Home / ECCouncil / 312-96

ECCouncil 312-96 Practice Test - Questions Answers, Page 3

Question list

List of questions

Question 21

(0)

In which phase of secure development lifecycle the threat modeling is performed?

Question 22

(0)

Identify the type of attack depicted in the figure below:

Question 23

(0)

Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He desig

Question 24

(0)

Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities. Which type of security assessment activity Jacob is currently performing?

Question 25

(0)

Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can po

Question 26

(0)

Which of the following relationship is used to describe security use case scenario?

Question 27

(0)

Identify the formula for calculating the risk during threat modeling.

Question 28

(0)

The threat modeling phase where applications are decomposed and their entry points are reviewed from an attacker's perspective is known as ________

Question 29

(0)

Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of u

Question 30

(0)

A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price

Related questions

During his secure code review, John, an independent application security expert, found that the developer has used Java code as highlighted in the following screenshot. Identify the security mistake committed by the developer?

James is a Java developer working INFR INC. He has written Java code to open a file, read it line by line and display its content in the text editor. He wants to ensure that any unhandled exception raised by the code should automatically close the opened file stream. Which of the following exception handling block should he use for the above purpose?

Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed 'false' parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.

Which of the following method will you use in place of ex.printStackTrace() method to avoid printing stack trace on error?

Which of the following relationship is used to describe abuse case scenarios?

A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to

Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp < form Id='form1' method='post' action='SearchProperty.jsp' > < input type='text' id=''txt_Search' name='txt_Search' placeholder='Search Property...' / > < input type='Submit' Id='Btn_Search' value='Search' / > < /form > However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

Identify the type of attack depicted in the figure below:

In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.

Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page. Alice wrote the following code on page load to read the file name. String myfilename = request.getParameter('filename'); String txtFileNameVariable = myfilename; String locationVariable = request.getServletContext().getRealPath('/'); String PathVariable = ''; PathVariable = locationVariable + txtFileNameVariable; BufferedInputStream bufferedInputStream = null; Path filepath = Paths.get(PathVariable); After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?

Question 21

In which phase of secure development lifecycle the threat modeling is performed?

Coding phase

Testing phase

Deployment phase

Design phase

Show Answer Comment (0)

Question 22

Identify the type of attack depicted in the figure below:

XSS

Cross-Site Request Forgery (CSRF) attack

SQL injection attack

Denial-of-Service attack

Show Answer Comment (0)

Question 23

< form Id='form1' method='post' action='SearchProperty.jsp' >

< input type='text' id=''txt_Search' name='txt_Search' placeholder='Search Property...' / >

< input type='Submit' Id='Btn_Search' value='Search' / >

< /form >

However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

He should write code like out-Write ('You Searched for:' +ESAPI.encoder().encodeForHTML(search));

He should write code like out.write ('You Searched for:' + request.qetParameter('search'l.toStrinq(ll;

He should write code like out.write ('You Searched for:' + request.qetParameterf'txt Search'));

He should write code like out.write (('You Searched for:' +(search));

Show Answer Comment (0)

Question 24

Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities.

Which type of security assessment activity Jacob is currently performing?

ISCST

CAST

SAST

Show Answer Comment (0)

Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can pose a serious security risk as attackers can access hidden script files in your directory. Which of the following will mitigate the above security risk?

< int-param > < param-name>directory-listinqs < param-value>true < /init-param >

< int param > < param-name>directorv-listinqs < param-value>false < /init-param >

< int-param > < param-name>listinqs < param-value>true < /init-param

< int-param > < param-name>listinqs < param-value>false < /init-param >

Show Answer Comment (0)

Question 26

Which of the following relationship is used to describe security use case scenario?

Threatens Relationship

Extend Relationship

Mitigates Relationship

Include Relationship

Show Answer Comment (0)

Question 27

Identify the formula for calculating the risk during threat modeling.

RISK = PROBABILITY 'Attack

RISK = PROBABILITY ' ASSETS

RISK = PROBABILITY * DAMAGE POTENTIAL

IRISK = PROBABILITY * VULNERABILITY

Show Answer Comment (0)

Question 28

The threat modeling phase where applications are decomposed and their entry points are reviewed from an attacker's perspective is known as ________

Attack Surface Evaluation

Threat Classification

Threat Identification

Impact Analysis

Show Answer Comment (0)

Question 29

Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of users depicted in the use cases of the project under inception. Based on the use case in hand, he started depicting the scenarios where attacker could misuse the application. Can you identify the activity on which Ted is working?

Ted was depicting abuse cases

Ted was depicting abstract use cases

Ted was depicting lower-level use cases

Ted was depicting security use cases

Show Answer Comment (0)