Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs. What type of malware did the attacker use to bypass the company’s application whitelisting?
Answer(s): A
A: File-less malware is the correct answer as it operates in memory, evading traditional detection methods employed by anti-virus (AV) tools and intrusion detection/prevention systems (IDS/IPS).File-less malware typically exploits legitimate system tools and processes to execute its payload directly in memory, thereby bypassing application whitelisting mechanisms that monitor for unauthorized executables. This type of malware can utilize vulnerabilities in existing applications or scripts (e.g., PowerShell, Windows Management Instrumentation) to carry out malicious activities without leaving traditional file signatures that security measures would detect.Evaluation of Incorrect Options:B: Zero-day malware: While it refers to newly discovered vulnerabilities exploited before a patch is available, it typically generates signatures that could potentially be detected by proactive security measures, such as IDS/IPS, unlike file-less malware which deliberately avoids such detection.C: Phishing malware: This option involves social engineering to trick users into divulging information or credentials. Although it can facilitate the introduction of malware, it does not fundamentally bypass application whitelisting since the malware still needs to be installed on the system, leaving detectable artifacts.D: Logic bomb malware: This malware activates under specific conditions but typically requires installation as a file, making it susceptible to whitelisting checks. Logic bombs do not inherently disguise themselves from detection mechanisms like file-less malware does.References:https://www.cio.com/article/284754/what-is-fileless-malware.html https://www.dell.com/en-us/blog/understanding-fileless-malware-and-how-to-prevent-it/ https://www.sans.org/white-papers/38596/
References:https://www.cio.com/article/284754/what-is-fileless-malware.html https://www.dell.com/en-us/blog/understanding-fileless-malware-and-how-to-prevent-it/ https://www.sans.org/white-papers/38596/
Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it?
Answer(s): C
C is correct because Dorian signs the message with his private key, allowing Poly to validate it using Dorian's public key.In Public Key Infrastructure (PKI), digital signatures rely on asymmetric encryption where a sender signs a message using their private key, and a recipient or any third party can verify the signature with the sender's public key. This ensures both authenticity and non-repudiation, confirming that the message originated from the stated sender—Dorian, in this scenario.Evaluation of Incorrect Options:A: This option incorrectly states that Dorian signs the message with his public key. Public keys are meant for encryption and verification, not signing. The signing process relies strictly on private keys.B: Here, Dorian is said to sign with Poly’s private key, which is fundamentally flawed. Dorian has no access to Poly's private key, and signing cannot be done with a recipient's private key; it must be done with the sender’s key.D: This option proposes Dorian signing with Poly’s public key. Similar to the prior errors, a public key cannot be used for signing because it’s not intended for that purpose. Signing inherently involves the creator's private key.In summary, option C correctly identifies the process of signing and verification in digital communications, while the other options misunderstand the foundational elements of public-key cryptography.References:https://www.rsa.com/en-us/what-is-cryptography/what-is-a-digital-signature https://www.cloudflare.com/learning/how-tls-ssl/what-is-a-digital-certificate/ https://www.digitalguardian.com/blog/what-is-digital-signature
References:https://www.rsa.com/en-us/what-is-cryptography/what-is-a-digital-signature https://www.cloudflare.com/learning/how-tls-ssl/what-is-a-digital-certificate/ https://www.digitalguardian.com/blog/what-is-digital-signature
Scenario: Joe turns on his home computer to access personal online banking. When he enters the URL www.bank.com, the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before. When he examines the website URL closer, he finds that the site is not secure and the web address appears different. What type of attack he is experiencing?
Answer(s): D
D: DNS hijacking is correct as it involves redirecting users from a legitimate website to a fraudulent one.In this scenario, Joe’s alteration in the website's URL and the refusal to recognize previous credentials suggest that his DNS queries might have been compromised. DNS hijacking manipulates the resolution of a domain name to reroute users to an imposter site. The unsecure connection further indicates a potential phishing attempt, wherein user credentials could be harvesting under the guise of a legitimate banking interface.Critical Evaluation of Other Options:A: DHCP Spoofing : While DHCP spoofing can assign a wrong IP address to a victim machine, it does not necessarily involve the modification of a URL or prompt for credentials unless combined with other attacks.B: DoS Attack : A Denial of Service attack aims to overwhelm a service, rendering it unavailable; it does not manipulate the site appearance or URL, nor does it prompt for credentials.C: ARP Cache Poisoning : This technique involves altering the ARP cache to redirect traffic through a malicious device, but it typically does not affect the URL appearance directly; rather, it can facilitate other types of attacks, including man-in-the-middle scenarios.Thus, the symptoms observed by Joe point clearly towards DNS hijacking rather than any of the other listed attacks.References:https://www.imperva.com/learn/application-security/dns-hijacking/ https://www.digitalattackmap.com/understanding-dos-attacks/ https://www.cloudflare.com/learning/security/glossary/dhcp-spoofing/
References:https://www.imperva.com/learn/application-security/dns-hijacking/ https://www.digitalattackmap.com/understanding-dos-attacks/ https://www.cloudflare.com/learning/security/glossary/dhcp-spoofing/
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account. What is the attack performed by Boney in the above scenario?
D is correct as the described scenario exemplifies a session fixation attack whereby the attacker manipulates the victim's session by using a predefined session ID.In a session fixation attack, the attacker first acquires a valid session ID, typically by logging into a service themselves. Subsequently, they feed this session ID to the target, leading the victim to unwittingly authenticate to the attacker’s account. This attack is particularly insidious as it does not require any direct interaction with the victim's credentials; rather, it leverages the established session control, allowing the attacker to gain unauthorized access seamlessly.Evaluation of Other Options:A: Forbidden attack : This term does not align with classical definitions of web application security threats.Forbidden attacks are not formally recognized in the domain of web session security and misattribute the context.B: CRIME attack : The CRIME (Compression Ratio Info-leak Made Easy) attack exploits HTTP compression to reveal secrets in secure sessions but does not pertain to session IDs directly. It primarily targets the confidentiality and integrity of session data rather than session fixation.C: Session donation attack : This attack occurs when a user unknowingly donates their session to an attacker, but it typically involves the user clicking a link that the attacker controls. In contrast, the scenario describes an attacker explicitly providing a session ID to the target, which fits the session fixation model more accurately.The underlying mechanics of session fixation pretext that an attacker can hijack a user’s session without exploiting vulnerabilities in the application itself, highlighting the need for robust session management practices.References:https://owasp.org/www-community/attacks/Session_Fixation https://www.owasp.org/index.php/CRIME https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
References:https://owasp.org/www-community/attacks/Session_Fixation https://www.owasp.org/index.php/CRIME https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
Kevin, a professional hacker, wants to penetrate CyberTech Inc’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packets, but the target web server can decode them. What is the technique used by Kevin to evade the IDS system?
The correct answer is C: Obfuscating.Obfuscating is a technique that involves encoding or altering data to make it difficult for intrusion detection systems (IDS) to detect malicious activity while still being interpretable by the target application. In this scenario, Kevin utilizes Unicode encoding to mask the content of the packets, thus evading detection by CyberTech Inc's IDS. This clever manipulation not only facilitates packet transmission without raising alarms but also ensures that the intended target web server can decode and process the packets correctly.Evaluation of Other Options:A: Session Splicing : This technique involves breaking up a single session into multiple segments to elude detection. While it can bypass some security measures, it does not inherently encode the packets and thus lacks the stealth advantage provided by Unicode obfuscation.B: Urgency Flag : This method pertains to manipulating TCP flags to signify packet urgency, which can create confusion in traffic analysis. However, it does not involve any encoding techniques and does not specifically target the evasion of IDS through packet content manipulation.D: Desynchronization : This technique disrupts the state of communication between endpoints and attempts to exploit timing or sequence expectation. Like the other options, it does not include content encoding or manipulation aimed at evading IDS detection.In conclusion, obfuscating via Unicode encoding is particularly effective at circumventing IDS mechanisms focused on signature-based detection since the malicious payload appears benign until it reaches the target application.References:1. https://www.sans.org/white-papers/1513/ 2. https://www.cisco.com/c/en/us/products/security/what-is-intrusion-detection-system-ids.html 3. https://www.jstor.org/stable/26273313
References:1. https://www.sans.org/white-papers/1513/ 2. https://www.cisco.com/c/en/us/products/security/what-is-intrusion-detection-system-ids.html 3. https://www.jstor.org/stable/26273313
Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?
Answer(s): B
select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’
Which of the following commands checks for valid users on an SMTP server?
C is correct because the VRFY command is specifically designed to verify the existence of a user on an SMTP server.The VRFY command directly queries the server to validate a specified email address, returning responses that indicate whether the user exists or not. This functionality is integral to the SMTP protocol, as it allows administrators to manage user accounts effectively while providing an essential tool for ethical hacking assessments. The command typically returns a response code of 250 for valid users, making it a reliable method for confirming user validity.Evaluation of Other Options:A: RCPT : This command is used during the SMTP mail transaction phase to specify the recipient of the email. It does not verify user existence; rather, it is part of the process for sending mail and requires an established SMTP transaction.B: CHK : The CHK command was intended to check for valid users but is not standard in modern SMTP implementations. Its sporadic availability does not make it a reliable choice for verifying user existence across different servers.D: EXPN : The EXPN command is intended to expand mailing lists or aliases into individual email addresses but does not serve the purpose of verifying a single user's validity. This command provides informational responses rather than validation confirmations.In conclusion, the specificity and function of the VRFY command uniquely qualify it for checking valid users on an SMTP server, while the other commands serve distinct purposes not directly related to user validation.References:https://tools.ietf.org/html/rfc5321 https://www.owasp.org/index.php/SMTP_Commands https://www.ietf.org/rfc/rfc2821.txt
References:https://tools.ietf.org/html/rfc5321 https://www.owasp.org/index.php/SMTP_Commands https://www.ietf.org/rfc/rfc2821.txt
Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates. Which of the following protocols is used by Bella?
A: FTPS is correct because it encrypts data during transfer, ensuring confidentiality and integrity using protocols such as SSL/TLS.Reasoning: FTPS (File Transfer Protocol Secure) extends the standard FTP by employing secure encryption through SSL/TLS, thereby safeguarding sensitive information like usernames and passwords. This protocol is specifically designed to protect files during transfer, making it appropriate for situations requiring confidentiality and data integrity, as evidenced by Bella's need to secure sensitive data against session hijacking. In using digital certificates, FTPS guarantees the authenticity of the server and the confidentiality of the data transmitted.Evaluation of Alternatives:B: FTP: The standard File Transfer Protocol (FTP) transmits data in plaintext, making it vulnerable to interception and session hijacking. It lacks built-in encryption mechanisms, which renders it unsuitable for transferring sensitive information.C: HTTPS: While HTTPS provides encryption similar to what FTPS offers, it is primarily designed for web traffic rather than dedicated file transfer scenarios. In the context of Bella's focus on file transfer, FTPS would be more relevant when explicit file transmission is required.D: IP: This option refers to the Internet Protocol, which is foundational for network communications but does not inherently provide any security measures. It does not offer encryption or authentication capabilities critical to secure file transfers.FTPS emerges as the superior choice due to its specific encryption features tailored for file transfers and protection against data breaches.References:1. https://www.owasp.org/index.php/FTPS 2. https://www.jamf.com/blog/introduction-to-ftps-and-how-to-use-ftps-in-jamf-pro/ 3. https://www.cloudflare.com/learning/how-tls-works/what-is-ftps/
References:1. https://www.owasp.org/index.php/FTPS 2. https://www.jamf.com/blog/introduction-to-ftps-and-how-to-use-ftps-in-jamf-pro/ 3. https://www.cloudflare.com/learning/how-tls-works/what-is-ftps/
Share your comments for EC-Council 312-50v13 exam with other users:
intéressant
thank you for making the interactive questions
questions are accurate
i need questions/dumps for this exam.
i need this exam, when will it be uploaded
i need the dumps !
very helpful
good source
my 3rd test and passed on first try. hats off to this brain dumps site.
please upload it
does anybody know if are these real exam questions?
are these questions similar to actual questions in the exam? because they seem to be too easy
i have a lot of experience but what comes in the exam is totally different from the practical day to day tasks. so i thought i would rather rely on these brain dumps rather failing the exam.
good questions
valied exam dumps. they were very helpful and i got a pretty good score. i am very grateful for this service and exam questions
will it help?
very useful to verify knowledge before exam
good stuffs
question 17 : responses arent b and c ?
just passed the exam on my first try using these dumps.
these questions look good.
this is very helpful content
please provide the dumps
it is amazing
quesion 178 about "a banking system that predicts whether a loan will be repaid is an example of the" the answer is classification. not regresion, you should fix it.
please upload apache spark dumps
q14 is b&c to reduce you will switch off mail for every single alert and you will switch on daily digest to get a mail once per day, you might even skip the empty digest mail but i see this as a part of the daily digest adjustment
i think it is good question
good for students who wish to give certification.
is there a google drive link to the images? the links in questions are not working.
very promising, looks great, so much wow!
i scored 87% on the az-204 exam. thanks! i always trust
good need more