Page: 1
/ 14
Total 363 questions
Eccouncil Certified Network Defender 312-38 CND Exam Questions
Question 1
Paul is a network security technician working on a contract for a laptop manufacturing company in Chicago. He has focused primarily on securing network devices, firewalls, and traffic traversing in and out of the
network. He just finished setting up a server a gateway between the internal private network and the outside public network. This server will act as a proxy, limited amount of services, and will filter packets. What is this
type of server called?
Answer : A
The server described in the question is known as aBastion host. A Bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. It is typically placed in a network's demilitarized zone (DMZ) and acts as a proxy server, offering limited services and filtering packets to protect the internal private network from the public network.It is hardened due to its exposure to potential attacks and usually hosts a single application, like a proxy server, while all other services are removed or limited to reduce the threat surface1.
Question 2
Which BC/DR activity includes action taken toward resuming all services that are dependent on business-critical applications?
Answer : C
In the context of Business Continuity/Disaster Recovery (BC/DR), the activity that includes actions taken toward resuming all services that are dependent on business-critical applications is referred to asResumption. This phase focuses on the steps necessary to bring critical functions back into operation after a disruption. Recovery, on the other hand, is more about the actions taken to return the business to normal operating conditions post-disaster, which may include repairs, restorations, and return to normalcy. Response is the immediate reaction to an incident, and Restoration is the process of rebuilding or restoring IT systems and operations.Reference: The information aligns with the objectives and documents of the EC-Council's Certified Network Defender (CND) program, which emphasizes understanding and implementing proper BC/DR activities.
Question 3
Maximus Tech Is a multinational company that uses Cisco ASA Firewalls for their systems. Jason is the one of the members of the team that checks the logs at Maximus Tech. As a part of his job. he is going through me logs and he came across a firewall log that looks like this:
May 06 2018 21:27:27 asa 1: % ASA -6-11008: User enable_16' executed the 'configure term' command
Based on the security level mentioned in the log, what did Jason understand about the description of this message?
Answer : B
The log entry%ASA-6-11008indicates that the message is of a severity level 6, which corresponds to an informational message. In the context of Cisco ASA Firewall logs, severity levels range from 0 (emergency) to 7 (debugging), with lower numbers indicating higher severity. A severity level of 6 is used for messages that provide information about normal but significant events. In this case, the log indicates that a user named 'enable_16' executed the 'configure term' command, which is a noteworthy event but does not indicate an error or critical condition.
Question 4
Which of the following filters car be applied to detect an ICMP ping sweep attempt using Wireshark?
Answer : A
In Wireshark, the filtericmp.type==8is used to detect ICMP Echo requests, which are commonly used in ping sweep attempts. A ping sweep is a network scanning technique used to determine which of a range of IP addresses map to live hosts. It involves sending ICMP Echo requests (type 8) to multiple hosts and listening for Echo replies (type 0). If an Echo reply is received, it indicates that the host is active. Therefore, the filtericmp.type==8can be applied to capture these ICMP Echo requests and detect a ping sweep attempt.
Question 5
John has planned to update all Linux workstations in his network. The organization is using various Linux distributions including Red hat, Fedora and Debian. Which of following commands will he use to
update each respective Linux distribution?
Answer : C
The correct commands to update the respective Linux distributions are as follows:
Red Hat: Uses theyumcommand or the newerdnfcommand for package management and updates.
Fedora: Originally usedyumbut now has transitioned todnfas the default package manager.
Debian: Utilizes theapt-getcommand for package management tasks, including updates.
The matching from the options provided would be:
1-v: Slackware based systems useAutoupdate.
2-iii: RPM-based systems, which include Fedora, useSwaret.
3-i: Debian based systems useapt-get.
4-iv: Red Hat based systems useup2date.
Question 6
The CEO of Max Rager wants to send a confidential message regarding the new formula for its coveted soft drink, SuperMax, to its manufacturer in Texas. However, he fears the message could be altered in
transit. How can he prevent this incident from happening and what element of the message ensures the success of this method?
Answer : A
To ensure the integrity of the message and prevent it from being altered in transit, hashing can be used. Hashing is a process where a hash function converts data into a fixed-size string of characters, which is typically a hash code. When the message is sent, the hash code is generated and sent along with it. Upon receipt, the receiver can run the same hash function on the received message to generate a new hash code. If this new hash code matches the one sent with the message, it confirms that the message has not been altered. This method does not encrypt the message content but ensures that any changes to the message in transit can be detected.
Question 7
Which authentication technique involves mathematical pattern-recognition of the colored part of the eye behind the cornea?
Answer : A
Iris scanning is an authentication technique that involves mathematical pattern-recognition of the colored part of the eye, known as the iris. This method uses the unique patterns in the iris to identify and verify an individual's identity. The iris is a muscle within the eye that controls the size of the pupil and is visible from the exterior. It has a complex structure and contains many microscopic features that are unique to each individual, making it a reliable biometric for authentication purposes.
All Official Question Types