Practical 312-50v9 Exam Questions and Answers 2021

NEW QUESTION 1
The Open Web Application Security Project (OWASP) isthe worldwide not-for-profit charitable organization focused on improving the security of software. What item is the primary concern on OWASP’s Top Ten Project most Critical Web application Security Rules?

• A. Injection
• B. Cross site Scripting
• C. Cross site Request Forgery
• D. Path Disclosure

Answer: A

NEW QUESTION 2
What does a firewall check to prevent particularports and applications from getting packets into an organizations?

• A. Transport layer port numbers and application layer headers
• B. Network layer headers and the session layer port numbers
• C. Application layer port numbers and the transport layer headers
• D. Presentation layer headers and the session layer port numbers

Answer: A

NEW QUESTION 3
You have successfully gained access to your client’s internal network and successfully comprised a linux server which is part of the internal IP network. You want to know which
Microsoft Windows workstation have the sharing enabled.
Which port would you see listeningon these Windows machines in the network?

• A. 1443
• B. 3389
• C. 161
• D. 445

Answer: D

NEW QUESTION 4
Your team has won a contract to infiltrate an organization. The company wants to have the attack be a realistic as possible; therefore, they did not provide any information besides the company name.
What should be thefirst step in security testing the client?

• A. Scanning
• B. Escalation
• C. Enumeration
• D. Reconnaissance

Answer: D

NEW QUESTION 5
Which of the following statements regarding ethical hacking is incorrect?

• A. Testing should be remotely performed offsite.
• B. Ethical hackers should never use tools that have potential of exploiting vulnerabilities in theorganizations IT system.
• C. Ethical hacking should not involve writing to or modifying the target systems.
• D. An organization should use ethical hackers who do not sell hardware/software or other consulting services.

Answer: B

NEW QUESTION 6
In Risk Management, how is the term “likelihood” related to the concept of “threat?”

• A. Likelihood is the probability that a vulnerability is a threat-source.
• B. Likelihood is a possible threat-source that may exploit a vulnerability.
• C. Likelihood is the likely source of a threat that could exploit a vulnerability.
• D. Likelihood is the probability that a threat-source will exploit a vulnerability.

Answer: D

NEW QUESTION 7
Ricardo wants to send secret messages to acompetitor company. To secure these messages, he uses a technique of hiding a secret message within an ordinary message, the technique provides 'security through obscurity'. What technique is Ricardo using?

• A. RSA algorithm
• B. Steganography
• C. Encryption
• D. Public-key cryptography

Answer: B

NEW QUESTION 8
A hacker has successfully infected an internet-facing server, which he will then use to send junk mail, take part incoordinated attacks, or host junk email content.
Which sort of trojan infects this server?

• A. Botnet Trojan
• B. Banking Trojans
• C. Ransomware Trojans
• D. Turtle Trojans

Answer: A

NEW QUESTION 9
Which of the following is a command line packet analyzer similar to GUI-based Wireshark?

• A. Jack the ripper
• B. nessus
• C. tcpdump
• D. ethereal

Answer: C

NEW QUESTION 10
Which of the following isthe greatest threat posed by backups?

• A. An un-encrypted backup can be misplaced or stolen
• B. A back is incomplete because no verification was performed.
• C. A backup is the source of Malware or illicit information.
• D. A backup is unavailable duringdisaster recovery.

Answer: A

NEW QUESTION 11
An attacker changes the profile information of a particular user on a target website (the victim). The attacker uses this string to update the victim's profile to a text file and then submit the data to the attacker’s database.
<frame src=http://www/vulnweb.com/updataif.php Style=”display:none”></iframe> What is this type of attack (that can use either HTTP GET or HRRP POST) called?

• A. Cross-Site Request Forgery
• B. Cross-Site Scripting
• C. SQL Injection
• D. Browser Hacking

Answer: A

NEW QUESTION 12
A company’s security states that all web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

• A. Attempts by attackers to determine the user's Web browser usage patterns, including when sites were visited and for how long.
• B. Attempts by attackers to access passwords stored on the user's computer without the user's knowledge.
• C. Attempts by attackers to access Web sites that trust the Web browser user by stealing the user's authentication credentials.
• D. Attempts by attacks to access the user and password information stores in the company's SQL database.

Answer: C

NEW QUESTION 13
Which of the following security operations is used for determining the attack surface of an organization?

• A. Reviewing the need for a security clearance for each employee
• B. Running a network scan to detect network services in the corporate DMZ
• C. Training employees on the security policy regarding social engineering
• D. Using configuration management to determine when and where to apply security patches

Answer: B

NEW QUESTION 14
When you are testing a web application, it is very useful to employ a prosy tool to save every request and response.Nyou can manually test every request and analyze the response to find vulnerabilities. You can test parameter and headers manually to get more precise results than if using web vulnerability scanners.
What proxy tool will help you find web vulnerabilities?

• A. Burpsuite
• B. Dimitry
• C. Proxychains
• D. Maskgen

Answer: A

NEW QUESTION 15
Which of the following is assured by the use of a hash?

• A. Availability
• B. Confidentiality
• C. Authentication
• D. Integrity

Answer: D

NEW QUESTION 16
Which of the following parameters describe LM Hash: I – The maximum password length is 14 characters.
II – There are no distinctions between uppercase and lowercase.
III – It’s a simple algorithm, so 10,000,000 hashes can be generated per second.

• A. I
• B. I and II
• C. II
• D. I, II and III

Answer: D

NEW QUESTION 17
You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine.
What wireshark filter will show the connections from the snort machineto kiwi syslog machine?

• A. tcp.dstport==514 && ip.dst==192.168.0.150
• B. tcp.dstport==514 &&ip.dst==192.168.0.99
• C. tcp.srcport==514 && ip.src==192.168.0.99
• D. tcp.srcport==514 && ip.src==192.168.150

Answer: A

NEW QUESTION 18
You work as a Security Analyst for a retail organization. In securing the company's network, you set up a firewall and an IDS. However, hackers are able to attack the network. After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed. What type of alert is the IDS giving?

• A. False Negative
• B. True Negative
• C. True Positive
• D. False Positive

Answer: A