Free Sample Questions to Practice 312-38 Certification Test Engine [Oct-2024]
2024 Valid 312-38 Real Exam Questions, practice Certified Ethical Hacker
The EC-Council Certified Network Defender (CND) certification exam is a globally recognized certification that validates the candidate’s ability to protect, detect, and respond to network security threats. EC-Council Certified Network Defender CND certification is ideal for network administrators, IT professionals, security officers, and anyone looking to enhance their knowledge and skills in network security. EC-Council Certified Network Defender CND certification exam covers both theory and practical exercises to ensure that the candidate has the necessary skills and knowledge to defend against network security threats. Passing the EC-Council CND certification exam is a significant achievement for any cybersecurity professional and opens up numerous career opportunities.
NEW QUESTION # 20
DRAG DROP
Drag and drop the terms to match with their descriptions.
Answer:
Explanation:
Explanation:
Following are the terms with their descriptions:
A Trojan horse is a malicious software program that contains hidden code and masquerades itself as a normal program. When a Trojan horse program is run, its hidden code runs to destroy or scramble data on the hard disk. An example of a Trojan horse is a program that masquerades as a computer logon to retrieve user names and password information. The developer of a Trojan horse can use this information later to gain unauthorized access to computers. Trojan horses are normally spread by e-mail attachments. Ping sweep is a technique used to determine which of a range of IP addresses map to live hosts. It consists of ICMP ECHO requests sent to multiple hosts. If a given address is live, it will return an ICMP ECHO reply. A ping is often used to check that a network device is functioning. To disable ping sweeps on a network, administrators can block ICMP ECHO requests from outside sources. However, ICMP TIMESTAMP and ICMP INFO can be used in a similar manner. Spamware is software designed by or for spammers to send out automated spam e-mail. Spamware is used to search for e-mail addresses to build lists of e-mail addresses to be used either for spamming directly or to be sold to spammers. The spamware package also includes an e-mail harvesting tool. A backdoor is any program that allows a hacker to connect to a computer without going through the normal authentication process. The main advantage of this type of attack is that the network traffic moves from inside a network to the hacker's computer. The traffic moving from inside a network to the outside world is typically the least restrictive, as companies are more concerned about what comes into a network, rather than what leaves it. It, therefore, becomes hard to detect backdoors.
NEW QUESTION # 21
Which type of modulation technique is used in local area wireless networks (LAWNs)?
- A. OFDM
- B. DSSS
- C. MIMO-OFDM
- D. FHSS
Answer: A
Explanation:
Local Area Wireless Networks (LAWNs), commonly known as Wireless LANs (WLANs), typically use Orthogonal Frequency-Division Multiplexing (OFDM) as the modulation technique. OFDM is a method of encoding digital data on multiple carrier frequencies. It is known for its efficiency in carrying high data rates over radio waves and its robustness against narrowband interference and frequency-selective fading due to multipath. This makes OFDM a suitable choice for LAWN environments where such conditions are prevalent.
NEW QUESTION # 22
Nancy is working as a network administrator for a small company. Management wants to implement a RAID storage for their organization. They want to use the appropriate RAID level for their backup plan that will satisfy the following requirements:
1. It has a parity check to store all the information about the data in multiple drives
2. Help reconstruct the data during downtime.
3. Process the data at a good speed.
4. Should not be expensive.
The management team asks Nancy to research and suggest the appropriate RAID level that best suits their requirements. What RAID level will she suggest?
- A. RAID 1
- B. RAID 10
- C. RAID 3.
- D. RAID 0
Answer: C
NEW QUESTION # 23
Which of the following help in estimating and totaling up the equivalent money value of the benefits and costs to the community of projects for establishing whether they are worthwhile?
Each correct answer represents a complete solution. Choose all that apply.
- A. Cost-benefit analysis
- B. Benefit-Cost Analysis
- C. Disaster recovery
- D. Business Continuity Planning
Answer: A,B
NEW QUESTION # 24
Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago.
He has focused primarily on securing network devices, firewalls, and traffic traversing in and out of the network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets. What is this type of server called?
- A. SOCKS hsot
- B. Session layer firewall
- C. Edge transport server
- D. Bastion host
Answer: D
Explanation:
The server described in the question is known as a Bastion host. A Bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. It is typically placed in a network's demilitarized zone (DMZ) and acts as a proxy server, offering limited services and filtering packets to protect the internal private network from the public network. It is hardened due to its exposure to potential attacks and usually hosts a single application, like a proxy server, while all other services are removed or limited to reduce the threat surface1.
References: The definition and role of a Bastion host align with the objectives and documents of the EC-Council's Certified Network Defender (CND) course, which emphasizes the importance of securing network devices and managing traffic between internal and external networks1
NEW QUESTION # 25
Which among the following options represents professional hackers with an aim of attacking systems for profit?
- A. Cyber terrorists
- B. Hacktivists
- C. Organized hackers
- D. Script kiddies
Answer: C
Explanation:
Organized hackers are professional cybercriminals who often work in groups and are motivated by financial gain. They are known for their skills and the ability to carry out sophisticated attacks on systems for profit. Unlike script kiddies, who lack advanced skills and typically use readily available tools, organized hackers use custom-developed tools and methods. Hacktivists are motivated by political or social causes, and cyber terrorists aim to use cyber attacks to create fear or political change, not necessarily for profit.
NEW QUESTION # 26
Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?
- A. Application whitelisting
- B. Application sandboxing
- C. Deployment of WAFS
- D. Application blacklisting
Answer: B
Explanation:
Application sandboxing is a security mechanism that helps prevent the execution of untrusted or untested programs or code from untrusted or unverified third-parties. It does this by running such programs in a restricted environment, known as a sandbox, where they have limited access to files and system resources.
This containment ensures that any malicious code or behavior is isolated from the host system, thereby protecting it from potential harm. Sandboxing is a proactive security measure that can significantly reduce the attack surface and mitigate the risk of security breaches.
References: The concept of application sandboxing is covered in the Certified Network Defender (CND) course, which discusses various strategies for protecting networks and systems, including the use of sandboxing to contain and control the execution of potentially harmful code12.
NEW QUESTION # 27
Which of the following technologies can be used to leverage zero-trust model security?
- A. Network visualization (NV)
- B. Network function visualization (NFV)
- C. Software defined networking (SDN)
- D. Software defined perimeter (SDP)
Answer: D
Explanation:
The zero-trust model is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access. The Software Defined Perimeter (SDP) aligns with this model by creating a dynamic, context-aware, and secure boundary around network resources. SDP controls access to resources based on identity, authentication, and authorization, ensuring that only authenticated and authorized users or systems can access the services they require. This approach minimizes the attack surface by hiding network resources from unauthorized or unauthenticated users, which is a core principle of zero-trust security.
NEW QUESTION # 28
What is the best way to describe a mesh network topology?
- A. A network in which every computer meshes together to form a hybrid between a star and bus topology.
- B. A network in which every computer in the network can communicate with a single central computer.
- C. A network that is extremely cost efficient, offering the best option for allowing computers to communicate amongst each other.
- D. A network in which every computer in the network has a connection to each and every computer in the network.
Answer: D
NEW QUESTION # 29
Which of the following is a type of computer security that deals with protection against spurious signals emitted by electrical equipment in the system?
- A. Physical security
- B. Emanation Security
- C. Hardware security
- D. Communication Security
Answer: B
Explanation:
Emanation security is one of the types of computer security that deals with protection against spurious signals emitted by electrical equipment in the system, such as electromagnetic emission (from displays), visible emission (displays may be visible through windows), and audio emission (sounds from printers, etc). Answer option D is incorrect. Hardware security helps in dealing with the vulnerabilities in the handling of hardware. Answer option B is incorrect. Physical security helps in dealing with protection of computer hardware and associated equipment. Answer option A is incorrect. Communication security helps in dealing with the protection of data and information during transmission.
NEW QUESTION # 30
Which of the following is a network maintenance protocol of the TCP/IP protocol suite that is responsible for the resolution of IP addresses to media access control (MAC) addresses of a network interface card (NIC)?
- A. DHCP
- B. PIM
- C. RARP
- D. ARP
Answer: D
Explanation:
Address Resolution Protocol (ARP) is a network maintenance protocol of the TCP/IP protocol suite. It is responsible for the resolution of IP addresses to media access control (MAC) addresses of a network interface card (NIC). The ARP cache is used to maintain a correlation between a MAC address and its corresponding IP address. ARP provides the protocol rules for making this correlation and providing address conversion in both directions. ARP is limited to physical network systems that support broadcast packets. Answer option A is incorrect. The Dynamic Host Configuration Protocol (DHCP) is a computer networking protocol used by hosts (DHCP clients) to retrieve IP address assignments and other configuration information. DHCP uses a client-server architecture. The client sends a broadcast request for configuration information. The DHCP server receives the request and responds with configuration information from its configuration database. In the absence of DHCP, all hosts on a network must be manually configured individually - a time-consuming and often error-prone undertaking. DHCP is popular with ISP's because it allows a host to obtain a temporary IP address. Answer option D is incorrect. Reverse Address Resolution Protocol (RARP) is a Network layer protocol used to obtain an IP address for a given hardware (MAC) address. RARP is sort of the reverse of an ARP. Common protocols that use RARP are BOOTP and DHCP. Answer option C is incorrect. Protocol-Independent Multicast (PIM) is a family of multicast routing protocols for Internet Protocol (IP) networks that provide one-to-many and many-to-many distribution of data over a LAN, WAN, or the Internet. It is termed protocol-independent because PIM does not include its own topology discovery mechanism, but instead uses routing information supplied by other traditional routing protocols, such as Border Gateway Protocol (BGP).
Topic 3, Volume C
NEW QUESTION # 31
Identify the minimum number of drives required to setup RAID level 5.
- A. 0
- B. 1
- C. 2
- D. Multiple
Answer: A
NEW QUESTION # 32
Identity the correct order for a successful black hat operation.
- A. Reconnaissance. Scanning, Gaining Access. Maintaining Access, and Covering Tracks
- B. Reconnaissance. Gaming Access, Scanning. Maintaining Access, and Covering Tracks
- C. Scanning, Reconnaissance, Gaining Access. Maintaining Access and Covering Tracks
- D. Reconnaissance, Scanning, Gaining Access, Covering Tracks, and Maintaining Access
Answer: A
NEW QUESTION # 33
CORRECT TEXT
Fill in the blank with the appropriate term. A______________________ network is a local area network (LAN) in which all computers are connected in a ring or star topology and a bit- or token-passing scheme is used for preventing the collision of data between two computers that want to send messages at the same time.
Answer:
Explanation:
Token Ring
Explanation:
A Token Ring network is a local area network (LAN) in which all computers are connected in a ring or star topology and a bit- or token-passing scheme is used in order to prevent the collision of data between two computers that want to send messages at the same time. The Token Ring protocol is the second most widely-used protocol on local area networks after Ethernet. The IBM Token Ring protocol led to a standard version, specified as IEEE 802.5. Both protocols are used and are very similar. The IEEE 802.5 Token Ring technology provides for data transfer rates of either 4 or 16 megabits per second. Working: Empty information frames are constantly circulated on the ring. When a computer has a message to send, it adds a token to an empty frame and adds a message and a destination identifier to the frame. The frame is then observed by each successive workstation. If the workstation sees that it is the destination for the message, it copies the message from the frame and modifies the token back to 0.When the frame gets back to the originator, it sees that the token has been modified to 0 and that the message has been copied and received. It removes the message from the particular frame.The frame continues to circulate as an empty frame, ready to be taken by a workstation when it has a message to send.
NEW QUESTION # 34
Kyle is an IT consultant working on a contract for a large energy company in Houston. Kyle was hired on to do contract work three weeks ago so the company could prepare for an external IT security audit. With suggestions from upper management, Kyle has installed a network-based IDS system. This system checks for abnormal behavior and patterns found in network traffic that appear to be dissimilar from the traffic normally recorded by the IDS. What type of detection is this network-based IDS system using?
- A. This network-based IDS is utilizing definition-based detection.
- B. This system is using misuse detection.
- C. This network-based IDS system is using dissimilarity algorithms.
- D. This network-based IDS system is using anomaly detection.
Answer: D
Explanation:
Anomaly detection in network-based Intrusion Detection Systems (IDS) involves establishing a baseline of normal behavior for the network or system and then monitoring for deviations from this baseline. The IDS analyzes traffic patterns, system performance, user behavior, and other metrics to detect anomalies that could indicate a potential security breach. This method is particularly effective for identifying new or unknown threats that do not match any known signatures or definitions. By focusing on irregular patterns rather than predefined signatures, anomaly detection can provide early warnings of malicious activities that might otherwise go unnoticed.
References: The concept of anomaly detection within IDS is discussed in various cybersecurity resources, including academic publications and industry guides, which align with the ECCouncil's Network Defender (CND) objectives and documents1234.
NEW QUESTION # 35
Emmanuel works as a Windows system administrator at an MNC. He uses PowerShell to enforce the script execution policy. He wants to allow the execution of the scripts that are signed by a trusted publisher. Which of the following script execution policy setting this?
- A. AllSigned
- B. Unrestricted
- C. RemoteSigned
- D. Restricted
Answer: A
Explanation:
The AllSigned execution policy in PowerShell requires that all scripts and configuration files be signed by a trusted publisher, including scripts that you write on the local computer. This setting is used when you want to ensure that only scripts that have been examined and signed by a trusted authority are run on your systems, which helps protect against the execution of unauthorized or malicious scripts. When using the AllSigned execution policy, PowerShell will prompt the user to confirm that they trust the signer before running any script.
References: This information aligns with the PowerShell documentation and best practices for script execution policies, which recommend the AllSigned policy for environments that require a high level of security12.
NEW QUESTION # 36
You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:
What is the IP address of the sender of this email?
- A. 209.191.91.180
- B. 141.1.1.1
- C. 216.168.54.25
- D. 172.16.10.90
Answer: C
Explanation:
The IP address of the sender of this email is 216.168.54.25. According to the scenario, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. Once you start to analyze the email header, you get an entry entitled as X-Originating-IP. You know that in Yahoo, the X-Originating-IP is the IP address of the email sender and in this case, the required IP address is 216.168.54.25. Answer options A, C, and B are incorrect. All these are the IP addresses of the Yahoo and Wetpaint servers.
NEW QUESTION # 37
Which of the following is a distributed application architecture that partitions tasks or work loads between service providers and service requesters?Each correct answer represents a complete solution. Choose all that apply.
- A. Client-server computing
- B. Peer-to-peer (P2P) computing
- C. Peer-to-peer networking
- D. Client-server networking
Answer: A,D
Explanation:
Client-server networking is also known as client-server computing. It is a distributed application architecture that partitions tasks or work loads between service providers (servers) and service requesters, called clients. Often clients and servers operate over a computer network on separate hardware. A server machine is a high-performance host that is running one or more server programs which share its resources with clients. A client does not share any of its resources, but requests a server's content or service function. Clients therefore initiate communication sessions with servers which await (listen to) incoming requests. Answer options D and B are incorrect. Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or workloads between peers. Peers are equally privileged, equipotent participants in the application. They are said to form a peer-to-peer network of nodes. Peer-to-peer networking (also known simply as peer networking) differs from client-server networking, where certain devices have the responsibility to provide or "serve" data, and other devices consume or otherwise act as "clients" of those servers.
NEW QUESTION # 38
Which of following are benefits of using loT devices in loT-enabled environments? I. loT device car be connected anytime M. loT device can be connected at any place ill. loT devices connected to anything
- A. II
- B. I and II
- C. I, II and III
- D. I
Answer: C
Explanation:
The benefits of using IoT devices in IoT-enabled environments encompass the ability to connect devices anytime, anywhere, and to anything. This means that IoT devices can be connected and communicate with each other and the internet 24/7 (I), from any location (II), and can be integrated with various systems and applications (III). These capabilities enable a wide range of functionalities, such as remote monitoring, data collection, and control of devices across different environments, leading to improved efficiency, convenience, and decision-making.
NEW QUESTION # 39
Which of the following layers provides communication session management between host computers?
- A. Application layer
- B. Transport layer
- C. Internet layer
- D. Link layer
Answer: B
NEW QUESTION # 40
Geon Solutions INC., had only 10 employees when it started. But as business grew, the organization had to increase the amount of staff. The network administrator is finding it difficult to accommodate an increasing number of employees in the existing network topology. So the organization is planning to implement a new topology where it will be easy to accommodate an increasing number of employees. Which network topology will help the administrator solve the problem of needing to add new employees and expand?
- A. Star
- B. Ring
- C. Mesh
- D. Bus
Answer: A
Explanation:
The star topology is the most suitable for accommodating an increasing number of employees because it allows for easy addition of new nodes or computers without disrupting the existing network. In a star topology, each node is independently connected to a central hub. If a new employee is added, they can be connected to the hub without affecting the other nodes. This topology also simplifies troubleshooting, as each connection can be individually assessed without taking down the entire network. Furthermore, the star topology is known for its scalability and robustness, making it ideal for a growing company like Geon Solutions INC.
NEW QUESTION # 41
Which of the following attacks is a class of brute force attacks that depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations?
- A. Birthday attack
- B. Dictionary attack
- C. Phishing attack
- D. Replay attack
Answer: A
Explanation:
A birthday attack is a class of brute force attacks that exploits the mathematics behind the birthday problem in probability theory. It is a type of cryptography attack. The birthday attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations.
Answer option D is incorrect. A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities. A dictionary attack uses a brute-force technique of successively trying all the words in an exhaustive list (from a pre- arranged list of values). In contrast with a normal brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words in a dictionary. Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries, or simple, easily-predicted variations on words, such as appending a digit.
Answer option A is incorrect. Phishing is a type of internet fraud attempted by hackers. Hackers try to log into system by masquerading as a trustworthy entity and acquire sensitive information, such as, username, password, bank account details, credit card details, etc. After collecting this information, hackers try to use this information for their gain.
Answer option B is incorrect. A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution.
NEW QUESTION # 42
Which of the following IEEE standards defines a physical bus topology?
- A. 802.4
- B. 802.3
- C. 802.6
- D. 802.5
Answer: A
NEW QUESTION # 43
You are tasked to perform black hat vulnerability assessment for a client. You received official written permission to work with: company site, forum, Linux server with LAMP, where this site is hosted.
Which vulnerability assessment tool should you consider using?
- A. hping
- B. wireshark
- C. dnsbrute
- D. OpenVAS
Answer: D
Explanation:
OpenVAS stands out as the most suitable tool for conducting a vulnerability assessment on a Linux server with LAMP. It is a full-featured vulnerability scanner that's actively maintained and updated, capable of detecting thousands of vulnerabilities in network services and software. For a black hat vulnerability assessment, which implies testing from the perspective of a potential attacker, OpenVAS can simulate attacks on the network services running on the LAMP stack and identify vulnerabilities that could be exploited.
NEW QUESTION # 44
......
Genuine 312-38 Exam Dumps Free Demo Valid QA's: https://selftestengine.testkingit.com/EC-COUNCIL/latest-312-38-exam-dumps.html