EC-COUNCIL Other ECCouncil 312-39 Questions & Answers

• Question 21:

  Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?

  A. File Injection Attacks

  B. URL Injection Attacks

  C. LDAP Injection Attacks

  D. Command Injection Attacks

  Correct Answer: B

• Question 22:

  Identify the attack in which the attacker exploits a target system through publicly known but still unpatched vulnerabilities.

  A. Slow DoS Attack

  B. DHCP Starvation

  C. Zero-Day Attack

  D. DNS Poisoning Attack

  Correct Answer: C

  Reference: https://www.bullguard.com/bullguard-security-center/pc-security/computer-threats/what-arezero-day-attacks.aspx

• Question 23:

  Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.

  What filter should Peter add to the 'show logging' command to get the required output?

  A. show logging | access 210

  B. show logging | forward 210

  C. show logging | include 210

  D. show logging | route 210

  Correct Answer: C

• Question 24:

  Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

  

  What does this event log indicate?

  A. Directory Traversal Attack

  B. XSS Attack

  C. SQL Injection Attack

  D. Parameter Tampering Attack

  Correct Answer: D

  Reference: https://infosecwriteups.com/what-is-parameter-tampering-5b1beb12c5ba

• Question 25:

  Which of the following is a correct flow of the stages in an incident handling and response (IHandR) process?

  A. Containment –andgt; Incident Recording –andgt; Incident Triage –andgt; Preparation –andgt; Recovery –andgt; Eradication –andgt; Post-Incident Activities

  B. Preparation –andgt; Incident Recording –andgt; Incident Triage –andgt; Containment –andgt; Eradication –andgt; Recovery –andgt; Post-Incident Activities

  C. Incident Triage –andgt; Eradication –andgt; Containment –andgt; Incident Recording –andgt; Preparation –andgt; Recovery –andgt; Post-Incident Activities

  D. Incident Recording –andgt; Preparation –andgt; Containment –andgt; Incident Triage –andgt; Recovery –andgt; Eradication –andgt; Post-Incident Activities

  Correct Answer: B

  Reference: https://blog.elearnsecurity.com/the-4-steps-of-incident-handling-response.html

• Question 26:

  Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one

  stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive.

  Identify the stage in which he is currently in.

  A. Post-Incident Activities

  B. Incident Recording and Assignment

  C. Incident Triage

  D. Incident Disclosure

  Correct Answer: B

• Question 27:

  Which of the following attack inundates DHCP servers with fake DHCP requests to exhaust all available IP addresses?

  A. DHCP Starvation Attacks

  B. DHCP Spoofing Attack

  C. DHCP Port Stealing

  D. DHCP Cache Poisoning

  Correct Answer: A

  Reference: https://www.cbtnuggets.com/blog/technology/networking/what-is-a-dhcp-starvation-attack

• Question 28:

  What does [-n] in the following checkpoint firewall log syntax represents?

  fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert name|all)] [-g] [logfile]

  A. Speed up the process by not performing IP addresses DNS resolution in the Log files

  B. Display both the date and the time for each log record

  C. Display account log records only

  D. Display detailed log chains (all the log segments a log record consists of)

  Correct Answer: A

  Reference: https://supportcenter.checkpoint.com/supportcenter/portal? eventSubmit_doGoviewsolutiondetails=andsolutionid=sk25532

• Question 29:

  Identify the attack, where an attacker tries to discover all the possible information about a target network before launching a further attack.

  A. DoS Attack

  B. Man-In-Middle Attack

  C. Ransomware Attack

  D. Reconnaissance Attack

  Correct Answer: D

  Reference: https://www2.deloitte.com/content/dam/Deloitte/sg/Documents/risk/sea-risk-cyber-101july2017.pdf

• Question 30:

  In which phase of Lockheed Martin's – Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

  A. Reconnaissance

  B. Delivery

  C. Weaponization D. Exploitation

  Correct Answer: B

  Reference: https://securityboulevard.com/2018/08/the-cyber-kill-chain-what-you-need-to-know/