312-50v10 Sample Questions & Answers

Anomaly-based IDS systems can identify unknown attacks by establishing a baseline of normal network behavior and flagging deviations from this baseline. Unlike signature-based IDS that only detect known attack patterns, anomaly-based systems can detect zero-day attacks and novel attack techniques that have not been previously catalogued.

The command "compmgmt.msc" launches the Computer Management Console in Windows. The .msc extension indicates a Microsoft Management Console snap-in, and compmgmt is the specific snap-in for computer management functions including disk management, services, and system tools.

HIPAA (Health Insurance Portability and Accountability Act) requires the use of standard national employer identification numbers for healthcare transactions. This standardization helps ensure proper identification of healthcare entities in electronic transactions and maintains consistency across the healthcare industry.

Wireshark displays packet data in the packet bytes pane in hexadecimal format, with corresponding ASCII representation on the right. This hex format allows security professionals to analyze raw packet contents at the byte level, which is essential for protocol analysis and network forensics.

DNSSEC (DNS Security Extensions) provides cryptographic authentication for DNS data, ensuring the integrity and authenticity of DNS responses. It uses digital signatures to verify that DNS responses have not been tampered with, effectively preventing DNS spoofing, cache poisoning, and man-in-the-middle attacks on DNS queries.

PGP (Pretty Good Privacy), SSL/TLS, and IKE (Internet Key Exchange) are all examples of public key cryptography systems. These protocols use asymmetric encryption with public and private key pairs to establish secure communications, authenticate parties, and exchange symmetric keys securely.

TCP Connect scan (also called Full Open scan) is the most reliable form of TCP scanning because it completes the full three-way handshake with the target port. This provides accurate results about port states, though it is also the most detectable method since it establishes complete connections that are logged by the target system.

SYN/FIN scanning using IP fragments splits the TCP header across multiple IP packets, making it difficult for packet filters and firewalls to detect the scanning attempt. This fragmentation technique helps evade detection systems that cannot reassemble fragmented packets to analyze the complete TCP header.

Using encryption protocols like HTTPS, SSL/TLS, VPN, and SSH is the best defense against network sniffing because encrypted communications remain unreadable even if intercepted. While physical security and network segmentation help, encryption ensures that captured packets cannot reveal sensitive information to attackers.

Encryption is the most effective method to evade Network-Based Intrusion Detection Systems (NIDS) because encrypted traffic cannot be analyzed for malicious content patterns. When outgoing traffic is encrypted using protocols like SSL/TLS or VPN, the NIDS cannot inspect the packet contents to detect suspicious activities or attack signatures.