EC-COUNCIL EC-COUNCIL Certifications 312-50V7 Questions & Answers

• Question 111:

  In keeping with the best practices of layered security, where are the best places to place intrusion detection/intrusion prevention systems? (Choose two.)

  A. HID/HIP (Host-based Intrusion Detection/Host-based Intrusion Prevention)

  B. NID/NIP (Node-based Intrusion Detection/Node-based Intrusion Prevention)

  C. NID/NIP (Network-based Intrusion Detection/Network-based Intrusion Prevention)

  D. CID/CIP (Computer-based Intrusion Detection/Computer-based Intrusion Prevention)

  Correct Answer: AC

• Question 112:

  What is one thing a tester can do to ensure that the software is trusted and is not changing or tampering with critical data on the back end of a system it is loaded on?

  A. Proper testing

  B. Secure coding principles

  C. Systems security and architecture review

  D. Analysis of interrupts within the software

  Correct Answer: D

• Question 113:

  Which of the following algorithms provides better protection against brute force attacks by using a 160-bit message digest?

  A. MD5

  B. SHA-1

  C. RC4

  D. MD4

  Correct Answer: B

• Question 114:

  Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI). What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B trust one another and each private PKI can validate digital certificates from the other company?

  A. Poly key exchange

  B. Cross certification

  C. Poly key reference

  D. Cross-site exchange

  Correct Answer: B

• Question 115:

  What is the best defense against privilege escalation vulnerability?

  A. Patch systems regularly and upgrade interactive login privileges at the system administrator level.

  B. Run administrator and applications on least privileges and use a content registry for tracking.

  C. Run services with least privileged accounts and implement multi-factor authentication and authorization.

  D. Review user roles and administrator privileges for maximum utilization of automation services.

  Correct Answer: C

• Question 116:

  If the final set of security controls does not eliminate all risk in a system, what could be done next?

  A. Continue to apply controls until there is zero risk.

  B. Ignore any remaining risk.

  C. If the residual risk is low enough, it can be accepted.

  D. Remove current controls since they are not completely effective.

  Correct Answer: C

• Question 117:

  If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TCP?

  A. Hping

  B. Traceroute

  C. TCP ping

  D. Broadcast ping

  Correct Answer: A

• Question 118:

  How can rainbow tables be defeated?

  A. Password salting

  B. Use of non-dictionary words

  C. All uppercase character passwords

  D. Lockout accounts under brute force password cracking attempts

  Correct Answer: A

• Question 119:

  Which of the following is an advantage of utilizing security testing methodologies to conduct a security audit?

  A. They provide a repeatable framework.

  B. Anyone can run the command line scripts.

  C. They are available at low cost.

  D. They are subject to government regulation.

  Correct Answer: A

• Question 120:

  A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?

  A. if (billingAddress = 50) {update field} else exit

  B. if (billingAddress != 50) {update field} else exit

  C. if (billingAddress >= 50) {update field} else exit

  D. if (billingAddress <= 50) {update field} else exit

  Correct Answer: D