Question 1

An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?

Options :

A :

Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing

B : Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form

C :

Implementing sophisticated matches such as “OR ‘john' = john" in place of classical matches like "OR 1-1"

D : Manipulating white spaces in SQL queries to bypass signature detection

Answer: D

Question 2

Which of the following commands checks for valid users on an SMTP server?

Options :

A : RCPT

B : CHK

C : VRFY

D : EXPN

Answer: C

Question 3

What is the proper response for a NULL scan if the port is open?

Options :

A : SYN

B : ACK

C : FIN

D : PSH

E : RST

F : No response

Answer: A

Question 4

In your cybersecurity class, you are learning about common security risks associated with web servers. One topic that comes up is the risk posed by using default server settings. Why is using default settings ona web - server considered a security risk, and what would be the best initial step to mitigate this risk?

Options :

A : Default settings cause server malfunctions; simplify the settings

B : Default settings allow unlimited login attempts; setup account lockout

C : Default settings reveal server software type; change these settings

D : Default settings enable auto-updates; disable and manually patch

Answer: C

Question 5

Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B. How do you prevent DNS spoofing?

Options :

A : Install DNS logger and track vulnerable packets

B : Disable DNS timeouts

C : Install DNS Anti-spoofing

D : Disable DNS Zone Transfer

Answer: C

Confidently Practice Online with Free 312-50 Exam Cram

Buying Options: