312-50 practice questions 141–150

1. Question 141 · 888 in bank

   Kevin, a professional hacker, wants to penetrate CyberTech Inc’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packets, but the target web server can decode them. What is the technique used by Kevin to evade the IDS system?

   • ASession splicing
   • BUrgency flag
   • CObfuscating
   • DDesynchronization

   Show answer

   Answer: C

   Next question

2. Question 142 · 888 in bank

   Which of the following scanning tools is specifically designed to find potential exploits in Microsoft Windows products?

   • AMicrosoft Security Baseline Analyzer
   • BRetina
   • CCore Impact
   • DMicrosoft Baseline Security Analyzer

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

3. Question 143 · 888 in bank

   Which of the following types of jailbreaking allows user-level access but does not allow iboot-level access?

   • ABootrom Exploit
   • BiBoot Exploit
   • CSandbox Exploit
   • DUserland Exploit

   Show answer

   Answer: D

   Next question

4. Question 144 · 888 in bank

   You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You see that IP's owned by XYZ (Internal) and private IP's are communicating to a Single Public IP. Therefore, the Internal IP's are sending data to the Public IP. After further analysis, you find out that this Public IP is a blacklisted IP, and the internal communicating devices are compromised. What kind of attack does the above scenario depict?

   • ABotnet Attack
   • BSpear Phishing Attack
   • CAdvanced Persistent Threats
   • DRootkit Attack

   Show answer

   Answer: A

   Next question

5. Question 145 · 888 in bank

   Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:

   

   Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

   • Aselect * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
   • Bselect * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’
   • Cselect * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
   • Dselect * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’

   Show answer

   Answer: D

   Next question

6. Question 146 · 888 in bank

   Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:

   

   Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

   • Aselect * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
   • Bselect * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’
   • Cselect * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
   • Dselect * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’

   Show answer

   Answer: B

   Next question

7. Question 147 · 888 in bank

   A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?

   • AFirewall-management policy
   • BAcceptable-use policy
   • CRemote-access policy
   • DPermissive policy

   Show answer

   Answer: B

   Explanation

   Dial-out modem is already installed on the system, to verify the use one should check if it is allowed or not. Hence Acceptable use policy.

   Source: Adapted from community discussion — Darpan24

   Next question

8. Question 148 · 888 in bank

   Scenario: 1. Victim opens the attacker's web site. 2. Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make $1000 in a day?'. 3. Victim clicks to the interesting and attractive content URL. 4. Attacker creates a transparent 'iframe' in front of the URL which the victim attempts to click, so the victim thinks that he/she clicks on the 'Do you want to make $1000 in a day?' URL but actually he/she clicks on the content or URL that exists in the transparent 'iframe' which is setup by the attacker. What is the name of the attack which is mentioned in the scenario?

   • ASession Fixation
   • BHTML Injection
   • CHTTP Parameter Pollution
   • DClickjacking Attack

   Show answer

   Answer: D

   Next question

9. Question 149 · 888 in bank

   Which of the following commands checks for valid users on an SMTP server?

   • ARCPT
   • BCHK
   • CVRFY
   • DEXPN

   Show answer

   Answer: C

   Next question

10. Question 150 · 888 in bank

    A security consultant is trying to bid on a large contract that involves penetration testing and reporting. The company accepting bids wants proof of work so the consultant prints out several audits that have been performed. Which of the following is likely to occur as a result?

    • AThe consultant will ask for money on the bid because of great work.
    • BThe consultant may expose vulnerabilities of other companies.
    • CThe company accepting bids will want the same type of format of testing.
    • DThe company accepting bids will hire the consultant because of the great work performed.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-50 practice, question 141. 888 questions available.