最新の312-50v13問題集で試験を準備する

ECCouncil 312-50v13 試験概要:

ECCouncil 312-50v13 試験シラバストピック:

ECCouncil Certified Ethical Hacker Exam (CEHv13) 認定 312-50v13 試験問題：

1. An attacker can employ many methods to perform social engineering against unsuspecting employees, including scareware. What is the best example of a scareware attack?

A) A pop-up appears to a user stating, "You have won a free cruise! Click here to claim your prize!"
B) A pop-up appears to a user stating, "Your computer may have been infected with spyware. Click here to install an anti-spyware tool to resolve this issue."
C) A banner appears to a user stating, "Your Amazon order has been delayed. Click here to find out your new delivery date."
D) A banner appears to a user stating, "Your account has been locked. Click here to reset your password and unlock your account."

2. You have recently been hired as an entry-level IT technician in a large corporation. In a meeting with the IT team, the terms "ethical hacking" and "penetration testing" are mentioned frequently.
Later, a colleague explains to you that the main difference between the two is based on their goals. What is the primary goal of an ethical hacker in comparison to a penetration tester?

A) An ethical hacker is primarily focused on securing the system, while a penetration tester tries to exploit the system's vulnerabilities.
B) An ethical hacker aims to improve system security, while a penetration tester seeks to bring the system down.
C) An ethical hacker is focused on exploiting system vulnerabilities, while a penetration tester aims to secure the system.
D) An ethical hacker seeks to bring the system down, while a penetration tester is focused on improving system security.

3. What is a "Collision attack" in cryptography?

A) Collision attacks try to find two inputs producing the same hash
B) Collision attacks try to get the public key
C) Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key
D) Collision attacks try to break the hash into three parts to get the plaintext value

4. A penetration tester performs a vulnerability scan on a company's network and identifies a critical vulnerability related to an outdated version of a database server. What should the tester prioritize as the next step?

A) Ignore the vulnerability and move on to testing other systems
B) Conduct a brute-force attack on the database login page
C) Attempt to exploit the vulnerability using publicly available tools or exploits
D) Perform a denial-of-service (DoS) attack on the database server

5. A regional insurance claims platform in Sacramento, California is protected by a web application firewall that evaluates inbound requests for suspicious query structures. During an authorized assessment, a tester observes that conventional injection attempts are consistently rejected.
The tester then adjusts the format and composition of the request while preserving its intended database behavior. After this modification, the request passes through the filtering mechanism and is processed by the backend system without disruption.
Which firewall evasion technique is being demonstrated?

A) Transforming query structure to evade pattern-based inspection
B) Splitting payload components using HTTP Parameter Fragmentation (HPF)
C) Combining multiple evasion methods through an integration approach
D) Using HTTP Parameter Pollution (HPP) to override query parameters

質問と回答：