Which of the following statements is FALSE with respect to Intrusion Detection Systems?

Intrusion Detection Systems can easily distinguish a malicious payload in an encrypted traffic

Intrusion Detection Systems can be configured to distinguish specific content in network packets

Intrusion Detection Systems can easily distinguish a malicious payload in an encrypted traffic

Intrusion Detection Systems require constant update of the signature library

Intrusion Detection Systems can examine the contents of the data n context of the network protocol

You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24. What command you would use?

sudo tshark -f''net 192 .68.8.0/24''

wireshark --fetch ''192.168.8*''

wireshark --capture --local masked 192.168.8.0 ---range 24

tshark -net 192.255.255.255 mask 192.168.8.0

sudo tshark -f''net 192 .68.8.0/24''

You are tasked to configure the DHCP server to lease the last 100 usable IP addresses in subnet to.

4.0/23. Which of the following IP addresses could be teased as a result of the new configuration?

The tools which receive event logs from servers, network equipment, and applications, and perform analysis and correlation on those logs, and can generate alarms for security relevant issues, are known as what?

Security incident and event Monitoring

What is the main security service a cryptographic hash provides?

Integrity and computational in-feasibility

Integrity and ease of computation

Message authentication and collision resistance

Integrity and collision resistance

Integrity and computational in-feasibility

What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail.

Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography.

Symmetric encryption allows the server to securely transmit the session keys out-of-band.

Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead.

When a security analyst prepares for the formal security assessment - what of the following should be done in order to determine inconsistencies in the secure assets database and verify that system is compliant to the minimum security baseline?

Data items and vulnerability scanning

Interviewing employees and network engineers

Reviewing the firewalls configuration

Why containers are less secure that virtual machines?

Host OS on containers has a larger surface attack.

Containers may full fill disk space of the host.

A compromise container may cause a CPU starvation of the host.

Containers are attached to the same virtual network.

In the field of cryptanalysis, what is meant by a "rubber-hose" attack?

Extraction of cryptographic secrets through coercion or torture.

Attempting to decrypt cipher text by making logical assumptions about the contents of the original plain text.

Extraction of cryptographic secrets through coercion or torture.

Forcing the targeted key stream through a hardware-accelerated device such as an ASIC.

A backdoor placed into a cryptographic algorithm by its creator.

Which of the following steps for risk assessment methodology refers to vulnerability identification?

Determines risk probability that vulnerability will be exploited (High. Medium, Low)

Determines if any flaws exist in systems, policies, or procedures

Assigns values to risk probabilities; Impact values.

Determines risk probability that vulnerability will be exploited (High. Medium, Low)

Identifies sources of harm to an IT system. (Natural, Human. Environmental)

The network team has well-established procedures to follow for creating new rules on the firewall.This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it. What would be a good step to have in the procedures for a situation like this?

Immediately roll back the firewall rule until a manager can approve it

Have the network team document the reason why the rule was implemented without prior manager approval.

Monitor all traffic using the firewall rule until a manager can approve it.

Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.

Immediately roll back the firewall rule until a manager can approve it

The Payment Card Industry Data Security Standard (PCI DSS) contains six different categories of control objectives. Each objective contains one or more requirements, which must be followed in order to achieve compliance. Which of the following requirements would best fit under the objective, "Implement strong access control measures"?

Assign a unique ID to each person with computer access.

Regularly test security systems and processes.

Encrypt transmission of cardholder data across open, public networks.

Assign a unique ID to each person with computer access.

Use and regularly update anti-virus software on all systems commonly affected by malware.

Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security breach to his company's email server based on analysis of a suspicious connection from the email server to an unknown IP Address.What is the first thing that Nedved needs to do before contacting the incident response team?

Disconnect the email server from the network

Leave it as it Is and contact the incident response te3m right away

Block the connection to the suspicious IP Address from the firewall

Disconnect the email server from the network

Migrate the connection to the backup email server

Vlady works in a fishing company where the majority of the employees have very little understanding of IT let alone IT Security. Several information security issues that Vlady often found includes, employees sharing password, writing his/ her password on a post it note and stick it to his/her desk, leaving the computer unlocked, didn't log out from emails or other social media accounts, and etc.After discussing with his boss, Vlady decided to make some changes to improve the security environment in his company. The first thing that Vlady wanted to do is to make the employees understand the importance of keeping confidential information, such as password, a secret and they should not share it with other persons.Which of the following steps should be the first thing that Vlady should do to make the employees in his company understand to importance of keeping confidential information a secret?

Warning to those who write password on a post it note and put it on his/her desk

Developing a strict information security policy

Information security awareness training

Conducting a one to one discussion with the other employees about the importance of information security

Jim, a professional hacker, targeted an organization that is operating critical Industrial Infrastructure.Jim used Nmap to scan open pons and running services on systems connected to the organization's OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered Information such as the vendor name, product code and name, device name, and IP address. Which of the following Nmap commands helped Jim retrieve the required information?

nmap -Pn -sU -p 44818 --script enip-info < Target IP >

nmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP >

nmap -Pn -sU -p 44818 --script enip-info < Target IP >

nmap -Pn -sT -p 46824 < Target IP >

nmap -Pn -sT -p 102 --script s7-info < Target IP >

Attacker Lauren has gained the credentials of an organization's internal server system, and she was often logging in during irregular times to monitor the network activities. The organization was skeptical about the login times and appointed security professional Robert to determine the issue.Robert analyzed the compromised device to find incident details such as the type of attack, its severity, target, impact, method of propagation, and vulnerabilities exploited. What is the incident handling and response (IH&R) phase, in whichRobert has determined these issues?

Incident recording and assignment

Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network. Which of the following Nmap commands must John use to perform the TCP SYN ping scan?

nmap -sn -PS < target IP address >

nmap -sn -pp < target ip address >

nmap -sn -PO < target IP address >

nmap -sn -PS < target IP address >

nmap -sn -PA < target IP address >

ECCouncil 312-50v12 Practice Test 6 - Free Online Exam Prep & Questions

Gavin owns a white-hat firm and is performing a website security audit for one of his clients. He begins by running a scan which looks for common misconfigurations and outdated software versions.

Which of the following tools is he most likely using?

Nikto

Nmap

Metasploit

Armitage

Comment (0)

ECCouncil 312-50v12 Practice Test 6

Question

ECCouncil 312-50v12 Practice Tests

Practice Tests