312-38: Certified Network DefenderDemo

Which of the following is a distributed multi-access network that supports integrated communications by using a dual bus and distributed queuing?

Which of the following is a network that links two or more LANs within the same geographical area?

Which BC/DR activity assumes that the most critical processes are restored from a remote location first, with less critical functions following?

Which IPv6 header field is reduced by 1 by every router that forwards the packet?

James is a network administrator at a student loan company in Minnesota. The company processes more than 20,000 student loans each year from colleges throughout the state. Most communication among the company, schools, and lenders occurs through email. Much of the company's email communication contains sensitive data, such as Social Security numbers. For this reason, James wants to use email encryption. Because a server-based PKI is not an option, he is seeking a low- or no-cost solution to encrypt email. What should James use?

David works for a mid-sized IT company. Management asks him to recommend a framework that can effectively align the company’s IT goals with its business goals. David recommends the _________ framework because it provides a set of IT controls and consolidates them into a framework.

Assume you are a network administrator at a bank’s head office. One day, a bank employee tells you that she cannot log in to her system. At the same time, another network administrator calls to report a problem connecting to the main server. How would you prioritize these two incidents?

Daniel, a junior network defender, is setting up a security-monitoring system to track unusual login patterns and after-hours access attempts. He wants the dashboards to enable prompt action by helping the team identify subtle risk trends during routine analysis. Which KRI feature is Daniel using in this configuration?

Which of the following is a digital telephone/telecommunications network that transports voice, data, and video over existing telephone-network infrastructure?

Brian, a security architect at a data center, is assessing virtualization methods to run legacy applications on isolated operating systems without changing them. The method must ensure the guest operating systems do not know they are running in a virtualized environment. He also needs close control of hardware-resource allocation through a virtual machine monitor (VMM) that intercepts and translates commands from the guest systems. Which virtualization approach best meets Brian’s requirement?

Which of these network-scanning tools is a TCP/UDP port scanner that also functions as a ping sweeper and hostname resolver?

Which of the following plans are documented and organized emergency backup and recovery operations maintained as part of the security program to ensure the availability of critical resources and support continuity of operations in an emergency?

A network defender must prevent malware from quietly disabling antivirus protection and changing system-wide settings on shared employee workstations. The objective is to enforce an access-control feature that restricts application privileges, even when applications are launched by users with administrative rights, and prompts users before any application tries to make system-level changes. Which Windows feature should the defender configure to satisfy this requirement?

Which of the following representatives are included on the incident response team during the incident response process? Each correct answer represents a complete solution. Choose all that apply.

Which of the following refers to virtually unsolicited email messages—often commercial in content—sent in large quantities to an indiscriminate group of recipients? Each correct answer represents a complete solution.

This Windows-based tool is used to detect wireless LANs that use the IEEE 802.11a, 802.11b, and 802.11g standards. Its principal features include the following:

• Displays a wireless network’s signal strength, MAC address, SSID, channel details, and so on.
• Is commonly used for:
  • a. War driving
  • b. Detecting unauthorized access points
  • c. Detecting causes of interference on a WLAN
  • d. WEP ICV error tracking
  • e. Creating graphs and alarms on 802.11 data, including signal strength

This tool is known as __________.

A university campus network administrator is investigating an incident in which an unauthorized host was able to inject traffic into a VLAN to which it was not assigned. The attacker impersonated a network device to form a link with the switch and obtained access to multiple VLANs by abusing negotiation on a default-configured port. Which configuration change would best prevent this kind of VLAN breach?

Sean has established a site-to-site VPN architecture between his company’s head office and branch office. When users at the branch office and head office communicate with each other, the traffic is encapsulated. As the traffic passes through the gateway, it is encapsulated again. Both the header and payload are encapsulated. This second encapsulation occurs only in the __________ VPN implementation.

Which of these IEEE standards operates in the 2.4 GHz band and transfers data at 54 Mbps?

A logistics company suffers a fire that damages every on-premises server. Its IT administrator restores the latest backup from an offsite cloud provider, but critical updates from the preceding three days are absent. The organization scheduled full backups weekly and configured a different backup type daily. Which backup type was misconfigured or failed to run correctly?

Which VPN QoS model guarantees traffic from one customer edge (CE) to another?

Which of the following network devices function at the network layer of the OSI model? Each correct answer represents a complete solution. Choose all that apply.

While conducting routine network monitoring, a network defender observes that finance-department systems are sending responses meant for the payroll application server to an unknown device on the same subnet. After examining the ARP cache on the affected clients, he finds that the MAC address mapped to the payroll server’s IP address has been replaced by the unfamiliar device’s MAC address. No DNS settings or routing rules have changed. Which network-level attack technique causes this behavior?