EC-COUNCIL EC-COUNCIL Certifications 312-50V9 Questions & Answers

• Question 341:

  A new wireless client is configured to join a 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect. A wireless packet sniffer shows that the Wireless Access Point (WAP) is not responding to the association requests being sent by the wireless client.

  What is a possible source of this problem?

  A. The WAP does not recognize the client's MAC address

  B. The client cannot see the SSID of the wireless network

  C. Client is configured for the wrong channel

  D. The wireless client is not configured to use DHCP

  Correct Answer: A Section: (none)

  MAC Filtering (or GUI filtering, or layer 2 address filtering) refers to a security access control method whereby the 48-bit address assigned to each network card is used to determine access to the network. MAC Filtering is often used on wireless networks.

  References: https://en.wikipedia.org/wiki/MAC_filtering

• Question 342:

  An Internet Service Provider (ISP) has a need to authenticate users connecting using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relay network.

  Which AAA protocol is most likely able to handle this requirement?

  A. RADIUS

  B. DIAMETER

  C. Kerberos

  D. TACACS+

  Correct Answer: A Section: (none)

  Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. These networks may incorporate modems, DSL, access points, VPNs, network ports, web servers, etc.

  References: https://en.wikipedia.org/wiki/RADIUS

• Question 343:

  Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS) flaws in software applications?

  A. Validate and escape all information sent to a server

  B. Use security policies and procedures to define and implement proper security settings

  C. Verify access right before allowing access to protected information and UI controls

  D. Use digital certificates to authenticate a server prior to sending data

  Correct Answer: A Section: (none)

  Contextual output encoding/escaping could be used as the primary defense mechanism to stop Cross-site Scripting (XSS) attacks.

  References: https://en.wikipedia.org/wiki/Crosssite_scripting#Contextual_output_encoding.2Fescaping_of_string_input

• Question 344:

  Which of the following is considered the best way to protect Personally Identifiable Information (PII) from Web application vulnerabilities?

  A. Use cryptographic storage to store all PII

  B. Use encrypted communications protocols to transmit PII

  C. Use full disk encryption on all hard drives to protect PII

  D. Use a security token to log into all Web applications that use PII

  Correct Answer: A Section: (none)

  As a matter of good practice any PII should be protected with strong encryption.

  References: https://cuit.columbia.edu/cuit/it-security-practices/handling-personally-identifying-information

• Question 345:

  A company's Web development team has become aware of a certain type of security vulnerability in their Web software. To mitigate the possibility of this vulnerability being exploited, the team wants to modify the software requirements to disallow users from entering HTML as input into their Web application.

  What kind of Web application vulnerability likely exists in their software?

  A. Cross-site scripting vulnerability

  B. Cross-site Request Forgery vulnerability

  C. SQL injection vulnerability

  D. Web site defacement vulnerability

  Correct Answer: A Section: (none)

  Many operators of particular web applications (e.g. forums and webmail) allow users to utilize a limited subset of HTML markup. When accepting HTML input from users (say, very large), output encoding (such as andlt;bandgt;veryandlt;/ bandgt; large) will not suffice since the user input needs to be rendered as HTML by the browser (so it shows as "very large", instead of "very large"). Stopping an XSS attack when accepting HTML input from users is much more complex in this situation. Untrusted HTML input must be run through an HTML sanitization engine to ensure that it does not contain cross-site scripting code.

  References: https://en.wikipedia.org/wiki/Cross-site_scripting#Safely_validating_untrusted_HTML_input

• Question 346:

  A company's security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

  A. Attempts by attackers to access Web sites that trust the Web browser user by stealing the user's authentication credentials.

  B. Attempts by attackers to access the user and password information stored in the company's SQL database.

  C. Attempts by attackers to access passwords stored on the user's computer without the user's knowledge.

  D. Attempts by attackers to determine the user's Web browser usage patterns, including when sites were visited and for how long.

  Correct Answer: A Section: (none)

  Cookies can store passwords and form content a user has previously entered, such as a credit card

  number or an address.

  Cookies can be stolen using a technique called cross-site scripting. This occurs when an attacker takes

  advantage of a website that allows its users to post unfiltered HTML and JavaScript content.

  References: https://en.wikipedia.org/wiki/HTTP_cookie#Cross-site_scripting_.E2.80.93_cookie_theft

• Question 347:

  While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place.

  What Web browser-based security vulnerability was exploited to compromise the user?

  A. Cross-Site Request Forgery

  B. Cross-Site Scripting

  C. Clickjacking

  D. Web form input validation

  Correct Answer: A Section: (none)

  Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the website trusts.

  Example and characteristics If an attacker is able to find a reproducible link that executes a specific action on the target page while the victim is being logged in there, he is able to embed such link on a page he controls and trick the victim into opening it. The attack carrier link may be placed in a location that the victim is likely to visit while logged into the target site (e.g. a discussion forum), sent in a HTML email body or attachment.

  Incorrect Answers:

  C: Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. It is a browser security issue that is a vulnerability across a variety of browsers and platforms. A clickjack takes the form of embedded code or a script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function. References: https://en.wikipedia.org/wiki/Cross-site_request_forgery

• Question 348:

  A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.

  What kind of vulnerability must be present to make this remote attack possible?

  A. File system permissions

  B. Privilege escalation

  C. Directory traversal

  D. Brute force login

  Correct Answer: A Section: (none)

  To upload files the user must have proper write file permissions.

  References: http://codex.wordpress.org/Hardening_WordPress

• Question 349:

  The chance of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1 (100%).

  What is the closest approximate cost of this replacement and recovery operation per year?

  A. $146

  B. $1320

  C. $440

  D. $100

  Correct Answer: A Section: (none)

  The annualized loss expectancy (ALE) is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). Suppose than an asset is valued at $100,000, and the Exposure Factor (EF) for this asset is 25%. The single loss expectancy (SLE) then, is 25% * $100,000, or $25,000. In our example the ARO is 33%, and the SLE is 300+14*10 (as EF=1). The ALO is thus: 33%*(300+14*10) which equals 146.

  References: https://en.wikipedia.org/wiki/Annualized_loss_expectancy

• Question 350:

  In Risk Management, how is the term "likelihood" related to the concept of "threat?"

  A. Likelihood is the probability that a threat-source will exploit a vulnerability.

  B. Likelihood is a possible threat-source that may exploit a vulnerability.

  C. Likelihood is the likely source of a threat that could exploit a vulnerability.

  D. Likelihood is the probability that a vulnerability is a threat-source.

  Correct Answer: A Section: (none)

  The ability to analyze the likelihood of threats within the organization is a critical step in building an effective security program. The process of assessing threat probability should be well defined and incorporated into a broader threat analysis process to be effective.

  References: http://www.mcafee.com/campaign/securitybattleground/resources/chapter5/whitepaper-onassessing-threat-attack-likelihood.pdf