Latest Verified & Correct EC-COUNCIL 312-38 Questions & Answers Daily Updated
100% Pass Guaranteed Download Certified Ethical Hacker Exam PDF Q&A
EC-Council 312-38 Exam Syllabus Topics:
| Topic | Details | Weights |
|---|---|---|
| Secure Firewall Configuration and Management | - Understanding firewalls - Understanding firewall security concerns - Describing various firewall technologies - Describing firewall topologies - Appropriate selection of firewall topologies - Designing and configuring firewall ruleset - Implementation of firewall policies - Explaining the deployment and implementation of firewall - Factors to considers before purchasing any firewall solution - Describing the configuring, testing and deploying of firewalls - Describing the management, maintenance and administration of firewall implementation - Understanding firewall logging - Measures for avoiding firewall evasion - Understanding firewall security best practices | 8% |
| Physical Security | - Understanding physical security - Importance of physical security - Factors affecting physical security - Describing various physical security controls - Understanding the selection of Fire Fighting Systems - Describing various access control authentication techniques - Understanding workplace security - Understanding personnel security - Describing Environmental Controls - Importance of physical security awareness and training | 6% |
| Network Traffic Monitoring and Analysis | - Understanding network traffic monitoring - Importance of network traffic monitoring - Discussing techniques used for network monitoring and analysis - Appropriate position for network monitoring - Connection of network monitoring system with managed switch - Understanding network traffic signatures - Baselining for normal traffic - Disusing the various categories of suspicious traffic signatures - Various techniques for attack signature analysis - Understanding Wireshark components, working and features - Demonstrating the use of various Wireshark filters - Demonstrating the monitoring LAN traffic against policy violation - Demonstrating the security monitoring of network traffic - Demonstrating the detection of various attacks using Wireshark - Discussing network bandwidth monitoring and performance improvement | 9% |
| Network Risk and Vulnerability Management | - Understanding risk and risk management - Key roles and responsibilities in risk management - Understanding Key Risk Indicators (KRI) in risk management - Explaining phase involves in risk management - Understanding enterprise network risk management - Describing various risk management frameworks - Discussing best practices for effective implementation of risk management - Understanding vulnerability management - Explaining various phases involve in vulnerability management - Understanding vulnerability assessment and its importance - Discussing requirements for effective network vulnerability assessment - Discussing internal and external vulnerability assessment - Discussing steps for effective external vulnerability assessment - Describing various phases involve in vulnerability assessment - Selection of appropriate vulnerability assessment tool - Discussing best practices and precautions for deploying vulnerability assessment tool - Describing vulnerability reporting, mitigation, remediation and verification | 9% |
| Wireless Network Defense | - Understanding wireless network - Discussing various wireless standards - Describing various wireless network topologies - Describing possible use of wireless networks - Explaining various wireless network components - Explaining wireless encryption (WEP, WPA,WPA2) technologies - Describing various authentication methods for wireless networks - Discussing various types of threats on wireless networks - Creation of inventory for wireless network components - Appropriate placement of wireless Access Point (AP) - Appropriate placement of wireless antenna - Monitoring of wireless network traffic - Detection and locating of rogue access points - Prevention of wireless network from RF interference - Describing various security implications for wireless network | 6% |
| Secure VPN Configuration and Management | - Understanding Virtual Private Network (VPN) and its working - Importance of establishing VPN - Describing various VPN components - Describing implementation of VPN concentrators and its functions - Explaining different types of VPN technologies - Discussing components for selecting appropriate VPN technology - Explaining core functions of VPN - Explaining various topologies for implementation of VPN - Discussing various VPN security concerns - Discussing various security implications to ensure VPN security and performance | 6% |
| Computer Network and Defense Fundamentals | - Understanding computer network - Describing OSI and TCP/IP network Models - Comparing OSI and TCP/IP network Models - Understanding different types of networks - Describing various network topologies - Understanding various network components - Explaining various protocols in TCP/IP protocol stack - Explaining IP addressing concept - Understanding Computer Network Defense (CND) - Describing fundamental CND attributes - Describing CND elements - Describing CND process and Approaches | 5% |
| Host Security | - Understanding host security - Understanding the importance of securing individual hosts - Understanding threats specific to hosts - Identifying paths to host threats - Purpose of host before assessment - Describing host security baselining - Describing OS security baselining - Understanding and describing security requirements for different types of servers - Understanding security requirements for hardening of routers - Understanding security requirements for hardening of switches - Understanding data security concerns when data is at rest, in use, and in motion - Understanding virtualization security | 7% |
NEW QUESTION 12
Which of the following standards is a proposed enhancement to the 802.11a and 802.11b wireless LAN
(WLAN) specifications that offers quality of service (QoS) features, including the prioritization of data, voice,
and video transmissions?
- A. 802.11h
- B. 802.11e
- C. 802.15
- D. 802.11n
Answer: B
Explanation:
The 802.11e standard is a proposed enhancement to the 802.11a and 802.11b wireless LAN (WLAN)
specifications. It offers quality of service (QoS) features, including the prioritization of data, voice, and video
transmissions. 802.11e enhances the 802.11 Media Access Control layer (MAC layer) with a coordinated time
division multiple access (TDMA) construct, and adds error-correcting mechanisms for delay-sensitive
applications such as voice and video. Answer option D is incorrect. 802.11h refers to the amendment added to
the IEEE 802.11 standard for Spectrum and Transmit Power Management Extensions.
Answer option B is incorrect. 802.11n is an amendment to the IEEE 802.11-2007 wireless networking standard
to improve network throughput over the two previous standards - 802.11a and 802.11g - with a significant
increase in the maximum raw data rate from 54 Mbit/s to 600 Mbit/s with the use of four spatial streams at a
channel width of 40 MHz. Answer option A is incorrect. IEEE 802.15 is a working group of the IEEE 802 and
specializes in Wireless PAN (Personal Area Network) standards. It includes seven task groups, which are as
follows:
1.Task group 1 (WPAN/Bluetooth)
2.Task group 2 (Coexistence)
3.Task group 3 (High Rate WPAN)
4.Task group 4 (Low Rate WPAN)
5.Task group 5 (Mesh Networking)
6.Task Group 6 (BAN)
7.Task group 7 (VLC)
NEW QUESTION 13
Which of the following systems is formed by a group of honeypots?
- A. Production honeypot
- B. Honeynet
- C. Research honeypot
- D. Honeyfarm
Answer: B
NEW QUESTION 14
FILL BLANK
Fill in the blank with the appropriate term.
______________ is an enumeration technique used to glean information about computer systems on a
network and the services running its open ports.
Answer:
Explanation:
Banner grabbing
Explanation:
Banner grabbing is an enumeration technique used to glean information about computer systems on a network
and the services running its open ports. Administrators can use this to take inventory of the systems and
services on their network. An intruder however can use banner grabbing in order to find network hosts that are
running versions of applications and operating systems with known exploits.
Some examples of service ports used for banner grabbing are those used by Hyper Text Transfer Protocol
(HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP); ports 80, 21, and 25
respectively. Tools commonly used to perform banner grabbing are Telnet, which is included with most
operating systems, and Netcat.
For example, one could establish a connection to a target host running a Web service with netcat, then send a
bad html request in order to get information about the service on the host:
[root@prober] nc www.targethost.com 80
HEAD / HTTP/1.1
HTTP/1.1 200 OK
Date: Mon, 11 May 2009 22:10:40 EST
Server: Apache/2.0.46 (Unix) (Red Hat/Linux)
Last-Modified: Thu, 16 Apr 2009 11:20:14 PST
ETag: "1986-69b-123a4bc6"
Accept-Ranges: bytes
Content-Length: 1110
Connection: close
Content-Type: text/html
The administrator can now catalog this system or an intruder now knows what version of Apache to look for
exploits.
NEW QUESTION 15
Which of the following network scanning tools is a TCP/UDP port scanner that works as a ping sweeper and
hostname resolver?
- A. Hping
- B. Netstat
- C. Nmap
- D. SuperScan
Answer: D
Explanation:
SuperScan is a TCP/UDP port scanner. It also works as a ping sweeper and hostname resolver. It can ping a
given range of IP addresses and resolve the host name of the remote system.
The features of SuperScan are as follows:
It scans any port range from a built-in list or any given range.
It performs ping scans and port scans using any IP range.
It modifies the port list and port descriptions using the built in editor.
It connects to any discovered open port using user-specified "helper" applications.
It has the transmission speed control utility.
Answer option D is incorrect. Nmap is a free open-source utility for network exploration and security auditing. It
is used to discover computers and services on a computer network, thus creating a "map" of the network. Just
like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be
able to determine various details about the remote computers. These include operating system, device type,
uptime, software product used to run a service, exact version number of that product, presence of some
firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux,
Microsoft Windows, etc.
Answer option C is incorrect. Netstat (network statistics) is a command-line tool that displays network
connections (both incoming and outgoing), routing tables, and a number of network interface statistics. It is
available on Unix, Unix-like, and Windows NT-based operating systems. It is used to find problems on the
network and to determine the amount of traffic on the network as a performance measurement.
Answer option A is incorrect. Hping is a free packet generator and analyzer for the TCP/IP protocol. Hping is
one of the de facto tools for security auditing and testing of firewalls and networks. The new version of hping,
hping3, is scriptable using the Tcl language and implements an engine for string based, human readable
description of TCP/IP packets, so that the programmer can write scripts related to low level TCP/IP packet
manipulation and analysis in very short time. Like most tools used in computer security, hping is useful to both
system administrators and crackers (or script kiddies).
NEW QUESTION 16
Which of the following IEEE standards operates at 2.4 GHz bandwidth and transfers data at a rate of 54 Mbps?
- A. 802.11r
- B. 802.11g
- C. 802.11a
- D. 802.11n
Answer: B
NEW QUESTION 17
Which of the following types of coaxial cable used for cable television and cable modems?
- A. RG-59
- B. RG-8
- C. RG-62
- D. RG-58
- E. None
Answer: A
NEW QUESTION 18
CORRECT TEXT
Fill in the blank with the appropriate term. The_______________ is typically considered as the top InfoSec officer in the organization and helps in maintaining current and appropriate body of knowledge required to perform InfoSec management functions.
Answer:
Explanation:
CISO
Explanation:
The Chief InfoSec Officer (CISO) is typically considered as the top InfoSec officer in the organization, though the CISO is usually not an executive-level position and commonly reports to the CIO. Following are the job competencies for the Chief InfoSec Officer (CISO): Maintaining current & appropriate body of knowledge required to perform InfoSec management functionsEffectively applying InfoSec management knowledge for improving security of open network and associated systems and services Maintaining working knowledge of external legislative & regulatory initiativesInterpreting and translating requirements for implementationDeveloping appropriate InfoSec policies, standards, guidelines, and proceduresProviding meaningful input, preparing effective presentations, and communicating InfoSec objectivesParticipating in short and long term planning
NEW QUESTION 19
John has successfully remediated the vulnerability of an internal application that could have caused a threat to the network. He is scanning the application for the existence of a remediated vulnerability, this process is called a __________ and it has to adhere to the __________.
- A. Mitigation, Security policies
- B. Vulnerability scanning, Risk Analysis
- C. Verification, Security Policies
- D. Risk analysis, Risk matrix
Answer: D
NEW QUESTION 20
Which of the following modems offers wireless communication under water?
- A. Optical modem
- B. Controllerless modem
- C. Short haul modem
- D. Acoustic modem
Answer: D
NEW QUESTION 21
CORRECT TEXT
Fill in the blank with the appropriate term. A ______________is a block of data that a Web server stores on the client computer.
Answer:
Explanation:
cookie
Explanation:
Cookie is a block of data, which a Web server stores on the client computer. If no expiration date is set for the cookie, it expires when the browser closes. If the expiration date is set for a future date, the cookie will be stored on the client's disk after the session ends. If the expiration date is set for a past date, the cookie is deleted.
Topic 2, Volume B
NEW QUESTION 22
Which of the following steps of the OPSEC process examines each aspect of the planned operation to identify
OPSEC indicators that could reveal critical information and then compare those indicators with the adversary's
intelligence collection capabilities identified in the previous action?
- A. Analysis of Vulnerabilities
- B. Application of Appropriate OPSEC Measures
- C. Assessment of Risk
- D. Analysis of Threats
- E. Identification of Critical Information
Answer: A
Explanation:
OPSEC is a 5-step process that helps in developing protection mechanisms in order to safeguard sensitive
information and preserve essential secrecy.
The OPSEC process has five steps, which are as follows:
1.Identification of Critical Information: This step includes identifying information vitally needed by an adversary,
which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to
protect all classified or sensitive unclassified information.
2.Analysis of Threats: This step includes the research and analysis of intelligence, counter-intelligence, and
open source information to identify likely adversaries to a planned operation.
3.Analysis of Vulnerabilities: It includes examining each aspect of the planned operation to identify OPSEC
indicators that could reveal critical information and then comparing those indicators with the adversary's
intelligence collection capabilities identified in the previous action.
4.Assessment of Risk: Firstly, planners analyze the vulnerabilities identified in the previous action and identify
possible OPSEC measures for each vulnerability. Secondly, specific OPSEC measures are selected for
execution based upon a risk assessment done by the commander and staff.
5.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in
the assessment of risk action or, in the case of planned future operations and activities, includes the measures
in specific OPSEC plans.
NEW QUESTION 23
Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago.
He has focused primarily on securing network devices, firewalls, and traffic traversing in and out of the network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets. What is this type of server called?
- A. SOCKS hsot
- B. Bastion host
- C. Session layer firewall
- D. Edge transport server
Answer: B
NEW QUESTION 24
Which of the following is a type of scam that entices a user to disclose personal information?
- A. Phishing
- B. Sniffing
- C. Smurfing
- D. Spamming
Answer: A
NEW QUESTION 25
Which of the following is used in conjunction with smoke detectors and fire alarm systems to improve and
increase public safety?
- A. Gaseous emission system
- B. Gaseous fire suppression
- C. Fire sprinkler
- D. Fire suppression system
Answer: D
NEW QUESTION 26
Which of the following is a best practice for wireless network security?
- A. Enabling the remote router login
- B. Do not placing packet filter between the AP and the corporate intranet
- C. Using SSID cloaking
- D. Do not changing the default SSID
Answer: C
NEW QUESTION 27
You are advising a school district on disaster recovery plans. In case a disaster affects the main IT centers for the district they will need to be able to work from an alternate location. However, budget is an issue. Which of the following is most appropriate for this client?
- A. Hot site
- B. Off site
- C. Cold site
- D. Warm site
Answer: C
Explanation:
A cold site provides an office space, and in some cases basic equipment. However, you will need to restore your data to that equipment in order to use it. This is a much less expensive solution than the hot site. Answer option C is incorrect. A hot site has equipment installed, configured and ready to use. This may make disaster recovery much faster, but will also be more expensive. And a school district can afford to be down for several hours before resuming IT operations, so the less expensive option is more appropriate. Answer option A is incorrect. A warm site is between a hot and cold site. It has some equipment ready and connectivity ready. However, it is still significantly more expensive than a cold site, and not necessary for this scenario. Answer option D is incorrect. Off site is not any type of backup site terminology.
NEW QUESTION 28
Identify the network topology where each computer acts as a repeater and the data passes from one computer to the other in a single direction until it reaches the destination.
- A. Bus
- B. Star
- C. Mesh
- D. Ring
Answer: D
NEW QUESTION 29
CORRECT TEXT
Fill in the blank with the appropriate term. ______________is a free open-source utility for network exploration and security auditing that is used to discover computers and services on a computer network, thus creating a "map" of the network.
Answer:
Explanation:
Nmap
Explanation:
Nmap is a free open-source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows, etc.
NEW QUESTION 30
Which of the following protocols sends a jam signal when a collision is detected?
- A. CSMA/CD
- B. CSMA/CA
- C. CSMA
- D. ALOHA
Answer: A
NEW QUESTION 31
Which of the following is an intrusion detection system that reads all incoming packets and tries to find suspicious patterns known as signatures or rules?
- A. IPS
- B. NIDS
- C. HIDS
- D. DMZ
Answer: B
Explanation:
A network intrusion detection system (NIDS) is an intrusion detection system that tries to detect malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. A NIDS reads all the incoming packets and tries to find suspicious patterns known as signatures or rules. It also tries to detect incoming shell codes in the same manner that an ordinary intrusion detection systems does. Answer option A is incorrect. A host-based intrusion detection system (HIDS) produces a false alarm because of the abnormal behavior of users and the network. A host-based intrusion detection system (HIDS) is an intrusion detection system that monitors and analyses the internals of a computing system rather than the network packets on its external interfaces. A host-based Intrusion Detection System (HIDS) monitors all or parts of the dynamic behavior and the state of a computer system. HIDS looks at the state of a system, its stored information, whether in RAM, in the file system, log files or elsewhere; and checks that the contents of these appear as expected. Answer option B is incorrect. An intrusion prevention system (IPS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities. When an attack is detected, it can drop the offending packets while still allowing all other traffic to pass. Answer option C is incorrect. A demilitarized zone (DMZ) is a physical or logical subnetwork that contains and exposes external services of an organization to a larger network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network. Hosts in the DMZ have limited connectivity to specific hosts in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external networks, while an intervening firewall controls the traffic between the DMZ servers and the internal network clients. In a DMZ configuration, most computers on the LAN run behind a firewall connected to a public network such as the Internet.
NEW QUESTION 32
Which of the following IP class addresses are not allotted to hosts? Each correct answer represents a complete solution. Choose all that apply.
- A. Class B
- B. Class A
- C. Class E
- D. Class C
- E. Class D
Answer: C,E
Explanation:
Class addresses D and E are not allotted to hosts. Class D addresses are reserved for multicasting, and their address range can extend from 224 to 239. Class E addresses are reserved for experimental purposes. Their addresses range from 240 to 254.
Answer option A is incorrect. Class A addresses are specified for large networks. It consists of up to
16,777,214 client devices (hosts), and their address range can extend from 1 to 126.
Answer option B is incorrect. Class B addresses are specified for medium size networks. It consists of up to
65,534 client devices, and their address range can extend from 128 to 191.
Answer option E is incorrect. Class C addresses are specified for small local area networks (LANs). It consists of up to 245 client devices, and their address range can extend from 192 to 223.
NEW QUESTION 33
FILL BLANK
Fill in the blank with the appropriate term. The ______________is a communication protocol that
communicates information between the network routers and the multicast end stations.
Answer:
Explanation:
IGMP
Explanation:
The Internet Group Management Protocol (IGMP) is a communication protocol that communicates information
between the network routers and the multicast end stations. It allows the receivers to request a multicast data
stream from a specific group address. However, multicast traffic is sent to a single MAC address but is
processed by multiple hosts. The IGMP allows an end station to connect to a multicast group and leave it, while
being connected to the group address. It can be effectively used for gaming and showing online videos.
Although it does not actually act as a transport protocol, it operates above the network layer. It is analogous to
ICMP for unicast connections. It is susceptible to some attacks, so firewalls commonly allow the user to disable
it if not needed.
NEW QUESTION 34
What is the range for private ports?
- A. Above 65535
- B. 49152 through 65535
- C. 0 through 1023
- D. 1024 through 49151
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION 35
Which of the following layers of the OSI model provides physical addressing?
- A. Network layer
- B. Physical layer
- C. Application layer
- D. Data link layer
Answer: D
NEW QUESTION 36
Alex is administrating the firewall in the organization's network. What command will he use to check all the remote addresses and ports in numerical form?
- A. Netstat -a
- B. Netstat -an
- C. Netstat -ao
- D. Netstat -o
Answer: B
NEW QUESTION 37
......
The EC-Council 312-38 test is the required exam for obtaining the Certified Network Defender certification. This certificate covers the individuals’ skills in detecting, responding, and protecting against threats on networks. The candidates interested in this path are required to demonstrate their understanding of data transfer, software technologies, and network technologies. They should be able to use their skills to evaluate the subject material and understand the specific software that should be automated.
This certification exam evaluates the applicants’ competence in various network defense fundamentals, network security application controls, as well as perimeter appliances, protocols, and VPNs. To succeed in the test, you should also have knowledge of firewall configurations, secure IDS, network traffic signature intricacies, vulnerability, and analysis scanning.
312-38 PDF Dumps Are Helpful To produce Your Dreams Correct QA's: https://www.dumpstillvalid.com/312-38-prep4sure-review.html
312-38 Practice Test Dumps with 100% Passing Guarantee: https://drive.google.com/open?id=1aWEr0Os47KT6MmOatOg7RhVo8duofchT
