EC-Council Network Defense Essentials Exam NDE 112-51 Exam Questions

Page: 1 / 14
Total 75 questions
Question 1

Below are the various steps involved in establishing a network connection using the shared key

authentication process.

1.The AP sends a challenge text to the station.

2.The station connects to the network.

3.The station encrypts the challenge text using its configured 128-bit key and sends the encrypted text to the AP.

4.The station sends an authentication frame to the AP.

5.The AP uses its configured WEP key to decrypt the encrypted text and compares it with the original challenge text.

What is the correct sequence of steps involved in establishing a network connection using the shared key authentication process?



Answer : B

The correct sequence of steps involved in establishing a network connection using the shared key authentication process is 4 -> 1 -> 3 -> 5 -> 2. This is based on the following description of the shared key authentication process from the Network Defense Essentials courseware:

The station sends an authentication frame to the AP, indicating that it wants to use shared key authentication.

The AP responds with an authentication frame containing a challenge text, which is a random string of bits.

The station encrypts the challenge text using its configured WEP key, which is derived from the shared secret key (password) that is also known by the AP. The station sends the encrypted text back to the AP in another authentication frame.

The AP decrypts the encrypted text using its configured WEP key and compares it with the original challenge text. If they match, the AP sends a positive authentication response to the station. If they do not match, the AP sends a negative authentication response to the station.

The station connects to the network if the authentication is successful.


Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-18 to 3-19

Shared Key Authentication - Techopedia, Techopedia, June 15, 2017

Question 2

Kalley, a network administrator of an organization, has installed a traffic monitoring system to capture and report suspicious traffic signatures. In this process, she detects traffic containing password cracking, sniffing, and brute-forcing attempts.Which of the following categories of suspicious traffic signature were identified by Kalley through the installed monitoring system?



Answer : B

Unauthorized access signatures were identified by Kalley through the installed monitoring system. Unauthorized access signatures are designed to detect attempts to gain unauthorized access to a system or network by exploiting vulnerabilities, misconfigurations, or weak credentials. Password cracking, sniffing, and brute-forcing are common techniques used by attackers to obtain or guess the passwords of legitimate users or administrators and gain access to their accounts or privileges. These techniques generate suspicious traffic patterns that can be detected by traffic monitoring systems, such as Snort, using signature-based detection. Signature-based detection is based on the premise that abnormal or malicious network traffic fits a distinct pattern, whereas normal or benign traffic does not. Therefore, by installing a traffic monitoring system and capturing and reporting suspicious traffic signatures, Kalley can identify and prevent unauthorized access attempts and protect the security of her organization's network. Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

Detecting Suspicious Traffic via Signatures - Intrusion Detection with Snort, O'Reilly, 2003

Threat Signature Categories - Palo Alto Networks, Palo Alto Networks, 2020


Question 3

Identify the UBA tool that collects user activity details from multiple sources and uses artificial intelligence and machine learning algorithms to perform user behavior analysis to prevent and detect various threats before the fraud is perpetrated.



Answer : C

Dtex Systems is the UBA tool that collects user activity details from multiple sources and uses artificial intelligence and machine learning algorithms to perform user behavior analysis to prevent and detect various threats before the fraud is perpetrated. Dtex Systems is a user and entity behavior analytics (UEBA) platform that provides visibility, detection, and response capabilities for insider threats, compromised accounts, data loss, and fraud. Dtex Systems collects user activity data from endpoints, servers, cloud applications, and network traffic, and applies advanced analytics and machine learning to establish baselines of normal user behavior, identify anomalies, and assign risk scores. Dtex Systems also provides contextual information, such as user intent, motivation, and sentiment, to help security teams understand and respond to the threats. Dtex Systems can integrate with other security tools, such as SIEM, DLP, or IAM, to enhance the security posture of the organization123. Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-35 to 3-36

Dtex Systems - Wikipedia, Wikipedia, March 16, 2021

Dtex Systems - User and Entity Behavior Analytics (UEBA), Dtex Systems, 2020


Question 4

Joseph, a security professional, was instructed to secure the organization's network. In this process, he began analyzing packet headers to check whether any indications of source and destination IP addresses and port numbers are being changed during transmission.

Identify the attack signature analysis technique performed by Joseph in the above scenario.



Answer : D

Atomic-signature-based analysis is a type of attack signature analysis technique that uses a single characteristic or attribute of a packet header to identify malicious traffic. Atomic signatures are simple and fast to match, but they can also generate false positives or miss some attacks. Some examples of atomic signatures are source and destination IP addresses, port numbers, protocol types, and TCP flags. Atomic-signature-based analysis is the technique performed by Joseph in the above scenario, as he analyzed packet headers to check whether any indications of source and destination IP addresses and port numbers are being changed during transmission. Reference:

[Understanding the Network Traffic Signatures] - Module 12: Network Traffic Monitoring

Network Defense Essentials (NDE) | Coursera - Week 12: Network Traffic Monitoring

[Network Defense Essentials Module 12 (Network Traffic Monitoring) - Quizlet] - Flashcards: What are Network Traffic Signatures?


Question 5

James was recruited as security personnel in an organization and was instructed to secure the organization's infrastructure from physical threats. To achieve this, James installed CCTV systems near gates, reception, hallways, and workplaces to capture illicit activities inside the premises, identify activities that need attention, collect images as evidence, and aid in an alarm system.

Identify the type of physical security control implemented by James in the above scenario.



Answer : A


Question 6

John has recently joined an organization and completed his security training. The organization conducted a security campaign on their employees by sending a fake email stating the urgency of password reset. John identified that it was an illegitimate mail and reported it as spam.

Identify the type of attack initiated by the organization as part of the security campaign discussed in the above scenario.



Answer : A

The type of attack initiated by the organization as part of the security campaign discussed in the above scenario is phishing. Phishing is a form of fraud where cybercriminals use email, instant messaging, or other social media to try to gather information such as login credentials by masquerading as a reputable person or organization. Phishing occurs when a malicious party sends a fraudulent email disguised as being from an authorized, trusted source, and tries to persuade the recipient to click on a link, open an attachment, or provide personal information. The link or attachment may lead to a fake website or install malware on the recipient's device, while the personal information may be used for identity theft, account takeover, or other malicious purposes. Phishing is one of the most common and effective cyberattacks, as it exploits the human factor and relies on social engineering techniques to manipulate the victim's emotions, such as urgency, fear, or curiosity.Phishing can be prevented or mitigated by educating the users on how to recognize and report phishing emails, using strong and unique passwords, enabling multi-factor authentication, and installing security software123.Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-30 to 3-31

20 types of phishing attacks + phishing examples - Norton, Norton, October 03, 2022

Types of Email Attacks - GeeksforGeeks, GeeksforGeeks, May 30, 2023


Question 7

Below are various authentication techniques.

1.Retina scanner

2.One-time password

3.DNA

4.Voice recognition

Identify the techniques that fall under biometric authentication.



Answer : A

Biometric authentication is a type of authentication that uses the physical or behavioral characteristics of a person to verify their identity. Biometric authentication is more secure and convenient than other methods such as passwords or tokens, as biometric traits are unique, hard to forge, and easy to use. Some examples of biometric authentication techniques are retina scanner, DNA, and voice recognition. Retina scanner uses a low-intensity light beam to scan the pattern of blood vessels at the back of the eye, which is unique for each individual. DNA uses the genetic code of a person to match their identity, which is the most accurate and reliable biometric technique. Voice recognition uses the sound and pitch of a person's voice to verify their identity, which is influenced by factors such as anatomy, physiology, and psychology. These techniques fall under biometric authentication, as they use the physical or behavioral traits of a person to authenticate them. Reference:

Biometric Authentication - Week 2: Identification, Authentication, and Authorization

Biometric Authentication: What You Need To Know

Biometric Authentication Techniques


Page:    1 / 14   
Total 75 questions