312-50v13 Practice Test practice questions, page 37 of 42, with answer review and explanations.
Question 181
In Miami, Florida, cybersecurity analyst Laura Bennett is investigating unauthorized access incidents affecting Sunshine Credit Union's online banking platform. Audit logs reveal that compromised accounts consistently involve users who accessed the portal through specially crafted links sent via email. The links direct victims to the legitimate website, where they proceed to authenticate successfully. Shortly afterward, unauthorized access to the same accounts is observed without any additional credential guessing or brute-force activity. Further examination shows that a value associated with the user's interaction with the application remains unchanged throughout the authentication process and can be introduced before the user completes sign-in. Which countermeasure should Laura implement to prevent this type of account takeover?
Use restrictive cache directives such as "Cache-Control: no-cache"
Implement SSL to encrypt all information in transit via the network
Regenerate the session ID after a successful login
Do not create sessions for unauthenticated users
Question 182
A national e-commerce retailer experiences a sustained distributed attack that saturates its edge connectivity with high-volume traffic originating from thousands of globally dispersed hosts. Internal mitigation attempts such as ACL tuning and rate limiting fail to restore service stability. After escalating the issue, the organization coordinates with its upstream connectivity provider, which begins rerouting inbound traffic through a large-scale filtering infrastructure capable of absorbing and scrubbing malicious traffic before forwarding legitimate requests back to the retailer's network. What defensive approach is being applied in this scenario?
Implementing RFC 3704 filtering at the network edge
Enabling Cisco IPS Source IP reputation filtering
Leveraging DDoS prevention offerings from an ISP or DDoS mitigation service
Deploying Black Hole filtering at the routing layer
Question 183
A manufacturing company in Columbus, Ohio, reported a surge in internal support tickets after employees received an alarming email appearing to originate from an independent cybersecurity researcher. The message claimed that a newly discovered malware strain was actively targeting corporate email systems and stated that several Fortune 500 organizations had already been compromised. It encouraged recipients to immediately circulate the message within their departments "to minimize exposure," warning that failure to act quickly could result in data loss. The email did not request credentials, payment, or direct downloads. However, it relied heavily on dramatic language and cited unverifiable statistics to increase urgency and credibility. From a social engineering classification standpoint, how should this technique be categorized?
Scareware designed to trick users into installing rogue software
Spam Email used for mass unsolicited distribution
Chain Letters that incentivize forwarding messages
Hoax Letters that spread false security warnings
Question 184
An internal audit at a pharmaceutical research company in San Diego, California, revealed that a directory server was reachable from a restricted testing subnet. Security analyst Daniel Harper initiated a basic directory query using simple authentication to validate connectivity. The query succeeded, confirming that the server was responding to unauthenticated search requests. To understand the structural layout of the directory before performing deeper queries, Daniel needed to retrieve the base-level naming context entries exposed by the server. His objective was to identify the root domain components and configuration partitions before constructing targeted search filters. Which command should Daniel execute to obtain the directory naming context information?
During a red team engagement against a multinational financial services organization, an ethical hacker conducts network reconnaissance against externally accessible systems. Instead of sending scan traffic directly from the originating assessment machine, the tester routes all reconnaissance packets through an intermediary external system before they reach the target network. When the organization's security team reviews monitoring data, the activity appears to originate from infrastructure unrelated to the tester's actual geographic or organizational location. From a reconnaissance methodology perspective, what is the primary objective of using this intermediary system?
To establish persistent access within the target network
To bypass authentication controls protecting internal applications
To conceal the origin of reconnaissance activity and reduce attribution risk