Certified Network Defender 312-38 Exam Dumps

dumps2023-05-20T10:15:47+08:00

Certified Network Defender 312-38 exam dumps are useful in your preparation. Understanding the 312-38 exam information is the first step to studying for the test. There are 100 questions in the real EC-Council certification 312-38 exam, and you have 4 hours to complete the test. The test format is multiple-choice questions. Free Certified Network Defender 312-38 exam dumps are available below.

Page 1 of 6

1. Which phase of vulnerability management deals with the actions taken for correcting the discovered vulnerability?

Mitigation

Assessment

Remediation

Verification

2. How is application whitelisting different from application blacklisting?

It allows all applications other than the undesirable applications

It allows execution of trusted applications in a unified environment

It allows execution of untrusted applications in an isolated environment

It rejects all applications other than the allowed applications

3. John, the network administrator and he wants to enable the NetFlow feature in Cisco routers to collect and monitor the IP network traffic passing through the router.

Which command will John use to enable NetFlow on an interface?

Router(Config-if) # IP route - cache flow

Router# Netmon enable

Router IP route

Router# netflow enable

4. Sean has built a site-to-site VPN architecture between the head office and the branch office of his company. When users in the branch office and head office try to communicate with each other, the traffic is encapsulated. As the traffic passes though the gateway, it is encapsulated again. The header and payload both are encapsulated. This second encapsulation occurs only in the __________implementation of a VPN.

Full Mesh Mode

Point-to-Point Mode

Transport Mode

Tunnel Mode

5. Sophie has been working as a Windows network administrator at an MNC over the past 7 years. She wants to check whether SMB1 is enabled or disabled.

Which of the following command allows Sophie to do so?

Get-WindowsOptionalFeatures -Online -FeatureNames SMB1Protocol

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Get-WindowsOptionalFeature -Online -FeatureNames SMB1Protocol

Get-WindowsOptionalFeatures -Online -FeatureName SMB1Protocol

6. Cindy is the network security administrator for her company. She just got back from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. She is worried about the current security state of her company's network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established, she sends RST packets to those hosts to stop the session. She has done this to see how her intrusion detection system will log the traffic.

What type of scan is Cindy attempting here?

The type of scan she is usinq is called a NULL scan.

Cindy is using a half-open scan to find live hosts on her network.

Cindy is attempting to find live hosts on her company's network by using a XMAS scan.

She is utilizing a RST scan to find live hosts that are listening on her network.

7. Which of the following helps prevent executing untrusted or untested programs or code from untrusted or unverified third-parties?

Application sandboxing

Deployment of WAFS

Application whitelisting

Application blacklisting

8. A VPN Concentrator acts as a bidirectional tunnel endpoint among host machines.

What are the other f unction(s) of the device? (Select all that apply)

Provides access memory, achieving high efficiency

Assigns user addresses

Enables input/output (I/O) operations

Manages security keys

9. Damian is the chief security officer of Enigma Electronics. To block intruders and prevent any environmental accidents, he needs to set a two-factor authenticated keypad lock at the entrance, rig a fire suppression system, and link any video cameras at various corridors to view the feeds in the surveillance room.

What layer of network defense-in-depth strategy is he trying to follow?

Physical

Perimeter

Policies and procedures

Host

10. John wants to implement a packet filtering firewall in his organization's network.

What TCP/IP layer does a packet filtering firewall work on?

Application layer

Network Interface layer

TCP layer

IP layer

Page 2 of 6

11. Management asked Adam to implement a system allowing employees to use the same credentials to access multiple applications. Adam should implement the-------------------------- authentication technique to satisfy the management request.

Two-factor Authentication

Smart Card Authentication

Single-sign-on

Biometric

12. Harry has sued the company claiming they made his personal information public on a social networking site in the United States. The company denies the allegations and consulted a/an _______ for legal advice to defend them against this allegation.

Evidence Manager

Incident Handler

Attorney

PR Specialist

13. The risk assessment team in Southern California has estimated that the probability of an incident that has potential to impact almost 80% of the bank's business is very high.

How should this risk be categorized in the risk matrix?

High

Medium

Extreme

Low

14. Michael decides to view the-----------------to track employee actions on the organization's network.

Firewall policy

Firewall log

Firewall settings

Firewall rule set

15. Management asked their network administrator to suggest an appropriate backup medium for their backup plan that best suits their organization's need.

Which of the following factors will the administrator consider when deciding on the appropriate backup medium?

Capability

Accountability

Extensibility

Reliability

16. The CEO of Max Rager wants to send a confidential message regarding the new formula for its coveted soft drink, SuperMax, to its manufacturer in Texas. However, he fears the message could be altered in transit.

How can he prevent this incident from happening and what element of the message ensures the success of this method?

Hashing; hash code

Symmetric encryption; secret key

Hashing; public key

Asymmetric encryption; public key

17. Which IEEE standard does wireless network use?

802.11

802.18

802.9

802.10

18. The--------------protocol works in the network layer and is responsible for handling the error codes during the delivery of packets. This protocol is also responsible for providing communication in the TCP/IP stack.

RARP

ICMP

DHCP

ARP

19. Identify the spread spectrum technique that multiplies the original data signal with a pseudo random noise spreading code.

FHSS

DSSS

OFDM

ISM

20. Which VPN QoS model guarantees the traffic from one customer edge (CE) to another?

Pipe Model

AAA model

Hub-and-Spoke VPN model

Hose mode

Page 3 of 6

21. John is a network administrator and is monitoring his network traffic with the help of Wireshark. He suspects that someone from outside is making a TCP OS fingerprinting attempt on his organization's network.

Which of the following Wireshark filter(s) will he use to locate the TCP OS fingerprinting attempt?

Tcp.flags==0x2b

Tcp.flags=0x00

Tcp.options.mss_val<1460

Tcp.options.wscale_val==20

22. John has implemented________in the network to restrict the limit of public IP addresses in his organization and to enhance the firewall filtering technique.

DMZ

Proxies

VPN

NAT

23. A network is setup using an IP address range of 0.0.0.0 to 127.255.255.255. The network has a default subnet mask of 255.0.0.0.

What IP address class is the network range a part of?

Class C

Class A

Class B

Class D

24. Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

Automated Field Correlation

Field-Based Approach

Rule-Based Approach

Graph-Based Approach

25. -----------is a group of broadband wireless communications standards for Metropolitan Area Networks (MANs)

802.15.4

802.15

802.12

802.16

26. James was inspecting ARP packets in his organization's network traffic with the help of Wireshark. He is checking the volume of traffic containing ARP requests as well as the source IP address from which they are originating.

Which type of attack is James analyzing?

ARP Sweep

ARP misconfiguration

ARP spoofinq

ARP Poisioning

27. Blake is working on the company's updated disaster and business continuity plan. The last section of the plan covers computer and data incidence response. Blake is outlining the level of severity for each type of incident in the plan.

Unsuccessful scans and probes are at what severity level?

High severity level

Extreme severity level

Mid severity level

Low severity level

28. To provide optimum security while enabling safe/necessary services, blocking known dangerous services, and making employees accountable for their online activity, what Internet Access policy would Brian, the network administrator, have to choose?

Prudent policy

Paranoid policy

Promiscuous policy

Permissive policy

29. Based on which of the following registry key, the Windows Event log audit configurations are recorded?

HKEY_LOCAL_MACHINESYSTEMServicesEventLog < ErrDev >

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEventLog < EntAppsvc >

HKEY_LOCAL_MACHINECurrentControlSetServicesEventLog< ESENT >

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLog < Event Log >

30. Fargo, head of network defense at Globadyne Tech, has discovered an undesirable process in several Linux systems, which causes machines to hang every 1 hour.

Fargo would like to eliminate it; what command should he execute?

# update-rc.d -f [service name] remove

# service [service name] stop

# ps ax | grep [Target Process]

# kill -9 [PID]

Page 4 of 6

31. Tom works as a network administrator in a multinational organization having branches across North America and Europe. Tom wants to implement a storage technology that can provide centralized data storage and provide free data backup on the server. He should be able to perform data backup and recovery more efficiently with the selected technology.

Which of the following storage technologies best suits Tom's requirements?

DAS

PAS

RAID

NAS

32. Which command is used to change the permissions of a file or directory?

rmdir

systemctl

kill

chmod

33. Frank installed Wireshark at all ingress points in the network. Looking at the logs he notices an odd packet source. The odd source has an address of 1080:0:FF:0:8:800:200C:4171 and is using port 21.

What does this source address signify?

This address means that the source is using an IPv6 address and is spoofed and signifies an IPv4 address of 127.0.0.1.

This source address is IPv6 and translates as 13.1.68.3

This source address signifies that the originator is using 802dot1x to try and penetrate into Frank's network

This means that the source is using IPv4

34. Simran is a network administrator at a start-up called Revolution. To ensure that neither party in the company can deny getting email notifications or any other communication, she mandates authentication before a connection establishment or message transfer occurs.

What fundamental attribute of network defense is she enforcing?

Integrity

Non-repudiation

Confidentiality

Authentication

35. An employee of a medical service company clicked a malicious link in an email sent by an attacker. Suddenly, employees of the company are not able to access billing information or client record as it is

encrypted. The attacker asked the company to pay money for gaining access to their data.

Which type of malware attack is described above?

Logic bomb

Rootkits

Trojan

Ransomware

36. John wants to implement a firewall service that works at the session layer of the OSI model. The firewall must also have the ability to hide the private network information.

Which type of firewall service is John thinking of implementing?

Application level gateway

Circuit level gateway

Stateful Multilayer Inspection

Packet Filtering

37. George was conducting a recovery drill test as a part of his network operation. Recovery drill tests are conducted on the______________.

Archived data

Deleted data

Data in transit

Backup data

38. Daniel is monitoring network traffic with the help of a network monitoring tool to detect any abnormalities.

What type of network security approach is Daniel adopting?

Preventative

Reactive

Retrospective

Defense-in-depth

39. Emmanuel works as a Windows system administrator at an MNC. He uses PowerShell to enforce the script execution policy. He wants to allow the execution of the scripts that are signed by a trusted publisher.

Which of the following script execution policy setting this?

AllSigned

Restricted

RemoteSigned

Unrestricted

40. In MacOS, how can the user implement disk encryption?

By enabling BitLocker feature

By executing dm-crypt command

By turning on Device Encryption feature

By enabling FileVault feature

Page 5 of 6

41. Assume that you are a network administrator and the company has asked you to draft an Acceptable Use Policy (AUP) for employees.

Under which category of an information security policy does AUP fall into?

System Specific Security Policy (SSSP)

Incident Response Policy (IRP)

Enterprise Information Security Policy (EISP)

Issue Specific Security Policy (ISSP)

42. You are responsible for network functions and logical security throughout the corporation. Your company has over 250 servers running Windows Server 2012, 5000 workstations running Windows 10, and 200 mobile users working from laptops on Windows 8. Last week 10 of your company's laptops were stolen from a salesman, while at a conference in Barcelona. These laptops contained proprietary company information. While doing a damage assessment, a news story leaks about a blog post containing information about the stolen laptops and the sensitive information.

What built-in Windows feature could you have implemented to protect the sensitive information on these laptops?

You should have used 3DE

You should have implemented the Distributed File System (DFS).

If you would have implemented Pretty Good Privacy (PGP).

You could have implemented the Encrypted File System (EFS)

43. Liza was told by her network administrator that they will be implementing IPsec VPN tunnels to connect the branch locations to the main office.

What layer of the OSI model do IPsec tunnels function on?

The data link layer

The session layer

The network layer

The application and physical layers

44. Ivan needs to pick an encryption method that is scalable even though it might be slower.

He has settled on a method that works where one key is public and the other is private.

What encryption method did Ivan settle on?

Ivan settled on the private encryption method.

Ivan settled on the symmetric encryption method.

Ivan settled on the asymmetric encryption method

Ivan settled on the hashing encryption method

45. An enterprise recently moved to a new office and the new neighborhood is a little risky. The CEO wants to monitor the physical perimeter and the entrance doors 24 hours.

What is the best option to do this job?

Install a CCTV with cameras pointing to the entrance doors and the street

Use fences in the entrance doors

Use lights in all the entrance doors and along the company's perimeter

Use an IDS in the entrance doors and install some of them near the corners

46. Which of the Windows security component is responsible for controlling access of a user to Windows resources?

Network Logon Service (Netlogon)

Security Accounts Manager (SAM)

Security Reference Monitor (SRM)

Local Security Authority Subsystem (LSASS)

47. Elden is working as a network administrator at an IT company. His organization opted for a virtualization technique in which the guest OS is aware of the virtual environment in which it is running and communicates with the host machines for requesting resources. Identify the virtualization technique implemented by Elden’s organization.

Hybrid virtualization

Hardware-assisted virtualization

Full virtualization

Para virtualization

48. Alex is administrating the firewall in the organization's network.

What command will he use to check the ports applications open?

Netstat -an

Netstat -o

Netstat -a

Netstat -ao

49. If an organization has decided to consume PaaS Cloud service model, then identify the organization's responsibility that they need to look after based on shared responsibility model.

Data, interfaces, application, etc.

Data, interfaces, application, middleware, OS, VM, virtual network, etc.

Data, interfaces, application, middleware, OS, VM, virtual network, hypervisors, processing and memory, data storage, network interfaces, facilities and data centers, etc.

Data, interfaces, etc.

50. How can a WAF validate traffic before it reaches a web application?

It uses a role-based filtering technique

It uses an access-based filtering technique

It uses a sandboxing filtering technique

It uses a rule-based filtering technique

Page 6 of 6

51. CORRECT TEXT

Identify the minimum number of drives required to setup RAID level 5.

Multiple

52. Which of the following VPN topologies establishes a persistent connection between an organization's main office and its branch offices using a third-party network or the Internet?

Star

Point-to-Point

Full Mesh

Hub-and-Spoke

53. The IR team and the network administrator have successfully handled a malware incident on the network. The team is now preparing countermeasure guideline to avoid a future occurrence of the malware incident.

Which of the following countermeasure(s) should be added to deal with future malware incidents? (Select all that apply)

Complying with the company's security policies

Implementing strong authentication schemes

Implementing a strong password policy

Install antivirus software

54. Choose the correct order of steps to analyze the attack surface.

Identify the indicators of exposure->visualize the attack surface->simulate the attack->reduce the attack surface

Visualize the attack surface->simulate the attack->identify the indicators of exposure->reduce the attack surface

Identify the indicators of exposure->simulate the attack->visualize the attack surface->reduce the attack surface

Visualize the attack surface->identify the indicators of exposure->simulate the attack->reduce the attack surface

55. Frank is a network technician working for a medium-sized law firm in Memphis. Frank and two other IT employees take care of all the technical needs for the firm. The firm's partners have asked that a secure wireless network be implemented in the office so employees can move about freely without being tied to a network cable. While Frank and his colleagues are familiar with wired Ethernet technologies, 802.3, they are not familiar with how to setup wireless in a business environment.

What IEEE standard should Frank and the other IT employees follow to become familiar with wireless?

The IEEE standard covering wireless is 802.9 and they should follow this.

802.7 covers wireless standards and should be followed

They should follow the 802.11 standard

Frank and the other IT employees should follow the 802.1 standard.

Certified Network Defender 312-38 Exam Dumps

Certified Network Defender 312-38 Exam Dumps

Share this post

Leave a Reply Cancel reply

Related Posts