Get Perfect Results with Premium 312-96 Dumps Updated 49 Questions
Free 312-96 Exam Study Guide for the NEW Dumps Test Engine
NEW QUESTION # 29
Which of the following is used to mapCustom Exceptions to Statuscode?
- A. @ResponseCode
- B. @ScacusCode
- C. @ResponseStatus
- D. @ResponseStatusCode
Answer: C
NEW QUESTION # 30
A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
- A. Brute force attack
- B. Cross Site Request Forgery attack
- C. SQL Injection attack
- D. Session Hijacking attack
Answer: C
NEW QUESTION # 31
Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?
- A. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 < /load-on-startup > < /servlet >
- B. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1 < /load-on-startup > < servlet >
- C. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >
- D. < servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l < /load-on-startup > < /servlet >
Answer: C
NEW QUESTION # 32
According to secure logging practices, programmers should ensure that logging processes are not disrupted by:
- A. Re-throwing incorrect exceptions
- B. Catching incorrect exceptions
- C. Throwing incorrect exceptions
- D. Multiple catching of incorrect exceptions
Answer: C
NEW QUESTION # 33
A developer has written the following line of code to handle and maintain session in the application. What did he do in the below scenario?
- A. Maintained session by creating a Cookie user with value stored in uname variable.
- B. Maintained session by creating a HTTP variable user with value stored in uname variable.
- C. Maintained session by creating a hidden variable user with value stored in uname variable.
- D. Maintained session by creating a Session variable user with value stored in uname variable.
Answer: D
NEW QUESTION # 34
Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?
- A. < connector lsSSLEnabled="Yes" / >
- B. < connector SSLEnabled="true" / >
- C. < connector EnableSSL="true" / >
- D. < connector SSLEnabled="false" / >
Answer: B
NEW QUESTION # 35
Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities.
Which type of security assessment activity Jacob is currently performing?
- A. SAST
- B. CAST
- C. ISCST
- D. CAST
Answer: A
NEW QUESTION # 36
Identify the type of attack depicted in the following figure.
- A. Session Fixation Attack
- B. Parameter Tampering Attack
- C. SQL Injection Attacks
- D. Denial-of-Service Attack
Answer: B
NEW QUESTION # 37
Which of the following state management method works only for a sequence of dynamically generated forms?
- A. Hidden Field
- B. Cookies
- C. URL-rewriting
- D. Sessions
Answer: A
NEW QUESTION # 38
Which of the following method will help you check if DEBUG level is enabled?
- A. DebugEnabled()
- B. EnableDebug ()
- C. isDebugEnabled()
- D. IsEnableDebug ()
Answer: C
NEW QUESTION # 39
It is recommended that you should not use return, break, continue or throw statements in _________
- A. Finally block
- B. Catch block
- C. Try block
- D. Try-With-Resources block
Answer: A
NEW QUESTION # 40
In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.
- A. Denial-of-Service [Do
- B. Broken Authentication
- C. Failure to Restrict URL
- D. Unvalidated Redirects and Forwards
Answer: A
NEW QUESTION # 41
Which of the threat classification model is used to classify threats during threat modeling process?
- A. RED
- B. SMART
- C. DREAD
- D. STRIDE
Answer: D
NEW QUESTION # 42
Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of users depicted in the use cases of the project under inception. Based on the use case in hand, he started depicting the scenarios where attacker could misuse the application. Can you identify the activity on which Ted is working?
- A. Ted was depicting lower-level use cases
- B. Ted was depicting security use cases
- C. Ted was depicting abuse cases
- D. Ted was depicting abstract use cases
Answer: C
NEW QUESTION # 43
Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?
- A. session-fixation-protection ="enabled"
- B. session-fixation-protection ="newSessionlD"
- C. session-fixation-protection =".
- D. session-fixation-protection =".
Answer: D
NEW QUESTION # 44
Which of the following configurations can help you avoid displaying server names in server response header?
- A. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" Server = " " redirectPort="8443" / >
- B. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort= "8443" / >
- C. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName=" disable" redirectPort="8443" / >
- D. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName ="null " redirectPort="8443'' / >
Answer: C
NEW QUESTION # 45
Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?
- A. < connector... maxFileSize="file size" / >
- B. < connector... maxPostSize="0"/>
- C. < connector... maxFileLimit="file size" / >
- D. < connector... maxPostSize="file size" / >
Answer: D
NEW QUESTION # 46
Which of the following can be derived from abuse cases to elicit security requirements for software system?
- A. Security use cases
- B. Use cases
- C. Misuse cases
- D. Data flow diagram
Answer: A
NEW QUESTION # 47
......
EC-Council 312-96 Exam Syllabus Topics:
| Topic | Details | Weights |
|---|---|---|
| Understanding Application Security, Threats, and Attacks | -Understand the need and benefits of application security -Demonstrate the understanding of common application-level attacks -Explain the causes of application-level vulnerabilities -Explain various components of comprehensive application security -Explain the need and advantages of integrating security in Software Development Life Cycle (SDLQ) -Differentiate functional vs security activities in SDLC -Explain Microsoft Security Development Lifecycle (SDU) -Demonstrate the understanding of various software security reference standards, models, and frameworks | 18% |
| Secure Deployment andMaintenance | - Understand the importance of secure deployment -Explain security practices at host level -Explain security practices at network level -Explain security practices at application level -Explain security practices at web container level (Tomcat) -Explain security practices at Oracle database level -Demonstrate the knowledge of security maintenance and monitoring activities | 10% |
| Secure Coding Practices for Input Validation | - Understand the need of input validation -Explain data validation techniques -Explain data validation in strut framework -Explain data validation in Spring framework -Demonstrate the knowledge of common input validation errors -Demonstrate the knowledge of common secure coding practices for input validation | 8% |
| Secure Coding Practices for Error Handling | - Explain Exception and Error Handling in Java -Explain erroneous exceptional behaviors -Demonstrate the knowledge of do's and don'ts in error handling -Explain Spring MVC error handing -Explain Exception Handling in Struts2 -Demonstrate the knowledge of best practices for error handling -Explain to Logging in Java -Demonstrate the knowledge of Log4j for logging -Demonstrate the knowledge of coding techniques for secure logging -Demonstrate the knowledge of best practices for logging | 16% |
| Security Requirements Gathering | -Understand the importance of gathering security requirements -Explain Security Requirement Engineering (SRE) and its phases -Demonstrate the understanding of Abuse Cases and Abuse Case Modeling - Demonstrate the understanding of Security Use Cases and Security Use Case Modeling -Demonstrate the understanding of Abuser and Security Stories -Explain Security Quality Requirements Engineering (SQUARE) Model -Explain Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Model | 8% |
| Secure Coding Practices for Authentication and Authorization | - Understand authentication concepts -Explain authentication implementation in Java -Demonstrate the knowledge of authentication weaknesses and prevention -Understand authorization concepts -Explain Access Control Model -Explain EJB authorization -Explain Java Authentication and Authorization (JAAS) -Demonstrate the knowledge of authorization common mistakes and countermeasures -Explain Java EE security -Demonstrate the knowledge of authentication and authorization in Spring Security Framework -Demonstrate the knowledge of defensive coding practices against broken authentication and authorization | 4% |
| Secure Coding Practices for Session Management | - Explain session management in Java -Demonstrate the knowledge of session management in Spring framework -Demonstrate the knowledge of session vulnerabilities and their mitigation techniques -Demonstrate the knowledge of best practices and guidelines for secure session management | 10% |
| Secure Coding Practices for Cryptography | - Understand fundamental concepts and need of cryptography In Java -Explain encryption and secret keys -Demonstrate the knowledge of cipher class Implementation -Demonstrate the knowledge of digital signature and Its Implementation -Demonstrate the knowledge of Secure Socket Layer ISSUand Its Implementation -Explain Secure Key Management -Demonstrate the knowledgeofdigital certificate and its implementation - Demonstrate the knowledge of Hash implementation -Explain Java Card Cryptography -Explain Crypto Module in Spring Security -Demonstrate the understanding of Do's and Don'ts in Java Cryptography | 6% |
312-96 PDF Dumps Extremely Quick Way Of Preparation: https://www.examsreviews.com/312-96-pass4sure-exam-review.html
Download 312-96 Dumps (2024) - Free PDF Exam Demo: https://drive.google.com/open?id=1lYejXpcqmxtikkKF4mSd_1RLsERDitRZ