IT Certification Exam Questions & Answers

Jun-2022 Free EC-COUNCIL 312-38 Exam Question Practice Exams

Ace 312-38 Certification with 171 Actual Questions

Recommended Training

So, let’s focus on the recommended online course for the CND 312-38 validation:

• Certified Network Defender (CND)

  The EC-Council offers one course with a corresponding name to help candidates study for the official 312-38 exam. This is the Certified Network Defender or CND training, which is an intensive, hands-on program that focuses on network security and other similar concepts. As a labor-intensive training that aligns with the latest skills, this class has been reorganized to reflect the current job roles and responsibilities of network administrators. It is intended to prepare candidates for advanced roles in this field by confirming their expertise in risk mitigation. With almost half of the course built around hands-on lab lessons, this program will be a vital tool to help you understand the learning objectives including endpoint protection, application & data protection, network perimeter protection, network defense management, and threat prediction among other skills. It’s worth mentioning that this training also includes three demo videos to help candidates gain a good grasp of the test details. These sections include the CND with Eric Reed, CND Meet Your Instructor, and iLabs Demo. Get the complete package today for $1,899 and validate your skills in the best way, and if you are still wondering what the full package contains, find the whole list below:

  • Official e-courseware (12-month access);
  • Instructor-led training modules (12-month access);
  • iLabs (6-month access);
  • Certificate of completion;
  • Exam voucher.

QUESTION 76
Which of the following recovery plans include specific strategies and actions to address the specific variances assumptions lead to a particular safety problem or emergency situation?

 Business Continuity Plan

 disaster survival plan

 None

 The emergency plan

QUESTION 77
Which of the following is a Unix and Windows tool capable of intercepting traffic on a network segment and capturing username and password?

 AirSnort

 Ettercap

 BackTrack

 Aircrack

Ettercap is a Unix and Windows tool for computer network protocol analysis and security auditing. It is capable of intercepting traffic on a network segment, capturing passwords, and conducting active eavesdropping against a number of common protocols. It is a free open source software. Ettercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis.
Answer option C is incorrect. BackTrack is a Linux distribution distributed as a Live CD, which is used for penetration testing. It allows users to include customizable scripts, additional tools and configurable kernels in personalized distributions. It contains various tools, such as Metasploit integration, RFMON injection capable wireless drivers, kismet, autoscan-network (network discovering and managing application), nmap, ettercap, wireshark (formerly known as Ethereal).
Answer option A is incorrect. AirSnort is a Linux-based WLAN WEP cracking tool that recovers encryption keys. AirSnort operates by passively monitoring transmissions. It uses Ciphertext Only Attack and captures approximately 5 to 10 million packets to decrypt the WEP keys. Answer option D is incorrect. Aircrack is the fastest WEP/WPA cracking tool used for 802.11a/b/g WEP and WPA cracking.

QUESTION 78
Which of the following steps of the OPSEC process examines each aspect of the planned operation to identify
OPSEC indicators that could reveal critical information and then compare those indicators with the adversary’s
intelligence collection capabilities identified in the previous action?

 Analysis of Threats

 Application of Appropriate OPSEC Measures

 Identification of Critical Information

 Analysis of Vulnerabilities

 Assessment of Risk

OPSEC is a 5-step process that helps in developing protection mechanisms in order to safeguard sensitive
information and preserve essential secrecy.
The OPSEC process has five steps, which are as follows:
1.Identification of Critical Information: This step includes identifying information vitally needed by an adversary,
which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to
protect all classified or sensitive unclassified information.
2.Analysis of Threats: This step includes the research and analysis of intelligence, counter-intelligence, and
open source information to identify likely adversaries to a planned operation.
3.Analysis of Vulnerabilities: It includes examining each aspect of the planned operation to identify OPSEC
indicators that could reveal critical information and then comparing those indicators with the adversary’s
intelligence collection capabilities identified in the previous action.
4.Assessment of Risk: Firstly, planners analyze the vulnerabilities identified in the previous action and identify
possible OPSEC measures for each vulnerability. Secondly, specific OPSEC measures are selected for
execution based upon a risk assessment done by the commander and staff.
5.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in
the assessment of risk action or, in the case of planned future operations and activities, includes the measures
in specific OPSEC plans.

QUESTION 79
Which of the following is a worldwide organization that aims to establish, refine, and promote Internet security
standards?

 ANSI

 WASC

 IEEE

 ITU

Web Application Security Consortium (WASC) is a worldwide organization that aims to establish, refine, and
promote Internet security standards. WASC is vendor-neutral, although members may belong to corporations
involved in the research, development, design, and distribution of Web security-related products.
Answer option A is incorrect. ANSI (American National Standards Institute) is the primary organization for
fostering the development of technology standards in the United States. ANSI works with industry groups and
is the U.S. member of the International Organization for Standardization (ISO) and the International Electro-
technical Commission (IEC). Long-established computer standards from ANSI include the American Standard
Code for Information Interchange (ASCII) and the Small Computer System Interface (SCSI).
Answer option D is incorrect. The International Telecommunication Union (ITU) is an organization established
to standardize and regulate international radio and telecommunications. Its main tasks include standardization,
allocation of the radio spectrum, and organizing interconnection arrangements between different countries to
allow international phone calls. ITU sets standards for global telecom networks.
The ITU’s telecommunications division (ITU-T) produces more than 200 standard recommendations each year
in the converging areas of telecommunications, information technology, consumer electronics, broadcasting
and multimedia communications. ITU was streamlined into the following three sectors:
ITU-D (Telecommunication Development)
ITU-R (Radio communication)
ITU-T (Telecommunication Standardization)
Answer option C is incorrect. The Institute of Electrical and Electronic Engineers (IEEE) is a society of technical
professionals. It promotes the development and application of electro-technology and allied sciences. IEEE
develops communications and network standards, among other activities. The organization publishes number
of journals, has many local chapters, and societies in specialized areas.

QUESTION 80
Which of the following layers provides communication session management between host computers?

 Application layer

 Internet layer

 Transport layer

 Link layer

Explanation/Reference:

QUESTION 81
Which of the following is an electronic device that helps in forwarding data packets along networks?

 Router

 Hub

 Repeater

 Gateway

QUESTION 82
Which of the following is a technique for gathering information about a remote network protected by a firewall?

 Firewalking

 Warchalking

 Wardriving

 Wardialing

Fire walking is a technique for gathering information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall. If the firewall allows this crafted packet through, it forwards the packet to the next hop. On the next hop, the packet expires and elicits an ICMP
“TTL expired in transit” message to the attacker. If the firewall does not allow the traffic, there should be no response, or an ICMP “administratively prohibited” message should be returned to the attacker. A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall. The main drawback of this technique is that if an administrator blocks ICMP packets from leaving the network, it is ineffective.
Answer option B is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing and war driving.
Answer option C is incorrect. War driving, also called access point mapping, is the act of locating and possibly exploiting connections to wireless local area networks while driving around a city or elsewhere. To do war driving, one needs a vehicle, a computer (which can be a laptop), a wireless Ethernet card set to work in promiscuous mode, and some kind of an antenna which can be mounted on top of or positioned inside the car.
Because a wireless LAN may have a range that extends beyond an office building, an outside user may be able to intrude into the network, obtain a free Internet connection, and possibly gain access to company records and other resources.
Answer option D is incorrect. War dialing or wardialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems, and fax machines. Hackers use the resulting lists for various purposes, hobbyists for exploration, and crackers – hackers that specialize in computer security – for password guessing.

QUESTION 83
CORRECT TEXT
Fill in the blank with the appropriate word. The primary goal of _________________ risk analysis is to determine the proportion of effect and theoretical response.

qualitative
Explanation:
Qualitative risk analysis uses the likelihood and impact of the identified risks in a fast and cost-effective manner. Qualitative risk analysis establishes a basis for a focused quantitative analysis or risk response plan by evaluating the precedence of risks with a view to impact on the project’s scope, cost, schedule, and quality objectives. Qualitative risk analysis is conducted at any point in a project life cycle. The primary goal of qualitative risk analysis is to determine the proportion of effect and theoretical response. The inputs to the qualitative risk analysis process are as follows: Organizational process assets Project scope statement Risk management plan Risk register

QUESTION 84
Which of the following attacks combines dictionary and brute force attacks?

 Replay attack

 Man-in-the-middle attack

 Hybrid attack

 Phishing attack

QUESTION 85
Which of the following network monitoring techniques requires extra monitoring software or hardware?

 Non-router based

 Switch based

 Hub based

 Router based

QUESTION 86
Jason has set a firewall policy that allows only a specific list of network services and deny everything else.
This strategy is known as a____________.

 Default allow

 Default deny

 Default restrict

 Default access

QUESTION 87
During a security awareness program, management was explaining the various reasons which create threats to network security. Which could be a possible threat to network security?

 Configuring automatic OS updates

 Having a web server in the internal network

 Implementing VPN

 Patch management

QUESTION 88
FILL BLANK
Fill in the blank with the appropriate term. ______________is a free open-source utility for network exploration
and security auditing that is used to discover computers and services on a computer network, thus creating a
“map” of the network.

Nmap
Explanation:
Nmap is a free open-source utility for network exploration and security auditing. It is used to discover
computers and services on a computer network, thus creating a “map” of the network. Just like many simple
port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine
various details about the remote computers. These include operating system, device type, uptime, software
product used to run a service, exact version number of that product, presence of some firewall techniques and,
on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows,
etc.

QUESTION 89
Which of the following network devices operate at the network layer of the OSI model? Each correct answer represents a complete solution. Choose all that apply.

 Router

 Bridge

 Repeater

 Gateway

A router is a device that routes data packets between computers in different networks. It is used to connect multiple networks, and it determines the path to be taken by each data packet to its destination computer. A router maintains a routing table of the available routes and their conditions. By using this information, along with distance and cost algorithms, the router determines the best path to be taken by the data packets to the destination computer. A router can connect dissimilar networks, such as Ethernet, FDDI, and Token Ring, and route data packets among them. Routers operate at the network layer (layer 3) of the Open Systems Interconnection (OSI) model.
A gateway is a network point that acts as an entrance to another network. On the Internet, a node or stopping point can be either a gateway node or a host (end-point) node. Both the computers of Internet users and the computers that serve pages to users are host nodes. The computers that control traffic within a company’s network or at a local Internet service provider (ISP) are gateway nodes. In the network for an enterprise, a computer server acting as a gateway node is often also acting as a proxy server and a firewall server. A gateway is often associated with both a router, which knows where to direct a given packet of data that arrives at the gateway, and a switch, which furnishes the actual path in and out of the gateway for a given packet. Most of the gateways operate at the application layer, but can operate at the network or session layer of the OSI model.
Answer option C is incorrect. A repeater operates only at the physical layer of the OSI model.
Answer option B is incorrect. A bridge operates at the data link layer of the OSI model.

QUESTION 90
Which of the following is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients? Each correct answer represents a complete solution. Choose all that apply.

 E-mail spam

 Junk mail

 Email spoofing

 Email jamming

E-mail spam, also known as unsolicited bulk email (UBE), junk mail, or unsolicited commercial email (UCE), is the practice of sending unwanted e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients. Answer option C is incorrect. Email spoofing is a fraudulent email activity in which the sender address and other parts of the email header are altered to appear as though the email originated from a different source. Email spoofing is a technique commonly used in spam and phishing emails to hide the origin of the email message. By changing certain properties of the email, such as the From, Return-Path and Reply-To fields (which can be found in the message header), ill-intentioned users can make the email appear to be from someone other than the actual sender. The result is that, although the email appears to come from the address indicated in the From field (found in the email headers), it actually comes from another source. Answer option D is incorrect. Email jamming is the use of sensitive words in e-mails to jam the authorities that listen in on them by providing a form of a red herring and an intentional annoyance. In this attack, an attacker deliberately includes “sensitive” words and phrases in otherwise innocuous emails to ensure that these are picked up by the monitoring systems. As a result the senders of these emails will eventually be added to a “harmless” list and their emails will be no longer intercepted, hence it will allow them to regain some privacy.

QUESTION 91
Which of the following is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic?

 Nmap

 Hping

 NetRanger

 PSAD

PSAD is a tool that runs on the Windows OS and analyzes iptables log messages to detect port scans and other suspicious traffic. It includes many signatures from the IDS to detect probes for various backdoor programs such as EvilFTP, GirlFriend, SubSeven, DDoS tools (mstream, shaft), and advanced port scans (FIN, NULL, XMAS). If it is combined with fwsnort and the Netfilter string match extension, it detects most of the attacks described in the Snort rule set that involve application layer data. Answer option C is incorrect. NetRanger is the complete network configuration and information toolkit that includes the following tools: a Ping tool, Trace Route tool, Host Lookup tool, Internet time synchronizer, Whois tool, Finger Unix hosts tool, Host and port scanning tool, check multiple POP3 mail accounts tool, manage dialup connections tool, Quote of the day tool, and monitor Network Settings tool. These tools are integrated in order to use an application interface with full online help. NetRanger is designed for both new and experienced users. This tool is used to help diagnose network problems and to get information about users, hosts, and networks on the Internet or on a user computer network. NetRanger uses multi-threaded and multi-connection technologies in order to be very fast and efficient. Answer option B is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol. Hping is one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping, hping3, is scriptable using the Tcl language and implements an engine for string based, human readable description of TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both system administrators and crackers (or script kiddies). Answer option A is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a “map” of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.

QUESTION 92
James was inspecting ARP packets in his organization’s network traffic with the help of Wireshark. He is checking the volume of traffic containing ARP requests as well as the source IP address from which they are originating. Which type of attack is James analyzing?

 ARP Sweep

 ARP misconfiguration

 ARP spoofinq

 ARP Poisioning

QUESTION 93
Which characteristic of an antenna refers to how directional an antennas radiation pattern is?

 Radiation pattern

 Polarization

 Directivity

 Typical gain

QUESTION 94
Which of the following standards have been proposed for the improvement of 802.11a and 802.11b wireless local area network (WLAN) specifications, which provides a quality of service (QoS) features, such as the prioritization of data, voice and video transmissions?

 None

 802.15

 802.11h

 802.11n

 802.11e

QUESTION 95
Choose the correct order of steps to analyze the attack surface.

 Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface

 Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface

 Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface

 Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface

QUESTION 96
Which of the following is a network maintenance protocol of the TCP/IP protocol suite that is responsible for the resolution of IP addresses to media access control (MAC) addresses of a network interface card (NIC)?

 DHCP

 ARP

 PIM

 RARP

Address Resolution Protocol (ARP) is a network maintenance protocol of the TCP/IP protocol suite. It is responsible for the resolution of IP addresses to media access control (MAC) addresses of a network interface card (NIC). The ARP cache is used to maintain a correlation between a MAC address and its corresponding IP address. ARP provides the protocol rules for making this correlation and providing address conversion in both directions. ARP is limited to physical network systems that support broadcast packets.
Answer option A is incorrect. The Dynamic Host Configuration Protocol (DHCP) is a computer networking protocol used by hosts (DHCP clients) to retrieve IP address assignments and other configuration information.
DHCP uses a client-server architecture. The client sends a broadcast request for configuration information.
The DHCP server receives the request and responds with configuration information from its configuration database. In the absence of DHCP, all hosts on a network must be manually configured individually – a time- consuming and often error-prone undertaking. DHCP is popular with ISP’s because it allows a host to obtain a temporary IP address.
Answer option D is incorrect. Reverse Address Resolution Protocol (RARP) is a Network layer protocol used to obtain an IP address for a given hardware (MAC) address. RARP is sort of the reverse of an ARP. Common protocols that use RARP are BOOTP and DHCP.
Answer option C is incorrect. Protocol-Independent Multicast (PIM) is a family of multicast routing protocols for Internet Protocol (IP) networks that provide one-to-many and many-to-many distribution of data over a LAN, WAN, or the Internet. It is termed protocol-independent because PIM does not include its own topology discovery mechanism, but instead uses routing information supplied by other traditional routing protocols, such as Border Gateway Protocol (BGP).

QUESTION 97
CORRECT TEXT
Fill in the blank with the appropriate term. ______________________ is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed.

Network reconnaissance
Explanation:
Network reconnaissance is typically carried out by a remote attacker attempting to gain information or access to a network on which it is not authorized or allowed. Network reconnaissance is increasingly used to exploit network standards and automated communication methods. The aim is to determine what types of computers are present, along with additional information about those computers such as the type and version of the operating system. This information can be analyzed for known or recently discovered vulnerabilities that can be exploited to gain access to secure networks and computers. Network reconnaissance is possibly one of the most common applications of passive data analysis. Early generation techniques, such as TCP/IP passive fingerprinting, have accuracy issues that tended to make it ineffective. Today, numerous tools exist to make reconnaissance easier and more effective.

QUESTION 98
FILL BLANK
Fill in the blank with the appropriate term. A ______________ is a set of tools that take Administrative control
of a computer system without authorization by the computer owners and/or legitimate managers.

rootkit
Explanation:
A rootkit is a set of tools that take Administrative control of a computer system without authorization by the
computer owners and/or legitimate managers. A rootkit requires root access to be installed in the Linux
operating system, but once installed, the attacker can get root access at any time. Rootkits have the following
features:
They allow an attacker to run packet sniffers secretly to capture passwords.
They allow an attacker to set a Trojan into the operating system and thus open a backdoor for anytime access.
They allow an attacker to replace utility programs that can be used to detect the attacker’s activity.
They provide utilities for installing Trojans with the same attributes as legitimate programs.

 Loading …

Understanding functional and technical aspects of Certified Network Defender Business Principles and Practices

The following will be discussed in ECCOUNCIL EC 312-38 exam dumps:

• Discuss Security Measures for IoT-enabled Environments
• Discuss the security in IoT-enabled Environments
• Discuss the implementation of Encryption of “Data at transit” between browser and web server
• Discuss Windows Active Directory Security Best Practices
• Understand Window OS and Security Concerns
• Discuss Windows Patch Management
• Discuss and refer various standards, Initiatives and Efforts for IoT Security
• Discus Network Virtualization (NV) Security
• Understand Data Security and its Importance
• Discuss and implement various enterprise-level mobile security management Solutions
• Discuss User Access Management
• Discuss Various Windows Security Features
• Discuss Windows security baseline configurations
• Discuss the implementation of Encryption of “Data at transit” in Email Delivery
• Discuss Security Guidelines, recommendations and best practices for Dockers
• Discuss Windows Network Services and Protocol Security
• Discus OS Virtualization Security
• Discuss Windows OS Security Hardening Techniques
• Discuss Data Destruction Concepts
• Understand IoT Ecosystem and Communication models
• Discuss Network Function Virtualization (NFV) Security
• Discuss Security Guidelines, recommendations and best practices for Kubernetes
• Understand IoT Devices, their need, and Application Areas
• Discuss the implementation of encryption of “Data at rest”
• Discuss Data Masking ConceptsDiscuss data backup and retention
• Discuss Security Guidelines, recommendations and best practices for Containers
• Understand Security Challenges and risks associated with IoT-enabled environments
• Discuss Security guidelines and tools for Android devices
• Discuss the Security Risk and challenges associated with Enterprises mobile usage policies
• Discuss the implementation of Encryption of “Data at transit”
• Discuss IoT Security Tools and Best Practices
• Discuss the implementation of data access controls
• Discuss Windows Security Components
• Data Loss Prevention(DLP) Concepts Understand Virtualization Essential Concepts
• Discuss Software-Defined Network (SDN) Security
• Discuss the implementation of Encryption of “Data at transit” between database server and web server
• Discuss Security guidelines and tools for iOS devices
• Discuss Windows User Account and Password Management

EC-Council CND Exam Certification Details:

312-38 Questions PDF [2022] Use Valid New dump to Clear Exam: https://www.it-tests.com/312-38.html

         

Related Links: myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt