EC-COUNCIL EC-COUNCIL Certifications 312-50V10 Questions & Answers

• Question 231:

  While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place. What Web browser-based security vulnerability was exploited to compromise the user?

  A. Cross-Site Request Forgery

  B. Cross-Site Scripting

  C. Clickjacking

  D. Web form input validation

  Correct Answer: A

  Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

  Example and characteristics If an attacker is able to find a reproducible link that executes a specific action on the target page while the victim is being logged in there, he is able to embed such link on a page he controls and trick the victim into opening it. The attack carrier link may be placed in a location that the victim is likely to visit while logged into the target site (e.g. a discussion forum), sent in a HTML email body or attachment.

• Question 232:

  Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

  A. Preparation phase

  B. Containment phase

  C. Identification phase

  D. Recovery phase

  Correct Answer: A

  There are several key elements to have implemented in preparation phase in order to help mitigate any potential problems that may hinder one's ability to handle an incident. For the sake of brevity, the following should be performed:

  References: https://www.sans.org/reading-room/whitepapers/incident/incident-handlers- handbook-33901

• Question 233:

  Sophia travels a lot and worries that her laptop containing confidential documents might be stolen. What is the best protection that will work for her?

  A. Password protected files

  B. Hidden folders

  C. BIOS password

  D. Full disk encryption.

  Correct Answer: D

• Question 234:

  What network security concept requires multiple layers of security controls to be placed throughout an IT infrastructure, which improves the security posture of an organization to defend against malicious attacks or potential vulnerabilities?

  A. Security through obscurity

  B. Host-Based Intrusion Detection System

  C. Defense in depth

  D. Network-Based Intrusion Detection System

  Correct Answer: C

• Question 235:

  When purchasing a biometric system, one of the considerations that should be reviewed is the processing speed. Which of the following best describes what it is meant by processing?

  A. The amount of time it takes to convert biometric data into a template on a smart card.

  B. The amount of time and resources that are necessary to maintain a biometric system.

  C. The amount of time it takes to be either accepted or rejected form when an individual provides Identification and authentication information.

  D. How long it takes to setup individual user accounts.

  Correct Answer: C

• Question 236:

  Which of the following tools can be used for passive OS fingerprinting?

  A. tcpdump

  B. nmap

  C. ping

  D. tracert

  Correct Answer: A

  The passive operating system fingerprinting is a feature built into both the pf and tcpdump tools.

  References: http://geek00l.blogspot.se/2007/04/tcpdump-privilege-dropping-passive- os.html

• Question 237:

  A hacker has managed to gain access to a Linux host and stolen the password file from /etc/passwd. How can he use it?

  A. The password file does not contain the passwords themselves.

  B. He can open it and read the user ids and corresponding passwords.

  C. The file reveals the passwords to the root user only.

  D. He cannot read it because it is encrypted.

  Correct Answer: A

• Question 238:

  Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, smallsized packets to the target computer, making it very difficult for an IDS to detect the attack signatures.

  Which tool can be used to perform session splicing attacks?

  A. Whisker

  B. tcpsplice

  C. Burp

  D. Hydra

  Correct Answer: A

  One basic technique is to split the attack payload into multiple small packets, so that the IDS must reassemble the packet stream to detect the attack. A simple way of splitting packets is by fragmenting them, but an adversary can also simply craft packets with small payloads. The 'whisker' evasion tool calls crafting packets with small payloads 'session splicing'.

  References: https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques#Fragmentati on_and_small_packets

• Question 239:

  Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS) flaws in software applications?

  A. Validate and escape all information sent to a server

  B. Use security policies and procedures to define and implement proper security settings

  C. Verify access right before allowing access to protected information and UI controls

  D. Use digital certificates to authenticate a server prior to sending data

  Correct Answer: A

  Contextual output encoding/escaping could be used as the primary defense mechanism to stop Cross-site Scripting (XSS) attacks.

  References: https://en.wikipedia.org/wiki/Crosssite_scripting#Contextual_output_encoding.2Fescaping_of_string_input

• Question 240:

  Which of these options is the most secure procedure for storing backup tapes?

  A. In a climate controlled facility offsite

  B. On a different floor in the same building

  C. Inside the data center for faster retrieval in a fireproof safe

  D. In a cool dry environment

  Correct Answer: A

  An effective disaster data recovery strategy should consist of producing backup tapes and housing them in an offsite storage facility. This way the data isn't compromised if a natural disaster affects the business' office. It is highly recommended that the backup tapes be handled properly and stored in a secure, climate controlled facility. This provides peace of mind, and gives the business almost immediate stability after a disaster.

  References: http://www.entrustrm.com/blog/1132/why-is-offsite-tape-storage-the-best- disaster-recoverystrategy