EC-COUNCIL Other ECCouncil 312-39 Questions & Answers

• Question 1:

  Which of the following attack can be eradicated by converting all non-alphanumeric characters to HTML character entities before displaying the user input in search engines and forums?

  A. Broken Access Control Attacks

  B. Web Services Attacks

  C. XSS Attacks

  D. Session Management Attacks

  Correct Answer: C

  Reference: https://ktflash.gitbooks.io/ceh_v9/content/125_countermeasures.html

• Question 2:

  Jony, a security analyst, while monitoring IIS logs, identified events shown in the figure below.

  

  What does this event log indicate?

  A. Parameter Tampering Attack

  B. XSS Attack

  C. Directory Traversal Attack

  D. SQL Injection Attack

  Correct Answer: A

• Question 3:

  Which attack works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

  A. Hybrid Attack

  B. Bruteforce Attack

  C. Rainbow Table Attack

  D. Birthday Attack

  Correct Answer: B

  Reference: https://www.techrepublic.com/article/brute-force-and-dictionary-attacks-a-cheat-sheet/

• Question 4:

  Identify the HTTP status codes that represents the server error.

  A. 2XX

  B. 4XX

  C. 1XX

  D. 5XX

  Correct Answer: D

  Reference: https://www.tutorialspoint.com/http/http_status_codes.htm

• Question 5:

  Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT.

  What is the first step that the IRT will do to the incident escalated by Emmanuel?

  A. Incident Analysis and Validation

  B. Incident Recording

  C. Incident Classification

  D. Incident Prioritization

  Correct Answer: C

• Question 6:

  David is a SOC analyst in Karen Tech. One day an attack is initiated by the intruders but David was not able to find any suspicious events.

  This type of incident is categorized into __________?

  A. True Positive Incidents

  B. False positive Incidents

  C. True Negative Incidents

  D. False Negative Incidents

  Correct Answer: C

• Question 7:

  Which of the following service provides phishing protection and content filtering to manage the Internet experience on and off your network with the acceptable use or compliance policies?

  A. Apility.io

  B. Malstrom

  C. OpenDNS

  D. I-Blocklist

  Correct Answer: C

  Reference: https://www.spamtitan.com/web-filtering/category/cybersecurity-advice/

• Question 8:

  If the SIEM generates the following four alerts at the same time:

  I. Firewall blocking traffic from getting into the network alerts

  II. SQL injection attempt alerts

  III. Data deletion attempt alerts

  IV. Brute-force attempt alerts

  Which alert should be given least priority as per effective alert triaging?

  A. III

  B. IV

  C. II

  D. I

  Correct Answer: D

• Question 9:

  InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC.

  Identify the job role of John.

  A. Security Analyst – L1

  B. Chief Information Security Officer (CISO)

  C. Security Engineer

  D. Security Analyst – L2

  Correct Answer: B

  Reference: https://www.exabeam.com/security-operations-center/security-operations-center-roles-andresponsibilities/

• Question 10:

  Which of the following threat intelligence helps cyber security professionals such as security operations managers, network operations center and incident responders to understand how the adversaries are expected to perform the attack on the organization, and the technical capabilities and goals of the attackers along with the attack vectors?

  A. Analytical Threat Intelligence

  B. Operational Threat Intelligence

  C. Strategic Threat Intelligence

  D. Tactical Threat Intelligence

  Correct Answer: D

  Reference: https://info-savvy.com/types-of-threat-intelligence/