Free Access to EC-COUNCIL.312-38.v2024-08-10.q281 with Valid Practice Test (Page 16)

Question 71

Which of the following tools is described below? It is a set of tools that are used for sniffing passwords, e-mail, and HTTP traffic. Some of its tools include arpredirect, macof, tcpkill, tcpnice, filesnarf, and mailsnarf. It is highly effective for sniffing both switched and shared networks. It uses the arpredirect and macof tools for switching across switched networks. It can also be used to capture authentication information for FTP, telnet, SMTP, HTTP, POP, NNTP, IMAP,
etc.

A.Dsniff
B.Cain
C.Libnids
D.LIDS

Question 72

Which of the following are the six different phases of the Incident handling process? Each correct answer
represents a complete solution. Choose all that apply.

A.Containment
B.Identification
C.Post mortem review
D.Preparation
E.Lessons learned
F.Recovery
G.Eradication

Correct Answer: A,B,D,E,F,G

Following are the six different phases of the Incident handling process:
1.Preparation: Preparation is the first step in the incident handling process. It includes processes like backing
up copies of all key data on a regular basis, monitoring and updating software on a regular basis, and creating
and implementing a documented security policy. To apply this step a documented security policy is formulated
that outlines the responses to various incidents, as a reliable set of instructions during the time of an incident.
The following list contains items that the incident handler should maintain in the preparation phase i.e. before
an incident occurs:
Establish applicable policies
Build relationships with key players
Build response kit
Create incident checklists
Establish communication plan
Perform threat modeling
Build an incident response team
Practice the demo incidents
2.Identification: The Identification phase of the Incident handling process is the stage at which the Incident
handler evaluates the critical level of an incident for an enterprise or system. It is an important stage where the
distinction between an event and an incident is determined, measured and tested.
3.Containment: The Containment phase of the Incident handling process supports and builds up the incident
combating process. It helps in ensuring the stability of the system and also confirms that the incident does not
get any worse.
4.Eradication: The Eradication phase of the Incident handling process involves the cleaning-up of the identified
harmful incidents from the system. It includes the analyzing of the information that has been gathered for
determining how the attack was committed. To prevent the incident from happening again, it is vital to
recognize how it was conceded out so that a prevention technique is applied.
5.Recovery: Recovery is the fifth step of the incident handling process. In this phase, the Incident Handler
places the system back into the working environment. In the recovery phase the Incident Handler also works
with the questions to validate that the system recovery is successful. This involves testing the system to make
sure that all the processes and functions are working normal. The Incident Handler also monitors the system to
make sure that the systems are not compromised again. It looks for additional signs of attack.
6.Lessons learned: Lessons learned is the sixth and the final step of incident handling process. The Incident
Handler utilizes the knowledge and experience he learned during the handling of the incident to enhance and
improve the incident-handling process. This is the most ignorant step of all incident handling processes. Many
times the Incident Handlers are relieved to have systems back to normal and get busy trying to catch up other
unfinished work. The Incident Handler should make documents related to the incident or look for ways to
improve the process.
Answer option C is incorrect. The post mortem review is one of the phases of the Incident response process.

Question 73

CORRECT TEXT
Fill in the blank with the appropriate file system. Alternate Data Streams (ADS) is a feature of the______________ file system, allowing more than one data stream to be associated with a filename.

Question 74

Which type of wireless network attack is characterized by an attacker using a high gain amplifier from a nearby location to drown out the legitimate access point signal?

A.Jamming signal attack
B.Ad Hoc Connection attack
C.Rogue access point attack
D.Unauthorized association

Question 75

Individuals in the organization using system resources in a way that violates acceptable usage policies indicates which of the following security incident(s):

A.Denial-of-Service (DoS)
B.Malicious Code
C.Unauthorized Access
D.Improper Usage

Question 71

Question 72

Question 73

Question 74

Question 75

Download PDF File