ECCouncil 312-50v12 Practice Test - Questions Answers, Page 6

List of questions
Question 51

The "Gray-box testing" methodology enforces what kind of restriction?
White-box testing (also known as clear box testing, glass box testing, transparent box testing, and structural testing) is a method of software testing that tests internal structures or workings of an application, as opposed to its functionality (i.e. black-box testing). In white-box testing, an internal perspective of the system, as well as programming skills, are used to design test cases. The tester chooses inputs to exercise paths through the code and determine the expected outputs. This is analogous to testing nodes in a circuit, e.g. in-circuit testing (ICT). White-box testing can be applied at the unit, integration and system levels of the software testing process. Although traditional testers tended to think of white-box testing as being done at the unit level, it is used for integration and system testing more frequently today. It can test paths within a unit, paths between units during integration, and between subsystems during a system-level test.
Though this method of test design can uncover many errors or problems, it has the potential to miss unimplemented parts of the specification or missing requirements. Where white-box testing is design-driven,[1] that is, driven exclusively by agreed specifications of how each component of the software is required to behave (as in DO-178C and ISO 26262 processes) then white-box test techniques can accomplish assessment for unimplemented or missing requirements.
White-box test design techniques include the following code coverage criteria:
. Control flow testing
. Data flow testing
. Branch testing
. Statement coverage
. Decision coverage
. Modified condition/decision coverage
. Prime path testing
. Path testing
Question 52

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's Computer to update the router configuration.
What type of an alert is this?
True Positive - IDS referring a behavior as an attack, in real life it is True Negative - IDS referring a behavior not an attack and in real life it is not False Positive - IDS referring a behavior as an attack, in real life it is not False Negative - IDS referring a behavior not an attack, but in real life is an attack.
False Negative - is the most serious and dangerous state of all !!!!
Question 53

A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the Prometric Online Testing – Reports https://ibt1.prometric.com/users/custom/report_queue/rq_str... corporate network. What tool should the analyst use to perform a Blackjacking attack?
Question 54

When you are getting information about a web server, it is very important to know the HTTPMethods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two criticalmethods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from theserver. You can detect all these methods (GET, POST, HEAD, DELETE, PUT, TRACE) using NMAP scriptengine. What Nmap script will help you with this task?
Question 55

Todd has been asked by the security officer to purchase a counter-based authentication system.
Which of the following best describes this type of system?
Question 56

Which of the following is a low-tech way of gaining unauthorized access to systems?
Question 57

Which system consists of a publicly available set of databases that contain domain name registration contact information?
Question 58

Why is a penetration test considered to be more thorough than vulnerability scan?
Question 59

Bob received this text message on his mobile phone: "Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: [email protected]". Which statement below is true?
Question 60

env x='(){ :;};echo exploit' bash –c 'cat/etc/passwd' What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?
Question