[2022年01月] 最新のCEH v11 312-50v11日本語試験解答豪華セット問題集 [Q95-Q111]

[2022年01月] 最新のCEH v11 312-50v11日本語試験解答豪華セット問題集

EC-COUNCILコンテンツをマスターして312-50v11日本語試験合格保証つき問題集！

質問 95
あなたは侵入テスターであり、特定のサーバーでスキャンを実行しようとしています。クライアントと署名した契約には、スキャンに関する次の特定の条件が含まれています。「攻撃者は、スプーフィングされたソースIPアドレスのセットを使用して、サーバー上のすべてのポートを数回スキャンする必要があります。」このスキャンを実行するためにNmapを使用しているとします。この要件を満たすためにどのフラグを使用しますか？

A. -Dフラグ
B. -gフラグ
C. -Aフラグ
D. -fフラグ

正解: A

解説:
Explanation
flags -source-port and -g are equivalent and instruct nmap to send packets through a selected port. this option is used to try to cheat firewalls whitelisting traffic from specific ports. the following example can scan the target from the port twenty to ports eighty, 22, 21,23 and 25 sending fragmented packets to LinuxHint.

質問 96
HackerOneなどのプラットフォームで企業が公開している脆弱性開示プログラムの一般名は何ですか？

A. ホワイトハットハッキングプログラム
B. 倫理的なハッキングプログラム
C. バグバウンティプログラム
D. 脆弱性ハンティングプログラム

正解: C

解説:
Explanation
Bug bounty programs allow independent security researchers to report bugs to an companies and receive rewards or compensation. These bugs area unit sometimes security exploits and vulnerabilities, although they will additionally embody method problems, hardware flaws, and so on.
The reports area unit usually created through a program travel by associate degree freelance third party (like Bugcrowd or HackerOne). The companies can got wind of (and run) a program curated to the organization's wants.
Programs is also non-public (invite-only) wherever reports area unit unbroken confidential to the organization or public (where anyone will sign in and join). they will happen over a collection timeframe or with without stopping date (though the second possibility is a lot of common).
Who uses bug bounty programs?Many major organizations use bug bounties as an area of their security program, together with AOL, Android, Apple, Digital Ocean, and goldman Sachs. you'll read an inventory of all the programs offered by major bug bounty suppliers, Bugcrowd and HackerOne, at these links.
Why do corporations use bug bounty programs?Bug bounty programs provide corporations the flexibility to harness an outsized cluster of hackers so as to seek out bugs in their code.
This gives them access to a bigger variety of hackers or testers than they'd be able to access on a one-on-one basis. It {can also|also will|can even|may also|may} increase the probabilities that bugs area unit found and reported to them before malicious hackers can exploit them.
It may also be an honest publicity alternative for a firm. As bug bounties became a lot of common, having a bug bounty program will signal to the general public and even regulators that a corporation incorporates a mature security program.
This trend is likely to continue, as some have began to see bug bounty programs as an business normal that all companies ought to invest in.
Why do researchers and hackers participate in bug bounty programs?Finding and news bugs via a bug bounty program may end up in each money bonuses and recognition. In some cases, it will be a good thanks to show real-world expertise once you are looking for employment, or will even facilitate introduce you to parents on the protection team within an companies.
This can be full time income for a few of us, income to supplement employment, or the way to point out off your skills and find a full time job.
It may also be fun! it is a nice (legal) probability to check out your skills against huge companies and government agencies.
What area unit the disadvantages of a bug bounty program for independent researchers and hackers?A lot of hackers participate in these varieties of programs, and it will be tough to form a major quantity of cash on the platform.
In order to say the reward, the hacker has to be the primary person to submit the bug to the program. meaning that in apply, you may pay weeks searching for a bug to use, solely to be the person to report it and build no cash.
Roughly ninety seven of participants on major bug bounty platforms haven't sold-out a bug.
In fact, a 2019 report from HackerOne confirmed that out of quite three hundred,000 registered users, solely around two.5% received a bounty in their time on the platform.
Essentially, most hackers are not creating a lot of cash on these platforms, and really few square measure creating enough to switch a full time wage (plus they do not have advantages like vacation days, insurance, and retirement planning).
What square measure the disadvantages of bug bounty programs for organizations?These programs square measure solely helpful if the program ends up in the companies realizeing issues that they weren't able to find themselves (and if they'll fix those problems)!
If the companies is not mature enough to be able to quickly rectify known problems, a bug bounty program is not the right alternative for his or her companies.
Also, any bug bounty program is probably going to draw in an outsized range of submissions, several of which can not be high-quality submissions. a corporation must be ready to cope with the exaggerated volume of alerts, and also the risk of a coffee signal to noise magnitude relation (essentially that it's probably that they're going to receive quite few unhelpful reports for each useful report).
Additionally, if the program does not attract enough participants (or participants with the incorrect talent set, and so participants are not able to establish any bugs), the program is not useful for the companies.
The overwhelming majority of bug bounty participants consider web site vulnerabilities (72%, per HackerOn), whereas solely a number of (3.5%) value more highly to seek for package vulnerabilities.
This is probably because of the actual fact that hacking in operation systems (like network hardware and memory) needs a big quantity of extremely specialised experience. this implies that firms may even see vital come on investment for bug bounties on websites, and not for alternative applications, notably those that need specialised experience.
This conjointly implies that organizations which require to look at AN application or web site among a selected time-frame may not need to rely on a bug bounty as there is no guarantee of once or if they receive reports.
Finally, it are often probably risky to permit freelance researchers to try to penetrate your network. this could end in public speech act of bugs, inflicting name harm within the limelight (which could end in individuals not eager to purchase the organizations' product or service), or speech act of bugs to additional malicious third parties, United Nations agency may use this data to focus on the organization.

質問 97
Nedvedは、自国の銀行のITセキュリティマネージャーです。ある日。彼は、電子メールサーバーから不明なIPアドレスへの疑わしい接続の分析に基づいて、会社の電子メールサーバーにセキュリティ違反があることを発見しました。
インシデント対応チームに連絡する前に、ネドベドが最初に行う必要があることは何ですか？

A. ファイアウォールから疑わしいIPアドレスへの接続をブロックします
B. そのままにして、すぐにインシデント対応te3mに連絡してください
C. バックアップメールサーバーへの接続を移行します
D. メールサーバーをネットワークから切断します

正解: D

質問 98
USBデバイスからファイルをサイレントコピーするために使用できるツールはどれですか？

A. USBスヌーピー
B. USBスニファー
C. USBグラバー
D. ダンパーを使用する

正解: D

質問 99
次のコマンドは何に使用されますか？
net use \ targetipc $ "" / u： ""

A. SAMをつかむ
B. Sambaを介してLinuxコンピューターに接続します。
C. etc / passwdファイルを取得します
D. このコマンドは、ヌルセッションとして接続するために使用されます
E. Ciscoルーターの列挙

正解: D

質問 100
この攻撃では、被害者はPayPalから、アカウントが無効になっており、アクティベーションの前に確認が必要であることを示す電子メールを受信します。次に、攻撃者は1つではなく2つのクレジットカード番号、ATM PIN番号、およびその他の個人情報を収集するために詐欺を行います。無知なユーザーは通常、この詐欺の餌食になります。
この攻撃に関連して正しくないステートメントは次のうちどれですか？

A. 個人情報や財務情報を求めるメールメッセージやポップアップ広告には返信しないでください
B. クレジットカード番号や個人情報や財務情報をメールで送信しないでください
C. 電子メールやポップアップ広告の電話番号を信用しないでください
D. クレジットカードと銀行口座の明細書を定期的に確認する
E. ウイルス対策、スパイウェア対策、ファイアウォールソフトウェアは、これらのタイプの攻撃を非常に簡単に検出できます

正解: E

質問 101
Webブラウザを使用してオンラインバンキングを実行しているときに、ユーザーは興味深いWebサイトへのリンクを含む電子メールを受信します。ユーザーがリンクをクリックすると、別のWebブラウザーセッションが開始され、猫がピアノを弾いているビデオが表示されます。翌営業日、ユーザーは自分の銀行から、自分の銀行口座が外国からアクセスされたことを示す電子メールのように見えるものを受け取ります。この電子メールは、ユーザーに銀行に電話して、行われた送金の承認を確認するように求めています。ユーザーを危険にさらすために悪用されたWebブラウザベースのセキュリティの脆弱性は何ですか？

A. Webフォーム入力の検証
B. クロスサイトスクリプティング
C. クロスサイトリクエストフォージェリ
D. クリックジャッキング

正解: C

解説:
Cross Site Request Forgery (XSRF) was committed against the poor individual. Fortunately the user's bank checked with the user prior to sending the funds.
If it would be Cross Site Request Forgery than transaction shouldn't be shown from foreign country. Because CSRF sends request from current user session. It seems XSS attack where attacker stolen the cookie and made a transaction using that cookie from foreign country.

質問 102
Eyecloud Inc.で働くクラウドセキュリティエンジニアのAlexは、基盤となるインフラストラクチャからアプリケーションを分離し、明確に定義されたチャネルを介して通信を促進する任務を負っています。この目的のために、彼はアプリケーションの開発、パッケージ化、および実行を支援するオープンソーステクノロジーを使用しました。さらに、このテクノロジーは、OSレベルの視覚化を通じてPaaSを提供し、コンテナー化されたソフトウェアパッケージを配信し、ソフトウェアの高速配信を促進します。上記のシナリオでAlexが採用したクラウドテクノロジーは何ですか？

A. ゼロトラストネットワーク
B. 仮想マシン
C. サーバーレスコンピューティング
D. Docker

正解: D

質問 103
次のスキャン方法のうち、TCPヘッダーを複数のパケットに分割し、パケットフィルターがパケットの目的を検出するのを困難にするのはどれですか？

A. ACKフラグプローブスキャン
B. ICMPエコースキャン
C. IPフラグメントを使用したSYN / FINスキャン
D. IPIDスキャン

正解: C

質問 104
ジェーン、倫理的なハッカー。ターゲット組織のWebサーバーとWebサイトをテストして、セキュリティの抜け穴を特定しています。
このプロセスでは、彼女はWebサイト全体とそのコンテンツをローカルドライブにコピーして、サイトのディレクトリ構造、ファイル構造、外部リンク、画像、Webページなどの完全なプロファイルを表示しました。この情報は、ジェーンがWebサイトのディレクトリをマップし、貴重な情報を取得するのに役立ちます。上記のシナリオでジェーンが採用した攻撃手法は何ですか？

A. ウェブサイトの改ざん
B. ウェブサイトのミラーリング
C. Webキャッシュポイズニング
D. セッションハイジャック

正解: C

解説:
Explanation
Web cache poisoning is a complicated technique whereby an attacker exploits the behavior of an internet server and cache in order that a harmful HTTP response is served to other users.Fundamentally, web cache poisoning involves two phases. First, the attacker must compute the way to elicit a response from the back-end server that inadvertently contains some quite dangerous payload. Once successful, they have to form sure that their response is cached and subsequently served to the intended victims.A poisoned web cache can potentially be a devastating means of distributing numerous different attacks, exploiting vulnerabilities like XSS, JavaScript injection, open redirection, and so on.
How does an internet cache work?To understand how web cache poisoning vulnerabilities arise, it's important to possess a basic understanding of how web caches work.If a server had to send a replacement response to each single HTTP request separately, this is able to likely overload the server, leading to latency issues and a poor user experience, especially during busy periods. Caching is primarily a way of reducing such issues.The cache sits between the server and therefore the user, where it saves (caches) the responses to particular requests, usually for a hard and fast amount of your time . If another user then sends the same request, the cache simply serves a replica of the cached response on to the user, with none interaction from the back-end.
This greatly eases the load on the server by reducing the amount of duplicate requests it's to handle.
Cache keysWhen the cache receives an HTTP request, it first has got to determine whether there's a cached response that it can serve directly, or whether it's to forward the request for handling by the back-end server.
Caches identify equivalent requests by comparing a predefined subset of the request's components, known collectively because the "cache key". Typically, this is able to contain the request line and Host header.
Components of the request that aren't included within the cache key are said to be "unkeyed".If the cache key of an incoming request matches the key of a previous request, then the cache considers them to be equivalent.
As a result, it'll serve a replica of the cached response that was generated for the first request. this is applicable to all or any subsequent requests with the matching cache key, until the cached response expires.Crucially, the opposite components of the request are ignored altogether by the cache. We'll explore the impact of this behavior in additional detail later.
What is the impact of an internet cache poisoning attack?The impact of web cache poisoning is heavily hooked in to two key factors:* What precisely the attacker can successfully get cachedAs the poisoned cache is more a way of distribution than a standalone attack, the impact of web cache poisoning is inextricably linked to how harmful the injected payload is. like most sorts of attack, web cache poisoning also can be utilized in combination with other attacks to escalate the potential impact even further.* The quantity of traffic on the affected pageThe poisoned response will only be served to users who visit the affected page while the cache is poisoned. As a result, the impact can range from non-existent to massive counting on whether the page is popular or not. If an attacker managed to poison a cached response on the house page of a serious website, for instance , the attack could affect thousands of users with none subsequent interaction from the attacker.Note that the duration of a cache entry doesn't necessarily affect the impact of web cache poisoning. An attack can usually be scripted in such how that it re-poisons the cache indefinitely.

質問 105
チャンドラーは、ニューヨークのIT企業で侵入テストを行っています。彼は、システム内のウイルスを検出する一環として、アンチウイルスが仮想マシン上で悪意のあるコードを実行してCPUとメモリのアクティビティをシミュレートする検出方法を使用しています。このコンテキストでチャンドラーはどのタイプのウイルス検出方法を使用しましたか？

A. 整合性チェック
B. コードエミュレーション
C. ヒューリスティック分析
D. スキャン

正解: B

質問 106
ハリー。プロのハッカーは、組織のITインフラストラクチャを標的にします。攻撃の準備をした後、彼はスピアフィッシングメールの送信や公開されているサーバーの脆弱性の悪用などの手法を使用してターゲットネットワークに侵入しようとします。彼はこれらの手法を使用して、ターゲットシステムにマルウェアを展開し、アウトバウンド接続を確立することに成功しました。ハリーが現在実行しているAPTライフサイクルフェーズとは何ですか？

A. 最初の侵入
B. 準備
C. クリーンアップ
D. 永続性

正解: A

解説:
After the attacker completes preparations, subsequent step is an effort to realize an edge within the target's environment. a particularly common entry tactic is that the use of spearphishing emails containing an internet link or attachment. Email links usually cause sites where the target's browser and related software are subjected to varied exploit techniques or where the APT actors plan to social engineer information from the victim which will be used later. If a successful exploit takes place, it installs an initial malware payload on the victim's computer. Figure 2 illustrates an example of a spearphishing email that contains an attachment. Attachments are usually executable malware, a zipper or other archive containing malware, or a malicious Office or Adobe PDF (Portable Document Format) document that exploits vulnerabilities within the victim's applications to ultimately execute malware on the victim's computer. Once the user has opened a malicious file using vulnerable software, malware is executing on the target system. These phishing emails are often very convincing and difficult to differentiate from legitimate email messages. Tactics to extend their believability include modifying legitimate documents from or associated with the organization. Documents are sometimes stolen from the organization or their collaborators during previous exploitation operations. Actors modify the documents by adding exploits and malicious code then send them to the victims. Phishing emails are commonly sent through previously compromised email servers, email accounts at organizations associated with the target or public email services. Emails also can be sent through mail relays with modified email headers to form the messages appear to possess originated from legitimate sources. Exploitation of vulnerabilities on public-facing servers is another favorite technique of some APT groups. Though this will be accomplished using exploits for known vulnerabilities, 0-days are often developed or purchased to be used in intrusions as required .

質問 107
攻撃者であるロビンは、データを盗み出すために、DNSトンネリング方式を介して組織のファイアウォールをバイパスしようとしています。彼はファイアウォールをバイパスするためにNSTXツールを使用しています。ロビンは次のどのポートでNSTXツールを実行する必要がありますか？

A. ポート50
B. ポート80
C. ポート53
D. ポート23

正解: C

解説:
Explanation
DNS uses Ports 53 which is almost always open on systems, firewalls, and clients to transmit DNS queries.
instead of the more familiar Transmission Control Protocol (TCP) these queries use User Datagram Protocol (UDP) due to its low-latency, bandwidth and resource usage compared TCP-equivalent queries. UDP has no error or flow-control capabilities, nor does it have any integrity checking to make sure the info arrived intact.How is internet use (browsing, apps, chat etc) so reliable then? If the UDP DNS query fails (it's a best-effort protocol after all) within the first instance, most systems will retry variety of times and only after multiple failures, potentially switch to TCP before trying again; TCP is additionally used if the DNS query exceeds the restrictions of the UDP datagram size - typically 512 bytes for DNS but can depend upon system settings.Figure 1 below illustrates the essential process of how DNS operates: the client sends a question string (for example, mail.google[.]com during this case) with a particular type - typically A for a number address.
I've skipped the part whereby intermediate DNS systems may need to establish where '.com' exists, before checking out where 'google[.]com' are often found, and so on.

Many worms and scanners are created to seek out and exploit systems running telnet. Given these facts, it's really no surprise that telnet is usually seen on the highest Ten Target Ports list. Several of the vulnerabilities of telnet are fixed. They require only an upgrade to the foremost current version of the telnet Daemon or OS upgrade. As is usually the case, this upgrade has not been performed on variety of devices. this might flow from to the very fact that a lot of systems administrators and users don't fully understand the risks involved using telnet. Unfortunately, the sole solution for a few of telnets vulnerabilities is to completely discontinue its use. the well-liked method of mitigating all of telnets vulnerabilities is replacing it with alternate protocols like ssh. Ssh is capable of providing many of an equivalent functions as telnet and a number of other additional services typical handled by other protocols like FTP and Xwindows. Ssh does still have several drawbacks to beat before it can completely replace telnet. it's typically only supported on newer equipment. It requires processor and memory resources to perform the info encryption and decryption. It also requires greater bandwidth than telnet thanks to the encryption of the info . This paper was written to assist clarify how dangerous the utilization of telnet are often and to supply solutions to alleviate the main known threats so as to enhance the general security of the web Once a reputation is resolved to an IP caching also helps: the resolved name-to-IP is usually cached on the local system (and possibly on intermediate DNS servers) for a period of your time . Subsequent queries for an equivalent name from an equivalent client then don't leave the local system until said cache expires. Of course, once the IP address of the remote service is understood , applications can use that information to enable other TCP-based protocols, like HTTP, to try to to their actual work, for instance ensuring internet cat GIFs are often reliably shared together with your colleagues.So, beat all, a couple of dozen extra UDP DNS queries from an organization's network would be fairly inconspicuous and will leave a malicious payload to beacon bent an adversary; commands could even be received to the requesting application for processing with little difficulty.