EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 371:

  George is the network administrator of a large Internet company on the west coast. Per corporate policy,

  none of the employees in the company are allowed to use FTP or SFTP programs without obtaining

  approval from the IT department. Few managers are using SFTP program on their computers. Before

  talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to

  monitor network traffic, but only SFTP traffic to and from his network.

  What filter should George use in Ethereal?

  A. src port 23 and dst port 23

  B. udp port 22 and host 172.16.28.1/24

  C. net port 22

  D. src port 22 and dst port 22

  Correct Answer: D

• Question 372:

  At what layer of the OSI model do routers function on?

  A. 4

  B. 3

  C. 1

  D. 5

  Correct Answer: B

• Question 373:

  Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

  A. APIPA

  B. IANA

  C. CVE

  D. RIPE

  Correct Answer: C

• Question 374:

  After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks. What countermeasures could he take to prevent DDoS attacks?

  A. Enable direct broadcasts

  B. Disable direct broadcasts

  C. Disable BGP

  D. Enable BGP

  Correct Answer: B

• Question 375:

  George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation?

  A. Nessus is too loud

  B. Nessus cannot perform wireless testing

  C. Nessus is not a network scanner

  D. There are no ways of performing a "stealthy" wireless scan

  Correct Answer: A

• Question 376:

  John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?

  A. Firewalk cannot pass through Cisco firewalls

  B. Firewalk sets all packets with a TTL of zero

  C. Firewalk cannot be detected by network sniffers

  D. Firewalk sets all packets with a TTL of one

  Correct Answer: D

• Question 377:

  George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time-based induction machine" be used.

  What IDS feature must George implement to meet this requirement?

  A. Signature-based anomaly detection

  B. Pattern matching

  C. Real-time anomaly detection

  D. Statistical-based anomaly detection

  Correct Answer: C

• Question 378:

  Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages. What networking protocol language should she learn that routers utilize?

  A. ATM

  B. UDP

  C. BPG

  D. OSPF

  Correct Answer: D

• Question 379:

  What is the target host IP in the following command?

  A. 172.16.28.95

  B. 10.10.150.1

  C. Firewalk does not scan target hosts

  D. This command is using FIN packets, which cannot scan target hosts

  Correct Answer: A

• Question 380:

  Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?

  A. EFS Encryption

  B. DFS Encryption

  C. IPS Encryption

  D. SDW Encryption

  Correct Answer: A