Question 1

What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

Options :

A : Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.

B : Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.

C : Symmetric encryption allows the server to securely transmit the session keys out-of-band.

D : Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead

Answer: D

Question 2

Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned. Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

Options :

A : “GET /restricted/goldtransfer?to=Rob&from=1 or 1=1’ HTTP/1.1Host: westbank.com”

B : “GET /restricted/\r\n\accountNedaccess HTTP/1.1 Host: westbank.com”

C : “GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com”

D : “GET /restricted/ HTTP/1.1 Host: westbank.com

Answer: C

Question 3

What type of a vulnerability/attack is it when the malicious person forces the user’s browser to send an authenticated request to a server?

Options :

A : Session hijacking

B : Server side request forgery

C : Cross-site request forgery

D : Cross-site scripting

Answer: C

Question 4

In this attack, a victim receives an e-mail claiming from PayPal stating that their account has been disabled and confirmation is required before activation. The attackers then scam to collect not one but two credit card numbers, ATM PIN number and other personal details. Ignorant users usually fall prey to this scam.

Which of the following statement is incorrect related to this attack?

Options :

A : Do not reply to email messages or popup ads asking for personal or financial information

B : Do not trust telephone numbers in e-mails or popup ads

C : Review credit card and bank account statements regularly

D : Antivirus, anti-spyware, and firewall software can very easily detect these type of attacks

E : Do not send credit card numbers, and personal or financial information via e-mail

Answer: D

Question 5

Harry. a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection. What is the APT lifecycle phase that Harry is currently executing?

Options :

A : Preparation

B : Cleanup

C : Persistence

D : initial intrusion

Answer: D

Confidently Practice Online with Free 312-50v13 Exam Cram

Buying Options: