EC-COUNCIL EC-COUNCIL Certifications 312-39 Questions & Answers

• Question 71:

  Banter is a threat analyst in Christine Group of Industries. As a part of the job, he is currently formatting and structuring the raw data. He is at which stage of the threat intelligence life cycle?

  A. Dissemination and Integration

  B. Processing and Exploitation

  C. Collection

  D. Analysis and Production

  Correct Answer: B

  Reference: https://socradar.io/5-stages-of-the-threat-intelligence-lifecycle/

• Question 72:

  Which of the following attacks causes sudden changes in file extensions or increase in file renames at rapid speed?

  A. Ransomware Attack

  B. DoS Attack

  C. DHCP starvation Attack

  D. File Injection Attack

  Correct Answer: A

  Reference: https://www.netfort.com/category/ransomware-detection/

• Question 73:

  An organization wants to implement a SIEM deployment architecture. However, they have the capability to do only log collection and the rest of the SIEM functions must be managed by an MSSP. Which SIEM deployment architecture will the organization adopt?

  A. Cloud, MSSP Managed

  B. Self-hosted, Jointly Managed

  C. Self-hosted, MSSP Managed

  D. Self-hosted, Self-Managed

  Correct Answer: C

• Question 74:

  Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

  A. Dictionary Attack

  B. Rainbow Table Attack

  C. Bruteforce Attack

  D. Syllable Attack

  Correct Answer: A

  Reference: https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic7-final/report.pdf

• Question 75:

  Which of the log storage method arranges event logs in the form of a circular buffer?

  A. FIFO

  B. LIFO

  C. non-wrapping

  D. wrapping

  Correct Answer: A

  Reference: https://en.wikipedia.org/wiki/Circular_buffer

• Question 76:

  Which of the following can help you eliminate the burden of investigating false positives?

  A. Keeping default rules

  B. Not trusting the security devices

  C. Treating every alert as high level

  D. Ingesting the context data

  Correct Answer: A

  Reference: https://stratozen.com/9-ways-eliminate-siem-false-positives/

• Question 77:

  Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

  A. Rule-based detection

  B. Heuristic-based detection

  C. Anomaly-based detection

  D. Signature-based detection

  Correct Answer: C

• Question 78:

  Shawn is a security manager working at Lee Inc Solution. His organization wants to develop threat intelligent strategy plan. As a part of threat intelligent strategy plan, he suggested various components, such as threat intelligence requirement analysis, intelligence and collection planning, asset identification, threat reports, and intelligence buy-in.

  Which one of the following components he should include in the above threat intelligent strategy plan to make it effective?

  A. Threat pivoting

  B. Threat trending

  C. Threat buy-in

  D. Threat boosting

  Correct Answer: C

• Question 79:

  Which of the following attack can be eradicated by filtering improper XML syntax?

  A. CAPTCHA Attacks

  B. SQL Injection Attacks

  C. Insufficient Logging and Monitoring Attacks

  D. Web Services Attacks

  Correct Answer: B

• Question 80:

  Which of the following attack can be eradicated by using a safe API to avoid the use of the interpreter entirely?

  A. Command Injection Attacks

  B. SQL Injection Attacks

  C. File Injection Attacks

  D. LDAP Injection Attacks

  Correct Answer: B

  Reference: https://www.kiuwan.com/owasp-top-10-a1-injection/