練習できる312-38問題には認定ガイド問題と解答とトレーニングを提供しています
無料EC-COUNCIL 312-38テスト練習問題試験問題集
質問 # 138
Which characteristic of an antenna refers to how directional an antennas radiation pattern is?
- A. Polarization
- B. Directivity
- C. Radiation pattern
- D. Typical gain
正解：C
質問 # 139
Which of the following is a drawback of traditional perimeter security?
- A. Traditional firewalls are dynamic in nature
- B. Traditional VPNs follow identity centric instead of trust based network centric approach
- C. Traditional perimeter security is identity-centric
- D. Traditional firewalls are static in nature
正解：D
解説：
One of the main drawbacks of traditional perimeter security is that it is based on a static model. Traditional firewalls, which are a core component of perimeter security, operate under the assumption that threats can be prevented by establishing a strong, static boundary. This model does not adapt well to the dynamic nature of modern networks, where users, devices, and applications are constantly changing and may exist outside of the traditional network boundary. The static nature of traditional firewalls means they cannot effectively handle the fluid and evolving security demands of today's interconnected environments.
質問 # 140
If a network is at risk from unskilled individuals, what type of threat is this?
- A. Unstructured Threats
- B. External Threats
- C. Internal Threats
- D. Structured Threats
正解：A
質問 # 141
Which of the following filters can be used to detect UDP scan attempts using Wireshark?
- A. icmp.type==15
- B. icmp.type==8 or icmp.type==0
- C. icmp.type==3 and icmp.code==3
- D. icmp.type==13
正解：C
解説：
The correct filter to detect UDP scan attempts using Wireshark is not listed among the options provided. To detect UDP scan attempts, a Wireshark filter that targets UDP traffic specifically would be used, rather than an ICMP type and code filter. A common method to detect a UDP scan is to look for a large amount of UDP packets sent to different ports, which can be indicative of a scanning activity. The filter would typically include parameters that isolate UDP traffic, such as udp.port or udp.dstport combined with a range or list of ports.
質問 # 142
Which of the following is an open source implementation of the syslog protocol for Unix?
- A. syslog Unix
- B. syslog-os
- C. syslog-ng
- D. Unix-syslog
正解：C
質問 # 143
Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.
- A. They can be removed completely by taking proper actions.
- B. They are considered an indicator of threats coupled with vulnerability.
- C. They can be mitigated by reviewing and taking responsible actions based on possible risks.
- D. They can be analyzed and measured by the risk analysis process.
正解：B、C、D
質問 # 144
Michelle is a network security administrator working in an MNC company. She wants to set a resource limit for CPU in a container. Which command-line allows Michelle to limit a container to 2 CPUs?
- A. $cpu="2"
- B. $cpus="2"
- C. --cpu="2"
- D. --cpus="2"
正解：D
解説：
In the context of containerization, setting resource limits is crucial for ensuring that applications do not consume more than their fair share of system resources. Michelle can limit a container to use only 2 CPUs by using the --cpus flag when running a container. This flag allows the user to specify the amount of CPU the container is limited to use. For example, --cpus="2" would restrict the container to using no more than two CPU cores.
References: This information is based on standard practices for managing Docker containers and their resources. The --cpus flag is a well-documented feature in Docker's command-line interface for controlling CPU usage1.
質問 # 145
Mark is monitoring the network traffic on his organization's network. He wants to detect a TCP and UDP ping sweep on his network. Which type of filter will be used to detect this on the network?
- A. Tcp.srcport==7 and udp.srcport==7
- B. Tcp.srcport==7 and udp.dstport==7
- C. Tcp.dstport==7 and udp.dstport==7
- D. Tcp.dstport==7 and udp.srcport==7
正解：C
解説：
To detect TCP and UDP ping sweeps on a network, the appropriate filter would be one that checks for packets directed at port 7, which is commonly used for the 'echo' service. This service is associated with ping functionality for both TCP and UDP protocols. Therefore, the correct filter to use would be Tcp.dstport==7 and udp.dstport==7, which checks for incoming packets where the destination port is 7 for both TCP and UDP traffic. This allows Mark to identify ping sweep attempts, as these would typically send packets to this port to elicit a response from the network.
質問 # 146
How can organizations obtain information about threats through human intelligence?
- A. By extracting information from security blogs and forums
- B. From the data of past incidents and network monitoring
- C. From attackers through the dark web and honeypots
- D. By discovering vulnerabilities through exploration, understanding malware behavior through malware processing, etc.
正解：A
解説：
Human intelligence (HUMINT) in the context of network defense involves the collection of information from human sources. This can include extracting insights from security blogs, forums, and other platforms where cybersecurity professionals and enthusiasts discuss vulnerabilities, threats, and incidents. By monitoring these discussions, organizations can gain valuable information about emerging threats, techniques used by attackers, and potential security weaknesses that need to be addressed.
References: The role of human intelligence in gathering threat information is highlighted in cybersecurity literature. For example, CrowdStrike discusses the importance of HUMINT in cybersecurity, noting that it involves engaging with threat actors on various platforms to gather information about their activities1. Additionally, the IEEE paper on "Gathering threat intelligence through computer network deception" emphasizes the significance of proactive threat intelligence development by network defenders2.
質問 # 147
Which of the following statements are true about security risks? Each correct answer represents a complete solution. (Choose three.)
- A. They can be removed completely by taking proper actions.
- B. They are considered an indicator of threats coupled with vulnerability.
- C. They can be mitigated by reviewing and taking responsible actions based on possible risks.
- D. They can be analyzed and measured by the risk analysis process.
正解：B、C、D
解説：
In information security, security risks are considered an indicator of threats coupled with vulnerability. In other words, security risk is a probabilistic function of a given threat agent exercising a particular vulnerability and the impact of that risk on the organization. Security risks can be mitigated by reviewing and taking responsible actions based on possible risks. These risks can be analyzed and measured by the risk analysis process.
Answer option B is incorrect. Security risks can never be removed completely but can be mitigated by taking proper actions.
質問 # 148
Which of the following layers provides communication session management between host computers?
- A. Link layer
- B. Internet layer
- C. Transport layer
- D. Application layer
正解：C
質問 # 149
John works as an Incident manager for TechWorld Inc. His task is to set up a wireless network for his organization. For this, he needs to decide the appropriate devices and policies required to set up the network. Which of the following phases of the incident handling process will help him accomplish the task?
- A. Preparation
- B. Containment
- C. Eradication
- D. Recovery
正解：A
質問 # 150
Which category of suspicious traffic signatures includes SYN flood attempts?
- A. Reconnaissance
- B. Denial of Service
- C. Informational
- D. Unauthorized access
正解：B
解説：
SYN flood attempts are a type of Denial of Service (DoS) attack. They are designed to exploit the TCP handshake process by sending a large number of SYN packets to a target server, which can overwhelm the server's resources and prevent legitimate users from establishing a connection. The goal of a SYN flood is not to gain unauthorized access or gather information, but rather to disrupt the normal operation of a service, making it a Denial of Service attack.
質問 # 151
Fill in the blank with the appropriate term. ______________ is an open wireless technology standard for exchanging data over short distances from fixed and mobile devices.
正解：
解説：
Bluetooth
質問 # 152
Which of the following protocols is used to share information between routers to transport IP Multicast packets among networks?
- A. RSVP
- B. RPC
- C. LWAPP
- D. DVMRP
正解：D
解説：
The Distance Vector Multicast Routing Protocol (DVMRP) is used to share information between routers to transport IP Multicast packets among networks. It uses a reverse path-flooding technique and is used as the basis for the Internet's multicast backbone (MBONE). In particular, DVMRP is notorious for poor network scaling, resulting from reflooding, particularly with versions that do not implement pruning. DVMRP's flat unicast routing mechanism also affects its capability to scale. Answer option A is incorrect. The Resource Reservation Protocol (RSVP) is a Transport layer protocol designed to reserve resources across a network for an integrated services Internet. RSVP does not transport application data but is rather an Internet control protocol, like ICMP, IGMP, or routing protocols. RSVP provides receiver-initiated setup of resource reservations for multicast or unicast data flows with scaling and robustness. RSVP can be used by either hosts or routers to request or deliver specific levels of quality of service (QoS) for application data streams. RSVP defines how applications place reservations and how they can leave the reserved resources once the need for them has ended. RSVP operation will generally result in resources being reserved in each node along a path. Answer option C is incorrect. A remote procedure call (RPC) hides the details of the network by using the common procedure call mechanism familiar to every programmer. Like any ordinary procedure, RPC is also synchronous and parameters are passed to it. A process of the client calls a function on a remote server and remains suspended until it gets back the results. Answer option D is incorrect. LWAPP (Lightweight Access Point Protocol) is a protocol used to control multiple Wi-Fi wireless access points at once. This can reduce the amount of time spent on configuring, monitoring, or troubleshooting a large network. This also allows network administrators to closely analyze the network.
質問 # 153
Which of the following is an Internet application protocol used for transporting Usenet news articles between news servers and for reading and posting articles by end-user client applications?
- A. BOOTP
- B. NTP
- C. NNTP
- D. DCAP
正解：C
解説：
The Network News Transfer Protocol (NNTP) is an Internet application protocol used for transporting Usenet news articles (netnews) between news servers and for reading and posting articles by end user client applications. NNTP is designed so that news articles are stored in a central database, allowing the subscriber to select only those items that he wants to read. Answer option D is incorrect. Network Time Protocol (NTP) is used to synchronize the timekeeping among the number of distributed time servers and clients. It is used for the time management in a large and diverse network that contains many interfaces. In this protocol, servers define the time, and clients have to be synchronized with the defined time. These clients can choose the most reliable source of time defined from the several NTP servers for their information transmission. Answer option C is incorrect. The Data Link Switching Client Access Protocol (DCAP) is an application layer protocol that is used between workstations and routers for transporting SNA/NetBIOS traffic over TCP sessions. It was introduced in order to address a few deficiencies by the Data Link Switching Protocol (DLSw). The DLSw raises the important issues of scalability and efficiency, and since DLSw is a switch-to-switch protocol, it is not efficient when implemented on workstations. DCAP was introduced in order to address these issues. Answer option B is incorrect. The BOOTP protocol is used by diskless workstations to collect configuration information from a network server. It is also used to acquire a boot image from the server.
質問 # 154
......
試験準備には欠かさない！トップクラスのEC-COUNCIL 312-38試験アプリ学習ガイドで練習問題最新版：https://www.passtest.jp/EC-COUNCIL/312-38-shiken.html
問題集練習試験問題学習ガイドは312-38試験：https://drive.google.com/open?id=1bV-dM1Fzs0P3V6PobEjm2SIDFdXFzbk6