Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API.Which of the following tools is used by Wilson in the above scenario?
Answer(s): D
Wilson uses Infoga, a tool designed to enumerate information about email addresses from public sources, including sender identities, mail servers, IPs, and related metadata, and it can check if an address was compromised via haveibeenpwned. A) Factiva is a business news and information aggregator, not focused on email reconnaissance. B) ZoomInfo provides corporate contact and demographic data, not email-header reconnaissance or Have I Been Pwned checks. C) Netcraft specializes in web server and hosting information, not comprehensive email metadata gathering or breach checks. D) Infoga specializes in gathering email-related information from multiple sources and integrates breach lookups.
David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities.Which phase of the vulnerability-management life cycle is David currently in?
Answer(s): A
Implementing fixes to reduce impact and severity corresponds to the Remediation phase of vulnerability management.A) Remediation — Correct: applying patches or compensating controls to fix identified vulnerabilities.B) Verification — Incorrect: focuses on validating that remediation actions were effective, usually after remediation.C) Risk assessment — Incorrect: involves identifying and prioritizing risks before or during vulnerability analysis, not the act of applying fixes.D) Vulnerability scan — Incorrect: is the discovery phase where vulnerabilities are identified, not the remediation step.
Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the target's MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization.Which of the following cloud attacks did Alice perform in the above scenario?
Answer(s): C
Alice performed a cloud-hopper attack by compromising an MSP to access target customer data and pivot into the target organization, leveraging the MSP as the foothold. A) Cloud cryptojacking involves illegal cryptomining on victims’ systems, not data exfiltration via MSPs. B) Man-in-the-cloud (MITC) refers to credential interception on cloud services through cloud account manipulation, not MSP compromise for customer data exfiltration. D) Cloudborne attack is not a standard ECCouncil term for this scenario. C) Cloud hopper attack correctly describes leveraging an MSP to access multiple customers’ cloud environments and exfiltrate data to launch further attacks.
Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images:What issue occurred for the users who clicked on the image?
The code hidden behind images indicates a PHP-based session hijacking payload that silently executes to steal the user’s session cookie and session ID, enabling session fixation or impersonation.A) This php file silently executes the code and grabs the user's session cookie and session ID.B) The code redirects the user to another site. - No redirection described; focus is on credential/session data theft.C) The code injects a new cookie to the browser. - Stealing existing session data, not just adding a cookie.D) The code is a virus that is attempting to gather the user's username and password. - Focus is on session data, not direct credential collection.
Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.Which two SQL injection types would give her the results she is looking for?
Answer(s): B
Boolean-based and union-based injections together can test true/false responses and reveal data structure, aligning with the goal of verifying true/false outcomes and leveraging query results across multiple rows. A) Out of band and boolean-based is incorrect because out-of-band focuses on data exfiltration via external channels, not immediate true/false evaluation. C) Time-based and union-based pairs time-based delays with data retrieval, not specifically targeting true/false response testing. D) Time-based and boolean-based combines timing to infer truth values but misses the broader data return aspect provided by union-based queries.
Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server.What is the type of attack Jason performed in the above scenario?
Jason performed a Server-Side Request Forgery (SSRF) attack by coercing the server to make requests to internal or unintended resources via manipulated input, exposing internal resources through the feed URL. A) Web server misconfiguration refers to improper server setup, not input-driven requests. C) Web cache poisoning involves injecting malicious content into a cache, not triggering server-side requests. D) Website defacement changes site content, not growing access to internal resources via the backend.
George is a security professional working for iTech Solutions. He was tasked with securely transferring sensitive data of the organization between industrial systems. In this process, he used a short-range communication protocol based on the IEEE 203.15.4 standard. This protocol is used in devices that transfer data infrequently at a low rate in a restricted area, within a range of 10-100 m.What is the short-range wireless communication technology George employed in the above scenario?
George used Zigbee, which aligns with IEEE 802.15.4 for low-rate, short-range, energy-efficient wireless networking in restricted areas (typically 10-100 m) suitable for infrequent data transfer in industrial environments.A) LPWAN is designed for long-range, low-power wide-area networks, not 10-100 m indoor industrial short-range.B) MQTT is a messaging protocol, not a wireless physical layer or standard for short-range device communication.C) NB-IoT is a cellular LPWAN technology aimed at broad-area coverage, not confined 10-100 m industrial scenarios.D) Zigbee correctly uses IEEE 802.15.4 for low-rate, short-range mesh networking.
Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role.What is the technique employed by Eric to secure cloud resources?
Zero trust network is correct because it requires continuous verification of every user and device before granting access, and enforces least-privilege access based on role, aligning with Eric’s default-deny and verify-every-connection approach. A) Demilitarized zone is a network segment that acts as a buffer, not a verification framework. C) Serverless computing is a cloud execution model, not a access-control paradigm. D) Container technology isolates applications but does not by itself implement zero-trust authentication and authorization policies.
Share your comments for EC-Council 312-50v13 exam with other users:
Question 104:
clustering keys
Q23: Fabric Admin is correct. Because Domain admin cannot create domains. Only Fabric Admin can among the given options. Q51: Wrapping @pipeline.parameter.param1 inside {} will return a string. But question requires the expression to return Int, so correct answer should be @pipeline.parameter.param1 (no {})
Question 62:
ZDX
Analyze Score
Y Engine
Question 32:
Question 3:
Question 1:
date = sys.argv[1]
sys.argv[1]
date = spark.conf.get("date")
input()
date = dbutils.notebooks.getParam("date")
dbutils.notebook.run
Question 528:
Question 23:The correct answer is Domain admin (option B), not Fabric admin.
Question 2:For question 2, the key concept is the Longest Prefix Match. Routers pick the route whose subnet mask is the most specific (largest prefix length) that still matches the destination IP. From the options:
Question 129:Correct answer: CNAME
compute.osAdminLogin
enable-oslogin
Question 2:
Recommend using AI for Solutions rather the Answer(s) submitted here
This is very interesting
Are these the same questions you have to pay for in ExamTopics?
For Question 7 - while the answer description indicates the correct answer, the option no. mentioned is incorrect. Nice and Comprehensive. Thankyou
This is very good and accurate. Explanation is very helpful even thou some are not 100% right but good enough to pass.
The DP-900 exam can be tricky if you aren't familiar with Microsoft’s specific cloud terminology. I used the practice questions from free-braindumps.com and found them incredibly helpful. The site breaks down core data concepts and Azure services in a way that actually mirrors the real test. As a resutl I passed my exam.
interesting
Passed this exam 2 days ago. These questions are in the exam. You are safe to use them.
Helpful to test your preparedness before giving exam
Really helped
Good explanation
very helpful
Question 1, Ans is - Developer,Standard,Professional Direct and Premier
Passed this exam in first appointment. Great resource and valid exam dump.
Today I wrote this exam and passed, i totally relay on this practice exam. The questions were very tough, these questions are valid and I encounter the same.
Anyone used this dump recently?
173 question is A not D
nice questions
Thanks for the practice questions they helped me a lot.
Passed this exam today. All questions are valid and this is not something you can find in ChatGPT.
i need to pass exam for VMware 2V0-11.25