[Oct 11, 2023] TorrentVCE 312-38 dumps & Certified Ethical Hacker sure practice dumps
EC-COUNCIL 312-38 Actual Questions and Braindumps
Prerequisites
The potential candidates must fulfill one of two options of eligibility criteria for this certification exam. The first thing is to complete the official training course, which can be taken as instructor-led training, academic learning, or online live training. The second variant is to opt for self-study. However, those who want to consider this option must have a minimum of two years of practical work experience in the domain of Information Technology. They should also have educational background that indicates a specialization in this area. To demonstrate this, they must submit a filled eligibility application form and pay the non-refundable application fee of $100.
Before you start the registration process, you should check if you qualify as one of the target audiences for this path. The intended candidates for EC-Council 312-38 are the security operators, network administrators, security analysts, network defense technicians, network security engineers, network security administrators, as well as any professionals who work with network operations.
EC-COUNCIL 312-38 certification exam is a valuable credential for those who are interested in pursuing a career in network security. EC-Council Certified Network Defender CND certification demonstrates to employers that the candidate has a deep understanding of network security and is capable of defending against common network attacks. The EC-COUNCIL 312-38 certification exam is also a valuable credential for those who are interested in pursuing further certifications in network security, such as the Certified Ethical Hacker (CEH) or Certified Network Security Professional (CNSP) certifications.
EC-Council 312-38 Exam Syllabus Topics:
| Topic | Details | Weights |
|---|---|---|
| Computer Network and Defense Fundamentals | - Understanding computer network - Describing OSI and TCP/IP network Models - Comparing OSI and TCP/IP network Models - Understanding different types of networks - Describing various network topologies - Understanding various network components - Explaining various protocols in TCP/IP protocol stack - Explaining IP addressing concept - Understanding Computer Network Defense (CND) - Describing fundamental CND attributes - Describing CND elements - Describing CND process and Approaches | 5% |
| Host Security | - Understanding host security - Understanding the importance of securing individual hosts - Understanding threats specific to hosts - Identifying paths to host threats - Purpose of host before assessment - Describing host security baselining - Describing OS security baselining - Understanding and describing security requirements for different types of servers - Understanding security requirements for hardening of routers - Understanding security requirements for hardening of switches - Understanding data security concerns when data is at rest, in use, and in motion - Understanding virtualization security | 7% |
| Network Security Controls, Protocols, and Devices | - Understanding fundamental elements of network security - Explaining network access control mechanism - Understanding different types of access controls - Explaining network Authentication, Authorization and Auditing (AAA) mechanism - Explaining network data encryption mechanism - Describing Public Key Infrastructure (PKI) - Describing various network security protocols - Describing various network security devices | 8% |
| Network Security Threats, Vulnerabilities, and Attacks | - Understanding threat, attack, and vulnerability - Discussing network security concerns - Reasons behind network security concerns - Effect of network security breach on business continuity - Understanding different types of network threats - Understanding different types of network security vulnerabilities - Understanding different types of network attacks - Describing various network attacks | 5% |
| Network Traffic Monitoring and Analysis | - Understanding network traffic monitoring - Importance of network traffic monitoring - Discussing techniques used for network monitoring and analysis - Appropriate position for network monitoring - Connection of network monitoring system with managed switch - Understanding network traffic signatures - Baselining for normal traffic - Disusing the various categories of suspicious traffic signatures - Various techniques for attack signature analysis - Understanding Wireshark components, working and features - Demonstrating the use of various Wireshark filters - Demonstrating the monitoring LAN traffic against policy violation - Demonstrating the security monitoring of network traffic - Demonstrating the detection of various attacks using Wireshark - Discussing network bandwidth monitoring and performance improvement | 9% |
| Network Security Policy Design and Implementation | - Understanding security policy - Need of security policies - Describing the hierarchy of security policy - Describing the characteristics of a good security policy - Describing typical content of security policy - Understanding policy statement - Describing steps for creating and implementing security policy - Designing of security policy - Implementation of security policy - Describing various types of security policy - Designing of various security policies - Discussing various information security related standards, laws and acts | 6% |
| Secure VPN Configuration and Management | - Understanding Virtual Private Network (VPN) and its working - Importance of establishing VPN - Describing various VPN components - Describing implementation of VPN concentrators and its functions - Explaining different types of VPN technologies - Discussing components for selecting appropriate VPN technology - Explaining core functions of VPN - Explaining various topologies for implementation of VPN - Discussing various VPN security concerns - Discussing various security implications to ensure VPN security and performance | 6% |
| Secure IDS Configuration and Management | - Understanding different types of intrusions and their indications - Understanding IDPS - Importance of implementing IDPS - Describing role of IDPS in network defense - Describing functions, components, and working of IDPS - Explaining various types of IDS implementation - Describing staged deployment of NIDS and HIDS - Describing fine-tuning of IDS by minimizing false positive and false negative rate - Discussing characteristics of good IDS implementation - Discussing common IDS implementation mistakes and their remedies - Explaining various types of IPS implementation - Discussing requirements for selecting appropriate IDSP product - Technologies complementing IDS functionality | 8% |
NEW QUESTION # 53
Which of the following are the various methods that a device can use for logging information on a Cisco router?
Each correct answer represents a complete solution. Choose all that apply.
- A. SNMP logging
- B. Console logging
- C. Buffered logging
- D. NTP logging
- E. Terminal logging
- F. Syslog logging
Answer: A,B,C,E,F
Explanation:
There are different methods that a device can use for logging information on a Cisco router:
Terminal logging: In this method, log messages are sent to the VTY session.
Console logging: In this method, log messages are sent directly to the console port.
Buffered logging: In this method, log messages are kept in the RAM on the router. As the buffer fills, the older
messages are overwritten by the newer messages.
Syslog logging: In this method, log messages are sent to an external syslog server where they are stored and
sorted.
SNMP logging: In this method, log messages are sent to an SNMP server in the network.
Answer option C is incorrect. This is an invalid option.
NEW QUESTION # 54
Which of the following can be performed with software or hardware devices in order to record everything a
person types using his or her keyboard?
- A. War dialing
- B. Keystroke logging
- C. Warchalking
- D. IRC bot
Answer: B
Explanation:
Keystroke logging is a method of logging and recording user keystrokes. It can be performed with software or
hardware devices. Keystroke logging devices can record everything a person types using his or her keyboard,
such as to measure employee's productivity on certain clerical tasks. These types of devices can also be used
to get usernames, passwords, etc.
Answer option C is incorrect. War dialing is a technique of using a modem to automatically scan a list of
telephone numbers, usually dialing every number in a local area code to search for computers, BBS systems,
and fax machines. Hackers use the resulting lists for various purposes, hobbyists for exploration, and crackers
(hackers that specialize in computer security) for password guessing.
Answer option A is incorrect. Warchalking is the drawing of symbols in public places to advertise an open Wi-Fi
wireless network. Having found a Wi-Fi node, the warchalker draws a special symbol on a nearby object, such
as a wall, the pavement, or a lamp post. The name warchalking is derived from the cracker terms war dialing
and war driving.
Answer option D is incorrect. An Internet Relay Chat (IRC) bot is a set of scripts or an independent program
that connects to Internet Relay Chat as a client, and so appears to other IRC users as another user. An IRC
bot differs from a regular client in that instead of providing interactive access to IRC for a human user, it
performs automated functions.
NEW QUESTION # 55
Which of the following flag to set whether the scan sends TCP Christmas tree frame with the remote machine? Each correct answer represents a part of the solution. Choose all that apply.
- A. PUSH
- B. RST
- C. FIN
- D. URG
Answer: A,C,D
NEW QUESTION # 56
Which of the following is also known as stateful firewall?
- A. Stateless firewall
- B. DMZ
- C. Dynamic packet-filtering firewall
- D. PIX firewall
Answer: C
NEW QUESTION # 57
Which of the following is a protocol that describes an approach to providing "streamlined" support of OSI application services on top of TCP/IP-based networks for some constrained environments?
- A. Lightweight Presentation Protocol
- B. Network News Transfer Protocol
- C. Dynamic Host Configuration Protocol
- D. Internet Relay Chat Protocol
Answer: A
NEW QUESTION # 58
Which of the following routing metrics refers to the time required to transfer the package to the source via the Internet?
- A. length of the trail
- B. None
- C. bandwidth
- D. charge
- E. routing delay
Answer: E
NEW QUESTION # 59
Which of the following attacks is a class of brute force attacks that depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations?
- A. Dictionary attack
- B. Replay attack
- C. Birthday attack
- D. Phishing attack
Answer: C
Explanation:
A birthday attack is a class of brute force attacks that exploits the mathematics behind the birthday problem in probability theory. It is a type of cryptography attack. The birthday attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations.
Answer option D is incorrect. A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities. A dictionary attack uses a brute-force technique of successively trying all the words in an exhaustive list (from a pre- arranged list of values). In contrast with a normal brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words in a dictionary. Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries, or simple, easily-predicted variations on words, such as appending a digit.
Answer option A is incorrect. Phishing is a type of internet fraud attempted by hackers. Hackers try to log into system by masquerading as a trustworthy entity and acquire sensitive information, such as, username, password, bank account details, credit card details, etc. After collecting this information, hackers try to use this information for their gain.
Answer option B is incorrect. A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution.
NEW QUESTION # 60
Which of the following layers performs routing of IP datagrams?
- A. Application layer
- B. Link layer
- C. Internet layer
- D. Transport layer
Answer: C
Explanation:
Explanation
NEW QUESTION # 61
Which of the following steps of the OPSEC process examines each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then compare those indicators with the adversary's intelligence collection capabilities identified in the previous action?
- A. Application of Appropriate OPSEC Measures
- B. Analysis of Threats
- C. Assessment of Risk
- D. Identification of Critical Information
- E. Analysis of Vulnerabilities
Answer: E
Explanation:
OPSEC is a 5-step process that helps in developing protection mechanisms in order to safeguard sensitive information and preserve essential secrecy. The OPSEC process has five steps, which are as follows: 1.Identification of Critical Information: This step includes identifying information vitally needed by an adversary, which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to protect all classified or sensitive unclassified information. 2.Analysis of Threats: This step includes the research and analysis of intelligence, counterintelligence, and open source information to identify likely adversaries to a planned operation. 3.Analysis of Vulnerabilities: It includes examining each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then comparing those indicators with the adversary's intelligence collection capabilities identified in the previous action. 4.Assessment of Risk: Firstly, planners analyze the vulnerabilities identified in the previous action and identify possible OPSEC measures for each vulnerability. Secondly, specific OPSEC measures are selected for execution based upon a risk assessment done by the commander and staff. 5.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in the assessment of risk action or, in the case of planned future operations and activities, includes the measures in specific OPSEC plans.
NEW QUESTION # 62
How many layers are present in the OSI layer model?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION # 63
In which of the following attacks does an attacker successfully insert an intermediary software or program between two communicating hosts?
- A. Denial-of-Service
- B. Session hijacking
- C. Man-in-the-middle
- D. Buffer overflow
Answer: C
Explanation:
Man-in-the-middle attacks occur when an attacker successfully inserts an intermediary software or program between two communicating hosts. The intermediary software or program allows attackers to listen to and modify the communication packets passing between the two hosts. The software intercepts the communication packets and then sends the information to the receiving host. The receiving host responds to the software, presuming it to be the legitimate client. Answer option B is incorrect. A Denial-of-Service (DoS) attack is mounted with the objective of causing a negative impact on the performance of a computer or network. It is also known as a network saturation attack or bandwidth consumption attack. Attackers perform DoS attacks by sending a large number of protocol packets to the network. The effects of a DoS attack are as follows: Saturates network resources Disrupts connections between two computers, thereby preventing communications between services Disrupts services to a specific computer Causes failure to access a Web site Results in an increase in the amount of spam A Denial-of-Service attack is very common on the Internet because it is much easier to accomplish. Most of the DoS attacks rely on the weaknesses in the TCP/IP protocol. Answer option D is incorrect. A buffer-overflow attack is performed when a hacker fills a field, typically an address bar, with more characters than it can accommodate. The excess characters can be run as executable code, effectively giving the hacker control of the computer and overriding any security measures set. There are two main types of buffer overflow attacks: stack-based buffer overflow attack: Stack-based buffer overflow attack uses a memory object known as a stack. The hacker develops the code which reserves a specific amount of space for the stack. If the input of user is longer than the amount of space reserved for it within the stack, then the stack will overflow. heap-based buffer overflow attack: Heap-based overflow attack floods the memory space reserved for the programs. Answer option A is incorrect. Session hijacking refers to the exploitation of a valid computer session to gain unauthorized access to information or services in a computer system. In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server. It has particular relevance to Web developers, as the HTTP cookies used to maintain a session on many Web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer (see HTTP cookie theft). TCP session hijacking is when a hacker takes over a TCP session between two machines. Since most authentication only occurs at the start of a TCP session, this allows the hacker to gain access to a machine.
NEW QUESTION # 64
Which of the following statements are NOT true about the FAT16 file system?Each correct answer represents a complete solution. Choose all that apply.
- A. It supports the Linux operating system.
- B. It does not support file-level security.
- C. It supports file-level compression.
- D. It works well with large disks because the cluster size increases as the disk partition size increases.
Answer: C,D
Explanation:
The FAT16 file system was developed for disks larger than 16MB. It uses 16-bit allocation table
entries. The FAT16 file system supports all Microsoft operating systems. It also supports OS/2 and
Linux.
Answer options C and A are incorrect. All these statements are true about the FAT16 file system.
NEW QUESTION # 65
In an Ethernet peer-to-peer network, which of the following cables is used to connect two computers, using RJ-45 connectors and Category-5 UTP cable?
- A. Loopback
- B. Crossover
- C. Serial
- D. Parallel
Answer: B
Explanation:
In an Ethernet peer-to-peer network, a crossover cable is used to connect two computers, using
RJ-45 connectors and Category-5 UTP cable.
Answer options D and A are incorrect. Parallel and serial cables do not use RJ-45 connectors and
Category-5 UTP cable. Parallel cables are used to connect printers, scanners etc., to computers,
whereas serial cables are used to connect modems, digital cameras etc., to computers.
Answer option B is incorrect. A loopback cable is used for testing equipments.
NEW QUESTION # 66
You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:
What is the IP address of the sender of this email?
- A. 172.16.10.90
- B. 216.168.54.25
- C. 141.1.1.1
- D. 209.191.91.180
Answer: B
Explanation:
The IP address of the sender of this email is 216.168.54.25. According to the scenario, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. Once you start to analyze the email header, you get an entry entitled as X-Originating-IP. You know that in Yahoo, the X-Originating-IP is the IP address of the email sender and in this case, the required IP address is 216.168.54.25.
Answer options A, C, and B are incorrect. All these are the IP addresses of the Yahoo and Wetpaint servers.
NEW QUESTION # 67
An organization needs to adhere to the______________rules for safeguarding and protecting the electronically stored health information of employees.
- A. PCI DSS
- B. ISEC
- C. HI PA A
- D. SOX
Answer: C
NEW QUESTION # 68
Which of the following statement holds true in terms of containers?
- A. Container is fully isolated; hence, more secure
- B. Container requires more memory space
- C. Each container runs in its own OS
- D. Process-level isolation happens; a container in hence less secure
Answer: D
NEW QUESTION # 69
Which of the following protocols is used for routing of voice conversation over the Internet?
- A. VoIP
- B. IP
- C. DNS
- D. DHCP
Answer: A
NEW QUESTION # 70
Which of the following types of coaxial cable is used for cable TV and cable modems?
- A. RG-59
- B. RG-62
- C. RG-58
- D. RG-8
Answer: A
Explanation:
RG-59 type of coaxial cable is used for cable TV and cable modems.
Answer option A is incorrect. RG-8 coaxial cable is primarily used as a backbone in an Ethernet LAN environment and often connects one wiring closet to another. It is also known as 10Base5 or ThickNet.
Answer option B is incorrect. RG-62 coaxial cable is used for ARCNET and automotive radio antennas.
Answer option D is incorrect. RG-58 coaxial cable is used for Ethernet networks. It uses baseband signaling and 50-Ohm terminator. It is also known as 10Base2 or ThinNet.
NEW QUESTION # 71
Ivan needs to pick an encryption method that is scalable even though it might be slower. He has settled on a method that works where one key is public and the other is private. What encryption method did Ivan settle on?
- A. Ivan settled on the asymmetric encryption method
- B. Ivan settled on the private encryption method.
- C. Ivan settled on the symmetric encryption method.
- D. Ivan settled on the hashing encryption method
Answer: A
NEW QUESTION # 72
Which of the following attacks are computer threats that try to exploit computer application vulnerabilities that are unknown to others or undisclosed to the software developer? Each correct answer represents a complete solution. Choose all that apply.
- A. Zero-hour
- B. Spoofing
- C. Zero-day
- D. Buffer overflow
Answer: A,C
Explanation:
A zero-day attack, also known as zero-hour attack, is a computer threat that tries to exploit computer application vulnerabilities which are unknown to others, undisclosed to the software vendor, or for which no security fix is available. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software vendor knows about the vulnerability. User awareness training is the most effective technique to mitigate such attacks. Answer option C is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the responses to be misdirected. Answer option A is incorrect. Buffer overflow is a condition in which an application receives more data than it is configured to accept. This usually occurs due to programming errors in the application. Buffer overflow can terminate or crash the application.
NEW QUESTION # 73
Which of the following procedures is intended to provide security personnel to identify, mitigate, and recover from malware events, such as unauthorized access to systems or data, denial-of-service or unauthorized changes to the system hardware, software, or information?
- A. A resident of the emergency plan
- B. disaster survival plan
- C. None
- D. Cyber Incident Response Plan
- E. Crisis communications guidelines
Answer: D
NEW QUESTION # 74
Fill in the blank with the appropriate term. ______________is a method for monitoring the e-mail delivery to the intended recipient.
Answer:
Explanation:
Email tracking
NEW QUESTION # 75
......
Latest 312-38 Pass Guaranteed Exam Dumps with Accurate & Updated Questions: https://www.torrentvce.com/312-38-valid-vce-collection.html
Pass 312-38 Exam with Updated 312-38 Exam Dumps PDF 2023: https://drive.google.com/open?id=1jOgfP-aUlj9N_tIjzAAxGzdPaELunRoK