Certified Ethical Hacker 312-38 Real Exam Questions and Answers FREE Updated on Dec 29, 2021
312-38 Ultimate Study Guide - Prep4sures
What is the duration, language, and format of Certified Network Defender
- No negative marking for wrong answers
- Number of Questions: 40
- Passing score: 200
- Type of Questions: Multiple choice (MCQs), multiple answers
- Duration of Exam: 90 minutes
- Language of Exam: English, Japanese, Korean.
NEW QUESTION 26
Which of the following types of cyberstalking damages the reputation of their victim and turns other people against them by setting up their own Websites, blogs, or user pages for this purpose?
- A. Encouraging others to harass the victim
- B. Attempts to gather information about the victim
- C. False victimization
- D. False accusation
Answer: D
Explanation:
In false accusations, many cyberstalkers try to damage the reputation of their victim and turn other people against them. They post false information about them on Websites. They may set up their own Websites, blogs, or user pages for this purpose. They post allegations about the victim to newsgroups, chat rooms, or other sites that allow public contributions.
Answer option D is incorrect. In false victimization, the cyberstalker claims that the victim is harassing him/her.
Answer option C is incorrect. In this type of cyberstalking, many cyberstalkers try to involve third parties in the harassment. They claim that the victim has harmed the stalker in some way, or may post the victim's name and telephone number in order to encourage others to join the pursuit.
Answer option B is incorrect. In an attempt to gather information, cyberstalkers may approach their victim's friends, family, and work colleagues to obtain personal information. They may advertise for information on the Internet. They often will monitor the victim's online activities and attempt to trace their IP address in an effort to gather more information about their victims.
NEW QUESTION 27
Which of the following is a congestion control mechanism that is designed for unicast flows operating in an Internet environment and competing with TCP traffic?
- A. Additive increase/multiplicative-decrease
- B. Sliding Window
- C. Selective Acknowledgment
- D. TCP Friendly Rate Control
Answer: D
Explanation:
TCP-Friendly Rate Control (TFRC) is a congestion control mechanism that is designed for unicast flows operating in an Internet environment and competing with TCP traffic. Its goal is to compete fairly with TCP traffic on medium timescales, but to be much less variable than TCP on short timescales. TCP congestion control works by maintaining a window of packets that have not yet been acknowledged. This window is increased by one packet every round-trip time if no packets have been lost, and is decreased by half if a packet loss is detected. Thus, TCP's window is a function of the losses observed in the network and the round trip time experienced by the flow. The idea behind TFRC is to measure the loss probability and round trip time and to use these as the parameters to a model of TCP throughput. The expected throughput from this model is then used to directly drive the transmit rate of a TFRC flow.
Answer option D is incorrect. The additive increase/multiplicative-decrease (AIMD) algorithm is a feedback control algorithm used in TCP Congestion Avoidance. Its major goal is to achieve fairness and efficiency in allocating resources. AIMD combines linear growth of the congestion window with an exponential reduction when congestion takes place. The approach taken is to increase the transmission rate (window size), probing for usable bandwidth, until loss occurs. The policy of additive increase may, for instance, increase the congestion window by 1 MSS (Maximum segment size) every RTT (Round Trip Time) until a loss is detected. When loss is detected, the policy is changed to be one of multiplicative decrease, which may, for instance, cut the congestion window in half after the loss. A loss event is generally described to be either a timeout or the event of receiving 3 duplicate ACKs. Answer option C is incorrect. Selective Acknowledgment (SACK) is one of the forms of acknowledgment. With selective acknowledgments, the sender can be informed by a data receiver about all segments that have arrived successfully, so the sender retransmits only those segments that have actually been lost. The selective acknowledgment extension uses two TCP options: The first is an enabling option, "SACK-permitted", which may be sent in a SYN segment to indicate that the SACK option can be used once the connection is established. The other is the SACK option itself, which can be sent over an established connection once permission has been given by "SACK-permitted". Answer option A is incorrect. Sliding Window Protocols are a feature of packet-based data transmission protocols. They are used where reliable in-order delivery of packets is required, such as in the data link layer (OSI model) as well as in TCP. Conceptually, each portion of the transmission (packets in most data link layers, but bytes in TCP) is assigned a unique consecutive sequence number, and the receiver uses the numbers to place received packets in the correct order, discarding duplicate packets and identifying missing ones. The problem with this is that there is no limit of the size of the sequence numbers that can be required.
NEW QUESTION 28
Daniel is giving training on designing and implementing a security policy in the organization. He is explaining the hierarchy of the security policy which demonstrates how policies are drafted, designed and implemented.
What is the correct hierarchy for a security policy implementation?
- A. Laws, Regulations, Policies, Standards and Procedures
- B. Regulations, Policies, Laws, Standards and Procedures
- C. Laws, Policies, Regulations, Procedures and Standards
- D. Procedures, Policies, Laws, Standards and Regulations
Answer: A
NEW QUESTION 29
You are a professional Computer Hacking forensic investigator. You have been called to collect evidences of buffer overflow and cookie snooping attacks. Which of the following logs will you review to accomplish the task? Each correct answer represents a complete solution. Choose all that apply.
- A. Event logs
- B. Program logs
- C. Web server logs
- D. System logs
Answer: A,B,D
Explanation:
Evidences of buffer overflow and cookie snooping attacks can be traced from system logs, event logs, and program logs, depending on the type of overflow or cookie snooping attack executed and the error recovery method used by the hacker.
Answer option B is incorrect. Web server logs are used to investigate cross-site scripting attacks.
NEW QUESTION 30
Which of the following is a management process that provides a framework to stimulate a rapid recovery, and the ability to react effectively to protect the interests of its brand, reputation and stakeholders?
- A. log analysis
- B. Business Continuity Management
- C. patch management
- D. None
- E. response systems
Answer: B
NEW QUESTION 31
Identify the password cracking attempt involving precomputed hash values stored as plaintext and used to crack the password.
- A. Bruteforce
- B. Dictionary
- C. Hybrid
- D. Rainbow table
Answer: D
NEW QUESTION 32
The company has implemented a backup plan. James is working as a network administrator for the company and is taking full backups of the data every time a backup is initiated. Alex who is a senior security manager talks to him about using a differential backup instead and asks him to implement this once a full backup of the data is completed. What is/are the reason(s) Alex is suggesting that James use a differential backup?
(Select all that apply)
- A. Father restoration
- B. Less expensive than full backup
- C. Faster than a full backup
- D. Slower than a full backup
- E. Less storage space is required
Answer: C,E
NEW QUESTION 33
Which of the following layers of the OSI model provides interhost communication?
- A. Session layer
- B. Application layer
- C. Transport layer
- D. Network layer
Answer: A
NEW QUESTION 34
Which of the following layers of the TCP/IP model maintains data integrity by ensuring that messages are delivered in the order in which they are sent and that there is no loss or duplication?
- A. Internet layer
- B. Application layer
- C. Transport layer
- D. Link layer
Answer: C
Explanation:
Explanation
Explanation:
The transport layer ensures that messages are delivered in the order in which they are sent and that there is no loss or duplication. Transport layer maintains data integrity.
Answer option C is incorrect. The Internet Layer of the TCP/IP model solves the problem of sending packets across one or more networks. Internetworking requires sending data from the source network to the destination network. This process is called routing. IP can carry data for a number of different upper layer protocols.
Answer option B is incorrect. The Link Layer of TCP/IP model is the networking scope of the local network connection to which a host is attached. This is the lowest component layer of the Internet protocols, as TCP/IP is designed to be hardware independent. As a result, TCP/IP has been implemented on top of virtually any hardware networking technology in existence. The Link Layer is used to move packets between the Internet Layer interfaces of two different hosts on the same link. The processes of transmitting and receiving packets on a given link can be controlled both in the software device driver for the network card, as well as on firmware or specialized chipsets.
Answer option D is incorrect. The Application Layer of TCP/IP model refers to the higher-level protocols used by most applications for network communication. Examples of application layer protocols include the File Transfer Protocol (FTP) and the Simple Mail Transfer Protocol (SMTP). Data coded according to application layer protocols are then encapsulated into one or more transport layer protocols, which in turn use lower layer protocols to affect actual data transfer.
NEW QUESTION 35
In an Ethernet peer-to-peer network, which of the following cables is used to connect two computers, using RJ-45 connectors and Category-5 UTP cable?
- A. Crossover
- B. Parallel
- C. Serial
- D. Loopback
Answer: A
Explanation:
In an Ethernet peer-to-peer network, a crossover cable is used to connect two computers, using
RJ-45 connectors and Category-5 UTP cable.
Answer options D and A are incorrect. Parallel and serial cables do not use RJ-45 connectors and
Category-5 UTP cable. Parallel cables are used to connect printers, scanners etc., to computers,
whereas serial cables are used to connect modems, digital cameras etc., to computers.
Answer option B is incorrect. A loopback cable is used for testing equipments.
NEW QUESTION 36
Simon had all his systems administrators implement hardware and software firewalls to ensure network security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker group was able to get into the network and modify files hosted on the company's website. After searching through the firewall and server logs, no one could find how the attackers were able to get in. He decides that the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts administrators when a critical file is altered. What tool could Simon and his administrators implement to accomplish this?
- A. Snort is the best tool for their situation
- B. They need to use Nessus
- C. They can implement Wireshark
- D. They could use Tripwire
Answer: D
NEW QUESTION 37
In which of the following attacks do computers act as zombies and work together to send out bogus messages, thereby increasing the amount of phony traffic?
- A. Bonk attack
- B. DDoS attack
- C. Buffer-overflow attack
- D. Smurf attack
Answer: B
Explanation:
In the distributed denial of service (DDOS) attack, an attacker uses multiple computers throughout the network that it has previously infected. Such computers act as zombies and work together to send out bogus messages, thereby increasing the amount of phony traffic. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track down and shut down. TFN, TRIN00, etc. are tools used for the DDoS attack. Answer option A is incorrect. A Smurf attack is a type of attack that uses third-party intermediaries to defend against, and get back to the originating system. In a Smurf attack, a false ping packet is forwarded by the originating system. The broadcast address of the third-party network is the packet's destination. Hence, each machine on the third-party network has a copy of the ping request. The victim system is the originator. The originator rapidly forwards a large number of these requests via different intermediary networks. The victim gets overwhelmed by these large number of requests. Answer option B is incorrect. A buffer-overflow attack is performed when a hacker fills a field, typically an address bar, with more characters than it can accommodate. The excess characters can be run as executable code, effectively giving the hacker control of the computer and overriding any security measures set. There are two main types of buffer overflow attacks: stack-based buffer overflow attack: Stack-based buffer overflow attack uses a memory object known as a stack. The hacker develops the code which reserves a specific amount of space for the stack. If the input of user is longer than the amount of space reserved for it within the stack, then the stack will overflow. heap-based buffer overflow attack: Heap-based overflow attack floods the memory space reserved for the programs. Answer option D is incorrect. Bonk attack is a variant of the teardrop attack that affects mostly Windows computers by sending corrupt UDP packets to DNS port 53. It is a type of denial-ofservice (DoS) attack. A bonk attack manipulates a fragment offset field in TCP/IP packets. This field tells a computer how to reconstruct a packet that was fragmented, because it is difficult to transmit big packets. A bonk attack causes the target computer to reassemble a packet that is too big to be reassembled and causes the target computer to crash.
NEW QUESTION 38
Which of the following commands is used for port scanning?
- A. nc -t
- B. nc -z
- C. nc -v
- D. nc -d
Answer: B
NEW QUESTION 39
Which of the following IEEE standards operates at 2.4 GHz bandwidth and transfers data at a rate of 54 Mbps?
- A. 802.11r
- B. 802.11g
- C. 802.11n
- D. 802.11a
Answer: B
NEW QUESTION 40
A newly joined network administrator wants to assess the organization against possible risk. He notices the organization doesn't have a __________ identified which helps measure how risky an activity is.
- A. Key Risk Indicator
- B. Risk Severity
- C. Risk levels
- D. Risk Matrix
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 41
Who is an IR custodian?
- A. An individual responsible for conveying company details after an incident
- B. An individual responsible for the remediation and resolution of the incident that occurred
- C. An individual who makes a decision on the classifications and the severity of the incident identified
- D. An individual who receives the initial IR alerts and leads the IR team in all the IR activities
Answer: D
NEW QUESTION 42
Which of the following is a symmetric 64-bit block cipher that can support key lengths up to 448 bits?
- A. BLOWFISH
- B. IDEA
- C. XOR
- D. HAVAL
Answer: A
NEW QUESTION 43
In an Ethernet peer-to-peer network, which of the following cables is used to connect two computers, using RJ-
45 connectors and Category-5 UTP cable?
- A. Crossover
- B. Parallel
- C. Serial
- D. Loopback
Answer: A
Explanation:
In an Ethernet peer-to-peer network, a crossover cable is used to connect two computers, using RJ-45 connectors and Category-5 UTP cable. Answer options C and B are incorrect. Parallel and serial cables do not use RJ-45 connectors and Category-5 UTP cable. Parallel cables are used to connect printers, scanners etc., to computers, whereas serial cables are used to connect modems, digital cameras etc., to computers.
Answer option A is incorrect. A loopback cable is used for testing equipments.
NEW QUESTION 44
......
Ultimate Guide to Prepare 312-38 Certification Exam for Certified Ethical Hacker: https://www.prep4sures.top/312-38-exam-dumps-torrent.html
Use Real 312-38 Dumps - EC-COUNCIL Correct Answers: https://drive.google.com/open?id=1wZf-dGLI3TvWnfgA2_Fnjd83-COBicY9