Discuss EC-Council 312-38 Exam Topic 6 Question 89

How can one identify the baseline for normal traffic?

AWhen the ACK flag appears at the beginning and the RST flag appears at the end of the connection

BWhen the SYN flag appears at the beginning and the FIN flag appears at the end of the connection

CWhen the RST flag appears at the beginning and the ACK flag appears at the end of the connection

DWhen the FIN flag appears at the beginning and the SYN flag appears at the end of the connection

Suggested Answer: B

Circuit-level gateway firewall technology operates at the session layer of the OSI model. This type of firewall validates TCP or UDP sessions before allowing traffic through, without inspecting the contents of the data packets. It acts as a handshaking device between trusted clients or servers and untrusted hosts, ensuring that the session packets adhere to established rules for a connection.The session layer, which is Layer 5 in the OSI model, is responsible for setting up, managing, and terminating the connections between applications1234.

Get Premium 312-38 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Xuan 11 months ago

Agreed, B is the standard for identifying normal traffic!

Gail 11 months ago

C is incorrect, right? RST doesn't start a normal connection.

Alida 11 months ago

Wait, can you really use SYN and FIN for baseline? Sounds off.

Mitsue 12 months ago

I thought it was A at first, but B makes more sense.

Audria 12 months ago

Definitely B! SYN and FIN are the way to go.

Lorean 1 year ago

From what I recall, the SYN flag should be at the beginning and the FIN flag at the end, which makes me lean towards option B.

Raul 1 year ago

I’m a bit confused about the RST flag. I thought it was used for resetting connections, so I’m not sure how it fits into identifying normal traffic.

Matt 1 year ago

I remember practicing a question about TCP flags, and I feel like the SYN flag is definitely involved at the start of a connection.

Georgeanna 1 year ago

I think the baseline for normal traffic is related to the SYN and FIN flags, but I'm not entirely sure if it's option B or D.

Dottie 1 year ago

I'm not too confident on this one. The TCP flags are definitely relevant, but I'm not sure which specific combination would indicate the "baseline" for normal traffic. I'll have to review my notes and try to reason through the logic here.

Rosalind 1 year ago

Okay, I've got this. The baseline for normal traffic would be when the SYN flag appears at the beginning and the FIN flag appears at the end of the connection. That's the standard TCP handshake and connection termination process.

Brent 1 year ago

Hmm, I'm a bit confused on this one. I know the TCP flags are important, but I'm not sure which combination would indicate the "baseline" for normal traffic. I'll have to think this through carefully.

Derick 1 year ago

This is a tricky one, but I think the key is to look at the TCP flags. The question is asking about identifying the "baseline" for normal traffic, so I'm guessing we need to look for the typical TCP connection setup and teardown.

Dulce 1 year ago

Hmm, I'm not sure about the "persona type" option. I'll have to double-check the requirements for creating a virtual volume on the 3PAR array.

Aja 1 year ago

Custom Vision is definitely the way to go. That service is designed for building custom image classification models, which is exactly what this use case requires.

Tequila 1 year ago

Hmm, I'm feeling a bit FINicky about this question. Maybe we should just SYN-chronize our answers and hope for the best?

Brent 1 year ago

↳ replying to Tequila

C) When the RST flag appears at the beginning and the ACK flag appears at the end of the connection

Art 1 year ago

↳ replying to Tequila

B) When the SYN flag appears at the beginning and the FIN flag appears at the end of the connection

Sarah 1 year ago

↳ replying to Tequila

A) When the ACK flag appears at the beginning and the RST flag appears at the end of the connection

Rolland 2 years ago

Guys, guys, guys... let's not complicate this. The baseline for normal traffic is clearly when the ACK flag appears at the beginning and the RST flag appears at the end. Option A is the one!

Stephen 2 years ago

Wait, wait, wait... aren't we supposed to be looking for the normal traffic pattern? I'm pretty sure that's when the SYN flag kicks things off and the FIN flag wraps it up. B is the way to go!

Lemuel 2 years ago

Nah, I'm pretty sure the correct answer is when the RST flag appears at the beginning and the ACK flag appears at the end. That's option C.

Tess 1 year ago

↳ replying to Lemuel

I'm not sure, but I think it might be when the FIN flag appears at the beginning and the SYN flag appears at the end. That's option D.

Carmela 1 year ago

↳ replying to Lemuel

Actually, I think it's when the ACK flag appears at the beginning and the RST flag appears at the end. That's option A.

Marta 1 year ago

↳ replying to Lemuel

I disagree, I believe it's when the SYN flag appears at the beginning and the FIN flag appears at the end. That's option B.

Cecilia 1 year ago

↳ replying to Lemuel

I think the correct answer is when the RST flag appears at the beginning and the ACK flag appears at the end. That's option C.

Wenona 2 years ago

Hmm, I think the baseline for normal traffic would be when the SYN flag appears at the beginning and the FIN flag appears at the end of the connection. That's option B, right?

Billi 2 years ago

I think the correct answer is C) When the RST flag appears at the beginning and the ACK flag appears at the end of the connection. This makes more sense in terms of establishing a baseline for normal traffic.

Lonna 2 years ago

I disagree, I believe it's when the ACK flag appears at the beginning and the RST flag appears at the end of the connection.

Billi 2 years ago

I think the baseline for normal traffic is when the SYN flag appears at the beginning and the FIN flag appears at the end of the connection.

EC-Council 312-38 Exam - Topic 6 Question 89 Discussion