Question 1

Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned. Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

Options :

A : “GET /restricted/goldtransfer?to=Rob&from=1 or 1=1’ HTTP/1.1Host: westbank.com”

B : “GET /restricted/\r\n\accountNedaccess HTTP/1.1 Host: westbank.com”

C : “GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com”

D : “GET /restricted/ HTTP/1.1 Host: westbank.com

Answer: C

Question 2

David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities. Which phase of the vulnerability-management life cycle is David currently in?

Options :

A : verification

B : Risk assessment

C : Vulnerability scan

D : Remediation

Answer: D

Question 3

Larry, a security professional in an organization, has noticed some abnormalities In the user accounts on a web server. To thwart evolving attacks, he decided to harden the security of the web server by adopting a countermeasures to secure the accounts on the web server. Which of the following countermeasures must Larry implement to secure the user accounts on the web server?

Options :

A : Enable unused default user accounts created during the installation of an OS

B : Enable all non-interactive accounts that should exist but do not require interactive login

C : Limit the administrator or toot-level access to the minimum number of users

D : Retain all unused modules and application extensions

Answer: C

Question 4

Which of the following are well known password-cracking programs?

Options :

A : L0phtcrack

B : NetCat

C : Jack the Ripper

D : Netbus

E : John the Ripper

Answer: A

Question 5

#!/usr/bin/python import socket buffer=[““A””] counter=50 while len(buffer)<=100: buffer.append

(““A””*counter)

counter=counter+50 commands= [““HELP””,““STATS .””,““RTIME .””,““LTIME. ””,““SRUN .”’,““TRUN

.””,““GMON

.””,““GDOG .””,““KSTET .”,““GTER .””,““HTER .””, ““LTER .”,““KSTAN .””] for command in

commands: for

buffstring in buffer: print ““Exploiting”” +command +““:””+str(len(buffstring))

s=socket.socket(socket.AF_INET,

socket.SOCK_STREAM) s.connect((‘127.0.0.1’, 9999)) s.recv(50) s.send(command+buffstring) s.close()

What is the code written for?

Options :

A : Denial-of-service (DOS)

B : Buffer Overflow

C : Bruteforce

D : Encryption

Answer: B

Higher Test Marks with Free Online 312-50v13 Exam Practice

Buying Options: