Eccouncil Certified Network Defender 312-38 CND Exam Questions

Page: 1 / 14
Total 363 questions
Question 1

Based on which of the following registry key, the Windows Event log audit configurations are recorded?



Answer : D

The Windows Event Log audit configurations are recorded in the registry key pathHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog. This key contains subkeys for each of the event logs on the system, including the Application, Security, and System logs, among others. Each of these subkeys can contain a number of values that determine how events are logged, which can include the maximum size of the log, the retention method, and the file path where the log is stored. Audit policies can be configured to determine which events are recorded in these logs, and the configurations are reflected in the registry under this key.


Question 2

An IT company has just been hit with a severe external security breach. To enhance the company's security posture, the network admin has decided to first block all the services and then individually

enable only the necessary services. What is such an Internet access policy called?



Answer : D

The Paranoid Policy is a type of Internet access policy that is characterized by initially blocking all services and then selectively enabling only those that are necessary. This approach is often taken as a security measure following a severe external breach, as it allows the network administrator to ensure that only essential and secure services are accessible, minimizing potential vulnerabilities.


Question 3

Kyle is an IT consultant working on a contract for a large energy company in Houston. Kyle was hired on to do contract work three weeks ago so the company could prepare for an external IT security audit. With

suggestions from upper management, Kyle has installed a network-based IDS system. This system checks for abnormal behavior and patterns found in network traffic that appear to be dissimilar from the traffic

normally recorded by the IDS. What type of detection is this network-based IDS system using?



Answer : A

Anomaly detection in network-based Intrusion Detection Systems (IDS) involves establishing a baseline of normal behavior for the network or system and then monitoring for deviations from this baseline. The IDS analyzes traffic patterns, system performance, user behavior, and other metrics to detect anomalies that could indicate a potential security breach. This method is particularly effective for identifying new or unknown threats that do not match any known signatures or definitions. By focusing on irregular patterns rather than predefined signatures, anomaly detection can provide early warnings of malicious activities that might otherwise go unnoticed.


Question 4

Which type of firewall consists of three interfaces and allows further subdivision of the systems based on specific security objectives of the organization?



Answer : D

A multi-homed firewall is designed with three or more network interfaces. This type of firewall allows an organization to create multiple subnets, each serving different security objectives. The multi-homed firewall can enforce security policies and control traffic flow between these subnets, effectively segmenting the network based on the organization's specific needs. This segmentation enhances security by isolating different parts of the network, reducing the risk of widespread network compromise in the event of a security breach.


Question 5

Which of the following Wireshark filters allows an administrator to detect SYN/FIN DDoS attempt on

the network?



Answer : B

The correct Wireshark filter to detect a SYN/FIN DDoS attempt istcp.flags==0X029. This filter is designed to capture packets where both the SYN and FIN flags are set, which is an unusual combination and indicative of a SYN/FIN attack. In a typical three-way TCP handshake, the SYN and FIN flags are not set in the same TCP segment. A SYN flag is used to initiate a connection, and a FIN flag is used to politely close a connection. Therefore, seeing both flags set in the same packet suggests a possible SYN/FIN DDoS attack.


Question 6

Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved. What is the last step he should list?



Answer : D

The last step Malone should list in his incident handling plan is 'A follow-up'. This step is crucial as it involves analyzing the incident to understand how it occurred and what can be done to prevent similar incidents in the future. It often includes a review of the effectiveness of the response, identification of lessons learned, updating policies and procedures accordingly, and conducting training sessions if necessary. This step ensures that the organization improves its security posture and is better prepared for future incidents.


Question 7

Which of the following incident handling stage removes the root cause of the incident?



Answer : A

The eradication stage in incident handling is responsible for removing the root cause of the incident. This stage involves identifying and eliminating the threats that caused the incident, such as malware or unauthorized access. It also includes patching vulnerabilities and strengthening security controls to prevent similar incidents in the future. The goal of eradication is to ensure that the incident is completely resolved and cannot recur.


The information about the eradication phase aligns with best practices in incident response, as detailed in various cybersecurity resources12.

Page:    1 / 14   
Total 363 questions