EC-COUNCIL EC-COUNCIL Certifications 312-50V7 Questions & Answers

• Question 131:

  A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input fielD.

  IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox("Vulnerable");>"

  When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

  A. Cross-site request forgery

  B. Command injection

  C. Cross-site scripting

  D. SQL injection

  Correct Answer: C

• Question 132:

  While testing the company's web applications, a tester attempts to insert the following test script into the search area on the company's web sitE.

  Afterwards, when the tester presses the search button, a pop-up box appears on the screen with the text: "Testing Testing Testing". Which vulnerability has been detected in the web application?

  A. Buffer overflow

  B. Cross-site request forgery

  C. Distributed denial of service

  D. Cross-site scripting

  Correct Answer: D

• Question 133:

  A hacker was able to sniff packets on a company's wireless network. The following information was discovereD.

  The Key 10110010 01001011 The Cyphertext 01100101 01011010 Using the Exlcusive OR, what was the original message?

  A. 00101000 11101110

  B. 11010111 00010001

  C. 00001101 10100100

  D. 11110010 01011011

  Correct Answer: B

• Question 134:

  International Organization for Standardization (ISO) standard 27002 provides guidance for compliance by outlining

  A. guidelines and practices for security controls.

  B. financial soundness and business viability metrics.

  C. standard best practice for configuration management.

  D. contract agreement writing standards.

  Correct Answer: A

• Question 135:

  A Security Engineer at a medium-sized accounting firm has been tasked with discovering how much information can be obtained from the firm's public facing web

  servers. The engineer decides to start by using netcat to port 80.

  The engineer receives this output:

  HTTP/1.1 200 OK

  Server: Microsoft-IIS/6

  Expires: Tue, 17 Jan 2011 01:41:33 GMT

  DatE. Mon, 16 Jan 2011 01:41:33 GMT

  Content-TypE. text/html

  Accept-Ranges: bytes

  Last-ModifieD. Wed, 28 Dec 2010 15:32:21 GMT

  ETaG. "b0aac0542e25c31:89d"

  Content-Length: 7369

  Which of the following is an example of what the engineer performed?

  A. Cross-site scripting

  B. Banner grabbing

  C. SQL injection

  D. Whois database query

  Correct Answer: B

• Question 136:

  To reduce the attack surface of a system, administrators should perform which of the following processes to remove unnecessary software, services, and insecure configuration settings?

  A. Harvesting

  B. Windowing

  C. Hardening

  D. Stealthing

  Correct Answer: C

• Question 137:

  While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at the session layer of the OSI model. Which type of firewall is the tester trying to traverse?

  A. Packet filtering firewall

  B. Application-level firewall

  C. Circuit-level gateway firewall

  D. Stateful multilayer inspection firewall

  Correct Answer: C

• Question 138:

  Which type of scan is used on the eye to measure the layer of blood vessels?

  A. Facial recognition scan

  B. Retinal scan

  C. Iris scan

  D. Signature kinetics scan

  Correct Answer: B

• Question 139:

  Which of the following items is unique to the N-tier architecture method of designing software applications?

  A. Application layers can be separated, allowing each layer to be upgraded independently from other layers.

  B. It is compatible with various databases including Access, Oracle, and SQL.

  C. Data security is tied into each layer and must be updated for all layers when any upgrade is performed.

  D. Application layers can be written in C, ASP.NET, or Delphi without any performance loss.

  Correct Answer: A

• Question 140:

  To send a PGP encrypted message, which piece of information from the recipient must the sender have before encrypting the message?

  A. Recipient's private key

  B. Recipient's public key

  C. Master encryption key

  D. Sender's public key

  Correct Answer: B