[Q105-Q123] 100% Guaranteed Results 312-50v12 Unlimited 505 Questions [2023]

Q105. Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?

tcpsplice

Burp

Hydra

Whisker

Many IDS reassemble communication streams; hence, if a packet is not received within a reasonable period, many IDS stop reassembling and handling that stream. If the application under attack keeps a session active for a longer time than that spent by the IDS on reassembling it, the IDS will stop. As a result, any session after the IDS stops reassembling the sessions will be susceptible to malicious data theft by attackers. The IDS will not log any attack attempt after a successful splicing attack. Attackers can use tools such as Nessus for session splicing attacks.
Did you know that the EC-Council exam shows how well you know their official book? So, there is no “Whisker” in it. In the chapter “Evading IDS” -> “Session Splicing”, the recommended tool for performing a session-splicing attack is Nessus. Where Wisker came from is not entirely clear, but I will assume the author of the question found it while copying Wikipedia.
https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques One basic technique is to split the attack payload into multiple small packets so that the IDS must reassemble the packet stream to detect the attack. A simple way of splitting packets is by fragmenting them, but an adversary can also simply craft packets with small payloads. The ‘whisker’ evasion tool calls crafting packets with small payloads ‘session splicing’.
By itself, small packets will not evade any IDS that reassembles packet streams. However, small packets can be further modified in order to complicate reassembly and detection. One evasion technique is to pause between sending parts of the attack, hoping that the IDS will time out before the target computer does. A second evasion technique is to send the packets out of order, confusing simple packet re-assemblers but not the target computer.
NOTE: Yes, I found scraps of information about the tool that existed in 2012, but I can not give you unverified information. According to the official tutorials, the correct answer is Nessus, but if you know anything about Wisker, please write in the QA section. Maybe this question will be updated soon, but I’m not sure about that.

Q106. Bob, an attacker, has managed to access a target loT device. He employed an online tool to gather information related to the model of the loT device and the certifications granted to it. Which of the following tools did Bob employ to gather the above Information?

search.com

EarthExplorer

Google image search

FCC ID search

Q107. Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization’s user. What is the enumeration technique used by Henry on the organization?

DNS zone walking

DNS cache snooping

DNS SEC zone walking

DNS cache poisoning

Q108. Firewalls are the software or hardware systems that are able to control and monitor the traffic coming in and out the target network based on pre-defined set of rules. Which of the following types of firewalls can protect against SQL injection attacks?

Data-driven firewall

Packet firewall

Web application firewall

Stateful firewall

Q109. What is the least important information when you analyze a public IP address in a security alert?

DNS

Whois

Geolocation

ARP

Q110. Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:
Username: attack’ or 1=1 –
Password: 123456
Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

select * from Users where UserName = ‘attack’ ‘ or 1=1 — and UserPassword = ‘123456’

select * from Users where UserName = ‘attack’ or 1=1 — and UserPassword = ‘123456’

select * from Users where UserName = ‘attack or 1=1 — and UserPassword = ‘123456’

select * from Users where UserName = ‘attack’ or 1=1 –‘ and UserPassword = ‘123456’

Q111. In both pharming and phishing attacks, an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims.
What is the difference between pharming and phishing attacks?

In a pharming attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a phishing attack, an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name

In a phishing attack, a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a pharming attack, an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name

Both pharming and phishing attacks are purely technical and are not considered forms of social engineering

Both pharming and phishing attacks are identical

Q112. Which of the following tools performs comprehensive tests against web servers, including dangerous files and CGIs?

Nikto

John the Ripper

Dsniff

Snort

Q113. Your organization has signed an agreement with a web hosting provider that requires you to take full responsibility of the maintenance of the cloud-based resources. Which of the following models covers this?

Platform as a service

Software as a service

Functions as a

service Infrastructure as a service

Q114. Why should the security analyst disable/remove unnecessary ISAPI filters?

To defend against social engineering attacks

To defend against webserver attacks

To defend against jailbreaking

To defend against wireless attacks

Q115. Identify the correct terminology that defines the above statement.

Vulnerability Scanning

Penetration Testing

Security Policy Implementation

Designing Network Security

Q116. In order to tailor your tests during a web-application scan, you decide to determine which web-server version is hosting the application. On using the sV flag with Nmap. you obtain the following response:
80/tcp open http-proxy Apache Server 7.1.6
what Information-gathering technique does this best describe?

WhOiS lookup

Banner grabbing

Dictionary attack

Brute forcing

Q117. A DDOS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete.
Which attack is being described here?

Desynchronization

Slowloris attack

Session splicing

Phlashing

Developed by Robert “RSnake” Hansen, Slowloris is DDoS attack software that permits one computer to require down an internet server. Due the straightforward yet elegant nature of this attack, it requires minimal bandwidth to implement and affects the target server’s web server only, with almost no side effects on other services and ports. Slowloris has proven highly-effective against many popular sorts of web server software, including Apache 1.x and 2.x. Over the years, Slowloris has been credited with variety of high-profile server takedowns. Notably, it had been used extensively by Iranian ‘hackivists’ following the 2009 Iranian presidential election to attack Iranian government internet sites . Slowloris works by opening multiple connections to the targeted web server and keeping them open as long as possible. It does this by continuously sending partial HTTP requests, none of which are ever completed. The attacked servers open more and connections open, expecting each of the attack requests to be completed. Periodically, the Slowloris sends subsequent HTTP headers for every request, but never actually completes the request. Ultimately, the targeted server’s maximum concurrent connection pool is filled, and extra (legitimate) connection attempts are denied. By sending partial, as against malformed, packets, Slowloris can easily elapse traditional Intrusion Detection systems. Named after a kind of slow-moving Asian primate, Slowloris really does win the race by moving slowly and steadily. A Slowloris attack must await sockets to be released by legitimate requests before consuming them one by one. For a high-volume internet site , this will take a while . the method are often further slowed if legitimate sessions are reinitiated. But within the end, if the attack is unmitigated, Slowloris-like the tortoise-wins the race. If undetected or unmitigated, Slowloris attacks also can last for long periods of your time . When attacked sockets outing , Slowloris simply reinitiates the connections, continuing to reach the online server until mitigated. Designed for stealth also as efficacy, Slowloris are often modified to send different host headers within the event that a virtual host is targeted, and logs are stored separately for every virtual host. More importantly, within the course of an attack, Slowloris are often set to suppress log file creation. this suggests the attack can catch unmonitored servers off-guard, with none red flags appearing in log file entries. Methods of mitigation Imperva’s security services are enabled by reverse proxy technology, used for inspection of all incoming requests on their thanks to the clients’ servers. Imperva’s secured proxy won’t forward any partial connection requests-rendering all Slowloris DDoS attack attempts completely and utterly useless.

Q118. Bill has been hired as a penetration tester and cyber security auditor for a major credit card company. Which information security standard is most applicable to his role?

FISMA

HITECH

PCI-DSS

Sarbanes-OxleyAct

Q119. Which of the following statements about a zone transfer is correct? (Choose three.)

A zone transfer is accomplished with the DNS

A zone transfer is accomplished with the nslookup service

A zone transfer passes all zone information that a DNS server maintains

A zone transfer passes all zone information that a nslookup server maintains

A zone transfer can be prevented by blocking all inbound TCP port 53 connections

Zone transfers cannot occur on the Internet

Q120. An unauthorized individual enters a building following an employee through the employee entrance after the lunch rush. What type of breach has the individual just performed?

Reverse Social Engineering

Tailgating

Piggybacking

Announced

Q121. Password cracking programs reverse the hashing process to recover passwords. (True/False.)

True

False

Q122. Which of the following is considered an exploit framework and has the ability to perform automated attacks on services, ports, applications and unpatched security flaws in a computer system?

Wireshark

Maltego

Metasploit

Nessus

Q123. Tony wants to integrate a 128-bit symmetric block cipher with key sizes of 128,192, or 256 bits into a software program, which involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit. Which of the following algorithms includes all the above features and can be integrated by Tony into the software program?

TEA

CAST-128

RC5

serpent

Leave a Reply Cancel reply