ECCouncil 312-50v13 問題集

質問 1：
A state benefits processing platform in Sacramento, California, implemented a multi-step identity verification process before granting access to sensitive citizen records. During a controlled assessment, security analyst Daniel Kim observed that by altering specific request parameters within the transaction sequence, it was possible to bypass an intermediate verification stage and retrieve restricted account data. Further analysis revealed that the authentication workflow advanced through sequential client-driven interactions, but the server did not enforce strict validation of completion for each required stage before granting access. Based on the scenario, which vulnerability classification best describes the issue identified?
A. Misconfigurations / Weak Configurations
B. Design Flaws
C. Application Flaws
D. Poor Patch Management
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
In a tense red team exercise at a mid-sized university in Austin, Texas, an ethical hacker named Jake targeted a legacy Linux server in the engineering department. Late one afternoon, he discovered TCP port 2049 was open during his first sweep, suggesting hidden file-sharing capabilities. Intrigued, Jake used a standard utility to request a list of remote file systems shared across the network, aiming to map accessible resources.
Meanwhile, he idly checked for Telnet access and probed a time-sync service out of routine, but both proved fruitless on this host.
Which enumeration method is actively demonstrated in this scenario?
A. NetBIOS Enumeration
B. NTP Enumeration
C. SNMP Enumeration
D. NFS Enumeration
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A penetration tester is conducting an external assessment of a corporate web server. They start by accessing
https://www.targetcorp.com/robots.txt and observe multiple Disallow entries that reference directories such as
/admin-panel/, /backup/, and /confidentialdocs/. When the tester directly visits these paths via a browser, they find that access is not restricted by authentication and gain access to sensitive files, including server configuration and unprotected credentials. Which stage of the web server attack methodology is demonstrated in this scenario?
A. Injecting malicious SQL queries to access sensitive database records
B. Leveraging the directory traversal flaw to access critical server files
C. Gathering information through exposed indexing instructions
D. Performing a cross-site request forgery (CSRF) attack to manipulate user actions
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
During a red team simul-ation, an attacker crafts packets with malformed checksums so the IDS accepts them but the target silently discards them. Which evasion technique is being employed?
A. Fragmentation attack
B. Session splicing
C. Polymorphic shellcode
D. Insertion attack
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You are leading an internal red team assessment for a multinational bank with a highly complex and distributed IT infrastructure. Your team is required to simulate attacks across cloud services, servers, and remote endpoints. Due to the sheer scale of the environment, you deploy an AI-based platform that automatically scans the entire network, flags anomalies based on prior breach data, and adjusts its threat detection models as new attack behaviors are encountered.
What key benefit of AI-driven ethical hacking is most critical to your success in this scenario?
A. Predictive analysis
B. Scalability
C. Enhanced reporting
D. Simulation and testing
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Joe, a cybersecurity analyst at XYZ-FinTech, has been assigned to perform a quarterly vulnerability assessment across the organization ' s Windows-based servers and employee workstations. His objective is to detect issues such as software configuration errors, incorrect registry or file permissions, native configuration table problems, and other system-level misconfigurations. He is instructed to log into each system using valid credentials to ensure comprehensive data collection. Based on this assignment, which type of vulnerability scanning should Joe perform?
A. External Scanning
B. Host-based Scanning
C. Network-based Scanning
D. Application Scanning
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
During a stealth assessment, an attacker exploits intermittent delays in ARP responses from a target system.
By injecting fake ARP replies before legitimate ones, the attacker temporarily redirects traffic to their own device, allowing intermittent packet capture. What type of sniffing attack is occurring?
A. Switch port stealing via timing-based ARP spoofing
B. Passive sniffing on a switched network
C. Duplicate IP conflict resolution attack
D. ARP poisoning for MiTM interception
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 8：
What is the main difference between ethical hacking and malicious hacking?
A. Ethical hackers use different tools than malicious hackers
B. Ethical hackers always work alone, while malicious hackers work in teams
C. Ethical hacking is illegal, while malicious hacking is legal
D. Ethical hacking is performed with permission, while malicious hacking is unauthorized
正解：D
解説: (Topexam メンバーにのみ表示されます)