December/2019 Braindump2go 312-50v10 Exam Dumps with PDF and VCE New Updated Today! Following are some new 312-50v10 Exam Questions,
New Question
A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?
A. Try to sell the information to a well-paying party on the dark web.
B. Exploit the vulnerability without harming the web site owner so that attention be drawn to the problem.
C. Ignore it.
D. Notify the web site owner so that corrective action be taken as soon as possible to patch the vulnerability.
Answer: D
New Question
You have compromised a server on a network and successfully opened a shell. You aimed to identify all operating systems running on the network. However, as you attempt to fingerprint all machines in the network using the nmap syntax below, it is not going through.
invictus@victim_server:~$ nmap -T4 -O 10.10.0.0/24
TCP/IP fingerprinting (for OS scan) xxxxxxx xxxxxx xxxxxxxxx.
QUITTING!
What seems to be wrong?
A. OS Scan requires root privileges.
B. The nmap syntax is wrong.
C. This is a common behavior for a corrupted nmap application.
D. The outgoing TCP/IP fingerprinting is blocked by the host firewall.
Answer: A
Explanation:
You requested a scan type which requires root privileges. http://askubuntu.com/questions/433062/using-nmap-for-information-regarding-web-host
New Question
What is the best description of SQL Injection?
A. It is an attack used to gain unauthorized access to a database.
B. It is an attack used to modify code in an application.
C. It is a Man-in-the-Middle attack between your SQL Server and Web App Server.
D. It is a Denial of Service Attack.
Answer: A
Explanation:
SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).
https://en.wikipedia.org/wiki/SQL_injection
New Question
You just set up a security system in your network. In what kind of system would you find the following string of characters used as a rule within its configuration?
alert tcp any any -> 192.168.100.0/24 21 (msg: “FTP on the network!”;)
A. An Intrusion Detection System
B. A firewall IPTable
C. A Router IPTable
D. FTP Server rule
Answer: A
Explanation:
Snort is an open source network intrusion detection system (NIDS) for networks .
Snort rule example:
This example is a rule with a generator id of 1000001.
alert tcp any any -> any 80 (content:”BOB”; gid:1000001; sid:1; rev:1;)
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html
New Question
What is the benefit of performing an unannounced Penetration Testing?
A. The tester will have an actual security posture visibility of the target network.
B. Network security would be in a “best state” posture.
C. It is best to catch critical infrastructure unpatched.
D. The tester could not provide an honest analysis.
Answer: A
Explanation:
Real life attacks will always come without expectation and they will often arrive in ways that are highly creative and very hard to plan for at all. This is, after all, exactly how hackers continue to succeed against network security systems, despite the billions invested in the data protection industry.
A possible solution to this danger is to conduct intermittent “unannounced” penentration tests whose scheduling and occurrence is only known to the hired attackers and upper management staff instead of every security employee, as would be the case with “announced” penetration tests that everyone has planned for in advance. The former may be better at detecting realistic weaknesses.
http://www.sitepronews.com/2013/03/20/the-pros-and-cons-of-penetration-testing/
New Question
Under the “Post-attack Phase and Activities”, it is the responsibility of the tester to restore the systems to a pre-test state.
Which of the following activities should not be included in this phase? (see exhibit)
A. III
B. IV
C. III and IV
D. All should be included.
Answer: A
Explanation:
The post-attack phase revolves around returning any modified system(s) to the pretest state.
Examples of such activities:
Removal of any files, tools, exploits, or other test-created objects uploaded to the system during testing
Removal or reversal of any changes to the registry made during system testing Computer and Information Security Handbook, John R. Vacca (2012), page 531
New Question
Which of the following is a component of a risk assessment?
A. Administrative safeguards
B. Physical security
C. DMZ
D. Logical interface
Answer: A
Explanation:
Risk assessment include:
The total process of identifying, measuring, and minimizing uncertain events affecting AIS resources.
It includes risk analysis, cost benefit analysis, safeguard selection, security test and evaluation, safeguard implementation, and systems review.
The total process of identifying, controlling, and eliminating or minimizing uncertain events that may affect system resources.
lt includes risk analysis, cost benefit analysis, selection, implementation and test, security evaluation of safeguards, and overall security review.
https://en.wikipedia.org/wiki/IT_risk_management#Risk_assessment
New Question
A medium-sized healthcare IT business decides to implement a risk management strategy. Which of the following is NOT one of the five basic responses to risk?
A. Delegate
B. Avoid
C. Mitigate
D. Accept
Answer: A
Explanation:
There are five main ways to manage risk: acceptance, avoidance, transference, mitigation or exploitation.
http://www.dbpmanagement.com/15/5-ways-to-manage-risk
New Question
Your company was hired by a small healthcare provider to perform a technical assessment on the network.
What is the best approach for discovering vulnerabilities on a Windows-based computer?
A. Use a scan tool like Nessus
B. Use the built-in Windows Update tool
C. Check MITRE.org for the latest list of CVE findings
D. Create a disk image of a clean Windows installation
Answer: A
Explanation:
Nessus is an open-source network vulnerability scanner that uses the Common Vulnerabilities and Exposures architecture for easy cross-linking between compliant security tools. The Nessus server is currently available for Unix, Linux and FreeBSD. The client is available for Unix-or Windows-based operating systems.
Note: Significant capabilities of Nessus include:
Compatibility with computers and servers of all sizes.
Detection of security holes in local or remote hosts.
Detection of missing security updates and patches.
Simulated attacks to pinpoint vulnerabilities.
Execution of security tests in a contained environment.
Scheduled security audits.
New Question
Nation-state threat actors often discover vulnerabilities and hold on to them until they want to launch a sophisticated attack. The Stuxnet attack was an unprecedented style of attack because it used four types of vulnerability.
What is this style of attack called?
A. zero-day
B. zero-hour
C. zero-sum
D. no-day
Answer: A
Explanation:
Stuxnet is a malicious computer worm believed to be a jointly built American-Israeli cyber weapon.
Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software.
https://en.wikipedia.org/wiki/Stuxnet
New Question
It is a vulnerability in GNU’s bash shell, discovered in September of 2014, that gives attackers access to run remote commands on a vulnerable system. The malicious software can take control of an infected machine, launch denial-of-service attacks to disrupt websites, and scan for other vulnerable devices (including routers).
Which of the following vulnerabilities is being described?
A. Shellshock
B. Rootshock
C. Rootshell
D. Shellbash
Answer: A
Explanation:
Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. https://en.wikipedia.org/wiki/Shellshock_(software_bug)
1.|2019 Latest Braindump2go 312-50v10 Exam Dumps (VCE & PDF) Instant Download:
https://www.braindump2go.com/312-50v10.html
2.|2019 Latest Braindump2go 312-50v10 Exam Questions & Answers Instant Download:
https://drive.google.com/drive/folders/1g15jl9W8jnovDp0b_CsOg86BZSP5ualP?usp=sharing