312-50v10

312-50v10 practice questions, page 5 of 13, with answer review and explanations.

Question 21

Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned. Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?

  1. "GET/restricted/goldtransfer?to=Rob&from=1 or 1=1' HTTP/1.1Host: westbank.com"
  2. "GET/restricted/accounts/?name=Ned HTTP/1.1 Host: westbank.com"
  3. "GET/restricted/bank.getaccount("˜Ned') HTTP/1.1 Host: westbank.com"
  4. "GET/restricted/\r\n\%00account%00Ned%00access HTTP/1.1 Host: westbank.com"

Question 22

Which tool allows analysts and pen testers to examine links between data using graphs and link analysis?

  1. Metasploit
  2. Cain & Abel
  3. Maltego
  4. Wireshark

Question 23

Which of these is capable of searching for and locating rogue access points?

  1. HIDS
  2. NIDS
  3. WISS
  4. WIPS

Question 24

A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer's software and hardware without the owner's permission. Their intention can either be to simply gain knowledge or to illegally make changes. Which of the following class of hacker refers to an individual who works both offensively and defensively at various times?

  1. White Hat
  2. Suicide Hacker
  3. Gray Hat
  4. Black Hat

Question 25

Websites and web portals that provide web services commonly use the Simple Object Access Protocol (SOAP). Which of the following is an incorrect definition or characteristics of the protocol?

  1. Based on XML
  2. Only compatible with the application protocol HTTP
  3. Exchanges data between web services
  4. Provides a structured model for messaging