauthorized scans or unauthorized connection attempts. A low-interaction honeypot is like a
one-way connection, as the honeypot provides services that are limited to listening ports. Its role is very
passive and does not alter any traffic. It generates logs or alerts when incoming packets match their patterns.
Answer option B is incorrect. A medium-interaction honeypot offers richer interaction capabilities than a low-
interaction honeypot, but does not provide any real underlying operating system target. Installing and
configuring a medium-interaction honeypot takes more time than a low-interaction honeypot. It is also more
complicated to deploy and maintain as compared to a low-interaction honeypot. A medium-interaction honeypot
captures a greater amount of information but comes with greater risk. Answer option C is incorrect. Honeyd is
an example of a low-interaction honeypot.
NEW QUESTION # 99
Which of the following is the full form of SAINT?
- A. System Automated Integrated Network Tool
- B. System Admin Integrated Network Tool
- C. System Administrators Integrated Network Tool
- D. Security Admin Integrated Network Tool
Answer: C
NEW QUESTION # 100
An IDS or IDPS can be deployed in two modes. Which deployment mode allows the IDS to both detect and stop malicious traffic?
- A. passive mode
- B. promiscuous mode
- C. inline mode
- D. firewall mode
Answer: C
NEW QUESTION # 101
Which of the following things need to be identified during attack surface visualization?
- A. Assets, topologies, and policies of the organization
- B. Authentication, authorization, and auditing in networks
- C. Attacker's tools, techniques, and procedures
- D. Regulatory frameworks, standards and, procedures for organizations
Answer: A
Explanation:
During attack surface visualization, it is crucial to identify the assets, topologies, and policies of the organization. This involves mapping out all the devices, paths, networks, and understanding the security posture of each asset. By identifying these elements, organizations can determine where vulnerabilities may exist and how an attacker could potentially exploit them. This process helps in prioritizing security efforts and mitigating risks effectively.
NEW QUESTION # 102
Which of the following is a maintenance protocol that permits routers and host computers to swap basic control information when data is sent from one computer to another?
- A. SNMP
- B. IGMP
- C. ICMP
- D. BGP
Answer: C
NEW QUESTION # 103
Which of the following forms of recognition of the sender can inform the data receiver of all segments that have arrived successfully?
- A. the cumulative reset
- B. with block
- C. None
- D. negative acknowledgment
- E. selective acknowledgment
Answer: E
NEW QUESTION # 104
Which of the following features is used to generate spam on the Internet by spammers and worms?
- A. SMTP relay
- B. AutoComplete
- C. Server Message Block (SMB) signing
- D. AutoFill
Answer: A
NEW QUESTION # 105
Which event type indicates a significant problem such as loss of data or loss of functionality?
- A. Warning
- B. Failure Audit
- C. Error
- D. Information
Answer: C
Explanation:
In the context of network security and event management, an 'Error' event type typically indicates a significant problem that could result in loss of data or loss of functionality. These events are logged when a system or application experiences a severe issue that prevents it from continuing normal operation. Unlike warnings or informational events, error events suggest a critical condition that may require immediate attention to prevent further damage or data loss.
NEW QUESTION # 106
Which of the following is the standard protocol that provides VPN security at the highest level?
- A. IPSec
- B. PPP
- C. None
- D. P.M
- E. L2TP
Answer: A
NEW QUESTION # 107
Alex is administering the firewall in the organization's network. What command will he use to check all the remote addresses and ports in numerical form?
- A. netstat -o
- B. netstat -an
- C. netstat -a
- D. netstat -ao
Answer: B
NEW QUESTION # 108
Choose the correct order of steps to analyze the attack surface.
- A. Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface
- B. Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface
- C. Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface
- D. Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface
Answer: B
Explanation:
The correct order of steps to analyze the attack surface begins with identifying the indicators of exposure. This step involves recognizing the elements within the system that could potentially be exploited by threats. Following this, the attack surface is visualized to understand the scope and scale of potential attack vectors. Next, a simulation of the attack is conducted to assess the effectiveness of the current security measures and identify any vulnerabilities. Finally, the attack surface is reduced by implementing measures to mitigate the identified risks and vulnerabilities, thereby enhancing the overall security posture.
NEW QUESTION # 109
If an organization has decided to consume PaaS Cloud service model, then identify the organization's responsibility that they need to look after based on shared responsibility model.
- A. Data, interfaces, application, middleware, OS, VM, virtual network, etc.
- B. Data, interfaces, application, middleware, OS, VM, virtual network, hypervisors, processing and memory, data storage, network interfaces, facilities and data centers, etc.
- C. Data, interfaces, application, etc.
- D. Data, interfaces, etc.
Answer: C
Explanation:
In the PaaS (Platform as a Service) cloud service model, the cloud provider manages the infrastructure, including network, servers, operating systems, and storage. The organization's responsibility is primarily at the application level, which includes the data, interfaces, and the applications themselves. This means the organization must ensure the security and compliance of their data, manage the applications they develop or deploy, and handle the interfaces that connect their applications to other services or users. References: The Certified Network Defender (CND) course by EC-Council discusses the shared responsibility model in cloud services, emphasizing the division of responsibilities between the cloud provider and the consumer123.
NEW QUESTION # 110
Which of the following tools examines a system for a number of known weaknesses and alerts the administrator?
- A. COPS
- B. SAINT
- C. Nessus
- D. SATAN
Answer: A
NEW QUESTION # 111
Which of the following can be used to disallow a system/user from accessing all applications except a specific folder on a system?
- A. Internet zone rule
- B. Hash rule
- C. Certificate rule
- D. Path rule
Answer: B
NEW QUESTION # 112
How is application whitelisting different from application blacklisting?
- A. It rejects all applications other than the allowed applications
- B. It allows all applications other than the undesirable applications
- C. It allows execution of untrusted applications in an isolated environment
- D. It allows execution of trusted applications in a unified environment
Answer: A
Explanation:
Application whitelisting is a security approach that allows only pre-approved applications to execute within a system or network. This method operates on a 'default deny' principle, meaning if an application is not explicitly listed as approved, it will not be allowed to run. This is in contrast to application blacklisting, which operates on a 'default allow' principle where all applications are allowed to run unless they have been specifically identified as malicious or undesirable and added to a blacklist. Whitelisting is generally considered more secure because it prevents any unapproved applications from running, which can include new or unknown threats. However, it can be more challenging to maintain as it requires a comprehensive understanding of all the necessary applications for business operations.
References: The concept of application whitelisting and its differentiation from blacklisting is well-documented in cybersecurity literature and aligns with the guidelines provided by the EC-Council's Certified Network Defender (CND) program. It is also supported by various cybersecurity frameworks and best practices, including those from authoritative sources such as the National Institute of Standards and Technology (NIST).
NEW QUESTION # 113
You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
- A. Cookies folder
- B. Temporary Internet Folder
- C. Download folder
- D. History folder
Answer: A,B,D
Explanation:
Online e-mail systems such as Hotmail and Yahoo leave files containing e-mail message information on the local computer. These files are stored in a number of folders, which are as follows: Cookies folder Temp folder History folder Cache folder Temporary Internet Folder Forensic tools can recover these folders for the respective e-mail clients. When folders are retrieved, e-mail files can be accessed. If the data is not readable, various tools are available to decrypt the information such as a cookie reader used with cookies. Answer option D is incorrect. Download folder does not contain any e-mail message information.
NEW QUESTION # 114
Which of the following is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic?
- A. Hping
- B. Nmap
- C. NetRanger
- D. PSAD
Answer: D
Explanation:
PSAD is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic. It includes many signatures from the IDS to detect probes for various backdoor programs such as EvilFTP, GirlFriend, SubSeven, DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS). If it is combined with fwsnort and the Netfilter string match extension, it detects most of the attacks described in the Snort rule set that involve application layer data. Answer option C is incorrect. NetRanger is the complete network configuration and information toolkit that includes the following tools: a Ping tool, Trace Route tool, Host Lookup tool, Internet time synchronizer, Whois tool, Finger Unix hosts tool, Host and port scanning tool, check multiple POP3 mail accounts tool, manage dialup connections tool, Quote of the day tool, and monitor Network Settings tool. These tools are integrated in order to use an application interface with full online help. NetRanger is designed for both new and experienced users. This tool is used to help diagnose network problems and to get information about users, hosts, and networks on the Internet or on a user computer network. NetRanger uses multi-threaded and multi-connection technologies in order to be very fast and efficient. Answer option D is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.
NEW QUESTION # 115
Sam wants to implement a network-based IDS and finalizes an IDS solution that works based on pattern matching. Which type of network-based IDS is Sam implementing?
- A. Stateful protocol analysis
- B. Anomaly-based IDS
- C. Behavior-based IDS
- D. Signature-based IDS
Answer: D
NEW QUESTION # 116
Which of the following is a windows in-built feature that provides filesystem-level encryption in the OS (starting from Windows 2000). except the Home version of Windows?
- A. EFS
- B. FileVault
- C. Bit Locker
- D. Disk Utility
Answer: A
NEW QUESTION # 117
Choose the correct order of steps to analyze the attack surface.
- A. Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface
- B. Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface
- C. Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface
- D. Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface
Answer: D
NEW QUESTION # 118
......
The EC-Council Certified Network Defender (CND) certification is an industry-recognized credential that validates a candidate’s abilities to protect, detect, and respond to network security threats. EC-Council Certified Network Defender CND certification program introduces the candidates to the latest methodologies and techniques in network defense, which are essential to secure the network infrastructure. To earn the EC-Council Certified Network Defender (CND) designation, candidates need to pass the EC-Council 312-38 exam, which is a challenging test of their network security skills.
Pass EC-COUNCIL 312-38 exam - questions - convert Tets Engine to PDF: https://pass4sures.freepdfdump.top/312-38-valid-torrent.html
