312-50v12 Practice Test Questions

569 Questions


Topic 1: Exam Pool A

Scenario1:
1.Victim opens the attacker's web site.
2.Attacker sets up a web site which contains interesting and attractive content like 'Do you
want to make
$1000 in a day?'.
3.Victim clicks to the interesting and attractive content URL.
4.Attacker creates a transparent 'iframe' in front of the URL which victim attempts to click,
so victim thinks that he/she clicks to the 'Do you want to make $1000 in a day?' URL but
actually he/she clicks to the content or URL that exists in the transparent 'iframe' which is
setup by the attacker.
What is the name of the attack which is mentioned in the scenario?


A.

Session Fixation


B.

HTML Injection


C.

HTTP Parameter Pollution


D.

Clickjacking Attack





D.
  

Clickjacking Attack



Explanation: https://en.wikipedia.org/wiki/Clickjacking
Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible
or disguised as another element. This can cause users to unwittingly download malware,
visit malicious web pages, provide credentials or sensitive information, transfer money, or
purchase products online.
Typically, clickjacking is performed by displaying an invisible page or HTML element, inside
an iframe, on top of the page the user sees. The user believes they are clicking the visible
page but in fact they are clicking an invisible element in the additional page transposed on
top of it.

The collection of potentially actionable, overt, and publicly available information is known
as


A.

Open-source intelligence


B.

Real intelligence


C.

Social intelligence


D.

Human intelligence





A.
  

Open-source intelligence



What is the proper response for a NULL scan if the port is open?


A.

SYN


B.

ACK


C.

FIN


D.

PSH


E.

RST


F.

No response





F.
  

No response



Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN
standards on a linux platform?


A.

Kismet


B.

Abel


C.

Netstumbler


D.

Nessus





A.
  

Kismet



Explanation:
https://en.wikipedia.org/wiki/Kismet_(software)
Kismet is a network detector, packet sniffer, and intrusion detection system for 802.11
wireless LANs. Kismet will work with any wireless card which supports raw monitoring
mode, and can sniff 802.11a, 802.11b, 802.11g, and 802.11n traffic

Which method of password cracking takes the most time and effort?


A.

Dictionary attack


B.

Shoulder surfing


C.

Rainbow tables


D.

Brute force





D.
  

Brute force



Explanation: Brute-force attack when an attacker uses a set of predefined values to attack
a target and analyze the response until he succeeds. Success depends on the set of
predefined values. It will take more time if it is larger, but there is a better probability of
success. In a traditional brute-force attack, the passcode or password is incrementally
increased by one letter/number each time until the right passcode/password is found.

During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a
compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic
is unimpeded. What type of firewall is inspecting outbound traffic?


A.

Circuit


B.

Stateful


C.

Application


D.

Packet Filtering





C.
  

Application



Explanation:
https://en.wikipedia.org/wiki/Internet_Relay_Chat
Internet Relay Chat (IRC) is an application layer protocol that facilitates communication in
text. The chat process works on a client/server networking model. IRC clients are computer
programs that users can install on their system or web-based applications running either
locally in the browser or on a third-party server. These clients communicate with chat
servers to transfer messages to other clients.
IRC is a plaintext protocol that is officially assigned port 194, according to IANA. However,
running the service on this port requires running it with root-level permissions, which is
inadvisable. As a result, the well-known port for IRC is 6667, a high-number port that does
not require elevated privileges. However, an IRC server can also be configured to run on
other ports as well.
You can't tell if an IRC server is designed to be malicious solely based on port number.
Still, if you see an IRC server running on port a WKP such as 80, 8080, 53, 443, it's almost
always going to be malicious; the only real reason for IRCD to be running on port 80 is to
try to evade firewalls.
https://en.wikipedia.org/wiki/Application_firewall
An application firewall is a form of firewall that controls input/output or system calls of an
application or service. It operates by monitoring and blocking communications based on a
configured policy, generally with predefined rule sets to choose from. The application
firewall can control communications up to the OSI model's application layer, which is the
highest operating layer, and where it gets its name. The two primary categories of
application firewalls are network-based and host-based.
Application layer filtering operates at a higher level than traditional security appliances. This
allows packet decisions to be made based on more than just source/destination IP
Addresses or ports. It can also use information spanning across multiple connections for
any given host.
Network-based application firewalls
Network-based application firewalls operate at the application layer of a TCP/IP stack.
They can understand certain applications and protocols such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP). This allows it
to identify unwanted applications or services using a non-standard port or detect if an
allowed protocol is being abused.
Host-based application firewalls
A host-based application firewall monitors application system calls or other general system
communication. This gives more granularity and control but is limited to only protecting the
host it is running on. Control is applied by filtering on a per-process basis. Generally, prompts are used to define rules for processes that have not yet received a connection.
Further filtering can be done by examining the process ID of the owner of the data packets.
Many host-based application firewalls are combined or used in conjunction with a packet
filter.

Bob is acknowledged as a hacker of repute and is popular among visitors of "underground"
sites.
Bob is willing to share his knowledge with those who are willing to learn, and many have
expressed their interest in learning from him. However, this knowledge has a risk
associated with it, as it can be used for malevolent attacks as well.
In this context, what would be the most effective method to bridge the knowledge gap
between the "black" hats or crackers and the "white" hats or computer security
professionals? (Choose the test answer.)


A.

Educate everyone with books, articles and training on risk analysis, vulnerabilities and
safeguards.


B.

Hire more computer security monitoring personnel to monitor computer systems and
networks.


C.

Make obtaining either a computer security certification or accreditation easier to achieve
so more individuals feel that they are a part of something larger than life.


D.

Train more National Guard and reservist in the art of computer security to help out in
times of emergency or crises.





A.
  

Educate everyone with books, articles and training on risk analysis, vulnerabilities and
safeguards.



Which of the following is a component of a risk assessment?


A.

Administrative safeguards


B.

Physical security


C.

DMZ


D.

Logical interface





A.
  

Administrative safeguards



Joseph was the Web site administrator for the Mason Insurance in New York, who's main
Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to
administer the Web site. One night, Joseph received an urgent phone call from his friend,
Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of
its normal content was removed and replaced with an attacker's message ''Hacker
Message: You are dead! Freaks!” From his office, which was directly connected to Mason
Insurance's internal network, Joseph surfed to the Web site using his laptop. In his
browser, the Web site looked completely intact.
No changes were apparent. Joseph called a friend of his at his home to help troubleshoot
the problem. The Web site appeared defaced when his friend visited using his DSL
connection. So, while Smith and his friend could see the defaced page, Joseph saw the
intact Mason Insurance web site. To help make sense of this problem, Joseph decided to
access the Web site using hisdial-up ISP. He disconnected his laptop from the corporate
internal network and used his modem to dial up the same ISP used by Smith. After his
modem connected, he quickly typed www.masonins.com in his browser to reveal the
following web page:


After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the
internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran
Tripwire against the entire Web site, and determined that every system file and all the Web
content on the server were intact. How did the attacker accomplish this hack?


A.

ARP spoofing


B.

SQL injection


C.

DNS poisoning


D.

Routing table injection





C.
  

DNS poisoning



Which of the following describes the characteristics of a Boot Sector Virus?


A.

Modifies directory table entries so that directory entries point to the virus code instead of
the actual program.


B.

Moves the MBR to another location on the RAM and copies itself to the original location
of the MBR.


C.

Moves the MBR to another location on the hard disk and copies itself to the original
location of the MBR.


D.

Overwrites the original MBR and only executes the new virus code





C.
  

Moves the MBR to another location on the hard disk and copies itself to the original
location of the MBR.



What is correct about digital signatures?


A.

A digital signature cannot be moved from one signed document to another because it is
the hash of the original document encrypted with the private key of the signing party.


B.

Digital signatures may be used in different documents of the same type.


C.

A digital signature cannot be moved from one signed document to another because it is
a plain hash of the document content.


D.

Digital signatures are issued once for each user and can be used everywhere until they
expire.





A.
  

A digital signature cannot be moved from one signed document to another because it is
the hash of the original document encrypted with the private key of the signing party.



A large company intends to use Blackberry for corporate mobile phones and a security
analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking
attack method to demonstrate how an attacker could circumvent perimeter defenses and
gain access to the Prometric Online Testing – Reports
https://ibt1.prometric.com/users/custom/report_queue/rq_str... corporate network. What tool
should the analyst use to perform a Blackjacking attack?


A.

Paros Proxy


B.

BBProxy


C.

Blooover


D.

BBCrack





B.
  

BBProxy




Page 7 out of 48 Pages
Previous