ExamGecko
Home Home / ECCouncil / 212-82

ECCouncil 212-82 Practice Test - Questions Answers, Page 10

Question list
Search
Search

List of questions

Search

Related questions











A software company has implemented a wireless technology to track the employees' attendance by recording their in and out timings. Each employee in the company will have an entry card that is embedded with a tag. Whenever an employee enters the office premises, he/she is required to swipe the card at the entrance. The wireless technology uses radio-frequency electromagnetic waves to transfer data for automatic identification and for tracking tags attached to objects.

Which of the following technologies has the software company implemented in the above scenario?

A.
WiMAX
A.
WiMAX
Answers
B.
RFID
B.
RFID
Answers
C.
Bluetooth
C.
Bluetooth
Answers
D.
Wi-Fi
D.
Wi-Fi
Answers
Suggested answer: B

Explanation:

RFID (Radio Frequency Identification) is the wireless technology that the software company has implemented in the above scenario. RFID uses radio-frequency electromagnetic waves to transfer data for automatic identification and for tracking tags attached to objects1112. WiMAX (Worldwide Interoperability for Microwave Access) is a wireless technology that provides high-speed broadband access over long distances13. Bluetooth is a wireless technology that enables short-range data communication between devices, such as phones, laptops, printers, etc.14. Wi-Fi (Wireless Fidelity) is a wireless technology that allows devices to connect to a local area network or the internet using radio waves

Matias, a network security administrator at an organization, was tasked with the implementation of secure wireless network encryption for their network. For this purpose, Matias employed a security solution that uses 256-bit Galois/Counter Mode Protocol (GCMP-256) to maintain the authenticity and confidentiality of data.

Identify the type of wireless encryption used by the security solution employed by Matias in the above scenario.

A.
WPA2 encryption
A.
WPA2 encryption
Answers
B.
WPA3 encryption
B.
WPA3 encryption
Answers
C.
WEP encryption
C.
WEP encryption
Answers
D.
WPA encryption
D.
WPA encryption
Answers
Suggested answer: B

Explanation:

WPA3 encryption is the type of wireless encryption used by the security solution employed by Matias in the above scenario. WPA3 encryption is the latest and most secure version of Wi-Fi Protected Access, a protocol that provides authentication and encryption for wireless networks. WPA3 encryption uses 256-bit Galois/Counter Mode Protocol (GCMP-256) to maintain the authenticity and confidentiality of data. WPA3 encryption also provides enhanced protection against offline dictionary attacks, forward secrecy, and secure public Wi-Fi access . WPA2 encryption is the previous version of Wi-Fi Protected Access, which uses Advanced Encryption Standard (AES) or Temporal Key Integrity Protocol (TKIP) for data encryption. WEP encryption is an outdated and insecure version of Wi-Fi security, which uses RC4 stream cipher for data encryption. WPA encryption is an intermediate version of Wi-Fi security, which uses TKIP for data encryption.

Andre, a security professional, was tasked with segregating the employees' names, phone numbers, and credit card numbers before sharing the database with clients. For this purpose, he implemented a deidentification technique that can replace the critical information in database fields with special characters such as asterisks (*) and hashes (#).

Which of the following techniques was employed by Andre in the above scenario?

A.
Tokenization
A.
Tokenization
Answers
B.
Masking
B.
Masking
Answers
C.
Hashing
C.
Hashing
Answers
D.
Bucketing
D.
Bucketing
Answers
Suggested answer: B

Explanation:

Masking is the technique that Andre employed in the above scenario. Masking is a deidentification technique that can replace the critical information in database fields with special characters such as asterisks (*) and hashes (#). Masking can help protect sensitive data from unauthorized access or disclosure, while preserving the format and structure of the original data . Tokenization is a deidentification technique that can replace the critical information in database fields with random tokens that have no meaning or relation to the original data. Hashing is a deidentification technique that can transform the critical information in database fields into fixed-length strings using a mathematical function. Bucketing is a deidentification technique that can group the critical information in database fields into ranges or categories based on certain criteria.

Ryleigh, a system administrator, was instructed to perform a full back up of organizational data on a regular basis. For this purpose, she used a backup technique on a fixed date when the employees are not accessing the system i.e., when a service-level down time is allowed a full backup is taken.

Identify the backup technique utilized by Ryleigh in the above scenario.

A.
Nearline backup
A.
Nearline backup
Answers
B.
Cold backup
B.
Cold backup
Answers
C.
Hot backup
C.
Hot backup
Answers
D.
Warm backup
D.
Warm backup
Answers
Suggested answer: B

Explanation:

Cold backup is the backup technique utilized by Ryleigh in the above scenario. Cold backup is a backup technique that involves taking a full backup of data when the system or database is offline or shut down. Cold backup ensures that the data is consistent and not corrupted by any ongoing transactions or operations. Cold backup is usually performed on a fixed date or time when the service-level downtime is allowed or scheduled . Nearline backup is a backup technique that involves storing data on a medium that is not immediately accessible, but can be retrieved within a short time. Hot backup is a backup technique that involves taking a backup of data while the system or database is online or running. Warm backup is a backup technique that involves taking a backup of data while the system or database is partially online or running.

Jaden, a network administrator at an organization, used the ping command to check the status of a system connected to the organization's network. He received an ICMP error message stating that the IP header field contains invalid information. Jaden examined the ICMP packet and identified that it is an IP parameter problem.

Identify the type of ICMP error message received by Jaden in the above scenario.

A.
Type =12
A.
Type =12
Answers
B.
Type = 8
B.
Type = 8
Answers
C.
Type = 5
C.
Type = 5
Answers
D.
Type = 3
D.
Type = 3
Answers
Suggested answer: A

Explanation:

Type = 12 is the type of ICMP error message received by Jaden in the above scenario. ICMP (Internet Control Message Protocol) is a protocol that sends error and control messages between network devices. ICMP error messages are categorized by types and codes, which indicate the cause and nature of the error. Type = 12 is the type of ICMP error message that indicates an IP parameter problem, which means that the IP header field contains invalid information . Type = 8 is the type of ICMP message that indicates an echo request, which is used to test the connectivity and reachability of a destination host. Type = 5 is the type of ICMP error message that indicates a redirect, which means that a better route to the destination host is available. Type = 3 is the type of ICMP error message that indicates a destination unreachable, which means that the destination host or network cannot be reached.

Dany, a member of a forensic team, was actively involved in an online crime investigation process. Dany's main responsibilities included providing legal advice on conducting the investigation and addressing legal issues involved in the forensic investigation process. Identify the role played by Dany in the above scenario.

A.
Attorney
A.
Attorney
Answers
B.
Incident analyzer
B.
Incident analyzer
Answers
C.
Expert witness
C.
Expert witness
Answers
D.
Incident responder
D.
Incident responder
Answers
Suggested answer: A

Explanation:

Attorney is the role played by Dany in the above scenario. Attorney is a member of a forensic team who provides legal advice on conducting the investigation and addresses legal issues involved in the forensic investigation process. Attorney can help with obtaining search warrants, preserving evidence, complying with laws and regulations, and presenting cases in court3. Reference: Attorney Role in Forensic Investigation

Kaison. a forensic officer, was investigating a compromised system used for various online attacks.

Kaison initiated the data acquisition process and extracted the data from the systems DVD-ROM.

Which of the following types of data did Kaison acquire in the above scenario?

A.
Archival media
A.
Archival media
Answers
B.
Kernel statistics
B.
Kernel statistics
Answers
C.
ARP cache
C.
ARP cache
Answers
D.
Processor cache
D.
Processor cache
Answers
Suggested answer: A

Explanation:

Archival media is the type of data that Kaison acquired in the above scenario. Archival media is a type of data that is stored on removable media such as DVD-ROMs, CD-ROMs, tapes, or flash drives.

Archival media can be used to backup or transfer data from one system to another. Archival media can be acquired using forensic tools that can read and copy the data from the media4. Reference:

Archival Media

Jase. a security team member at an organization, was tasked with ensuring uninterrupted business operations under hazardous conditions. Thus, Jase implemented a deterrent control strategy to minimize the occurrence of threats, protect critical business areas, and mitigate the impact of threats. Which of the following business continuity and disaster recovery activities did Jase perform in this scenario?

A.
Prevention
A.
Prevention
Answers
B.
Response
B.
Response
Answers
C.
Restoration
C.
Restoration
Answers
D.
Recovery
D.
Recovery
Answers
Suggested answer: A

Explanation:

Prevention is the business continuity and disaster recovery activity performed by Jase in this scenario. Prevention is an activity that involves implementing a deterrent control strategy to minimize the occurrence of threats, protect critical business areas, and mitigate the impact of threats. Prevention can include measures such as backup systems, firewalls, antivirus software, or physical security1. Reference: Prevention Activity in BCDR

An organization's risk management team identified the risk of natural disasters in the organization's current location. Because natural disasters cannot be prevented using security controls, the team suggested to build a new office in another location to eliminate the identified risk. Identify the risk treatment option suggested by the risk management team in this scenario.

A.
Risk modification
A.
Risk modification
Answers
B.
Risk avoidance
B.
Risk avoidance
Answers
C.
Risk sharing
C.
Risk sharing
Answers
D.
Risk retention
D.
Risk retention
Answers
Suggested answer: B

Explanation:

Risk avoidance is the risk treatment option suggested by the risk management team in this scenario. Risk avoidance is a risk treatment option that involves eliminating the identified risk by changing the scope, requirements, or objectives of the project or activity. Risk avoidance can be used when the risk cannot be prevented using security controls or when the risk outweighs the benefits2.

Reference: Risk Avoidance

The SOC department in a multinational organization has collected logs of a security event as "Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder of the

-Attacker Maehine-1" and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is 4625.) (Practical Question)

A.
10.10.1.12
A.
10.10.1.12
Answers
B.
10.10.1.10
B.
10.10.1.10
Answers
C.
10.10.1.16
C.
10.10.1.16
Answers
D.
10.10.1.19
D.
10.10.1.19
Answers
Suggested answer: C

Explanation:

The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The logs show that the source network address of the failed logon attempts is 10.10.1.16, which is the IP address of the attacker3. The screenshot below shows an example of viewing one of the logs using Event Viewer4: Reference: Audit Failure Log, [Windows.events.evtx], [Screenshot of Event Viewer showing Audit Failure log]

Total 102 questions
Go to page: of 11