最新なECCouncil 312-50v13問題集（570題）、真実試験の問題を全部にカバー！

質問 1：
Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned.
Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?
A. "GET /restricted/\r\n\%00account%00Ned%00access HTTP/1.1 Host: westbank.com"
B. "GET /restricted/ HTTP/1.1 Host: westbank.com
C. "GET /restricted/goldtransfer?to=Rob&from=1 or 1=1' HTTP/1.1Host: westbank.com"
D. "GET /restricted/accounts/?name=Ned HTTP/1.1 Host westbank.com"
正解：D
解説: (Pass4Test メンバーにのみ表示されます)

質問 2：
Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine.
Joel waits for the victim to access the infected web application so as to compromise the victim's machine.
Which of the following techniques is used by Joel in the above scenario?
A. DNS rebinding attack
B. Clickjacking attack
C. MarioNet attack
D. Watering hole attack
正解：D
解説: (Pass4Test メンバーにのみ表示されます)

質問 3：
What is the least important information when you analyze a public IP address in a security alert?
A. Whois
B. ARP
C. Geolocation
D. DNS
正解：B

質問 4：
Which system consists of a publicly available set of databases that contain domain name registration contact information?
A. IANA
B. IETF
C. WHOIS
D. CAPTCHA
正解：C

質問 5：
Mr. Omkar performed tool-based vulnerability assessment and found two vulnerabilities. During analysis, he found that these issues are not true vulnerabilities.
What will you call these issues?
A. False positives
B. True negatives
C. True positives
D. False negatives
正解：A
解説: (Pass4Test メンバーにのみ表示されます)

質問 6：
What is the purpose of DNS AAAA record?
A. Address database record
B. IPv6 address resolution record
C. Authorization, Authentication and Auditing record
D. Address prefix record
正解：B

質問 7：
You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?
A. UNION SELECT NULL, NULL, NULL -- : This payload manipulates the UNION SQL operator, enabling the attacker to retrieve data from different database tables
B. 'OR 'T="1: This payload manipulates the WHERE clause of an SQL statement, allowing the attacker to view unauthorized data
C. 'OR username LIKE '%: This payload uses the LIKE operator to search for a specific pattern in a column
D. OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE clause with a destructive action, causing data loss
正解：D
解説: (Pass4Test メンバーにのみ表示されます)