EC0-350

EC0-350 practice questions, page 4 of 15, with answer review and explanations.

Question 16

A penetration tester is hired to do a risk assessment of a company's DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems. What kind of test is being performed?

  1. white box
  2. grey box
  3. red box
  4. black box

Question 17

Which of the following is a detective control?

  1. Smart card authentication
  2. Security policy
  3. Audit trail
  4. Continuity of operations plan

Question 18

Which of the following is a component of a risk assessment?

  1. Physical security
  2. Administrative safeguards
  3. DMZ
  4. Logical interface

Question 19

When utilizing technical assessment methods to assess the security posture of a network, which of the following techniques would be most effective in determining whether end-user security training would be beneficial?

  1. Vulnerability scanning
  2. Social engineering
  3. Application security testing
  4. Network sniffing

Question 20

A company has publicly hosted web applications and an internal Intranet protected by a firewall. Which technique will help protect against enumeration?

  1. Reject all invalid email received via SMTP.
  2. Allow full DNS zone transfers.
  3. Remove A records for internal hosts.
  4. Enable null session pipes.