EC-COUNCIL EC-COUNCIL Certifications 312-39 Questions & Answers

• Question 81:

  Which of the following Windows features is used to enable Security Auditing in Windows?

  A. Bitlocker

  B. Windows Firewall

  C. Local Group Policy Editor

  D. Windows Defender

  Correct Answer: C

  Reference: https://resources.infosecinstitute.com/topic/how-to-audit-windows-10-application-logs/

• Question 82:

  Which of the following is a report writing tool that will help incident handlers to generate efficient reports on detected incidents during incident response process?

  A. threat_note

  B. MagicTree

  C. IntelMQ

  D. Malstrom

  Correct Answer: C

• Question 83:

  An organization is implementing and deploying the SIEM with following capabilities.

  

  What kind of SIEM deployment architecture the organization is planning to implement?

  A. Cloud, MSSP Managed

  B. Self-hosted, Jointly Managed C. Self-hosted, Self-Managed

  D. Self-hosted, MSSP Managed

  Correct Answer: A

• Question 84:

  What is the process of monitoring and capturing all data packets passing through a given network using different tools?

  A. Network Scanning

  B. DNS Footprinting

  C. Network Sniffing

  D. Port Scanning

  Correct Answer: C

  Reference: https://www.greycampus.com/opencampus/ethical-hacking/sniffing-and-its-types

• Question 85:

  Juliea a SOC analyst, while monitoring logs, noticed large TXT, NULL payloads. What does this indicate?

  A. Concurrent VPN Connections Attempt

  B. DNS Exfiltration Attempt

  C. Covering Tracks Attempt

  D. DHCP Starvation Attempt

  Correct Answer: B

  Reference: https://www.google.com/url?sa=tandrct=jandq=andesrc=sandsource=webandcd=andved=2ahUKEwj8gZaKq_PuAhWGi1wKHfQTC0oQFjAAegQIARADandurl=https%3A%2F%2Fconf.splunk.com%2Fsession%2F2014% 2Fconf2014_FredWilmotSanfordOwings_Splunk_Security.pdfandusg=AOvVaw3ZLfzGqM-VUG7xKtze67ac

• Question 86:

  Which of the following formula is used to calculate the EPS of the organization?

  A. EPS = average number of correlated events / time in seconds

  B. EPS = number of normalized events / time in seconds

  C. EPS = number of security events / time in seconds

  D. EPS = number of correlated events / time in seconds

  Correct Answer: A

• Question 87:

  Which of the following technique involves scanning the headers of IP packets leaving a network to make sure that the unauthorized or malicious traffic never leaves the internal network?

  A. Egress Filtering

  B. Throttling

  C. Rate Limiting

  D. Ingress Filtering

  Correct Answer: A

  Reference: https://grokdesigns.com/wp-content/uploads/2018/04/CEH-v9-Notes.pdf (99)

• Question 88:

  Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

  A. $ tailf /var/log/sys/kern.log

  B. $ tailf /var/log/kern.log

  C. # tailf /var/log/messages

  D. # tailf /var/log/sys/messages

  Correct Answer: B

  Reference: https://tecadmin.net/enable-logging-in-iptables-on-linux/

• Question 89:

  According to the Risk Matrix table, what will be the risk level when the probability of an attack is very low and the impact of that attack is major?

  A. High

  B. Extreme

  C. Low

  D. Medium

  Correct Answer: C

  Reference: https://www.moheri.gov.om/userupload/Policy/IT%20Risk%20Management%20Framework.pdf (17)

• Question 90:

  The Syslog message severity levels are labelled from level 0 to level 7. What does level 0 indicate?

  A. Alert

  B. Notification

  C. Emergency

  D. Debugging

  Correct Answer: B