EC-COUNCIL 312-50v10 問題集

質問 1：
Which of the following is the greatest threat posed by backups?
A. A backup is incomplete because no verification was performed.
B. An un-encrypted backup can be misplaced or stolen.
C. A backup is unavailable during disaster recovery.
D. A backup is the source of Malware or illicit information.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
What is the most common method to exploit the "Bash Bug" or "ShellShock" vulnerability?
A. SSH
B. SYN Flood
C. Through Web servers utilizing CGI (Common Gateway Interface) to send a malformed environment variable to a vulnerable Web server
D. Manipulate format strings in text fields
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A hacker was able to sniff packets on a company's wireless network. The following information was discovered:

Using the Exlcusive OR, what was the original message?
A. 00101000 11101110
B. 11010111 00010001
C. 00001101 10100100
D. 11110010 01011011
正解：B

質問 4：
When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?
A. At least twice a year or after any significant upgrade or modification
B. At least once every two years and after any significant upgrade or modification
C. At least once every three years or after any significant upgrade or modification
D. At least once a year and after any significant upgrade or modification
正解：D

質問 5：
Your business has decided to add credit card numbers to the data it backs up to tape. Which of the following represents the best practice your business should observe?
A. Back up the hashes of the credit card numbers not the actual credit card numbers.
B. Hire a security consultant to provide direction.
C. Encrypt backup tapes that are sent off-site.
D. Do not back up cither the credit card numbers or then hashes.
正解：B

質問 6：
How do employers protect assets with security policies pertaining to employee surveillance activities?
A. Employers use informal verbal communication channels to explain employee monitoring activities to employees.
B. Employers promote monitoring activities of employees as long as the employees demonstrate trustworthiness.
C. Employers provide employees written statements that clearly discuss the boundaries of monitoring activities and consequences.
D. Employers use network surveillance to monitor employee email traffic, network access, and to record employee keystrokes.
正解：C

質問 7：
While checking the settings on the internet browser, a technician finds that the proxy server settings have been checked and a computer is trying to use itself as a proxy server. What specific octet within the subnet does the technician see?
A. 192.168.1.1
B. 192.168.168.168
C. 127.0.0.1
D. 10.10.10.10
正解：C

質問 8：
What is the purpose of a demilitarized zone on a network?
A. To provide a place to put the honeypot
B. To contain the network devices you wish to protect
C. To only provide direct access to the nodes within the DMZ and protect the network behind it
D. To scan all traffic coming through the DMZ to the internal network
正解：C

質問 9：
Security Policy is a definition of what it means to be secure for a system, organization or other entity. For Information Technologies, there are sub-policies like Computer Security Policy, Information Protection Policy, Information Security Policy, network Security Policy, Physical Security Policy, Remote Access Policy, and User Account Policy.
What is the main theme of the sub-policies for Information Technologies?
A. Authenticity, Integrity, Non-repudiation
B. Availability, Non-repudiation, Confidentiality
C. Confidentiality, Integrity, Availability
D. Authenticity, Confidentiality, Integrity
正解：C