312-50

312-50 practice questions, page 19 of 25, with answer review and explanations.

Question 91

A newly discovered flaw in a software application would be considered which kind of security vulnerability?

  1. Input validation flaw
  2. HTTP header injection vulnerability
  3. 0-day vulnerability
  4. Time-to-check to time-to-use flaw

Question 92

During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?

  1. The web application does not have the secure flag set.
  2. The session cookies do not have the HttpOnly flag set.
  3. The victim user should not have an endpoint security solution.
  4. The victim's browser must have ActiveX technology enabled. B

Question 93

The use of alert thresholding in an IDS can reduce the volume of repeated alerts, but introduces which of the following vulnerabilities?

  1. An attacker, working slowly enough, can evade detection by the IDS.
  2. Network packets are dropped if the volume exceeds the threshold.
  3. Thresholding interferes with the IDS’ ability to reassemble fragmented packets.
  4. The IDS will not distinguish among packets originating from different sources.

Question 94

What is the main advantage that a network-based IDS/IPS system has over a host-based solution?

  1. They do not use host system resources.
  2. They are placed at the boundary, allowing them to inspect all traffic.
  3. They are easier to install and configure.
  4. They will not interfere with user interfaces.

Question 95

The network administrator for a company is setting up a website with e-commerce capabilities. Packet sniffing is a concern because credit card information will be sent electronically over the Internet. Customers visiting the site will need to encrypt the data with HTTPS. Which type of certificate is used to encrypt and decrypt the data?

  1. Asymmetric
  2. Confidential
  3. Symmetric
  4. Non-confidential