Get 312-39 Products Practice Material for 312-39 Exam Question Preparation [Q33-Q50]

admin • June 3, 2024

Get 312-39 Products Practice Material for 312-39 Exam Question Preparation [Q33-Q50]

4.7/5 - (4 votes)

Get 312-39 Products Practice Material for 312-39 Exam Question Preparation

Most Reliable EC-COUNCIL 312-39 Training Materials

NEW QUESTION 33
Which of the following process refers to the discarding of the packets at the routing level without informing the source that the data did not reach its intended recipient?

Load Balancing

Rate Limiting

Black Hole Filtering

Drop Requests

NEW QUESTION 34
Shawn is a security manager working at Lee Inc Solution. His organization wants to develop threat intelligent strategy plan. As a part of threat intelligent strategy plan, he suggested various components, such as threat intelligence requirement analysis, intelligence and collection planning, asset identification, threat reports, and intelligence buy-in.
Which one of the following components he should include in the above threat intelligent strategy plan to make it effective?

Threat pivoting

Threat trending

Threat buy-in

Threat boosting

NEW QUESTION 35
What is the process of monitoring and capturing all data packets passing through a given network using different tools?

Network Scanning

DNS Footprinting

Network Sniffing

Port Scanning

NEW QUESTION 36
Which of the following formula is used to calculate the EPS of the organization?

EPS = average number of correlated events / time in seconds

EPS = number of normalized events / time in seconds

EPS = number of security events / time in seconds

EPS = number of correlated events / time in seconds

NEW QUESTION 37
Harley is working as a SOC analyst with Powell Tech. Powell Inc. is using Internet Information Service (IIS) version 7.0 to host their website.
Where will Harley find the web server logs, if he wants to investigate them for any anomalies?

SystemDrive%inetpublogsLogFilesW3SVCN

SystemDrive%LogFilesinetpublogsW3SVCN

%SystemDrive%LogFileslogsW3SVCN

SystemDrive% inetpubLogFileslogsW3SVCN

For Internet Information Service (IIS) version 7.0, the default location for web server logs is in the directory %SystemDrive%\inetpub\logs\LogFiles. Within this directory, you will find subfolders named W3SVCN, where N is a number that corresponds to the site ID of the IIS instance. These folders contain the log files for each website hosted on the server. Harley, as a SOC analyst, can investigate these logs for any anomalies by accessing this path.
References: The information provided aligns with the standard practices and configurations for IIS 7.0 as outlined in Microsoft’s official documentation123. These references are part of the learning resources for understanding the management and structure of IIS logs, which are crucial for a SOC Analyst’s role in monitoring and analyzing web server activity for security purposes. The EC-Council’s SOC Analyst course and study guides also emphasize the importance of log file analysis in identifying and responding to security incidents.

NEW QUESTION 38
Which of the following attack can be eradicated by using a safe API to avoid the use of the interpreter entirely?

Command Injection Attacks

SQL Injection Attacks

File Injection Attacks

LDAP Injection Attacks

NEW QUESTION 39
Which encoding replaces unusual ASCII characters with “%” followed by the character’s two-digit ASCII code expressed in hexadecimal?

Unicode Encoding

UTF Encoding

Base64 Encoding

URL Encoding

NEW QUESTION 40
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

Directory Traversal Attack

XSS Attack

SQL Injection Attack

Parameter Tampering Attack

The event log indicates a Parameter Tampering Attack. This type of attack involves the manipulation of parameters exchanged between the client and the server to alter application data, such as user credentials and permissions, product price and quantity, etc. The IDS log entries showing repeated access to the URL
“/OrderDetail.aspx?id=ORDR-001117” with varying order ID values suggest that the attacker is manipulating the ‘id’ parameter to potentially access or modify order details unauthorizedly.
References The EC-Council’s Certified SOC Analyst (CSA) course materials and study guides discuss various types of cyber attacks, including Parameter Tampering, and their characteristics. Additionally, information on this type of attack can be found in resources provided by the OWASP Foundation1.

NEW QUESTION 41
Which of the following directory will contain logs related to printer access?

/var/log/cups/Printer_log file

/var/log/cups/access_log file

/var/log/cups/accesslog file

/var/log/cups/Printeraccess_log file

NEW QUESTION 42
An attacker, in an attempt to exploit the vulnerability in the dynamically generated welcome page, inserted code at the end of the company’s URL as follows:
http://technosoft.com.com/<script>alert(“WARNING: The application has encountered an error”);</script>.
Identify the attack demonstrated in the above scenario.

Cross-site Scripting Attack

SQL Injection Attack

Denial-of-Service Attack

Session Attack

NEW QUESTION 43
Identify the attack when an attacker by several trial and error can read the contents of a password file present in the restricted etc folder just by manipulating the URL in the browser as shown:
http://www.terabytes.com/process.php./../../../../etc/passwd

Directory Traversal Attack

SQL Injection Attack

Denial-of-Service Attack

Form Tampering Attack

The attack described is a Directory Traversal Attack. This type of attack occurs when an attacker exploits vulnerabilities in a web application (or a web server’s software) to gain unauthorized access to files and directories that are stored outside of the web root folder. By manipulating variables that reference files with ../ sequences (also known as dot-dot-slash), the attacker can move up the directory hierarchy and access files or directories that should be restricted. This can lead to information disclosure, such as reading sensitive files like /etc/passwd, which contains user password details in Unix-based systems.
In the given URL http://www.terabytes.com/process.php./../../../../etc/passwd, the attacker uses the ../ pattern to navigate up from the current directory where process.php resides, aiming to reach the root directory and then descend into the /etc/ directory to access the passwd file. This is a classic example of a Directory Traversal Attack.
References: The EC-Council’s Certified SOC Analyst course covers various types of cyber attacks, including Directory Traversal Attacks. Specific references to this type of attack can be found in the EC-Council’s official training materials for the Certified SOC Analyst (CSA) program, such as the CSA study guide and related courses that discuss web application vulnerabilities and attacks123.

NEW QUESTION 44
Which of the log storage method arranges event logs in the form of a circular buffer?

FIFO

LIFO

non-wrapping

wrapping

In the context of log storage, a circular buffer is a data structure that uses a single, fixed-size buffer as if it were connected end-to-end. This structure lends itself to buffering streams of data, where the data is written to the buffer and read from it in a potentially non-sequential manner. When the buffer is full, new data is written starting at the beginning of the buffer, and thus ‘wraps’ around. This is why the method is referred to as
‘wrapping’. FIFO (First In, First Out) and LIFO (Last In, First Out) are queueing methods, and non-wrapping implies that the buffer does not overwrite existing data when full.
References: The answer can be verified through EC-Council’s SOC Analyst study materials and official courseware, which detail various log storage methods and their characteristics. Additionally, the concept of a circular buffer is a well-known data structure in computer science, often discussed in the context of system design and memory management.

NEW QUESTION 45
Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are trying to provide additional bandwidth to the network devices and increasing the capacity of the servers.
What is Ray and his team doing?

Blocking the Attacks

Diverting the Traffic

Degrading the services

Absorbing the Attack

NEW QUESTION 46
Which of the following is a Threat Intelligence Platform?

SolarWinds MS

TC Complete

Keepnote

Apility.io

NEW QUESTION 47
Which attack works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

Hybrid Attack

Bruteforce Attack

Rainbow Table Attack

Birthday Attack

NEW QUESTION 48
Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

Directory Traversal Attack

XSS Attack

SQL Injection Attack

Parameter Tampering Attack

NEW QUESTION 49
Which of the following attack can be eradicated by converting all non-alphanumeric characters to HTML character entities before displaying the user input in search engines and forums?

Broken Access Control Attacks

Web Services Attacks

XSS Attacks

Session Management Attacks

NEW QUESTION 50
Jane, a security analyst, while analyzing IDS logs, detected an event matching Regex /((%3C)|<)((%69)|i|(%
49))((%6D)|m|(%4D))((%67)|g|(%47))[^n]+((%3E)|>)/|.
What does this event log indicate?

Directory Traversal Attack

Parameter Tampering Attack

XSS Attack

SQL Injection Attack

Loading …