QUESTION: 13

Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

$ tailf /var/log/sys/kern.log
$ tailf /var/log/kern.log
# tailf /var/log/messages
# tailf /var/log/sys/messages

Answer(s): B

Reference:

https://tecadmin.net/enable-logging-in-iptables-on-linux/

Show Answer Next Question

QUESTION: 14

Which of the following technique involves scanning the headers of IP packets leaving a network to make sure that the unauthorized or malicious traffic never leaves the internal network?

Egress Filtering
Throttling
Rate Limiting
Ingress Filtering

Answer(s): A

Reference:

https://grokdesigns.com/wp-content/uploads/2018/04/CEH-v9-Notes.pdf (99)

Show Answer Next Question

QUESTION: 15

Which of the following formula is used to calculate the EPS of the organization?

EPS = average number of correlated events / time in seconds
EPS = number of normalized events / time in seconds
EPS = number of security events / time in seconds
EPS = number of correlated events / time in seconds

Answer(s): A

Show Answer Next Question

QUESTION: 16

Juliea a SOC analyst, while monitoring logs, noticed large TXT, NULL payloads. What does this indicate?

Concurrent VPN Connections Attempt
DNS Exfiltration Attempt
Covering Tracks Attempt
DHCP Starvation Attempt

Answer(s): B

Reference:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8gZaKq_PuAhWGi1wKHfQTC0oQFjAAegQIARAD&url=https%3A%2F%2Fconf.splunk.com%2Fsession%2F2014%2Fconf2014_FredWilmotSanfordOwings_Splunk_Security.pdf&usg=AOvVaw3ZLfzGqM-VUG7xKtze67ac

Show Answer Next Question

Free EC-Council 312-39 Exam Braindumps (page: 5)

QUESTION: 13

Reference:

QUESTION: 14

Reference:

QUESTION: 15

QUESTION: 16

Reference:

312-39 Exam Discussions & Posts