Best Way To Study For ECCouncil 312-96 Exam Brilliant 312-96 Exam Questions PDF
Updated Verified Pass 312-96 Exam - Real Questions and Answers
NEW QUESTION # 10
Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page.
Alice wrote the following code on page load to read the file name.
String myfilename = request.getParameter("filename");
String txtFileNameVariable = myfilename;
String locationVariable = request.getServletContext().getRealPath("/"); String PathVariable = ""; PathVariable = locationVariable + txtFileNameVariable; BufferedInputStream bufferedInputStream = null; Path filepath = Paths.get(PathVariable); After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?
- A. Form Tampering vulnerability
- B. XSS vulnerability
- C. Directory Traversal vulnerability
- D. URL Tampering vulnerability
Answer: C
NEW QUESTION # 11
Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities.
Which type of security assessment activity Jacob is currently performing?
- A. ISCST
- B. SAST
- C. CAST
- D. CAST
Answer: B
NEW QUESTION # 12
Which of the following authentication mechanism does J2EE support?
- A. Windows, Form based. Role Based, Client/Server Mutual Authentication
- B. Http Basic, Form Based, Client/Server Mutual, HTTP Digest Authentication
- C. Role Based, Http Basic, Windows, Http Digest Authentication
- D. Http Basic, Form Based, Client/Server Mutual, Role Based Authentication
Answer: B
NEW QUESTION # 13
Alice, a Server Administrator (Tomcat), wants to ensure that Tomcat can be shut down only by the user who owns the Tomcat process. Select the appropriate setting of the CATALINA_HOME/conf in server.xml that will enable him to do so.
- A. < server port="" shutdown-"' >
- B. < server port="8080" shutdown="SHUTDOWN" >
- C. < server port="-1" shutdown-*" >
- D. < server port="-1" shutdown="SHUTDOWN" >
Answer: C
NEW QUESTION # 14
Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed 'false' parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.
- A. SQL Injection Attack
- B. Directory Traversal Attack
- C. Client-Side Scripts Attack
- D. Denial-of-Service attack
Answer: C
NEW QUESTION # 15
A developer has written the following line of code to handle and maintain session in the application. What did he do in the below scenario?
- A. Maintained session by creating a Session variable user with value stored in uname variable.
- B. Maintained session by creating a hidden variable user with value stored in uname variable.
- C. Maintained session by creating a HTTP variable user with value stored in uname variable.
- D. Maintained session by creating a Cookie user with value stored in uname variable.
Answer: A
NEW QUESTION # 16
Oliver, a Server Administrator (Tomcat), has set configuration in web.xml file as shown in the following screenshot. What is he trying to achieve?
- A. He wants to transfer only request parameter data over encrypted channel
- B. He wants to transfer only response parameter data over encrypted channel
- C. He wants to transfer only Session cookies over encrypted channel
- D. He wants to transfer the entire data over encrypted channel
Answer: D
NEW QUESTION # 17
Identify the type of attack depicted in the following figure.
- A. Session Fixation Attack
- B. Denial-of-Service Attack
- C. Parameter Tampering Attack
- D. SQL Injection Attacks
Answer: C
NEW QUESTION # 18
According to secure logging practices, programmers should ensure that logging processes are not disrupted by:
- A. Re-throwing incorrect exceptions
- B. Multiple catching of incorrect exceptions
- C. Catching incorrect exceptions
- D. Throwing incorrect exceptions
Answer: D
NEW QUESTION # 19
Identify the type of attack depicted in the figure below:
- A. Denial-of-Service attack
- B. XSS
- C. Cross-Site Request Forgery (CSRF) attack
- D. SQL injection attack
Answer: C
NEW QUESTION # 20
Which of the following is used to mapCustom Exceptions to Statuscode?
- A. @ResponseCode
- B. @ScacusCode
- C. @ResponseStatusCode
- D. @ResponseStatus
Answer: D
NEW QUESTION # 21
Identify what should NOT be catched while handling exceptions.
- A. NullPointerException
- B. IllegalAccessException
- C. EOFException
- D. SecurityException
Answer: D
NEW QUESTION # 22
Which of the following configurations can help you avoid displaying server names in server response header?
- A. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" Server = " " redirectPort="8443" / >
- B. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName=" disable" redirectPort="8443" / >
- C. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName ="null " redirectPort="8443'' / >
- D. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort= "8443" / >
Answer: B
NEW QUESTION # 23
Which of the following relationship is used to describe abuse case scenarios?
- A. Extend Relationship
- B. Mitigates Relationship
- C. Include Relationship
- D. Threatens Relationship
Answer: D
NEW QUESTION # 24
Sam, an application security engineer working in INFRA INC., was conducting a secure code review on an application developed in Jav a. He found that the developer has used a piece of code as shown in the following screenshot. Identify the security mistakes that the developer has coded?
- A. He is attempting to use blacklist input validation approach
- B. He is attempting to use whitelist input validation approach
- C. He is attempting to use client-side validation
- D. He is attempting to use regular expression for validation
Answer: A
NEW QUESTION # 25
Suppose there is a productList.jsp page, which displays the list of products from the database for the requested product category. The product category comes as a request parameter value. Which of the following line of code will you use to strictly validate request parameter value before processing it for execution?
- A. public boolean validateUserName() {String CategoryId= request.getParameter("CatId");}
- B. public.boolean validateUserName() { if(!request.getParamcter("CatId").equals("null"))}
- C. public boolean validateUserName() { if(request.getParameter("CatId")!=null ) String CategoryId=request.getParameter("CatId");}
- D. public boolean validateUserName() { Pattern p = Pattern.compile("[a-zA-Z0-9]*$"); Matcher m = p.matcher(request.getParameter(CatId")); boolean result = m.matches(); return result;}
Answer: D
NEW QUESTION # 26
The software developer has implemented encryption in the code as shown in the following screenshot.
However, using the DES algorithm for encryption is considered to be an insecure coding practice as DES is a weak encryption algorithm. Which of the following symmetric encryption algorithms will you suggest for strong encryption?
- A. MD5
- B. Triple DES
- C. SHA-1
- D. AES
Answer: D
NEW QUESTION # 27
Which of the following method will help you check if DEBUG level is enabled?
- A. EnableDebug ()
- B. isDebugEnabled()
- C. IsEnableDebug ()
- D. DebugEnabled()
Answer: B
NEW QUESTION # 28
It is recommended that you should not use return, break, continue or throw statements in _________
- A. Try block
- B. Finally block
- C. Catch block
- D. Try-With-Resources block
Answer: B
NEW QUESTION # 29
......
Updated PDF (New 2023) Actual ECCouncil 312-96 Exam Questions: https://www.free4dump.com/312-96-braindumps-torrent.html
Dumps Moneyack Guarantee - 312-96 Dumps Approved Dumps: https://drive.google.com/open?id=1_m5n6V1ofTvFLsSk9ccZHDBwTHOW7pAb