312-96 Exam Study Guide Free Practice Test LAST UPDATED DATE Nov 17, 2023
The New 312-96 2023 Updated Verified Study Guides & Best Courses
EC-Council CASE Java Exam Certification Details:
| Exam Price | $450 (USD) |
| Books / Training | Master Class |
| Number of Questions | 50 |
| Schedule Exam | Pearson VUE OREC-Council Store,ECC Exam Center |
| Exam Code | 312-96 |
| Sample Questions | EC-Council CASE Java Sample Questions |
NEW QUESTION # 17
Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can pose a serious security risk as attackers can access hidden script files in your directory. Which of the following will mitigate the above security risk?
- A. < int-param > < param-name>listinqs < param-value>true < /init-param
- B. < int param > < param-name>directorv-listinqs < param-value>false < /init-param >
- C. < int-param > < param-name>directory-listinqs < param-value>true < /init-param >
- D. < int-param > < param-name>listinqs < param-value>false < /init-param >
Answer: B
NEW QUESTION # 18
Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?
- A. session-fixation-protection ="newSessionlD"
- B. session-fixation-protection =".
- C. session-fixation-protection ="enabled"
- D. session-fixation-protection =".
Answer: B
NEW QUESTION # 19
Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?
- A. < connector EnableSSL="true" / >
- B. < connector lsSSLEnabled="Yes" / >
- C. < connector SSLEnabled="true" / >
- D. < connector SSLEnabled="false" / >
Answer: C
NEW QUESTION # 20
Which of the following configurations can help you avoid displaying server names in server response header?
- A. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" Server = " " redirectPort="8443" / >
- B. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName ="null " redirectPort="8443'' / >
- C. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName=" disable" redirectPort="8443" / >
- D. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort= "8443" / >
Answer: C
NEW QUESTION # 21
Identify the formula for calculating the risk during threat modeling.
- A. RISK = PROBABILITY "Attack
- B. RISK = PROBABILITY " ASSETS
- C. IRISK = PROBABILITY * VULNERABILITY
- D. RISK = PROBABILITY * DAMAGE POTENTIAL
Answer: D
NEW QUESTION # 22
A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
- A. SQL Injection attack
- B. Brute force attack
- C. Session Hijacking attack
- D. Cross Site Request Forgery attack
Answer: A
NEW QUESTION # 23
In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.
- A. Unvalidated Redirects and Forwards
- B. Failure to Restrict URL
- C. Denial-of-Service [Do
- D. Broken Authentication
Answer: C
NEW QUESTION # 24
Suppose there is a productList.jsp page, which displays the list of products from the database for the requested product category. The product category comes as a request parameter value. Which of the following line of code will you use to strictly validate request parameter value before processing it for execution?
- A. public boolean validateUserName() { Pattern p = Pattern.compile("[a-zA-Z0-9]*$"); Matcher m = p.matcher(request.getParameter(CatId")); boolean result = m.matches(); return result;}
- B. public boolean validateUserName() {String CategoryId= request.getParameter("CatId");}
- C. public.boolean validateUserName() { if(!request.getParamcter("CatId").equals("null"))}
- D. public boolean validateUserName() { if(request.getParameter("CatId")!=null ) String CategoryId=request.getParameter("CatId");}
Answer: A
NEW QUESTION # 25
A developer has written the following line of code to handle and maintain session in the application. What did he do in the below scenario?
- A. Maintained session by creating a HTTP variable user with value stored in uname variable.
- B. Maintained session by creating a Cookie user with value stored in uname variable.
- C. Maintained session by creating a Session variable user with value stored in uname variable.
- D. Maintained session by creating a hidden variable user with value stored in uname variable.
Answer: C
NEW QUESTION # 26
Which of the following authentication mechanism does J2EE support?
- A. Http Basic, Form Based, Client/Server Mutual, HTTP Digest Authentication
- B. Role Based, Http Basic, Windows, Http Digest Authentication
- C. Windows, Form based. Role Based, Client/Server Mutual Authentication
- D. Http Basic, Form Based, Client/Server Mutual, Role Based Authentication
Answer: A
NEW QUESTION # 27
The threat modeling phase where applications are decomposed and their entry points are reviewed from an attacker's perspective is known as ________
- A. Attack Surface Evaluation
- B. Threat Classification
- C. Impact Analysis
- D. Threat Identification
Answer: A
NEW QUESTION # 28
Which of the following is used to mapCustom Exceptions to Statuscode?
- A. @ResponseCode
- B. @ResponseStatus
- C. @ResponseStatusCode
- D. @ScacusCode
Answer: B
NEW QUESTION # 29
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
- A. He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
- B. He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
- C. He should write code like out-Write ("You Searched for:" +ESAPI.encoder().encodeForHTML(search));
- D. He should write code like out.write (("You Searched for:" +(search));
Answer: C
NEW QUESTION # 30
To enable the struts validator on an application, which configuration setting should be applied in the struts validator configuration file?
- A. lsNotvalidate="false"
- B. valid ate-'true"
- C. lsNotvalidate="disabled"
- D. validate="enabled"
Answer: B
NEW QUESTION # 31
Which of the following state management method works only for a sequence of dynamically generated forms?
- A. Hidden Field
- B. Cookies
- C. Sessions
- D. URL-rewriting
Answer: A
NEW QUESTION # 32
Identify the type of attack depicted in the figure below:
- A. Denial-of-Service attack
- B. Cross-Site Request Forgery (CSRF) attack
- C. SQL injection attack
- D. XSS
Answer: B
NEW QUESTION # 33
Which of the threat classification model is used to classify threats during threat modeling process?
- A. DREAD
- B. STRIDE
- C. RED
- D. SMART
Answer: B
NEW QUESTION # 34
Oliver, a Server Administrator (Tomcat), has set configuration in web.xml file as shown in the following screenshot. What is he trying to achieve?
- A. He wants to transfer only response parameter data over encrypted channel
- B. He wants to transfer only Session cookies over encrypted channel
- C. He wants to transfer the entire data over encrypted channel
- D. He wants to transfer only request parameter data over encrypted channel
Answer: C
NEW QUESTION # 35
Identify the type of attack depicted in the following figure.
- A. Directory Traversal Attack
- B. SQL Injection attack
- C. Form Tampering Attack
- D. Denial-of-service attack
Answer: A
NEW QUESTION # 36
......
Get Prepared for Your 312-96 Exam With Actual 49 Questions: https://www.crampdf.com/312-96-exam-prep-dumps.html
Authentic 312-96 Exam Dumps PDF - 2023 Updated: https://drive.google.com/open?id=1y6uMeasiAczmCxxkgfJo4ayUFNCh0j5j