EC-COUNCIL EC-COUNCIL Certifications 312-39 Questions & Answers

• Question 61:

  Which of the following is a Threat Intelligence Platform?

  A. SolarWinds MS

  B. TC Complete

  C. Keepnote

  D. Apility.io

  Correct Answer: A

  Reference: https://www.esecurityplanet.com/products/threat-intelligence-platforms/

• Question 62:

  Which of the following framework describes the essential characteristics of an organization's security engineering process that must exist to ensure good security engineering?

  A. COBIT

  B. ITIL

  C. SSE-CMM

  D. SOC-CMM

  Correct Answer: C

  Reference: https://www.iso.org/standard/44716.html

• Question 63:

  What does Windows event ID 4740 indicate?

  A. A user account was locked out.

  B. A user account was disabled.

  C. A user account was enabled.

  D. A user account was created.

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740#:~:text=For%204740(S)%3A%20A,Security%20ID"%20is%20not%20SYSTEM.

• Question 64:

  Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex /\\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix. What does this event log indicate?

  A. SQL Injection Attack

  B. Parameter Tampering Attack

  C. XSS Attack

  D. Directory Traversal Attack

  Correct Answer: A

  Reference: https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=001f5e09-88b4-4a9a-b310-4c20578eecf9andCommunityKey=1ecf5f55-9545-44d6-b0f44e4a7f5f5e68andtab=librarydocuments

• Question 65:

  Which of the following are the responsibilities of SIEM Agents?

  1.

  Collecting data received from various devices sending data to SIEM before forwarding it to the central engine.

  2.

  Normalizing data received from various devices sending data to SIEM before forwarding it to the central engine.

  3.

  Co-relating data received from various devices sending data to SIEM before forwarding it to the central engine.

  4.

  Visualizing data received from various devices sending data to SIEM before forwarding it to the central engine.

  A. 1 and 2

  B. 2 and 3

  C. 1 and 4

  D. 3 and 1

  Correct Answer: C

• Question 66:

  Which of the following Windows event is logged every time when a user tries to access the "Registry" key?

  A. 4656

  B. 4663

  C. 4660

  D. 4657

  Correct Answer: D

  Reference: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4657

• Question 67:

  Which of the following factors determine the choice of SIEM architecture?

  A. SMTP Configuration

  B. DHCP Configuration

  C. DNS Configuration

  D. Network Topology

  Correct Answer: C

• Question 68:

  What does HTTPS Status code 403 represents?

  A. Unauthorized Error

  B. Not Found Error

  C. Internal Server Error

  D. Forbidden Error

  Correct Answer: D

  Reference: https://en.wikipedia.org/wiki/HTTP_403

• Question 69:

  Identify the event severity level in Windows logs for the events that are not necessarily significant, but may indicate a possible future problem.

  A. Failure Audit

  B. Warning

  C. Error

  D. Information

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/windows/win32/eventlog/event-types

• Question 70:

  Which of the following security technology is used to attract and trap people who attempt unauthorized or illicit utilization of the host system?

  A. De-Militarized Zone (DMZ)

  B. Firewall

  C. Honeypot

  D. Intrusion Detection System

  Correct Answer: C

  Reference: https://www.kaspersky.com/resource-center/threats/what-is-a-honeypot