Certified Ethical Hacker (CEH) practice questions

1. Question 1 of 25

   Which of the following is a hardware requirement that either an IDS/IPS system or a proxy server must have in order to properly function?

   • AFast processor to help with network traffic analysis
   • BThey must be dual-homed
   • CSimilar RAM requirements
   • DFast network interface cards

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Dual-homed or dual-homing can refer to either an Ethernet device that has more than one network interface, for redundancy purposes, or in firewall technology, dual-homed is one of the firewall architectures, such as an IDS/IPS system, for implementing preventive security. References: https://en.wikipedia.org/wiki/Dual-homed

   Adapted from community discussion by XX20Jim20XX · 2023-11-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. [

      [Removed]

      2024-08-26

      Selected B1 upvote

      The correct answer is B. They must be dual-homed. Dual-homed configurations allow IDS/IPS systems or proxy servers to handle network traffic more securely and efficiently by having separate network interfaces for different network segments.

   2. X

      XX20Jim20XX

      2023-11-06

      2 upvotes

      Hi guys don't waste your time, I have just done the exam and none of the questions from here were present. not one. your choice time and money gl all

   3. C

      ceh007

      2023-02-19

      2 upvotes

      An IDS is not the same as IPS. IDS need not be dual homed. An IPS can be inline or non-inline and can work with one physical ethernet connection.

   4. A

      AmalUB

      2023-02-04

      1 upvote

      Answer B Dual-homed or dual-homing can refer to either an Ethernet device that has more than one network interface, for redundancy purposes, or in firewall technology, dual-homed is one of the firewall architectures, such as an IDS/IPS system, for implementing preventive security. References: https://en.wikipedia.org/wiki/Dual-homed

2. Question 2 of 25

   Which of the following is an application that requires a host application for replication?

   • AMicro
   • BWorm
   • CTrojan
   • DVirus

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Computer viruses infect a variety of different subsystems on their hosts. A computer virus is a malware that, when executed, replicates by reproducing it self or infecting other programs by modifying them. Infecting computer programs can include as well, data files, or the boot sector of the hard drive. When this replication succeeds, the affected areas are then said to be "infected". References: https://en.wikipedia.org/wiki/Computer_virus

   View community discussion2

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. A

      AmalUB

      2023-02-04

      1 upvote

      D Computer viruses infect a variety of different subsystems on their hosts. A computer virus is a malware that, when executed, replicates by reproducing it self or infecting other programs by modifying them. Infecting computer programs can include as well, data files, or the boot sector of the hard drive. When this replication succeeds, the affected areas are then said to be "infected". References: https://en.wikipedia.org/wiki/Computer_virus

   2. [

      [Removed]

      2024-08-26

      Selected D1 upvote

      D. Virus. A virus requires a host application to replicate and spread by attaching itself to executable files or documents.

3. Question 3 of 25

   A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the corporate network. What tool should the analyst use to perform a Blackjacking attack?

   • AParos Proxy
   • BBBProxy
   • CBBCrack
   • DBlooover

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Blackberry users warned of hacking tool threat. Users have been warned that the security of Blackberry wireless e-mail devices is at risk due to the availability this week of a new hacking tool. Secure Computing Corporation said businesses that have installed Blackberry servers behind their gateway security devices could be vulnerable to a hacking attack from a tool call BBProxy. References: http://www.computerweekly.com/news/2240062112/Technology-news-in-brief

   View community discussion2

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. A

      AmalUB

      2023-02-04

      1 upvote

      B Blackberry users warned of hacking tool threat. Users have been warned that the security of Blackberry wireless e-mail devices is at risk due to the availability this week of a new hacking tool. Secure Computing Corporation said businesses that have installed Blackberry servers behind their gateway security devices could be vulnerable to a hacking attack from a tool call BBProxy. References: http://www.computerweekly.com/news/2240062112/Technology-news-in-brief

   2. [

      [Removed]

      2024-08-26

      Selected B1 upvote

      The analyst should use B. BBProxy to perform a Blackjacking attack. BBProxy is a tool designed to exploit vulnerabilities in Blackberry devices for this purpose.

4. Question 4 of 25

   Which of the following describes the characteristics of a Boot Sector Virus?

   • AMoves the MBR to another location on the RAM and copies itself to the original location of the MBR
   • BMoves the MBR to another location on the hard disk and copies itself to the original location of the MBR
   • CModifies directory table entries so that directory entries point to the virus code instead of the actual program
   • DOverwrites the original MBR and only executes the new virus code

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   A boot sector virus is a computer virus that infects a storage device's master boot record (MBR). The virus moves the boot sector to another location on the hard drive. References: https://www.techopedia.com/definition/26655/boot-sector-virus

   Adapted from community discussion by AmalUB · 2023-02-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. A

      AmalUB

      2023-02-04

      2 upvotes

      Answer B A boot sector virus is a computer virus that infects a storage device's master boot record (MBR). The virus moves the boot sector to another location on the hard drive. References: https://www.techopedia.com/definition/26655/boot-sector-virus

   2. T

      tyw82

      2024-10-07

      Selected B1 upvote

      CEHv12 Pg1033 - A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, first, the virus code executes and then control passes to the original MBR.

   3. D

      dorinh

      2021-11-30

      1 upvote

      A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, first, the virus code executes and then control passes to the original MBR

5. Question 5 of 25

   Bluetooth uses which digital modulation technique to exchange information between paired devices?

   • APSK (phase-shift keying)
   • BFSK (frequency-shift keying)
   • CASK (amplitude-shift keying)
   • DQAM (quadrature amplitude modulation)

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Phase shift keying is the form of Bluetooth modulation used to enable the higher data rates achievable with Bluetooth 2 EDR (Enhanced Data Rate). Two forms of PSK are used: /4 DQPSK, and 8DPSK. References: http://www.radio-electronics.com/info/wireless/bluetooth/radio-interface-modulation.php

   Adapted from community discussion by AmalUB · 2024-08-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. B

      Booict

      2025-01-09

      Selected B1 upvote

      B - Reason: The question asked about the modulation technique used by Bluetooth to exchange information between paired devices in general, not specifically for EDR. For standard Bluetooth (Basic Rate), the modulation technique used is Gaussian Frequency Shift Keying (GFSK)

   2. A

      AmalUB

      2024-08-04

      2 upvotes

      Answer A Phase shift keying is the form of Bluetooth modulation used to enable the higher data rates achievable with Bluetooth 2 EDR (Enhanced Data Rate). Two forms of PSK are used: /4 DQPSK, and 8DPSK

6. Question 6 of 25

   A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?

   • Awhite box
   • Bgrey box
   • Cred box
   • Dblack box

   Show answer

   Correct answer: D

   Explanation

   Black box scanning is a method of software security testing in which the security controls, defenses and design of an application are tested from the outside-in, with little or no prior knowledge of the application’s internal workings. It is typically used to test web applications and web services.

   Adapted from community discussion by karthik_2003 · 2024-06-29 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. K

      karthik_2003

      2024-06-29

      2 upvotes

      Black box scanning is a method of software security testing in which the security controls, defenses and design of an application are tested from the outside-in, with little or no prior knowledge of the application’s internal workings. It is typically used to test web applications and web services.

   2. K

      kodji

      2024-09-21

      1 upvote

      In a black-box testing assignment, the penetration tester is placed in the role of the average hacker, with no internal knowledge of the target system. Testers are not provided with any architecture diagrams or source code that is not publicly available. A black-box penetration test determines the vulnerabilities in a system that are exploitable from outside the network.

   3. D

      DjoCh

      2023-11-23

      2 upvotes

      i confirm D the black box scan shoud be done without credential

7. Question 7 of 25

   A security consultant decides to use multiple layers of anti-virus defense, such as end user desktop anti-virus and E-mail gateway. This approach can be used to mitigate which kind of attack?

   • AForensic attack
   • BARP spoofing attack
   • CSocial engineering attack
   • DScanning attack

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Should be C. An email gateway is a type of email server that protects an organizations or users internal email servers. This server acts as a gateway through which every incoming and outgoing email passes through. A Secure Email Gateway (SEG) is a device or software used for email monitoring that are being sent and received. Email gateway protection is designed to prevent unwanted email and deliver good email. Messages that are unwanted include spam, phishing attacks, malware or fraudulent content. Outgoing messages can be analyzed to prevent sensitive data from leaving the organization or to automatically encrypt emails that contain sensitive information.

   Adapted from community discussion by WZ1122 · 2022-03-19 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. W

      WZ1122

      2022-03-19

      3 upvotes

      Should be C. An email gateway is a type of email server that protects an organizations or users internal email servers. This server acts as a gateway through which every incoming and outgoing email passes through. A Secure Email Gateway (SEG) is a device or software used for email monitoring that are being sent and received. Email gateway protection is designed to prevent unwanted email and deliver good email. Messages that are unwanted include spam, phishing attacks, malware or fraudulent content. Outgoing messages can be analyzed to prevent sensitive data from leaving the organization or to automatically encrypt emails that contain sensitive information.

   2. G

      gtantse

      2022-03-21

      4 upvotes

      Answer is definitely C! Why will you need to secure your email gateway for ARP. But in C the email gateway will monitor the email. And if a malicious email got through the antivirus will catch the malicious software

   3. B

      bic3p

      2024-08-01

      1 upvote

      they are trying to trick us, for arp spoofing attack we need to secure the network devices like router and set up firewall. So the answer is definately c

8. Question 8 of 25

   A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?

   • AFirewall-management policy
   • BAcceptable-use policy
   • CRemote-access policy
   • DPermissive policy

   Show answer

   Correct answer: B

   How others answered

   • B67%
   • C33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Dial-out modem is already installed on the system, to verify the use one should check if it is allowed or not. Hence Acceptable use policy.

   Adapted from community discussion by Darpan24 · 2024-06-29 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. K

      Kelzz

      2022-12-02

      4 upvotes

      remote access policy? Should it not be Acceptable use since he is already on the network and not connecting remotely?

   2. D

      Darpan24

      2024-06-29

      Selected B2 upvotes

      Dial-out modem is already installed on the system, to verify the use one should check if it is allowed or not. Hence Acceptable use policy.

   3. A

      Ajstars

      2023-04-02

      1 upvote

      I quite agree that is should be acceptable use policy. except the installation is permissible for a business need, such shouldn't be allowed.

   4. D

      DaveyIRL

      2023-04-24

      1 upvote

      Acceptable use pertains to the equipment implemented already, not for regulating what equipment can or cannot be implemented.

9. Question 9 of 25

   While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at the session layer of the OSI model. Which type of firewall is the tester trying to traverse?

   • APacket filtering firewall
   • BApplication-level firewall
   • CCircuit-level gateway firewall
   • DStateful multilayer inspection firewall

   Show answer

   Correct answer: C

   Explanation

   A circuit-level gateway firewall works at the session layer of the OSI model or transport layer of TCP/IP. It forwards data between networks without verification and blocks incoming packets from the host but allows the traffic to pass through itself. Information passed to remote computers through a circuit-level gateway will appear to have originated from the gateway, as the incoming traffic carries the IP address of the proxy (circuit-level gateway). Such firewalls monitor requests to create sessions and determine if those sessions will be allowed.

   Adapted from community discussion by dorinh · 2023-05-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

   1. D

      dorinh

      2023-05-30

      2 upvotes

      A circuit-level gateway firewall works at the session layer of the OSI model or transport layer of TCP/IP. It forwards data between networks without verification and blocks incoming packets from the host but allows the traffic to pass through itself. Information passed to remote computers through a circuit-level gateway will appear to have originated from the gateway, as the incoming traffic carries the IP address of the proxy (circuit-level gateway). Such firewalls monitor requests to create sessions and determine if those sessions will be allowed.

   2. S

      salei

      2024-05-22

      1 upvote

      A circuit-level gateway is a type of firewall. Circuit-level gateways work at the session layer of the OSI model, or as a "shim-layer" between the application layer and the transport layer of the TCP/IP stack. They monitor TCP handshaking between packets to determine whether a requested session is legitimate.

   3. C

      carejohn

      2024-08-05

      1 upvote

      "monitoring TCP handshaking of packets at the session layer of the OSI model" is the point to note

10. Question 10 of 25

    What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?

    • AInjecting parameters into a connection string using semicolons as a separator
    • BInserting malicious Javascript code into input parameters
    • CSetting a user's session identifier (SID) to an explicit known value
    • DAdding multiple parameters with the same name in HTTP requests

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Connection String Injection: A connection string injection attack can occur when dynamic string concatenation is used to build connection strings that are based on user input. If the string isn’t validated and malicious text or characters are not escaped, an attacker can potentially access sensitive data or other resources on the server. For example, an attacker could mount an attack by supplying a ***semicolon*** and appending another value. The connection string is parsed by using a “last one wins” algorithm, and the hostile input is replaced with a legitimate value. source from :https://www.geeksforgeeks.org/what-is-connection-string-parameter-pollution/

    Adapted from community discussion by max_max_max · 2024-04-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. M

       max_max_max

       2024-04-20

       Selected A2 upvotes

       Connection String Injection: A connection string injection attack can occur when dynamic string concatenation is used to build connection strings that are based on user input. If the string isn’t validated and malicious text or characters are not escaped, an attacker can potentially access sensitive data or other resources on the server. For example, an attacker could mount an attack by supplying a ***semicolon*** and appending another value. The connection string is parsed by using a “last one wins” algorithm, and the hostile input is replaced with a legitimate value. source from :https://www.geeksforgeeks.org/what-is-connection-string-parameter-pollution/

    2. N

       NikoTomas

       2024-09-10

       1 upvote

       I agree, A) is correct - injecting parameters with semicolons, which separate commands. D) is incorrect - multiple parameters with the SAME NAME in HTTP request - it usually does nothing, because another occurence of the same parameter (or HTTP header like "host:", "origin:" etc..) just REWRITES the value of the previous occurence. So in the end, there is just 1 parameter. There are some attacks like HTTP request smuggling, which exploit inconsistency in processing of HTTP headers between front-end server (loadbalancer / proxy) and back-end server, however they aren't based on repeating of the same HTTP header but playing with order of two headers: Content-Length and Transfer-Encoding + optionally some fuzzing to confuse server. This is just for info.

    3. D

       dorinh

       2022-05-30

       1 upvote

       Connection String Parameter Pollution (CSPP) attacks consist of injecting connection string parameters into other existing parameters. This vulnerability is similar to vulnerabilities, and perhaps more well known, within HTTP environments where parameter pollution can also occur. However, it also can apply in other places such as database connection strings. If an application does not properly sanitize the user input, a malicious user may compromise the logic of the application to perform attacks from stealing credentials, to retrieving the entire database. By submitting additional parameters to an application, and if these parameters have the same name as an existing parameter, the database connection may react in one of the following ways:

11. Question 11 of 25

    The network administrator for a company is setting up a website with e-commerce capabilities. Packet sniffing is a concern because credit card information will be sent electronically over the Internet. Customers visiting the site will need to encrypt the data with HTTPS. Which type of certificate is used to encrypt and decrypt the data?

    • AAsymmetric
    • BConfidential
    • CSymmetric
    • DNon-confidential

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Agreed, a very poorly worded question. The second part seems to hint that the answer is symmetric, but the first part clearly says certificate which is asymmetric. It's pretty much a coin toss, but whats clear is the person who wrote this question should be maimed beyond recognition.

    Adapted from community discussion by Acidscars · 2024-05-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. A

       Acidscars

       2024-05-24

       2 upvotes

       Agreed, a very poorly worded question. The second part seems to hint that the answer is symmetric, but the first part clearly says certificate which is asymmetric. It's pretty much a coin toss, but whats clear is the person who wrote this question should be maimed beyond recognition.

    2. L

       Luukman

       2022-12-14

       2 upvotes

       Strange question.. think it should be: what type of encryption is used... then the answer is symetric. (Only the sessionkey is done with asymetric)

    3. [

       [Removed]

       2023-10-01

       Selected C1 upvote

       Symmetric. Asymmetric is used to establish the session and share the symmetric key, the symmetric key is used throughout the session.

    4. A

       asadeyemo

       2024-06-30

       1 upvote

       Https uses TLS/SSL protocol to establish handshake and that relies on asymmetric (2 pairs of keys). However, during a TLS handshake, the client and server agree upon new keys to use for symmetric encryption, called "session keys". Each new communication session will start with a new TLS handshake and use new session keys.

12. Question 12 of 25

    A penetration tester is attempting to scan an internal corporate network from the internet without alerting the border sensor. Which is the most efficient technique should the tester consider using?

    • ASpoofing an IP address
    • BTunneling scan over SSH
    • CTunneling over high port numbers
    • DScanning using fragmented IP packets

    Show answer

    Correct answer: D

    How others answered

    • D80%
    • B20%

    Explanation

    While the question says the pen tester is trying to scan the internal network from the internet (let's assume static nat or something), then this is the correct answer: https://nmap.org/book/man-bypass-firewalls-ids.html -f (fragment packets); --mtu (using the specified MTU) The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing

    Adapted from community discussion by salei · 2022-11-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. S

       salei

       2022-11-28

       Selected D2 upvotes

       While the question says the pen tester is trying to scan the internal network from the internet (let's assume static nat or something), then this is the correct answer: https://nmap.org/book/man-bypass-firewalls-ids.html -f (fragment packets); --mtu (using the specified MTU) The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing

    2. V

       virus9

       2020-10-05

       1 upvote

       An already established connection in the network is needed first. https://isc.sans.edu/forums/diary/Tunneling+scanners+or+really+anything+over+SSH/24286/

    3. V

       virus9

       2020-10-05

       1 upvote

       But since the question says, "penetration tester" and not a hacker, it means he might already been given the access.

13. Question 13 of 25

    A hacker is attempting to see which ports have been left open on a network. Which NMAP switch would the hacker use?

    • A-sO
    • B-sP
    • C-sS
    • D-sU

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    NMAP switch "-sS" (Option C), which stands for "TCP SYN scan". This is one of the most popular and widely used NMAP scan techniques that sends SYN packets to each target port, and waits for a response from the target. This can help the hacker identify which ports are open and accepting connections. Option A (-sO) is an IP protocol scan that can be used to identify which IP protocols are supported by the target system. Option B (-sP) is a "ping" or "host discovery" scan that can be used to identify which hosts are up and responding to network traffic. Option D (-sU) is a UDP scan that can be used to identify which UDP ports are open and accepting connections.

    Adapted from community discussion by lau2123 · 2023-02-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. L

       lau2123

       2023-02-21

       2 upvotes

       NMAP switch "-sS" (Option C), which stands for "TCP SYN scan". This is one of the most popular and widely used NMAP scan techniques that sends SYN packets to each target port, and waits for a response from the target. This can help the hacker identify which ports are open and accepting connections. Option A (-sO) is an IP protocol scan that can be used to identify which IP protocols are supported by the target system. Option B (-sP) is a "ping" or "host discovery" scan that can be used to identify which hosts are up and responding to network traffic. Option D (-sU) is a UDP scan that can be used to identify which UDP ports are open and accepting connections.

    2. P

       PennyTester

       2021-10-01

       3 upvotes

       The correct answer is -sS, i confirmed it using nmap. -sO is IP protocol scan, tells you if icmp is open

    3. A

       a4687eb

       2024-07-17

       1 upvote

       -sO shows not port numbers but protocol numbers. User is not able to find our what PORTS are Open/Closed from nmap output that with -sO becasue it will shown protocol numbers only. Correct answer is "C" of course it not perfect answer bacuse it will show only open ports for TCP not for UDP. So the opetions vs the question do not match perfectly.

    4. E

       EOL

       2021-05-26

       2 upvotes

       A is a good answer -sO: IP Protocal scan -sP: Ping sweep scan -sS: stealth scan -sU: UDP scan

14. Question 14 of 25

    A hacker is attempting to use nslookup to query Domain Name Service (DNS). The hacker uses the nslookup interactive mode for the search. Which command should the hacker type into the command shell to request the appropriate records?

    • ALocate type=ns
    • BRequest type=ns
    • CSet type=ns
    • DTransfer type=ns

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    nslookup set type= Specifies a DNS resource record type. The default resource record type is A, but you can use any of the following values: A: Specifies a computer's IP address. ANY: Specifies a computer's IP address. CNAME: Specifies a canonical name for an alias. GID Specifies a group identifier of a group name. HINFO: Specifies a computer's CPU and type of operating system. MB: Specifies a mailbox domain name. MG: Specifies a mail group member. MINFO: Specifies mailbox or mail list information. MR: Specifies the mail rename domain name. MX: Specifies the mail exchanger. NS: Specifies a DNS name server for the named zone. PTR: Specifies a computer name if the query is an IP address; otherwise, specifies the pointer to other information. SOA: Specifies the start-of-authority for a DNS zone. TXT: Specifies the text information. UID: Specifies the user identifier. UINFO: Specifies the user information. WKS: Describes a well-known service. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup-set-type

    Adapted from community discussion by dorinh · 2024-12-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion1

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. D

       dorinh

       2024-12-01

       Selected C3 upvotes

       nslookup set type= Specifies a DNS resource record type. The default resource record type is A, but you can use any of the following values: A: Specifies a computer's IP address. ANY: Specifies a computer's IP address. CNAME: Specifies a canonical name for an alias. GID Specifies a group identifier of a group name. HINFO: Specifies a computer's CPU and type of operating system. MB: Specifies a mailbox domain name. MG: Specifies a mail group member. MINFO: Specifies mailbox or mail list information. MR: Specifies the mail rename domain name. MX: Specifies the mail exchanger. NS: Specifies a DNS name server for the named zone. PTR: Specifies a computer name if the query is an IP address; otherwise, specifies the pointer to other information. SOA: Specifies the start-of-authority for a DNS zone. TXT: Specifies the text information. UID: Specifies the user identifier. UINFO: Specifies the user information. WKS: Describes a well-known service. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup-set-type

15. Question 15 of 25

    Which tool is used to automate SQL injections and exploit a database by forcing a given web application to connect to another database controlled by a hacker?

    • ADataThief
    • BNetCat
    • CCain and Abel
    • DSQLInjector

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    DataThief is a tool used to demonstrate to web administrators and developers how to steal data from a web application that is vulnerable to SQL Injection. Data Thief is designed to retrieve the data from a Microsoft SQL Server back-end behind a web application with a SQL Injection vulnerability. https://diarium.usal.es/pmgallardo/2020/11/02/list-of-sql-injection-tools/

    Adapted from community discussion by dorinh · 2021-12-01 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. D

       dorinh

       2021-12-01

       2 upvotes

       DataThief is a tool used to demonstrate to web administrators and developers how to steal data from a web application that is vulnerable to SQL Injection. Data Thief is designed to retrieve the data from a Microsoft SQL Server back-end behind a web application with a SQL Injection vulnerability. https://diarium.usal.es/pmgallardo/2020/11/02/list-of-sql-injection-tools/

    2. C

       Chogi_

       2024-09-15

       Selected D1 upvote

       Does DataThief Automate SQL injection? What if SQL Injector since it also a tool but AUTOMATE SQL injections attacks and exploit database connections by manipulating the web application's interaction with the database. What do you think? i think SQL is more suitable for the task described.

    3. B

       blackkofia

       2024-11-20

       1 upvote

       A. DataThief Purpose: DataThief is a tool for digitizing data from images of graphs, not for SQL injections or database exploitation. Fit: Not suitable for SQL injection tasks. D. SQLInjector Purpose: SQLInjector (or tools with similar names) is specifically built to automate SQL injection attacks, making it the most relevant choice for exploiting a database via SQL injection. Fit: Fits the use case perfectly. D should be the answer.What do you think?

    4. J

       jaycc

       2021-01-08

       1 upvote

       I think there are two tools with the same name. 'DataThief' is the reverse engineering tool, but 'Data Thief' (with a space) appears to be an automated SQL injection tool. So it's more a typo than a wrong answer

16. Question 16 of 25

    From the two screenshots below, which of the following is occurring?

    

    • A10.0.0.253 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
    • B10.0.0.253 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.
    • C10.0.0.2 is performing an IP scan against 10.0.0.0/24, 10.0.0.252 is performing a port scan against 10.0.0.2.
    • D10.0.0.252 is performing an IP scan against 10.0.0.2, 10.0.0.252 is performing a port scan against 10.0.0.2.

    Show answer

    Correct answer: A

    Explanation

    Answer A states the same information as Answer D does, but then also includes the correct information for the first scan, this is why A is correct.

    Adapted from community discussion by bleepbl0p · 2022-05-29 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. T

       thinkinconcept

       2024-11-23

       1 upvote

       None of this is correct, must be some kind of terminology issue here, let's dig in. .253 is nmap -sP .0/24 .252 is nmap -sO .2 Command: -sO is found here https://nmap.org/book/scan-methods-ip-protocol-scan.html Command: -sP is found here https://nmap.org/book/man-host-discovery.html So -sP is NOT a port scan and it's also not an IP protocol scan. But what is this "IP scan" mentioned in every answer? I would have to assume they mean "IP protocol scan" which is -sO. But none of the answers match correctly even with the terminology changed to the IP protocol scan. So then does "IP scan" mean any scan other than a port scan? If that's the case then none of the answers match either since 252 is NOT performing a port scan. SIGH, IDK...

    2. B

       bleepbl0p

       2022-05-29

       2 upvotes

       Answer A states the same information as Answer D does, but then also includes the correct information for the first scan, this is why A is correct.

    3. M

       MoodyDork

       2023-03-22

       1 upvote

       While A is correct, your explanation is not. D does not have the /24

    4. M

       MoodyDork

       2023-03-22

       1 upvote

       you missed out the /24 information that makes A the correct answer.

17. Question 17 of 25

    The use of technologies like IPSec can help guarantee the following: authenticity, integrity, confidentiality and

    • Anon-repudiation.
    • Boperability.
    • Csecurity.
    • Dusability.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Not sure I agree, Non-repudiation says never give room for anyone or any subject to deny their action on any object. So Ipsec mainly encrypts the communication path (Integrity and confidentiality)

    Adapted from community discussion by Router · 2024-08-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. R

       Router

       2024-08-26

       2 upvotes

       Not sure I agree, Non-repudiation says never give room for anyone or any subject to deny their action on any object. So Ipsec mainly encrypts the communication path (Integrity and confidentiality)

    2. K

       karpal

       2024-09-12

       Selected C1 upvote

       IP Sec does NOT offer non-repudiation. PKI, digital signatures do that. I would go for B-> Security.

    3. L

       Lumos98

       2022-12-03

       1 upvote

       It can provide all of the security that can be achieved through cryptography: confidentiality and integrity of the data, plus authentication of the endpoint hosts. The combination of integrity and authentication provides non-repudiation.

18. Question 18 of 25

    An IT security engineer notices that the company’s web server is currently being hacked. What should the engineer do next?

    • AUnplug the network connection on the company’s web server.
    • BDetermine the origin of the attack and launch a counterattack.
    • CRecord as much information as possible from the attack.
    • DPerform a system restart on the company’s web server.

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    In the above scenario, the company’s web server is hacked. As an IT security engineer, your first task is to unplug the network connection (cable) on the company’s web server from the router and modem in order to prevent further attacks.

    Adapted from community discussion by salei · 2022-11-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. N

       NikoTomas

       2024-03-15

       1 upvote

       From above provided link: "The CEH model says that you identify and analyze an incident before you contain or eradicate it. What's more, it's very rare that they'd want you to make a change to the system without using an integrated change management process. If you're talking a small company or your own web server, unplugging it might make sense. But what's the maximum tolerable downtime for that server? How much damage is this unspecified hack going to do compared to the cost of shutting down the company's web presence? But that's common sense/real-life talking. For CEH, just memorize the steps in their process (they have a blog article about their steps here): Prepare Identify Contain Eradicate Recover Lessons learned "

    2. S

       salei

       2022-11-28

       Selected A2 upvotes

       In the above scenario, the company’s web server is hacked. As an IT security engineer, your first task is to unplug the network connection (cable) on the company’s web server from the router and modem in order to prevent further attacks.

    3. A

       amal1302

       2020-10-08

       2 upvotes

       the web server must be in a DMZ. It is a question from forensic perspective, he has to get as much info as he can to find the indice of compromision. If heunplug the server then he will not know how to fix the problem.

    4. H

       hcakyol

       2020-09-29

       2 upvotes

       If you are Polat ALEMDAR you can do it. https://www.youtube.com/watch?v=yLx9B3xVOw8

19. Question 19 of 25

    For messages sent through an insecure channel, a properly implemented digital signature gives the receiver reason to believe the message was sent by the claimed sender. While using a digital signature, the message digest is encrypted with which key?

    • ASender's public key
    • BReceiver's private key
    • CReceiver's public key
    • DSender's private key

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    D. Sender's private key In a digital signature, the message digest (a fixed-length representation of the original message) is encrypted with the sender's private key. This process creates a unique digital signature that can only be decrypted by the sender's public key, which is widely available. When the receiver gets the message, they can verify its authenticity by using the sender's public key to decrypt the digital signature and comparing it to the message digest they calculated from the received message. If the two match, the receiver can be reasonably sure that the message came from the claimed sender and has not been altered in transit.

    Adapted from community discussion by Novmejst · 2024-10-22 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. N

       Novmejst

       2024-10-22

       Selected D3 upvotes

       D. Sender's private key In a digital signature, the message digest (a fixed-length representation of the original message) is encrypted with the sender's private key. This process creates a unique digital signature that can only be decrypted by the sender's public key, which is widely available. When the receiver gets the message, they can verify its authenticity by using the sender's public key to decrypt the digital signature and comparing it to the message digest they calculated from the received message. If the two match, the receiver can be reasonably sure that the message came from the claimed sender and has not been altered in transit.

    2. D

       dorinh

       2023-06-01

       3 upvotes

       Receiver’s public key is available also for an attacker, so he can change the message, generate another hash and encript the hash with the receiver’s public key so the authenticyty of the message is not garanteed. If the hash is encripted with the sender's private key, anyoane can decrypt it with the sender's pubic key to validate the hash. With this approach, the authenticity of the message is guaranteed, as log as the sender's privte key is not compriomised .

    3. W

       WZ1122

       2023-09-20

       4 upvotes

       Encryption is using receiver's public key and decrypted by receiver's private key. digital signature is using sender's private key and verified by sender's public key.

    4. H

       HeyacedoGomez

       2024-07-27

       3 upvotes

       I think the question stated signing......and that's done by hashing the data with sender's PRIVATE key.....

20. Question 20 of 25

    An attacker tries to do banner grabbing on a remote web server and executes the following command.

    

    Service detection performed. Please report any incorrect results at http://nmap.org/submit/. Nmap done: 1 IP address (1 host up) scanned in 6.42 seconds What did the hacker accomplish?

    • Anmap can't retrieve the version number of any running remote service.
    • BThe hacker successfully completed the banner grabbing.
    • CThe hacker should've used nmap -O host.domain.com.
    • DThe hacker failed to do banner grabbing as he didn't get the version of the Apache web server.

    Show answer

    Correct answer: B

    Explanation

    B is correct. You are wrong, the banner grabbing was successful but was changed by admin to not include the verison. -O is for os detection.

    Adapted from community discussion by Cute_Fluff · 2024-08-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. C

       Cute_Fluff

       2024-08-07

       2 upvotes

       B is correct. You are wrong, the banner grabbing was successful but was changed by admin to not include the verison. -O is for os detection.

    2. A

       Adbucket

       2024-10-09

       1 upvote

       VERY UNETHICAL to not telling uses at the beginning of the practice they they will be Locked up to pay!!! Now I have to go through a other we site reading again 36 page of questions and find new questions. If you would say it upfront I might of paid!

    3. S

       Sakmoto

       2024-07-29

       1 upvote

       The correct answer is C. The attack should have used nmap -o host.domain.com. Without using the -O syntax, he failed to grab the version of Apache httpd and other possible details about the server.

21. Question 21 of 25

    A hacker was able to easily gain access to a website. He was able to log in via the frontend user login form of the website using default or commonly used credentials. This exploitation is an example of what Software design flaw?

    • AInsufficient security management
    • BInsufficient database hardening
    • CInsufficient input validation
    • DInsufficient exception handling

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    I am not sure if "Database Hardening" has anything to do with this. https://security.berkeley.edu/education-awareness/best-practices-how-tos/system-application-security/database-hardening-best Besides, by using a weak/default password, the hacker is only accessing the website. Nothing in the question mentions about accessing the database. You have access to a website does not necessarily mean you have access to a database. If you can manipulate/access data via the application once you gain access to the system, does not necessarily mean the database is not hardened.

    Adapted from community discussion by bleble00001 · 2021-04-13 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. D

       dimaste

       2021-08-28

       5 upvotes

       Actually, A is correct from my perspective, because using default credentials on the website is a security management problem

    2. B

       bleble00001

       2021-04-13

       2 upvotes

       I am not sure if "Database Hardening" has anything to do with this. https://security.berkeley.edu/education-awareness/best-practices-how-tos/system-application-security/database-hardening-best Besides, by using a weak/default password, the hacker is only accessing the website. Nothing in the question mentions about accessing the database. You have access to a website does not necessarily mean you have access to a database. If you can manipulate/access data via the application once you gain access to the system, does not necessarily mean the database is not hardened.

    3. S

       Script_Kitty

       2024-08-22

       1 upvote

       I feel the answer is most likely A. Database hardening (option B) is about securing the database from attacks, but the issue here is with the management of credentials, not the database structure or protection mechanisms. In this scenario, we have to assume the credentials were easy to guess, which shows weak security practices and policies to protect against unauthorized access. There could be confusion between the specific use of security tokens and other security practices. For instance, if B mentioned a practice that's commonly misunderstood or conflated with the use of tokens, like encryption or specific types of authentication methods, it might seem like a good choice without understanding the distinct role and definition of security tokens.

    4. W

       White_T_10

       2023-11-17

       1 upvote

       ok, here is my theory after reading the question so many times. Using default credentials to log in is a database-hardening issue. If the question stated the attacker could gain access using SQL injection techniques, then yes, it would be input validation. So, I'd go with B.

22. Question 22 of 25

    Select 3

    Which of the following statements about a zone transfer is correct? (Choose three.)

    • AA zone transfer is accomplished with the DNS
    • BA zone transfer is accomplished with the nslookup service
    • CA zone transfer passes all zone information that a DNS server maintains
    • DA zone transfer passes all zone information that a nslookup server maintains
    • EA zone transfer can be prevented by blocking all inbound TCP port 53 connections
    • FZone transfers cannot occur on the Internet

    Show answer

    Correct answer: A, C, E

    How others answered

    • ACE67%
    • BCE33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    DNS uses TCP for Zone transfer and UDP for name, and queries either regular (primary) or reverse. Both TCP and UDP are port 53

    Adapted from community discussion by salei · 2023-10-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. S

       salei

       2023-10-04

       Selected A, C, E2 upvotes

       DNS uses TCP for Zone transfer and UDP for name, and queries either regular (primary) or reverse. Both TCP and UDP are port 53

    2. X

       XX20Jim20XX

       2024-11-02

       1 upvote

       AI response :) " Your answer is partially correct. However, there are a couple of incorrect statements. The correct statements about a zone transfer are as follows: A. A zone transfer is accomplished with the DNS. C. A zone transfer passes all zone information that a DNS server maintains. E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections. Therefore, the options A, C, and E are the correct ones. Well done! If you have any more questions or need further clarification, please feel free to ask. "

    3. [

       [Removed]

       2023-04-06

       1 upvote

       DNS uses UDP 53 for default name resolution and TCP 53 for zone transfers

    4. E

       EngMina

       2022-09-03

       1 upvote

       ABC E is wrong as DNS can use UDP 53 also nsLookup can do zone transfer

23. Question 23 of 25

    While examining audit logs, you discover that people are able to telnet into the SMTP server on port 25. You would like to block this, though you do not see any evidence of an attack or other wrong doing. However, you are concerned about affecting the normal functionality of the email server. From the following options choose how best you can achieve this objective?

    • ABlock port 25 at the firewall.
    • BShut off the SMTP service on the server.
    • CForce all connections to use a username and password.
    • DSwitch from Windows Exchange to UNIX Sendmail.
    • ENone of the above.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Blocking port 25 in the firewall or forcing all connections to use username and password would have the consequences that the server is unable to communicate with other SMTP servers. Turning of the SMTP service would disable the email function completely. All email servers use SMTP to communicate with other email servers and therefore changing email server will not help. So None of the above option is true.

    Adapted from community discussion by gauravtewari · 2023-05-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. B

       boog

       2024-11-19

       Selected C1 upvote

       By enforcing authentication using a username and password for SMTP connections, you can ensure that only authorized users are able to access the SMTP server. This can be achieved by implementing SMTP authentication mechanisms such as SMTP-AUTH or STARTTLS, which require clients to provide valid credentials before establishing a connection to the server. Blocking port 25 at the firewall (option A) would indeed prevent telnet access to the SMTP server, but it would also affect legitimate email communication as port 25 is the standard SMTP port used for email delivery. Shutting off the SMTP service on the server (option B) would completely disable email functionality. Switching from Windows Exchange to UNIX Sendmail (option D) is not necessary to address the issue at hand and would involve a significant infrastructure change. ---ChatGPT

    2. G

       gauravtewari

       2023-05-28

       2 upvotes

       Blocking port 25 in the firewall or forcing all connections to use username and password would have the consequences that the server is unable to communicate with other SMTP servers. Turning of the SMTP service would disable the email function completely. All email servers use SMTP to communicate with other email servers and therefore changing email server will not help. So None of the above option is true.

    3. F

       fishPSU21

       2022-09-15

       1 upvote

       a hacker can just get the username and password from an employee and then it will be be compromised. This wouldn't be an effective method.

24. Question 24 of 25

    A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port. What kind of vulnerability must be present to make this remote attack possible?

    • AFile system permissions
    • BPrivilege escalation
    • CDirectory traversal
    • DBrute force login A

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    To upload files the user must have proper write file permissions. References: http://codex.wordpress.org/Hardening_WordPress

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. T

       tyw82

       2024-10-07

       Selected A1 upvote

       Not B because it says the the activities were done by the 'anonymous user account' which logged in to the server.

    2. I

       igodomigododevcenter

       2024-04-30

       Selected A1 upvote

       File system permission is required to be able to run a script inside the folder

    3. P

       Pragdeashwar

       2024-04-17

       1 upvote

       File System Permission, it is the weakness that allowed adversary to copy malicious file also allowed to execute it.

    4. L

       Luukman

       2021-09-17

       1 upvote

       Ftp users don’t have permissions to start processes. Privelige escalation is needed to achieve this

25. Question 25 of 25

    Which of the following is considered the best way to protect Personally Identifiable Information (PII) from Web application vulnerabilities?

    • AUse cryptographic storage to store all PII
    • BUse encrypted communications protocols to transmit PII
    • CUse full disk encryption on all hard drives to protect PII
    • DUse a security token to log into all Web applications that use PII

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    As a matter of good practice any PII should be protected with strong encryption. References: https://cuit.columbia.edu/cuit/it-security-practices/handling-personally-identifying-information

    Adapted from community discussion by Bright07 · 2022-08-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 312-50 or CertExamHQ.

    1. B

       Bright07

       2022-08-11

       2 upvotes

       Use encrypted communications protocols to transmit PII. Even According to your comment, the right answer is B. I don't know the reason why a lot of website is choosing cryptographic storage. If you choose A as your answer can you give the reason because it has become the bone of contention. Thanks. If there is no reason then B. is the right answer.

    2. G

       Grezavi

       2024-01-03

       2 upvotes

       A. Justification: Cryptography is Encryption. Storing is any time the data is in any type of memory. B -> A but A is more comprehensive and would cover transmission memory, servers, hard disks etc. It is a more comprehensive answer.

    3. C

       cehexam

       2023-11-27

       2 upvotes

       For Me A snd B is the answer but now which is the most correct?.. as they asked for web application and not storage, I will pick B. storage is not done on web application level but on DB/server level

    4. I

       IamStuding

       2023-08-24

       2 upvotes

       Also for me is B. We are talking about web services and here ecrypted communications are the most important.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-50 practice, question 1 of 25