EC-COUNCIL EC-COUNCIL Certifications 312-38 Questions & Answers

• Question 431:

  Which of the following routing metrics refers to the length of time that is required to move a packet from source to destination through the internetwork?

  A. Routing delay

  B. Bandwidth

  C. Load

  D. Path length

  Correct Answer: A

  Routing delay refers to the length of time that is required to move a packet from source to destination through the internetwork. Delay depends on many factors, including the following:

  Bandwidth of intermediate network links

  Port queues at each router along the way

  Network congestion on all intermediate network links

  Physical distance to be traveled

  Since delay is a conglomeration of several important variables, it is a common and useful metric.

  Answer option D is incorrect. Path length is defined as the sum of the costs associated with each link traversed.

  Answer option B is incorrect. Bandwidth refers to the available traffic capacity of a link.

  Answer option C is incorrect. Load refers to the degree to which a network resource, such as a router, is busy.

• Question 432:

  You are taking over the security of an existing network. You discover a machine that is not being used as such, but has software on it that emulates the activity of a sensitive database server. What is this?

  A. A Polymorphic Virus

  B. A Virus

  C. A reactive IDS.

  D. A Honey Pot

  Correct Answer: D

  A honey pot is a device specifically designed to emulate a high value target such as a database server or entire sub section of your network. It is designed to attract the hacker's attention.

• Question 433:

  Which of the following types of transmission is the process of sending one bit at a time over a single transmission line?

  A. Unicast transmission

  B. Serial data transmission

  C. Multicast transmission

  D. Parallel data transmission

  Correct Answer: B

  In serial data transmission, one bit is sent after another (bit-serial) on a single transmission line. It is the simplest method of transmitting digital information from one point to another. This transmission is suitable for providing communication between two participants as well as for multiple participants. It is used for all long-haul communication and provides high data rates. It is also inexpensive and beneficial in transferring data over long distances. Answer option D is incorrect. In parallel data transmission, several data signals are sent simultaneously over several parallel channels. Parallel data transmission is faster than serial data transmission. It is used primarily for transferring data between devices at the same site. For instance, communication between a computer and printer is most often parallel, allowing the entire byte to be transferred in one operation. Answer option A is incorrect. The unicast transmission method is used to establish communication between a single host and a single receiver. Packets sent to a unicast address are delivered to the interface recognized by that IP address, as shown in the following figure:

  

  Answer option C is incorrect. The multicast transmission method is used to establish communication between a single host and multiple receivers. Packets are sent to all interfaces recognized by that IP address, as shown in the figure below:

  

• Question 434:

  Which of the following are used as a cost estimating technique during the project planning stage? Each correct answer represents a complete solution. (Choose three.)

  A. Function point analysis

  B. Program Evaluation Review Technique (PERT)

  C. Expert judgment

  D. Delphi technique

  Correct Answer: DCA

  Delphi technique, expert judgment, and function point analysis are used as a cost estimating technique during the project planning stage. Delphi is a technique to identify potential risk. In this technique, the responses are gathered via a questionnaire from different experts and their inputs are organized according to their contents. The collected responses are sent back to these experts for further input, addition, and comments. The final list of risks in the project is prepared after that. The participants in this technique are anonymous and therefore it helps prevent a person from unduly influencing the others in the group. The Delphi technique helps in reaching the consensus quickly. Expert judgment is a technique based on a set of criteria that has been acquired in a specific knowledge area or product area. It is obtained when the project manager or project team requires specialized knowledge that they do not possess. Expert judgment involves people most familiar with the work of creating estimates. Preferably, the project team member who will be doing the task should complete the estimates. Expert judgment is applied when performing administrative closure activities, and experts should ensure the project or phase closure is performed to the appropriate standards. A function point is a unit of measurement to express the amount of business functionality an information system provides to a user. Function points are the units of measure used by the IFPUG Functional Size Measurement Method. The IFPUG FSM Method is an ISO recognized software metric to size an information system based on the functionality that is perceived by the user of the information system, independent of the technology used to implement the information system. Answer option B is incorrect. A PERT chart is a project management tool used to schedule, organize, and coordinate tasks within a project. PERT stands for Program Evaluation Review Technique, a methodology developed by the U.S. Navy in the 1950s to manage the Polaris submarine missile program. A PERT chart presents a graphic illustration of a project as a network diagram consisting of numbered nodes (either circles or rectangles) representing events, or milestones in the project linked by labeled vectors (directional lines) representing tasks in the project. The direction of the arrows on the lines indicates the sequence of tasks.

• Question 435:

  Which of the following provide an "always on" Internet access service when connecting to an ISP? Each correct answer represents a complete solution. (Choose two.)

  A. Digital modem

  B. Cable modem

  C. Analog modem

  D. DSL

  Correct Answer: DB

  DSL and Cable modems are used in remote-access WAN technology for connecting to the Internet. Both provide an "always on" Internet access service. Answer options C and A are incorrect. Analog and Digital modems are not always in 'ON' mode when connecting to an ISP. Analog modems transmit analog voice signals, while Digital modems transmit digital signals over a link.

• Question 436:

  Which of the following types of coaxial cable is used for cable TV and cable modems?

  A. RG-62

  B. RG-59

  C. RG-58

  D. RG-8

  Correct Answer: B

  RG-59 type of coaxial cable is used for cable TV and cable modems.

  Answer option D is incorrect. RG-8 coaxial cable is primarily used as a backbone in an Ethernet LAN environment and often connects one wiring closet to another. It is also known as 10Base5 or ThickNet.

  Answer option A is incorrect. RG-62 coaxial cable is used for ARCNET and automotive radio antennas.

  Answer option C is incorrect. RG-58 coaxial cable is used for Ethernet networks. It uses baseband signaling and 50-Ohm terminator. It is also known as 10Base2 or ThinNet.

• Question 437:

  Which of the following fields in the IPv6 header is decremented by 1 for each router that forwards the packet?

  A. Flow label

  B. Next header

  C. Traffic class

  D. Hop limit

  Correct Answer: D

  The hop limit field in the IPv6 header is decremented by 1 for each router that forwards a packet. The packet is discarded when the hop limit field reaches zero.

  Answer option B is incorrect. Next header is an 8-bit field that specifies the next encapsulated protocol.

  Answer option A is incorrect. Flow label is a 20-bit field that is used for specifying special router handling from source to destination for a sequence of packets.

  Answer option C is incorrect. Traffic class is an 8-bit field that specifies the Internet traffic priority delivery value.

• Question 438:

  Which of the following is a type of computer security that deals with protection against spurious signals emitted by electrical equipment in the system?

  A. Communication Security

  B. Physical security

  C. Emanation Security

  D. Hardware security

  Correct Answer: C

  Emanation security is one of the types of computer security that deals with protection against spurious signals emitted by electrical equipment in the system, such as electromagnetic emission (from displays), visible emission (displays may be

  visible through windows), and audio emission (sounds from printers, etc). Answer option D is incorrect. Hardware security helps in dealing with the vulnerabilities in the handling of hardware.

  Answer option B is incorrect. Physical security helps in dealing with protection of computer hardware and associated equipment.

  Answer option A is incorrect. Communication security helps in dealing with the protection of data and information during transmission.

• Question 439:

  Which of the following is a Unix and Windows tool capable of intercepting traffic on a network segment and capturing username and password?

  A. AirSnort

  B. Ettercap

  C. BackTrack

  D. Aircrack

  Correct Answer: B

  Ettercap is a Unix and Windows tool for computer network protocol analysis and security auditing. It is capable of intercepting traffic on a network segment, capturing passwords, and conducting active eavesdropping against a number of

  common protocols. It is a free open source software. Ettercap supports active and passive dissection of many protocols (including ciphered ones) and provides many features for network and host analysis. Answer option C is incorrect.

  BackTrack is a Linux distribution distributed as a Live CD, which is used for penetration testing. It allows users to include customizable scripts, additional tools and configurable kernels in personalized distributions. It contains various tools,

  such as Metasploit integration, RFMON injection capable wireless drivers, kismet, autoscan-network (network discovering and managing application), nmap, ettercap, wireshark (formerly known as Ethereal).

  Answer option A is incorrect. AirSnort is a Linux-based WLAN WEP cracking tool that recovers encryption keys. AirSnort operates by passively monitoring transmissions. It uses Ciphertext Only Attack and captures approximately 5 to 10

  million packets to decrypt the WEP keys. Answer option D is incorrect. Aircrack is the fastest WEP/WPA cracking tool used for 802.11a/b/g WEP and WPA cracking.

• Question 440:

  Which of the following network devices operate at the network layer of the OSI model? Each correct answer represents a complete solution. Choose all that apply.

  A. Router

  B. Bridge

  C. Repeater

  D. Gateway

  Correct Answer: AD

  A router is a device that routes data packets between computers in different networks. It is used to connect multiple networks, and it determines the path to be taken by each data packet to its destination computer. A router maintains a routing table of the available routes and their conditions. By using this information, along with distance and cost algorithms, the router determines the best path to be taken by the data packets to the destination computer. A router can connect dissimilar networks, such as Ethernet, FDDI, and Token Ring, and route data packets among them. Routers operate at the network layer (layer 3) of the Open Systems Interconnection (OSI) model. A gateway is a network point that acts as an entrance to another network. On the Internet, a node or stopping point can be either a gateway node or a host (end-point) node. Both the computers of Internet users and the computers that serve pages to users are host nodes. The computers that control traffic within a company's network or at a local Internet service provider (ISP) are gateway nodes. In the network for an enterprise, a computer server acting as a gateway node is often also acting as a proxy server and a firewall server. A gateway is often associated with both a router, which knows where to direct a given packet of data that arrives at the gateway, and a switch, which furnishes the actual path in and out of the gateway for a given packet. Most of the gateways operate at the application layer, but can operate at the network or session layer of the OSI model. Answer option C is incorrect. A repeater operates only at the physical layer of the OSI model. Answer option B is incorrect. A bridge operates at the data link layer of the OSI model.