312-49 practice questions 51–60

1. Question 51 · 647 in bank

   Software firewalls work at which layer of the OSI model?

   • AApplication
   • BNetwork
   • CTransport
   • DData Link

   Show answer

   Answer: D

   Explanation

   Point is not, if firewall is or not an application. Is, obviously. And as application, that fw works at OSI layer 7. Point is, what OSI layer that fw is inspecting. If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at layer 7. Software fw usually inspects OSI layer 2 pdus. So, data link :)

   Source: Adapted from community discussion — Bodescu

   Next question

2. Question 52 · 647 in bank

   After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

   • AStateful firewalls do not work with packet filtering firewalls
   • BNAT does not work with stateful firewalls
   • CIPSEC does not work with packet filtering firewalls
   • DNAT does not work with IPSEC

   Show answer

   Answer: D

   Next question

3. Question 53 · 647 in bank

   You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?

   • APolymorphic
   • BMetamorphic
   • COligomorhic
   • DTransmorphic

   Show answer

   Answer: B

   Next question

4. Question 54 · 647 in bank

   As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?

   • AThe IP address of the employees' computers
   • BBank account numbers and the corresponding routing numbers
   • CThe employees network usernames and passwords
   • DThe MAC address of the employees' computers

   Show answer

   Answer: C

   Explanation

   idk if the question answers were written correctly. A better answer would be : Potential end user passwords and corresponding usernames. You cant guarantee that youre getting exact network usernames and passwords but its likely

   Source: Adapted from community discussion — Ariel235788

   Next question

5. Question 55 · 647 in bank

   Study the log given below and answer the following question: Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

   • ADisallow UDP53 in from outside to DNS server
   • BAllow UDP53 in from DNS server to outside
   • CDisallow TCP53 in from secondaries or ISP server to DNS server
   • DBlock all UDP traffic

   Show answer

   Answer: A

   Next question

6. Question 56 · 647 in bank

   What will the following command accomplish?

   • ATest ability of a router to handle over-sized packets
   • BTest the ability of a router to handle under-sized packets
   • CTest the ability of a WLAN to handle fragmented packets
   • DTest the ability of a router to handle fragmented packets

   Show answer

   Answer: A

   Next question

7. Question 57 · 647 in bank

   When investigating a potential e-mail crime, what is your first step in the investigation?

   • ATrace the IP address to its origin
   • BWrite a report
   • CDetermine whether a crime was actually committed
   • DRecover the evidence

   Show answer

   Answer: D

   Next question

8. Question 58 · 647 in bank

   If a suspect computer is located in an area that may have toxic chemicals, you must:

   • Acoordinate with the HAZMAT team
   • Bdetermine a way to obtain the suspect computer
   • Cassume the suspect machine is contaminated
   • Ddo not enter alone

   Show answer

   Answer: A

   Next question

9. Question 59 · 647 in bank

   What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

   • AWindows Services Monitoring
   • BSystem Baselining
   • CStart-up Programs Monitoring
   • DHost integrity Monitoring

   Show answer

   Answer: D

   Next question

10. Question 60 · 647 in bank

    What type of equipment would a forensics investigator store in a StrongHold bag?

    • APDAPDA?
    • BBackup tapes
    • CHard drives
    • DWireless cards

    Show answer

    Answer: D

    Explanation

    A should be the answer. As without connecting, an wireless card is unusable. But in case of PDA, it is best practice to keep it turned on and hence should be put inside strongholds to deprive any communication.

    Source: Adapted from community discussion — ireen

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 51. 647 questions available.