EC-COUNCIL EC-COUNCIL Certifications 312-50V9 Questions & Answers

• Question 141:

  A newly discovered flaw in a software application would be considered which kind of security vulnerability?

  A. Input validation flaw

  B. HTTP header injection vulnerability

  C. 0-day vulnerability

  D. Time-to-check to time-to-use flaw

  Correct Answer: C Section: (none)

• Question 142:

  During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?

  A. The web application does not have the secure flag set.

  B. The session cookies do not have the HttpOnly flag set.

  C. The victim user should not have an endpoint security solution.

  D. The victim's browser must have ActiveX technology enabled.

  Correct Answer: B Section: (none)

• Question 143:

  What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?

  A. Injecting parameters into a connection string using semicolons as a separator

  B. Inserting malicious Javascript code into input parameters

  C. Setting a user's session identifier (SID) to an explicit known value

  D. Adding multiple parameters with the same name in HTTP requests

  Correct Answer: A Section: (none)

• Question 144:

  WPA2 uses AES for wireless data encryption at which of the following encryption levels?

  A. 64 bit and CCMP

  B. 128 bit and CRC

  C. 128 bit and CCMP

  D. 128 bit and TKIP

  Correct Answer: C Section: (none)

• Question 145:

  An attacker uses a communication channel within an operating system that is neither designed nor intended to transfer information. What is the name of the communications channel?

  A. Classified

  B. Overt

  C. Encrypted

  D. Covert

  Correct Answer: D Section: (none)

• Question 146:

  Which type of scan measures a person's external features through a digital video camera?

  A. Iris scan

  B. Retinal scan

  C. Facial recognition scan

  D. Signature kinetics scan

  Correct Answer: C Section: (none)

• Question 147:

  A company has hired a security administrator to maintain and administer Linux and Windows-based systems. Written in the nightly report file is the following:

  Firewall log files are at the expected value of 4 MB. The current time is 12am. Exactly two hours later the size has decreased considerably. Another hour goes by and the log files have shrunk in size again.

  Which of the following actions should the security administrator take?

  A. Log the event as suspicious activity and report this behavior to the incident response team immediately.

  B. Log the event as suspicious activity, call a manager, and report this as soon as possible.

  C. Run an anti-virus scan because it is likely the system is infected by malware.

  D. Log the event as suspicious activity, continue to investigate, and act according to the site's security policy.

  Correct Answer: D Section: (none)

• Question 148:

  A security policy will be more accepted by employees if it is consistent and has the support of

  A. coworkers.

  B. executive management.

  C. the security officer.

  D. a supervisor.

  Correct Answer: B Section: (none)

• Question 149:

  Which of the following business challenges could be solved by using a vulnerability scanner?

  A. Auditors want to discover if all systems are following a standard naming convention.

  B. A web server was compromised and management needs to know if any further systems were compromised.

  C. There is an emergency need to remove administrator access from multiple machines for an employee that quit.

  D. There is a monthly requirement to test corporate compliance with host application usage and security policies.

  Correct Answer: D Section: (none)

• Question 150:

  A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The alert was generated because a large number of packets were coming into the network over ports 20 and 21. During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this situation?

  A. True negatives

  B. False negatives

  C. True positives

  D. False positives

  Correct Answer: D Section: (none)